GROUP LIST (OBSAHUJE SEZNAM HACKERSKÝCH SKUPIN A JEDNOTLIVCÙ)
H APT(180) CYBERCRIME() CLUSTER(2) HACKTIVISTS() MaaS() NATION STATE() RaaS() VISHING(1) | ABECEDNÌ | GROUP LIST | Group Records
| Name | Description | GROUP | GROUP |
| admin@338 | admin@338 is a China-based cyber threat group. | APT | APT |
| Ajax Security Team | Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. | APT | APT |
| ALLANITE | ALLANITE is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. | APT | APT |
| Andariel | Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. | APT | APT |
| Aoqin Dragon | Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. | APT | APT |
| APT-C-36 | APT-C-36 is a suspected South America espionage group that has been active since at least 2018. | APT | APT |
| APT1 | APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department | APT | APT |
| APT12 | APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. | APT | APT |
| APT16 | APT16 is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. | APT | APT |
| APT17 | APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms | APT | APT |
| APT18 | APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. | APT | APT |
| APT19 | APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, | APT | APT |
| APT28 | APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. | APT | APT |
| APT29 | APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). | APT | APT |
| APT3 | APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. | APT | APT |
| APT30 | APT30 is a threat group suspected to be associated with the Chinese government. | APT | APT |
| APT32 | APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. | APT | APT |
| APT33 | APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. | APT | APT |
| APT37 | APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. | APT | APT |
| APT38 | APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. | APT | APT |
| APT39 | APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. | APT | APT |
| APT41 | APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. | APT | APT |
| Aquatic Panda | Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. | APT | APT |
| Axiom | Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. | APT | APT |
| BackdoorDiplomacy | BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. | APT | APT |
| BITTER | BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. | APT | APT |
| BlackOasis | BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. | APT | APT |
| BlackTech | BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia- | APT | APT |
| Blue Mockingbird | Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. | APT | APT |
| Bouncing Golf | Bouncing Golf is a cyberespionage campaign targeting Middle Eastern countries. | APT | APT |
| BRONZE BUTLER | BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. | APT | APT |
| Carbanak | Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. | APT | APT |
| Chimera | Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry. | APT | APT |
| Cleaver | Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. | APT | APT |
| Cobalt Group | Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. | APT | APT |
| Confucius | Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. | APT | APT |
| CopyKittens | CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. | APT | APT |
| Dark Caracal | Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. | APT | APT |
| Darkhotel | Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. | APT | APT |
| DarkHydrus | DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. | APT | APT |
| DarkVishnya | DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. | APT | APT |
| Deep Panda | Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. | APT | APT |
| Dragonfly | Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. | APT | APT |
| DragonOK | DragonOK is a threat group that has targeted Japanese organizations with phishing emails. | APT | APT |
| Earth Lusca | Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. | APT | APT |
| Elderwood | Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. | APT | APT |
| Ember Bear | Ember Bear is a suspected Russian state-sponsored cyber espionage group that has been active since at least March 2021. | APT | APT |
| Equation | Equation is a sophisticated threat group that employs multiple remote access tools. | APT | APT |
| Evilnum | Evilnum is a financially motivated threat group that has been active since at least 2018. | APT | APT |
| EXOTIC LILY | EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. | RAAS | RAAS |
| Ferocious Kitten | Ferocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015. | APT | APT |
| FIN10 | FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. | APT | APT |
| FIN4 | FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. | APT | APT |
| FIN5 | FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. | APT | APT |
| FIN6 | FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. | APT | APT |
| FIN7 | FIN7 is a financially-motivated threat group that has been active since 2013 primarily targeting the U.S. retail, restaurant, and hospitality sectors, often using point-of-sale malware. | APT | APT |
| FIN8 | FIN8 is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail, restaurant, and hospitality industries. | APT | APT |
| Fox Kitten | Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. | APT | APT |
| GALLIUM | GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, | APT | APT |
| Gallmaker | Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. | APT | APT |
| Gamaredon Group | Gamaredon Group is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. | APT | APT |
| GCMAN | GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. | APT | APT |
| GOLD SOUTHFIELD | GOLD SOUTHFIELD is a financially motivated threat group active since at least 2019 that operates the REvil Ransomware-as-a Service (RaaS). | RAAS | RAAS |
| Gorgon Group | Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. | APT | APT |
| Group5 | Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. | APT | APT |
| HAFNIUM | HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. | APT | APT |
| HEXANE | HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. | APT | APT |
| Higaisa | Higaisa is a threat group suspected to have South Korean origins. | APT | APT |
| Inception | Inception is a cyber espionage group active since at least 2014. | APT | APT |
| IndigoZebra | IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014. | APT | APT |
| Indrik Spider | Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. | APT | APT |
| Ke3chang | Ke3chang is a threat group attributed to actors operating out of China. | APT | APT |
| Kimsuky | Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. | APT | APT |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. | APT | APT |
| Lazarus Group | Lazarus Group is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau. | APT | APT |
| LazyScripter | LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets. | APT | APT |
| Leafminer | Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. | APT | APT |
| Leviathan | Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. | APT | APT |
| Lotus Blossom | Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia. | APT | APT |
| Machete | Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. | APT | APT |
| Magic Hound | Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. | APT | APT |
| menuPass | menuPass is a threat group that has been active since at least 2006. | APT | APT |
| Moafee | Moafee is a threat group that appears to operate from the Guandong Province of China. | APT | APT |
| Mofang | Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. | APT | APT |
| Molerats | Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. | APT | APT |
| Moses Staff | Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. | APT | APT |
| MuddyWater | MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). | APT | APT |
| Mustang Panda | Mustang Panda is a China-based cyber espionage threat actor that was first observed in 2017 but may have been conducting operations since at least 2014. | APT | APT |
| Naikon | Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA). | APT | APT |
| NEODYMIUM | NEODYMIUM is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. | APT | APT |
| Nomadic Octopus | Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. | APT | APT |
| OilRig | OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. | APT | APT |
| Orangeworm | Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. | APT | APT |
| Patchwork | Patchwork is a cyber espionage group that was first observed in December 2015. | APT | APT |
| PittyTiger | PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control. | APT | APT |
| PLATINUM | PLATINUM is an activity group that has targeted victims since at least 2009. | APT | APT |
| POLONIUM | POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. | APT | APT |
| Poseidon Group | Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. | APT | APT |
| PROMETHIUM | PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. | APT | APT |
| Putter Panda | Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). | APT | APT |
| Rancor | Rancor is a threat group that has led targeted campaigns against the South East Asia region. | APT | APT |
| Rocke | Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. | APT | APT |
| RTM | RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. | APT | APT |
| Sandworm Team | Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. | APT | APT |
| Scarlet Mimic | Scarlet Mimic is a threat group that has targeted minority rights activists. | APT | APT |
| SideCopy | SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. | APT | APT |
| Sidewinder | Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. | APT | APT |
| Silence | Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. | APT | APT |
| Silent Librarian | Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. | APT | APT |
| SilverTerrier | SilverTerrier is a Nigerian threat group that has been seen active since 2014. SilverTerrier mainly targets organizations in high technology, higher education, and manufacturing. | APT | APT |
| Sowbug | Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. | APT | APT |
| Stealth Falcon | Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. | APT | APT |
| Strider | Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda. | APT | APT |
| Suckfly | Suckfly is a China-based threat group that has been active since at least 2014. | APT | APT |
| TA459 | TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. | APT | APT |
| TA505 | TA505 is a cyber criminal group that has been active since at least 2014. | APT | APT |
| TA551 | TA551 is a financially-motivated threat group that has been active since at least 2018. | APT | APT |
| TeamTNT | TeamTNT is a threat group that has primarily targeted cloud and containerized environments. | APT | APT |
| TEMP.Veles | TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. | APT | APT |
| The White Company | The White Company is a likely state-sponsored threat actor with advanced capabilities. | APT | APT |
| Threat Group-1314 | Threat Group-1314 is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. | APT | APT |
| Threat Group-3390 | Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. | APT | APT |
| Thrip | Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. | APT | APT |
| Tonto Team | Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; | APT | APT |
| Transparent Tribe | Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India | APT | APT |
| Tropic Trooper | Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. | APT | APT |
| Turla | Turla is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies | APT | APT |
| Volatile Cedar | Volatile Cedar is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. | APT | APT |
| Whitefly | Whitefly is a cyber espionage group that has been operating since at least 2017. | APT | APT |
| Windigo | The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. | APT | APT |
| Windshift | Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East. | APT | APT |
| Winnti Group | Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. | APT | APT |
| WIRTE | WIRTE is a threat group that has been active since at least August 2018. | APT | APT |
| Wizard Spider | Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. | APT | APT |
| ZIRCONIUM | ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community. | APT | APT |