VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters 1
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoSonicWallApacheAtlassianF5FortraPalo Alto NetworksZohoConnectWiseJetBrainsVeeamZimbraAdobeCheck PointProgress

22 groups · about 79.4K records of personal data leaked in total (disclosed)

  1. #01

    Tick

    aka BRONZE BUTLER, REDBALDKNIGHT

    Espionage
    Alert level4 / 5
    Reports & advisories (90 days)
    11
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Motex

    Assessed as Chinese state-sponsored (Sophos)

  2. #02

    SafePay

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeam
  3. #03

    Andariel

    aka Onyx Sleet, PLUTONIUM, Silent Chollima

    EspionageFinancial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    16
    Personal data leaked (disclosed)
    None confirmed
    ApacheJetBrainsCitrixIvantiProgressFortinet

    Assessed as part of North Korea's RGB 3rd Bureau (US FBI, CISA, NSA, South Korea's NIS and police, UK NCSC)

  4. #04

    LockBit

    aka LockBit 3.0, LockBit Black, LockBitSupp

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    about 79.4K records
    FortinetMicrosoftF5ApacheFortraPaperCut

    Leader identified as a Russian national (UK National Crime Agency (Operation Cronos, incl. Japan's NPA))

  5. #05

    Qilin

    aka Agenda, Phantom Mantis

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  6. #06

    APT-C-60

    aka SpyGlace

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Kingsoft

    Assessed as a South Korea-aligned cyberespionage group (ESET)

  7. #07

    APT37

    aka ScarCruft, Reaper, Ricochet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    North Korean state-sponsored espionage group; targets include South Korea and Japan (MITRE ATT&CK)

  8. #08

    Fog

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    SonicWall
  9. #09

    Kimsuky

    aka APT43, Emerald Sleet, Velvet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as North Korean actors (US FBI, State Department and NSA)

  10. #10

    MirrorFace

    aka Earth Kasha

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Array NetworksFortinetCitrixMicrosoft

    Assessed as an organized campaign with suspected Chinese involvement (Japan's National Police Agency and National Cybersecurity Office)

  11. #11

    NightSpire

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  12. #12

    Lynx

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  13. #13

    BlackNevas

    aka Trial Recovery

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  14. #14

    BlackTech

    aka Palmerworm, Temp.Overboard, Circuit Panda

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Cisco

    Assessed as PRC-linked (US NSA, FBI, CISA and Japan's NPA and NISC)

  15. #15

    Cicada3301

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    VMware
  16. #16

    Jasper Sleet

    aka Storm-0287, DPRK IT workers, UNC5267

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Warned that North Korean IT workers use false identities to obtain work, including from Japanese companies (Japan NPA, MOFA, MOF and METI)

  17. #17

    Kawa4096

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  18. #18

    NoName057(16)

    aka NoName05716, DDoSia

    Hacktivism
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a covert project created within a Kremlin-linked organization (CISM) (US CISA, FBI, NSA and international partners)

  19. #19

    The Gentlemen

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    GLPI

    Notes Russian-speaking individuals may be involved (Cisco Talos)

  20. #20

    TraderTraitor

    aka Jade Sleet, UNC4899, Slow Pisces

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a North Korea-linked group (Japan's NPA, US FBI and DC3)

  21. #21

    WaterPlum

    aka Contagious Interview, Famous Chollima

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operating under the 313 General Bureau of North Korea's Munitions Industry Department (Japan's NPA and NCO, US FBI and DC3, Australia and Germany)

  22. #22

    World Leaks

    aka Hunters International

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.