VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters 1
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoSonicWallApacheAtlassianF5FortraPalo Alto NetworksZohoConnectWiseJetBrainsVeeamZimbraAdobeCheck PointProgress

49 groups · about 116.8M records of personal data leaked in total (disclosed)

  1. #01

    Tick

    aka BRONZE BUTLER, REDBALDKNIGHT

    Espionage
    Alert level4 / 5
    Reports & advisories (90 days)
    11
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Motex

    Assessed as Chinese state-sponsored (Sophos)

  2. #02

    Ghost

    aka Cring, Crypt3r, Phantom

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    5
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    FortinetAdobeMicrosoft

    Assessed as financially motivated actors located in China (US FBI, CISA and MS-ISAC)

  3. #03

    Play

    aka Playcrypt

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    4
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    FortinetMicrosoftSimpleHelp
  4. #04

    SafePay

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeam
  5. #05

    Andariel

    aka Onyx Sleet, PLUTONIUM, Silent Chollima

    EspionageFinancial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    16
    Personal data leaked (disclosed)
    None confirmed
    ApacheJetBrainsCitrixIvantiProgressFortinet

    Assessed as part of North Korea's RGB 3rd Bureau (US FBI, CISA, NSA, South Korea's NIS and police, UK NCSC)

  6. #06

    LockBit

    aka LockBit 3.0, LockBit Black, LockBitSupp

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    about 79.4K records
    FortinetMicrosoftF5ApacheFortraPaperCut

    Leader identified as a Russian national (UK National Crime Agency (Operation Cronos, incl. Japan's NPA))

  7. #07

    Qilin

    aka Agenda, Phantom Mantis

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  8. #08

    APT28

    aka Fancy Bear, Forest Blizzard, BlueDelta

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftRoundcubeRARLAB

    Assessed as Russian GRU 85th GTsSS, military unit 26165 (US NSA, FBI, CISA, UK NCSC, Germany, France and others)

  9. #09

    Sandworm

    aka Seashell Blizzard, APT44, Unit 74455

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftZimbraJetBrainsConnectWiseFortinet

    Assessed as acting on behalf of Russian military intelligence Unit 74455 (GRU) (Microsoft)

  10. #10

    UNC5221

    aka WARP PANDA, UTA0178

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    IvantiCitrixVMware

    Assessed as a suspected China-nexus espionage actor (Google Threat Intelligence Group (Mandiant))

  11. #11

    Akira

    aka Storm-1567, Howling Scorpius, Punk Spider

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeamVMwareMicrosoftNutanix
  12. #12

    APT-C-60

    aka SpyGlace

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Kingsoft

    Assessed as a South Korea-aligned cyberespionage group (ESET)

  13. #13

    APT37

    aka ScarCruft, Reaper, Ricochet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    North Korean state-sponsored espionage group; targets include South Korea and Japan (MITRE ATT&CK)

  14. #14

    APT40

    aka Kryptonite Panda, GINGHAM TYPHOON, Leviathan

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    AtlassianMicrosoftApache

    Assessed as conducting operations for China's Ministry of State Security (Australia's ASD, US CISA/NSA/FBI, Japan's NPA and NISC and others (8 countries))

  15. #15

    APT41

    aka Wicked Panda, Brass Typhoon, BARIUM

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixZohoMicrosoftAtlassianApache

    Assessed by researchers as a Chinese state-sponsored espionage group that also runs financially motivated operations (MITRE ATT&CK)

  16. #16

    BianLian

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftVMware

    Assessed as likely based in Russia (US FBI, CISA and Australia's ASD)

  17. #17

    Cadet Blizzard

    aka Unit 29155, Ember Bear, UNC2589

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    DahuaAtlassianSophos

    Assessed as Russian GRU Unit 29155 (US FBI, CISA, NSA and partners in 9 countries)

  18. #18

    Flax Typhoon

    aka Ethereal Panda, RedJuliett, Integrity Technology Group

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    IvantiGitLabApacheISCProFTPDONLYOFFICE

    Assessed as enabled by a China-based company with links to the Chinese government (US FBI, CISA, NSA, Japan's NPA and NCO and partners)

  19. #19

    Fog

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    SonicWall
  20. #20

    Kimsuky

    aka APT43, Emerald Sleet, Velvet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as North Korean actors (US FBI, State Department and NSA)

  21. #21

    MirrorFace

    aka Earth Kasha

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Array NetworksFortinetCitrixMicrosoft

    Assessed as an organized campaign with suspected Chinese involvement (Japan's National Police Agency and National Cybersecurity Office)

  22. #22

    NightSpire

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  23. #23

    Pioneer Kitten

    aka Fox Kitten, Lemon Sandstorm, UNC757

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixF5IvantiPalo Alto NetworksCheck Point

    Assessed as tied to the Government of Iran (US FBI, CISA and DC3)

  24. #24

    Salt Typhoon

    aka OPERATOR PANDA, RedMike, UNC5807

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CiscoIvantiPalo Alto Networks

    Assessed as PRC state-sponsored, supported by three named Chinese companies (NSA, CISA, FBI, Japan's NPA and NCO and partners in 13 countries)

  25. #25

    Silk Typhoon

    aka HAFNIUM

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiPalo Alto NetworksCitrixMicrosoft

    Assessed as a Chinese espionage group (Microsoft)

  26. #26

    UNC5174

    aka Houken, Uteus

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiF5ConnectWiseAtlassianZyxel

    Assessed as operating from China and likely an MSS contractor (Mandiant (Google))

  27. #27

    INC Ransom

    aka GOLD IONIC

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Citrix
  28. #28

    APT27

    aka Linen Typhoon, Emissary Panda, LuckyMouse

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as a Chinese state actor (Linen Typhoon) (Microsoft)

  29. #29

    APT29

    aka Midnight Blizzard, Cozy Bear, NOBELIUM

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    JetBrainsMicrosoft

    Assessed as Russia's Foreign Intelligence Service (SVR) (US FBI, CISA, NSA, UK NCSC and Polish agencies)

  30. #30

    Cactus

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Qlik
  31. #31

    Citrine Sleet

    aka AppleJeus, UNC4736, Gleaming Pisces

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    GoogleMicrosoft

    North Korean state-sponsored group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  32. #32

    Cl0p

    aka TA505, FIN11

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    about 96.8M records
    ProgressFortraAccellionOracleCleo
  33. #33

    DragonForce

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    SimpleHelp
  34. #34

    FIN7

    aka Carbon Spider, ELBRUS, Sangria Tempest

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    about 20M records
    Veeam

    Described as a financially motivated threat group (MITRE ATT&CK)

  35. #35

    FSB Center 16

    aka Static Tundra, Berserk Bear, Energetic Bear

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Cisco

    Assessed as Russian FSB Center 16 (US NSA, CISA, FBI, UK NCSC and European, Australian and Canadian partners)

  36. #36

    Gunra

    aka Golden Community

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    FortinetMicrosoft
  37. #37

    Laundry Bear

    aka Void Blizzard, CL-STA-1114, TA488

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    ZimbraMicrosoft

    Assessed as Russian state-supported (US CISA, NSA, FBI, Dutch AIVD and MIVD and partners)

  38. #38

    Medusa

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    ConnectWiseFortinetFortraBeyondTrust
  39. #39

    OilRig

    aka APT34, Earth Simnavaz, Hazel Sandstorm

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Iranian group believed to work on behalf of the Iranian government (MITRE ATT&CK)

  40. #40

    RedNovember

    aka TAG-100, Storm-2077

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Palo Alto NetworksCheck PointIvantiSonicWallCiscoF5

    Assessed as highly likely Chinese state-sponsored (Recorded Future)

  41. #41

    RomCom

    aka Storm-0978, Tropical Scorpius, UNC2596

    EspionageFinancial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    RARLABMozillaMicrosoft

    Assessed with high confidence as Russia-aligned (ESET)

  42. #42

    SideWinder

    aka Rattlesnake, T-APT-04, Razor Tiger

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Indian threat actor group (MITRE ATT&CK)

  43. #43

    Storm-0501

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    ZohoCitrixAdobeMicrosoft
  44. #44

    Storm-2460

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft
  45. #45

    Storm-2603

    aka Warlock, GOLD SALEM, CL-CRI-1040

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed with moderate confidence to be a China-based actor (Microsoft)

  46. #46

    UAT-6382

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Trimble

    Assessed with high confidence as Chinese-speaking actors (Cisco Talos)

  47. #47

    UNC3886

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    JuniperFortinetVMware

    Assessed as a China-nexus espionage group (Mandiant (Google))

  48. #48

    Volt Typhoon

    aka Vanguard Panda, BRONZE SILHOUETTE, Voltzite

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    FortinetIvantiCiscoCitrixNETGEARZoho

    Assessed as PRC state-sponsored (US CISA, NSA, FBI and Five Eyes partners)

  49. #49

    Water Gamayun

    aka EncryptHub, LARVA-208

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Described as a Russian threat actor (Trend Micro)

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.