VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters 1
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoSonicWallApacheAtlassianF5FortraPalo Alto NetworksZohoConnectWiseJetBrainsVeeamZimbraAdobeCheck PointProgress

26 groups · about 79.4K records of personal data leaked in total (disclosed)

  1. #01

    Tick

    aka BRONZE BUTLER, REDBALDKNIGHT

    Espionage
    Alert level4 / 5
    Reports & advisories (90 days)
    11
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Motex

    Assessed as Chinese state-sponsored (Sophos)

  2. #02

    Ghost

    aka Cring, Crypt3r, Phantom

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    5
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    FortinetAdobeMicrosoft

    Assessed as financially motivated actors located in China (US FBI, CISA and MS-ISAC)

  3. #03

    Play

    aka Playcrypt

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    4
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    FortinetMicrosoftSimpleHelp
  4. #04

    SafePay

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeam
  5. #05

    Andariel

    aka Onyx Sleet, PLUTONIUM, Silent Chollima

    EspionageFinancial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    16
    Personal data leaked (disclosed)
    None confirmed
    ApacheJetBrainsCitrixIvantiProgressFortinet

    Assessed as part of North Korea's RGB 3rd Bureau (US FBI, CISA, NSA, South Korea's NIS and police, UK NCSC)

  6. #06

    LockBit

    aka LockBit 3.0, LockBit Black, LockBitSupp

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    about 79.4K records
    FortinetMicrosoftF5ApacheFortraPaperCut

    Leader identified as a Russian national (UK National Crime Agency (Operation Cronos, incl. Japan's NPA))

  7. #07

    Qilin

    aka Agenda, Phantom Mantis

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  8. #08

    APT28

    aka Fancy Bear, Forest Blizzard, BlueDelta

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftRoundcubeRARLAB

    Assessed as Russian GRU 85th GTsSS, military unit 26165 (US NSA, FBI, CISA, UK NCSC, Germany, France and others)

  9. #09

    Sandworm

    aka Seashell Blizzard, APT44, Unit 74455

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftZimbraJetBrainsConnectWiseFortinet

    Assessed as acting on behalf of Russian military intelligence Unit 74455 (GRU) (Microsoft)

  10. #10

    UNC5221

    aka WARP PANDA, UTA0178

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    IvantiCitrixVMware

    Assessed as a suspected China-nexus espionage actor (Google Threat Intelligence Group (Mandiant))

  11. #11

    Akira

    aka Storm-1567, Howling Scorpius, Punk Spider

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeamVMwareMicrosoftNutanix
  12. #12

    APT-C-60

    aka SpyGlace

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Kingsoft

    Assessed as a South Korea-aligned cyberespionage group (ESET)

  13. #13

    APT37

    aka ScarCruft, Reaper, Ricochet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    North Korean state-sponsored espionage group; targets include South Korea and Japan (MITRE ATT&CK)

  14. #14

    APT40

    aka Kryptonite Panda, GINGHAM TYPHOON, Leviathan

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    AtlassianMicrosoftApache

    Assessed as conducting operations for China's Ministry of State Security (Australia's ASD, US CISA/NSA/FBI, Japan's NPA and NISC and others (8 countries))

  15. #15

    APT41

    aka Wicked Panda, Brass Typhoon, BARIUM

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixZohoMicrosoftAtlassianApache

    Assessed by researchers as a Chinese state-sponsored espionage group that also runs financially motivated operations (MITRE ATT&CK)

  16. #16

    BianLian

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftVMware

    Assessed as likely based in Russia (US FBI, CISA and Australia's ASD)

  17. #17

    Cadet Blizzard

    aka Unit 29155, Ember Bear, UNC2589

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    DahuaAtlassianSophos

    Assessed as Russian GRU Unit 29155 (US FBI, CISA, NSA and partners in 9 countries)

  18. #18

    Flax Typhoon

    aka Ethereal Panda, RedJuliett, Integrity Technology Group

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    IvantiGitLabApacheISCProFTPDONLYOFFICE

    Assessed as enabled by a China-based company with links to the Chinese government (US FBI, CISA, NSA, Japan's NPA and NCO and partners)

  19. #19

    Fog

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    SonicWall
  20. #20

    Kimsuky

    aka APT43, Emerald Sleet, Velvet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as North Korean actors (US FBI, State Department and NSA)

  21. #21

    MirrorFace

    aka Earth Kasha

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Array NetworksFortinetCitrixMicrosoft

    Assessed as an organized campaign with suspected Chinese involvement (Japan's National Police Agency and National Cybersecurity Office)

  22. #22

    NightSpire

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  23. #23

    Pioneer Kitten

    aka Fox Kitten, Lemon Sandstorm, UNC757

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixF5IvantiPalo Alto NetworksCheck Point

    Assessed as tied to the Government of Iran (US FBI, CISA and DC3)

  24. #24

    Salt Typhoon

    aka OPERATOR PANDA, RedMike, UNC5807

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CiscoIvantiPalo Alto Networks

    Assessed as PRC state-sponsored, supported by three named Chinese companies (NSA, CISA, FBI, Japan's NPA and NCO and partners in 13 countries)

  25. #25

    Silk Typhoon

    aka HAFNIUM

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiPalo Alto NetworksCitrixMicrosoft

    Assessed as a Chinese espionage group (Microsoft)

  26. #26

    UNC5174

    aka Houken, Uteus

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiF5ConnectWiseAtlassianZyxel

    Assessed as operating from China and likely an MSS contractor (Mandiant (Google))

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.