VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters 1
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoSonicWallApacheAtlassianF5FortraPalo Alto NetworksZohoConnectWiseJetBrainsVeeamZimbraAdobeCheck PointProgress

59 groups

  1. #01

    Tick

    aka BRONZE BUTLER, REDBALDKNIGHT

    Espionage
    Alert level4 / 5
    Reports & advisories (90 days)
    11
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Motex

    Assessed as Chinese state-sponsored (Sophos)

  2. #02

    Andariel

    aka Onyx Sleet, PLUTONIUM, Silent Chollima

    EspionageFinancial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    16
    Personal data leaked (disclosed)
    None confirmed
    ApacheJetBrainsCitrixIvantiProgressFortinet

    Assessed as part of North Korea's RGB 3rd Bureau (US FBI, CISA, NSA, South Korea's NIS and police, UK NCSC)

  3. #03

    APT28

    aka Fancy Bear, Forest Blizzard, BlueDelta

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftRoundcubeRARLAB

    Assessed as Russian GRU 85th GTsSS, military unit 26165 (US NSA, FBI, CISA, UK NCSC, Germany, France and others)

  4. #04

    Sandworm

    aka Seashell Blizzard, APT44, Unit 74455

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftZimbraJetBrainsConnectWiseFortinet

    Assessed as acting on behalf of Russian military intelligence Unit 74455 (GRU) (Microsoft)

  5. #05

    UNC5221

    aka WARP PANDA, UTA0178

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    IvantiCitrixVMware

    Assessed as a suspected China-nexus espionage actor (Google Threat Intelligence Group (Mandiant))

  6. #06

    APT-C-60

    aka SpyGlace

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Kingsoft

    Assessed as a South Korea-aligned cyberespionage group (ESET)

  7. #07

    APT37

    aka ScarCruft, Reaper, Ricochet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    North Korean state-sponsored espionage group; targets include South Korea and Japan (MITRE ATT&CK)

  8. #08

    APT40

    aka Kryptonite Panda, GINGHAM TYPHOON, Leviathan

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    AtlassianMicrosoftApache

    Assessed as conducting operations for China's Ministry of State Security (Australia's ASD, US CISA/NSA/FBI, Japan's NPA and NISC and others (8 countries))

  9. #09

    APT41

    aka Wicked Panda, Brass Typhoon, BARIUM

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixZohoMicrosoftAtlassianApache

    Assessed by researchers as a Chinese state-sponsored espionage group that also runs financially motivated operations (MITRE ATT&CK)

  10. #10

    Cadet Blizzard

    aka Unit 29155, Ember Bear, UNC2589

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    DahuaAtlassianSophos

    Assessed as Russian GRU Unit 29155 (US FBI, CISA, NSA and partners in 9 countries)

  11. #11

    Flax Typhoon

    aka Ethereal Panda, RedJuliett, Integrity Technology Group

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    IvantiGitLabApacheISCProFTPDONLYOFFICE

    Assessed as enabled by a China-based company with links to the Chinese government (US FBI, CISA, NSA, Japan's NPA and NCO and partners)

  12. #12

    Kimsuky

    aka APT43, Emerald Sleet, Velvet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as North Korean actors (US FBI, State Department and NSA)

  13. #13

    MirrorFace

    aka Earth Kasha

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Array NetworksFortinetCitrixMicrosoft

    Assessed as an organized campaign with suspected Chinese involvement (Japan's National Police Agency and National Cybersecurity Office)

  14. #14

    Pioneer Kitten

    aka Fox Kitten, Lemon Sandstorm, UNC757

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixF5IvantiPalo Alto NetworksCheck Point

    Assessed as tied to the Government of Iran (US FBI, CISA and DC3)

  15. #15

    Salt Typhoon

    aka OPERATOR PANDA, RedMike, UNC5807

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CiscoIvantiPalo Alto Networks

    Assessed as PRC state-sponsored, supported by three named Chinese companies (NSA, CISA, FBI, Japan's NPA and NCO and partners in 13 countries)

  16. #16

    Silk Typhoon

    aka HAFNIUM

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiPalo Alto NetworksCitrixMicrosoft

    Assessed as a Chinese espionage group (Microsoft)

  17. #17

    UNC5174

    aka Houken, Uteus

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiF5ConnectWiseAtlassianZyxel

    Assessed as operating from China and likely an MSS contractor (Mandiant (Google))

  18. #18

    MuddyWater

    aka Mango Sandstorm, Seedworm, Static Kitten

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    3
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed to be a subordinate element of Iran's MOIS (MITRE ATT&CK)

  19. #19

    APT27

    aka Linen Typhoon, Emissary Panda, LuckyMouse

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as a Chinese state actor (Linen Typhoon) (Microsoft)

  20. #20

    APT29

    aka Midnight Blizzard, Cozy Bear, NOBELIUM

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    JetBrainsMicrosoft

    Assessed as Russia's Foreign Intelligence Service (SVR) (US FBI, CISA, NSA, UK NCSC and Polish agencies)

  21. #21

    BlackTech

    aka Palmerworm, Temp.Overboard, Circuit Panda

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Cisco

    Assessed as PRC-linked (US NSA, FBI, CISA and Japan's NPA and NISC)

  22. #22

    FSB Center 16

    aka Static Tundra, Berserk Bear, Energetic Bear

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Cisco

    Assessed as Russian FSB Center 16 (US NSA, CISA, FBI, UK NCSC and European, Australian and Canadian partners)

  23. #23

    Jasper Sleet

    aka Storm-0287, DPRK IT workers, UNC5267

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Warned that North Korean IT workers use false identities to obtain work, including from Japanese companies (Japan NPA, MOFA, MOF and METI)

  24. #24

    Laundry Bear

    aka Void Blizzard, CL-STA-1114, TA488

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    ZimbraMicrosoft

    Assessed as Russian state-supported (US CISA, NSA, FBI, Dutch AIVD and MIVD and partners)

  25. #25

    OilRig

    aka APT34, Earth Simnavaz, Hazel Sandstorm

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Iranian group believed to work on behalf of the Iranian government (MITRE ATT&CK)

  26. #26

    RedNovember

    aka TAG-100, Storm-2077

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Palo Alto NetworksCheck PointIvantiSonicWallCiscoF5

    Assessed as highly likely Chinese state-sponsored (Recorded Future)

  27. #27

    RomCom

    aka Storm-0978, Tropical Scorpius, UNC2596

    EspionageFinancial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    RARLABMozillaMicrosoft

    Assessed with high confidence as Russia-aligned (ESET)

  28. #28

    SideWinder

    aka Rattlesnake, T-APT-04, Razor Tiger

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Indian threat actor group (MITRE ATT&CK)

  29. #29

    UAT-6382

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Trimble

    Assessed with high confidence as Chinese-speaking actors (Cisco Talos)

  30. #30

    UNC3886

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    JuniperFortinetVMware

    Assessed as a China-nexus espionage group (Mandiant (Google))

  31. #31

    Volt Typhoon

    aka Vanguard Panda, BRONZE SILHOUETTE, Voltzite

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    FortinetIvantiCiscoCitrixNETGEARZoho

    Assessed as PRC state-sponsored (US CISA, NSA, FBI and Five Eyes partners)

  32. #32

    WaterPlum

    aka Contagious Interview, Famous Chollima

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operating under the 313 General Bureau of North Korea's Munitions Industry Department (Japan's NPA and NCO, US FBI and DC3, Australia and Germany)

  33. #33

    Earth Lusca

    aka FishMonger, Aquatic Panda, Charcoal Typhoon

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operated by Chinese contractor I-SOON (ESET)

  34. #34

    APT31

    aka Violet Typhoon, Zirconium, Judgment Panda

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Identified as operating on behalf of China's MSS Hubei State Security Department (US Treasury and Department of Justice)

  35. #35

    APT32

    aka OceanLotus, SeaLotus, Canvas Cyclone

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected Vietnam-based threat group (MITRE ATT&CK)

  36. #36

    APT33

    aka Peach Sandstorm, Elfin, HOLMIUM

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Iranian threat group (MITRE ATT&CK)

  37. #37

    APT42

    aka CALANQUE, UNC788

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Iranian-sponsored cyber espionage and surveillance group (MITRE ATT&CK)

  38. #38

    BITTER

    aka TA397, T-APT-17, APT-C-08

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected South Asian cyber espionage group (MITRE ATT&CK)

  39. #39

    Blind Eagle

    aka APT-C-36, AguilaCiega, TAG-144

    EspionageFinancial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected South American threat group (MITRE ATT&CK)

  40. #40

    Charming Kitten

    aka APT35, Mint Sandstorm, Magic Hound

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Iranian-sponsored group likely operating on behalf of the IRGC (MITRE ATT&CK)

  41. #41

    Confucius

    aka Confucius APT

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Cyber espionage group targeting military and government in South Asia (MITRE ATT&CK)

  42. #42

    Curly COMrades

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operating to support Russian interests (not tied to a known group) (Bitdefender)

  43. #43

    Emennet Pasargad

    aka Cotton Sandstorm, Aria Sepehr Ayandehsazan, Haywire Kitten

    HacktivismEspionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    IRGC-affiliated company operating under the name Aria Sepehr Ayandehsazan (US FBI, Treasury and Israel National Cyber Directorate)

  44. #44

    Gamaredon

    aka Aqua Blizzard, Primitive Bear, Shuckworm

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Notes Ukraine's government attributed it to FSB Center 18 (MITRE ATT&CK)

  45. #45

    Ghostwriter

    aka UNC1151, UAC-0057

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed with high confidence as linked to the Belarusian government (Mandiant (Google))

  46. #46

    Jewelbug

    aka REF7707, CL-STA-0049, Earth Alux

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as being of Chinese origin (Symantec (Broadcom))

  47. #47

    Lazarus Group

    aka Diamond Sleet, HIDDEN COBRA, Labyrinth Chollima

    EspionageFinancialDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean state-sponsored group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  48. #48

    Moonstone Sleet

    aka Storm-1789

    EspionageFinancial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean-linked threat actor (MITRE ATT&CK)

  49. #49

    Mustang Panda

    aka Twill Typhoon, Earth Preta, Stately Taurus

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as PRC state-sponsored (US DOJ and FBI)

  50. #50

    Nimbus Manticore

    aka UNC1549, Smoke Sandstorm, TA455

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Iran-nexus threat group (MITRE ATT&CK)

  51. #51

    Phantom Taurus

    aka CL-STA-0043, TGR-STA-0043

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as a Chinese-nexus actor aligned with PRC state interests (Palo Alto Networks Unit 42)

  52. #52

    PlushDaemon

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a China-aligned espionage group (ESET)

  53. #53

    Star Blizzard

    aka COLDRIVER, Callisto Group, SEABORGIUM

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as almost certainly subordinate to Russia's FSB Centre 18 (UK NCSC, US CISA, NSA, FBI and partners)

  54. #54

    TheWizards

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as China-aligned, with tools supplied by a Chinese company (ESET)

  55. #55

    Transparent Tribe

    aka APT36, Mythic Leopard, COPPER FIELDSTONE

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected Pakistan-based threat group (MITRE ATT&CK)

  56. #56

    Turla

    aka Secret Blizzard, Venomous Bear, Snake

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Attributed to Russia's FSB Center 16 (Microsoft (citing US CISA))

  57. #57

    UAT-7237

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed with high confidence as a Chinese-speaking APT group (Cisco Talos)

  58. #58

    Weaver Ant

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Zyxel

    Assessed as a China-nexus threat actor (Sygnia)

  59. #59

    WIRTE

    aka Ashen Lepus

    EspionageDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as an APT connected to the Hamas-affiliated Gaza Cybergang (Check Point)

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.