VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters 1
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoSonicWallApacheAtlassianF5FortraPalo Alto NetworksZohoConnectWiseJetBrainsVeeamZimbraAdobeCheck PointProgress

7 groups

  1. #01

    Cyber Army of Russia Reborn

    aka CARR, CyberArmyofRussia_Reborn

    HacktivismDestructive
    Alert level2 / 5
    Reports & advisories (90 days)
    13
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed that GRU Unit 74455 likely supported its creation (US CISA, FBI, NSA and international partners)

  2. #02

    NoName057(16)

    aka NoName05716, DDoSia

    Hacktivism
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a covert project created within a Kremlin-linked organization (CISM) (US CISA, FBI, NSA and international partners)

  3. #03

    CyberAv3ngers

    aka Cyber Avengers, CyberAveng3rs

    HacktivismDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Unitronics

    Assessed as IRGC-affiliated (US FBI, CISA, NSA, EPA, Israel's INCD and others)

  4. #04

    Emennet Pasargad

    aka Cotton Sandstorm, Aria Sepehr Ayandehsazan, Haywire Kitten

    HacktivismEspionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    IRGC-affiliated company operating under the name Aria Sepehr Ayandehsazan (US FBI, Treasury and Israel National Cyber Directorate)

  5. #05

    Sector16

    Hacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed that members may receive indirect Russian government support (US CISA, FBI, NSA and international partners)

  6. #06

    Void Manticore

    aka Handala Hack, Homeland Justice, Karma

    DestructiveHacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed to operate on behalf of Iran's MOIS (MITRE ATT&CK)

  7. #07

    Z-Pentest

    Hacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Pro-Russia hacktivist group formed by CARR and NoName057(16) administrators (no direct state attribution) (US CISA, FBI, NSA and international partners)

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.