VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters 2
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoPalo Alto NetworksSonicWallApacheAtlassianConnectWiseF5FortraZohoJetBrainsVeeamZimbraAdobeBeyondTrustCheck Point

61 groups · about 116.9M records of personal data leaked in total (disclosed)

  1. #01

    Ghost

    aka Cring, Crypt3r, Phantom

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    5
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    FortinetAdobeMicrosoft

    Assessed as financially motivated actors located in China (US FBI, CISA and MS-ISAC)

  2. #02

    Play

    aka Playcrypt

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    4
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    FortinetMicrosoftSimpleHelp
  3. #03

    SafePay

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeam
  4. #04

    Andariel

    aka Onyx Sleet, PLUTONIUM, Silent Chollima

    EspionageFinancial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    16
    Personal data leaked (disclosed)
    None confirmed
    ApacheJetBrainsCitrixIvantiProgressFortinet

    Assessed as part of North Korea's RGB 3rd Bureau (US FBI, CISA, NSA, South Korea's NIS and police, UK NCSC)

  5. #05

    LockBit

    aka LockBit 3.0, LockBit Black, LockBitSupp

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    about 79.4K records
    FortinetMicrosoftF5ApacheFortraPaperCut

    Leader identified as a Russian national (UK National Crime Agency (Operation Cronos, incl. Japan's NPA))

  6. #06

    Qilin

    aka Agenda, Phantom Mantis, Spikey Scorpius

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    FortinetPalo Alto Networks
  7. #07

    Akira

    aka Storm-1567, Howling Scorpius, Punk Spider

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeamVMwareMicrosoftNutanix
  8. #08

    APT41

    aka Wicked Panda, Brass Typhoon, BARIUM

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixZohoMicrosoftAtlassianApache

    Assessed by researchers as a Chinese state-sponsored espionage group that also runs financially motivated operations (MITRE ATT&CK)

  9. #09

    BianLian

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftVMware

    Assessed as likely based in Russia (US FBI, CISA and Australia's ASD)

  10. #10

    Fog

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    SonicWall
  11. #11

    NightSpire

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  12. #12

    Pioneer Kitten

    aka Fox Kitten, Lemon Sandstorm, UNC757

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixF5IvantiPalo Alto NetworksCheck Point

    Assessed as tied to the Government of Iran (US FBI, CISA and DC3)

  13. #13

    UNC6040

    aka ShinyHunters

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    14
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Salesforce
  14. #14

    Cyber Army of Russia Reborn

    aka CARR, CyberArmyofRussia_Reborn

    HacktivismDestructive
    Alert level2 / 5
    Reports & advisories (90 days)
    13
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed that GRU Unit 74455 likely supported its creation (US CISA, FBI, NSA and international partners)

  15. #15

    Vect

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    7
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    VMware
  16. #16

    INC Ransom

    aka GOLD IONIC, Tarnished Scorpius

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    CitrixPalo Alto Networks
  17. #17

    Lynx

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  18. #18

    BlackNevas

    aka Trial Recovery

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  19. #19

    Cactus

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Qlik
  20. #20

    Cicada3301

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    VMware
  21. #21

    Citrine Sleet

    aka AppleJeus, UNC4736, Gleaming Pisces

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    GoogleMicrosoft

    North Korean state-sponsored group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  22. #22

    Cl0p

    aka TA505, FIN11

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    about 96.8M records
    ProgressFortraAccellionOracleCleo
  23. #23

    DragonForce

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    SimpleHelp
  24. #24

    FIN7

    aka Carbon Spider, ELBRUS, Sangria Tempest

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    about 20M records
    Veeam

    Described as a financially motivated threat group (MITRE ATT&CK)

  25. #25

    Gunra

    aka Golden Community

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    FortinetMicrosoft
  26. #26

    Jasper Sleet

    aka Storm-0287, DPRK IT workers, UNC5267

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Warned that North Korean IT workers use false identities to obtain work, including from Japanese companies (Japan NPA, MOFA, MOF and METI)

  27. #27

    Kawa4096

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  28. #28

    Medusa

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    ConnectWiseFortinetFortraBeyondTrust
  29. #29

    NoName057(16)

    aka NoName05716, DDoSia

    Hacktivism
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a covert project created within a Kremlin-linked organization (CISM) (US CISA, FBI, NSA and international partners)

  30. #30

    RomCom

    aka Storm-0978, Tropical Scorpius, UNC2596

    EspionageFinancial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    RARLABMozillaMicrosoft

    Assessed with high confidence as Russia-aligned (ESET)

  31. #31

    Storm-0501

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    ZohoCitrixAdobeMicrosoft
  32. #32

    Storm-2460

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft
  33. #33

    Storm-2603

    aka Warlock, GOLD SALEM, CL-CRI-1040

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed with moderate confidence to be a China-based actor (Microsoft)

  34. #34

    The Gentlemen

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    GLPI

    Notes Russian-speaking individuals may be involved (Cisco Talos)

  35. #35

    TraderTraitor

    aka Jade Sleet, UNC4899, Slow Pisces

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a North Korea-linked group (Japan's NPA, US FBI and DC3)

  36. #36

    Water Gamayun

    aka EncryptHub, LARVA-208

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Described as a Russian threat actor (Trend Micro)

  37. #37

    WaterPlum

    aka Contagious Interview, Famous Chollima

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operating under the 313 General Bureau of North Korea's Munitions Industry Department (Japan's NPA and NCO, US FBI and DC3, Australia and Germany)

  38. #38

    World Leaks

    aka Hunters International

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  39. #39

    Everest

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  40. #40

    Interlock

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  41. #41

    Blind Eagle

    aka APT-C-36, AguilaCiega, TAG-144

    EspionageFinancial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected South American threat group (MITRE ATT&CK)

  42. #42

    BlueNoroff

    aka APT38, Sapphire Sleet, Stardust Chollima

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean state-sponsored financially motivated group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  43. #43

    Chaos

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  44. #44

    CrazyHunter

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  45. #45

    Crypto24

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  46. #46

    CyberAv3ngers

    aka Cyber Avengers, CyberAveng3rs

    HacktivismDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Unitronics

    Assessed as IRGC-affiliated (US FBI, CISA, NSA, EPA, Israel's INCD and others)

  47. #47

    Embargo

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  48. #48

    Emennet Pasargad

    aka Cotton Sandstorm, Aria Sepehr Ayandehsazan, Haywire Kitten

    HacktivismEspionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    IRGC-affiliated company operating under the name Aria Sepehr Ayandehsazan (US FBI, Treasury and Israel National Cyber Directorate)

  49. #49

    GhostRedirector

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as very likely China-aligned (ESET)

  50. #50

    Kraken

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  51. #51

    Lazarus Group

    aka Diamond Sleet, HIDDEN COBRA, Labyrinth Chollima

    EspionageFinancialDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean state-sponsored group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  52. #52

    Moonstone Sleet

    aka Storm-1789

    EspionageFinancial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean-linked threat actor (MITRE ATT&CK)

  53. #53

    Nitrogen

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  54. #54

    RansomHouse

    aka Jolly Scorpius

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    VMware
  55. #55

    Rhysida

    aka Vice Society

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    about 90K records
  56. #56

    Scattered Spider

    aka UNC3944, Octo Tempest, Muddled Libra

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    5,000 records
    MicrosoftVMwareSnowflake
  57. #57

    Sector16

    Hacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed that members may receive indirect Russian government support (US CISA, FBI, NSA and international partners)

  58. #58

    Sinobi

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    SonicWall
  59. #59

    TeamPCP

    aka PCPcat, UNC6780

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    DockerKubernetesRedisAqua SecurityCheckmarx
  60. #60

    Void Manticore

    aka Handala Hack, Homeland Justice, Karma

    DestructiveHacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed to operate on behalf of Iran's MOIS (MITRE ATT&CK)

  61. #61

    Z-Pentest

    Hacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Pro-Russia hacktivist group formed by CARR and NoName057(16) administrators (no direct state attribution) (US CISA, FBI, NSA and international partners)

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.