VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoSonicWallApacheAtlassianF5FortraPalo Alto NetworksZohoConnectWiseJetBrainsVeeamZimbraAdobeCheck PointProgress

110 groups · about 116.9M records of personal data leaked in total (disclosed)

  1. #01

    Tick

    aka BRONZE BUTLER, REDBALDKNIGHT

    Espionage
    Alert level4 / 5
    Reports & advisories (90 days)
    11
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Motex

    Assessed as Chinese state-sponsored (Sophos)

  2. #02

    Ghost

    aka Cring, Crypt3r, Phantom

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    5
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    FortinetAdobeMicrosoft

    Assessed as financially motivated actors located in China (US FBI, CISA and MS-ISAC)

  3. #03

    Play

    aka Playcrypt

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    4
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    FortinetMicrosoftSimpleHelp
  4. #04

    SafePay

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeam
  5. #05

    Andariel

    aka Onyx Sleet, PLUTONIUM, Silent Chollima

    EspionageFinancial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    16
    Personal data leaked (disclosed)
    None confirmed
    ApacheJetBrainsCitrixIvantiProgressFortinet

    Assessed as part of North Korea's RGB 3rd Bureau (US FBI, CISA, NSA, South Korea's NIS and police, UK NCSC)

  6. #06

    LockBit

    aka LockBit 3.0, LockBit Black, LockBitSupp

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    about 79.4K records
    FortinetMicrosoftF5ApacheFortraPaperCut

    Leader identified as a Russian national (UK National Crime Agency (Operation Cronos, incl. Japan's NPA))

  7. #07

    Qilin

    aka Agenda, Phantom Mantis

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  8. #08

    APT28

    aka Fancy Bear, Forest Blizzard, BlueDelta

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftRoundcubeRARLAB

    Assessed as Russian GRU 85th GTsSS, military unit 26165 (US NSA, FBI, CISA, UK NCSC, Germany, France and others)

  9. #09

    Sandworm

    aka Seashell Blizzard, APT44, Unit 74455

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftZimbraJetBrainsConnectWiseFortinet

    Assessed as acting on behalf of Russian military intelligence Unit 74455 (GRU) (Microsoft)

  10. #10

    UNC5221

    aka WARP PANDA, UTA0178

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    IvantiCitrixVMware

    Assessed as a suspected China-nexus espionage actor (Google Threat Intelligence Group (Mandiant))

  11. #11

    Akira

    aka Storm-1567, Howling Scorpius, Punk Spider

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    CiscoSonicWallVeeamVMwareMicrosoftNutanix
  12. #12

    APT-C-60

    aka SpyGlace

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Kingsoft

    Assessed as a South Korea-aligned cyberespionage group (ESET)

  13. #13

    APT37

    aka ScarCruft, Reaper, Ricochet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    North Korean state-sponsored espionage group; targets include South Korea and Japan (MITRE ATT&CK)

  14. #14

    APT40

    aka Kryptonite Panda, GINGHAM TYPHOON, Leviathan

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    AtlassianMicrosoftApache

    Assessed as conducting operations for China's Ministry of State Security (Australia's ASD, US CISA/NSA/FBI, Japan's NPA and NISC and others (8 countries))

  15. #15

    APT41

    aka Wicked Panda, Brass Typhoon, BARIUM

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixZohoMicrosoftAtlassianApache

    Assessed by researchers as a Chinese state-sponsored espionage group that also runs financially motivated operations (MITRE ATT&CK)

  16. #16

    BianLian

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftVMware

    Assessed as likely based in Russia (US FBI, CISA and Australia's ASD)

  17. #17

    Cadet Blizzard

    aka Unit 29155, Ember Bear, UNC2589

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    DahuaAtlassianSophos

    Assessed as Russian GRU Unit 29155 (US FBI, CISA, NSA and partners in 9 countries)

  18. #18

    Flax Typhoon

    aka Ethereal Panda, RedJuliett, Integrity Technology Group

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    None confirmed
    IvantiGitLabApacheISCProFTPDONLYOFFICE

    Assessed as enabled by a China-based company with links to the Chinese government (US FBI, CISA, NSA, Japan's NPA and NCO and partners)

  19. #19

    Fog

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    SonicWall
  20. #20

    Kimsuky

    aka APT43, Emerald Sleet, Velvet Chollima

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as North Korean actors (US FBI, State Department and NSA)

  21. #21

    MirrorFace

    aka Earth Kasha

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Array NetworksFortinetCitrixMicrosoft

    Assessed as an organized campaign with suspected Chinese involvement (Japan's National Police Agency and National Cybersecurity Office)

  22. #22

    NightSpire

    Financial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Fortinet
  23. #23

    Pioneer Kitten

    aka Fox Kitten, Lemon Sandstorm, UNC757

    EspionageFinancial
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CitrixF5IvantiPalo Alto NetworksCheck Point

    Assessed as tied to the Government of Iran (US FBI, CISA and DC3)

  24. #24

    Salt Typhoon

    aka OPERATOR PANDA, RedMike, UNC5807

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    6
    Personal data leaked (disclosed)
    None confirmed
    CiscoIvantiPalo Alto Networks

    Assessed as PRC state-sponsored, supported by three named Chinese companies (NSA, CISA, FBI, Japan's NPA and NCO and partners in 13 countries)

  25. #25

    Silk Typhoon

    aka HAFNIUM

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiPalo Alto NetworksCitrixMicrosoft

    Assessed as a Chinese espionage group (Microsoft)

  26. #26

    UNC5174

    aka Houken, Uteus

    Espionage
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    IvantiF5ConnectWiseAtlassianZyxel

    Assessed as operating from China and likely an MSS contractor (Mandiant (Google))

  27. #27

    UNC6040

    aka ShinyHunters

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    14
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Salesforce
  28. #28

    Cyber Army of Russia Reborn

    aka CARR, CyberArmyofRussia_Reborn

    HacktivismDestructive
    Alert level2 / 5
    Reports & advisories (90 days)
    13
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed that GRU Unit 74455 likely supported its creation (US CISA, FBI, NSA and international partners)

  29. #29

    Vect

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    7
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    VMware
  30. #30

    MuddyWater

    aka Mango Sandstorm, Seedworm, Static Kitten

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    3
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed to be a subordinate element of Iran's MOIS (MITRE ATT&CK)

  31. #31

    INC Ransom

    aka GOLD IONIC

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Citrix
  32. #32

    Lynx

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  33. #33

    APT27

    aka Linen Typhoon, Emissary Panda, LuckyMouse

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as a Chinese state actor (Linen Typhoon) (Microsoft)

  34. #34

    APT29

    aka Midnight Blizzard, Cozy Bear, NOBELIUM

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    JetBrainsMicrosoft

    Assessed as Russia's Foreign Intelligence Service (SVR) (US FBI, CISA, NSA, UK NCSC and Polish agencies)

  35. #35

    BlackNevas

    aka Trial Recovery

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  36. #36

    BlackTech

    aka Palmerworm, Temp.Overboard, Circuit Panda

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Cisco

    Assessed as PRC-linked (US NSA, FBI, CISA and Japan's NPA and NISC)

  37. #37

    Cactus

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Qlik
  38. #38

    Cicada3301

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    VMware
  39. #39

    Citrine Sleet

    aka AppleJeus, UNC4736, Gleaming Pisces

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    GoogleMicrosoft

    North Korean state-sponsored group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  40. #40

    Cl0p

    aka TA505, FIN11

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    about 96.8M records
    ProgressFortraAccellionOracleCleo
  41. #41

    DragonForce

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    SimpleHelp
  42. #42

    FIN7

    aka Carbon Spider, ELBRUS, Sangria Tempest

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    about 20M records
    Veeam

    Described as a financially motivated threat group (MITRE ATT&CK)

  43. #43

    FSB Center 16

    aka Static Tundra, Berserk Bear, Energetic Bear

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    Cisco

    Assessed as Russian FSB Center 16 (US NSA, CISA, FBI, UK NCSC and European, Australian and Canadian partners)

  44. #44

    Gunra

    aka Golden Community

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    FortinetMicrosoft
  45. #45

    Jasper Sleet

    aka Storm-0287, DPRK IT workers, UNC5267

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Warned that North Korean IT workers use false identities to obtain work, including from Japanese companies (Japan NPA, MOFA, MOF and METI)

  46. #46

    Kawa4096

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  47. #47

    Laundry Bear

    aka Void Blizzard, CL-STA-1114, TA488

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    ZimbraMicrosoft

    Assessed as Russian state-supported (US CISA, NSA, FBI, Dutch AIVD and MIVD and partners)

  48. #48

    Medusa

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    ConnectWiseFortinetFortraBeyondTrust
  49. #49

    NoName057(16)

    aka NoName05716, DDoSia

    Hacktivism
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a covert project created within a Kremlin-linked organization (CISM) (US CISA, FBI, NSA and international partners)

  50. #50

    OilRig

    aka APT34, Earth Simnavaz, Hazel Sandstorm

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Iranian group believed to work on behalf of the Iranian government (MITRE ATT&CK)

  51. #51

    RedNovember

    aka TAG-100, Storm-2077

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    Palo Alto NetworksCheck PointIvantiSonicWallCiscoF5

    Assessed as highly likely Chinese state-sponsored (Recorded Future)

  52. #52

    RomCom

    aka Storm-0978, Tropical Scorpius, UNC2596

    EspionageFinancial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    RARLABMozillaMicrosoft

    Assessed with high confidence as Russia-aligned (ESET)

  53. #53

    SideWinder

    aka Rattlesnake, T-APT-04, Razor Tiger

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Indian threat actor group (MITRE ATT&CK)

  54. #54

    Storm-0501

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    4
    Personal data leaked (disclosed)
    None confirmed
    ZohoCitrixAdobeMicrosoft
  55. #55

    Storm-2460

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft
  56. #56

    Storm-2603

    aka Warlock, GOLD SALEM, CL-CRI-1040

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed with moderate confidence to be a China-based actor (Microsoft)

  57. #57

    The Gentlemen

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    GLPI

    Notes Russian-speaking individuals may be involved (Cisco Talos)

  58. #58

    TraderTraitor

    aka Jade Sleet, UNC4899, Slow Pisces

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a North Korea-linked group (Japan's NPA, US FBI and DC3)

  59. #59

    UAT-6382

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Trimble

    Assessed with high confidence as Chinese-speaking actors (Cisco Talos)

  60. #60

    UNC3886

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    2
    Personal data leaked (disclosed)
    None confirmed
    JuniperFortinetVMware

    Assessed as a China-nexus espionage group (Mandiant (Google))

  61. #61

    Volt Typhoon

    aka Vanguard Panda, BRONZE SILHOUETTE, Voltzite

    Espionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    None confirmed
    FortinetIvantiCiscoCitrixNETGEARZoho

    Assessed as PRC state-sponsored (US CISA, NSA, FBI and Five Eyes partners)

  62. #62

    Water Gamayun

    aka EncryptHub, LARVA-208

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Described as a Russian threat actor (Trend Micro)

  63. #63

    WaterPlum

    aka Contagious Interview, Famous Chollima

    FinancialEspionage
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operating under the 313 General Bureau of North Korea's Munitions Industry Department (Japan's NPA and NCO, US FBI and DC3, Australia and Germany)

  64. #64

    World Leaks

    aka Hunters International

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  65. #65

    Earth Lusca

    aka FishMonger, Aquatic Panda, Charcoal Typhoon

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    2
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operated by Chinese contractor I-SOON (ESET)

  66. #66

    Everest

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  67. #67

    Interlock

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  68. #68

    APT31

    aka Violet Typhoon, Zirconium, Judgment Panda

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Identified as operating on behalf of China's MSS Hubei State Security Department (US Treasury and Department of Justice)

  69. #69

    APT32

    aka OceanLotus, SeaLotus, Canvas Cyclone

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected Vietnam-based threat group (MITRE ATT&CK)

  70. #70

    APT33

    aka Peach Sandstorm, Elfin, HOLMIUM

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Suspected Iranian threat group (MITRE ATT&CK)

  71. #71

    APT42

    aka CALANQUE, UNC788

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Iranian-sponsored cyber espionage and surveillance group (MITRE ATT&CK)

  72. #72

    BITTER

    aka TA397, T-APT-17, APT-C-08

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected South Asian cyber espionage group (MITRE ATT&CK)

  73. #73

    Blind Eagle

    aka APT-C-36, AguilaCiega, TAG-144

    EspionageFinancial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected South American threat group (MITRE ATT&CK)

  74. #74

    BlueNoroff

    aka APT38, Sapphire Sleet, Stardust Chollima

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean state-sponsored financially motivated group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  75. #75

    Chaos

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  76. #76

    Charming Kitten

    aka APT35, Mint Sandstorm, Magic Hound

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Iranian-sponsored group likely operating on behalf of the IRGC (MITRE ATT&CK)

  77. #77

    Confucius

    aka Confucius APT

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Cyber espionage group targeting military and government in South Asia (MITRE ATT&CK)

  78. #78

    CrazyHunter

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  79. #79

    Crypto24

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  80. #80

    Curly COMrades

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as operating to support Russian interests (not tied to a known group) (Bitdefender)

  81. #81

    CyberAv3ngers

    aka Cyber Avengers, CyberAveng3rs

    HacktivismDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Unitronics

    Assessed as IRGC-affiliated (US FBI, CISA, NSA, EPA, Israel's INCD and others)

  82. #82

    Embargo

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  83. #83

    Emennet Pasargad

    aka Cotton Sandstorm, Aria Sepehr Ayandehsazan, Haywire Kitten

    HacktivismEspionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    IRGC-affiliated company operating under the name Aria Sepehr Ayandehsazan (US FBI, Treasury and Israel National Cyber Directorate)

  84. #84

    Gamaredon

    aka Aqua Blizzard, Primitive Bear, Shuckworm

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Notes Ukraine's government attributed it to FSB Center 18 (MITRE ATT&CK)

  85. #85

    GhostRedirector

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as very likely China-aligned (ESET)

  86. #86

    Ghostwriter

    aka UNC1151, UAC-0057

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed with high confidence as linked to the Belarusian government (Mandiant (Google))

  87. #87

    Jewelbug

    aka REF7707, CL-STA-0049, Earth Alux

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as being of Chinese origin (Symantec (Broadcom))

  88. #88

    Kraken

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  89. #89

    Lazarus Group

    aka Diamond Sleet, HIDDEN COBRA, Labyrinth Chollima

    EspionageFinancialDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean state-sponsored group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  90. #90

    Moonstone Sleet

    aka Storm-1789

    EspionageFinancial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean-linked threat actor (MITRE ATT&CK)

  91. #91

    Mustang Panda

    aka Twill Typhoon, Earth Preta, Stately Taurus

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as PRC state-sponsored (US DOJ and FBI)

  92. #92

    Nimbus Manticore

    aka UNC1549, Smoke Sandstorm, TA455

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Iran-nexus threat group (MITRE ATT&CK)

  93. #93

    Nitrogen

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
  94. #94

    Phantom Taurus

    aka CL-STA-0043, TGR-STA-0043

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Microsoft

    Assessed as a Chinese-nexus actor aligned with PRC state interests (Palo Alto Networks Unit 42)

  95. #95

    PlushDaemon

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as a China-aligned espionage group (ESET)

  96. #96

    RansomHouse

    aka Jolly Scorpius

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    VMware
  97. #97

    Rhysida

    aka Vice Society

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    about 90K records
  98. #98

    Scattered Spider

    aka UNC3944, Octo Tempest, Muddled Libra

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    5,000 records
    MicrosoftVMwareSnowflake
  99. #99

    Sector16

    Hacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed that members may receive indirect Russian government support (US CISA, FBI, NSA and international partners)

  100. #100

    Sinobi

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    SonicWall
  101. #101

    Star Blizzard

    aka COLDRIVER, Callisto Group, SEABORGIUM

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as almost certainly subordinate to Russia's FSB Centre 18 (UK NCSC, US CISA, NSA, FBI and partners)

  102. #102

    TeamPCP

    aka PCPcat, UNC6780

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    DockerKubernetesRedisAqua SecurityCheckmarx
  103. #103

    TheWizards

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as China-aligned, with tools supplied by a Chinese company (ESET)

  104. #104

    Transparent Tribe

    aka APT36, Mythic Leopard, COPPER FIELDSTONE

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Suspected Pakistan-based threat group (MITRE ATT&CK)

  105. #105

    Turla

    aka Secret Blizzard, Venomous Bear, Snake

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Attributed to Russia's FSB Center 16 (Microsoft (citing US CISA))

  106. #106

    UAT-7237

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed with high confidence as a Chinese-speaking APT group (Cisco Talos)

  107. #107

    Void Manticore

    aka Handala Hack, Homeland Justice, Karma

    DestructiveHacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed to operate on behalf of Iran's MOIS (MITRE ATT&CK)

  108. #108

    Weaver Ant

    Espionage
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Zyxel

    Assessed as a China-nexus threat actor (Sygnia)

  109. #109

    WIRTE

    aka Ashen Lepus

    EspionageDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as an APT connected to the Hamas-affiliated Gaza Cybergang (Check Point)

  110. #110

    Z-Pentest

    Hacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Pro-Russia hacktivist group formed by CARR and NoName057(16) administrators (no direct state attribution) (US CISA, FBI, NSA and international partners)

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.