VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-24 · daily

Filters 1
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoPalo Alto NetworksSonicWallApacheConnectWiseFortraAtlassianF5JetBrainsZohoBeyondTrustSimpleHelpVeeamZimbraAdobe

5 groups · about 116.9M records of personal data leaked in total (disclosed)

  1. #01

    LockBit

    aka LockBit 3.0, LockBit Black, LockBitSupp

    Financial
    Alert level4 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    8
    Personal data leaked (disclosed)
    about 79.4K records
    FortinetMicrosoftF5ApacheFortraPaperCut

    Leader identified as a Russian national (UK National Crime Agency (Operation Cronos, incl. Japan's NPA))

  2. #02

    Cl0p

    aka TA505, FIN11

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    3
    Personal data leaked (disclosed)
    about 96.8M records
    ProgressFortraAccellionOracleCleo
  3. #03

    FIN7

    aka Carbon Spider, ELBRUS, Sangria Tempest

    Financial
    Alert level2 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    1
    Personal data leaked (disclosed)
    about 20M records
    Veeam

    Described as a financially motivated threat group (MITRE ATT&CK)

  4. #04

    Rhysida

    aka Vice Society

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    about 90K records
  5. #05

    Scattered Spider

    aka UNC3944, Octo Tempest, Muddled Libra

    Financial
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    5,000 records
    MicrosoftVMwareSnowflake

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.