VulnPulse

Threat Actor Index

Active attack groups, organized by government assessments and the vulnerabilities they have actually exploited. Pick the products you run to bring the groups that target them to the top.

Updated 2026-10-23 · daily

Filters 1
SortAlert levelReports & advisoriesExploited CVEsData leakedRecent activityName (A–Z)
Alert level3+4+5+
MotiveEspionageFinancialDestructiveHacktivism
HasTargeted JapanDisclosed leaksKnown exploited CVEs
My productsMicrosoftFortinetCitrixIvantiVMwareCiscoPalo Alto NetworksSonicWallApacheAtlassianConnectWiseF5FortraZohoJetBrainsVeeamZimbraAdobeBeyondTrustCheck Point

7 groups

  1. #01

    Sandworm

    aka Seashell Blizzard, APT44, Unit 74455

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    1
    Known exploited CVEs
    7
    Personal data leaked (disclosed)
    None confirmed
    MicrosoftZimbraJetBrainsConnectWiseFortinet

    Assessed as acting on behalf of Russian military intelligence Unit 74455 (GRU) (Microsoft)

  2. #02

    Cadet Blizzard

    aka Unit 29155, Ember Bear, UNC2589

    EspionageDestructive
    Alert level3 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    5
    Personal data leaked (disclosed)
    None confirmed
    DahuaAtlassianSophos

    Assessed as Russian GRU Unit 29155 (US FBI, CISA, NSA and partners in 9 countries)

  3. #03

    Cyber Army of Russia Reborn

    aka CARR, CyberArmyofRussia_Reborn

    HacktivismDestructive
    Alert level2 / 5
    Reports & advisories (90 days)
    13
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed that GRU Unit 74455 likely supported its creation (US CISA, FBI, NSA and international partners)

  4. #04

    CyberAv3ngers

    aka Cyber Avengers, CyberAveng3rs

    HacktivismDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed
    Unitronics

    Assessed as IRGC-affiliated (US FBI, CISA, NSA, EPA, Israel's INCD and others)

  5. #05

    Lazarus Group

    aka Diamond Sleet, HIDDEN COBRA, Labyrinth Chollima

    EspionageFinancialDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    North Korean state-sponsored group attributed to the Reconnaissance General Bureau (MITRE ATT&CK)

  6. #06

    Void Manticore

    aka Handala Hack, Homeland Justice, Karma

    DestructiveHacktivism
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed to operate on behalf of Iran's MOIS (MITRE ATT&CK)

  7. #07

    WIRTE

    aka Ashen Lepus

    EspionageDestructive
    Alert level1 / 5
    Reports & advisories (90 days)
    0
    Known exploited CVEs
    0
    Personal data leaked (disclosed)
    None confirmed

    Assessed as an APT connected to the Hamas-affiliated Gaza Cybergang (Check Point)

Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.

Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.

The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.