MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 14:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
misp-galaxy/clusters/tidal-groups.json
Alexandre Dulaunoy 59a0d9a986
Some checks are pending
Python application / build (3.10) (push) Waiting to run
Details
Python application / build (3.8) (push) Waiting to run
Details
Python application / build (3.9) (push) Waiting to run
Details
chg: [tidal] updated to the latest version
2024-10-03 08:40:13 +02:00

6566 lines
324 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"authors": [
"Tidal Cyber"
],
"category": "Threat Groups",
"description": "Tidal Groups Galaxy",
"name": "Tidal Groups",
"source": "https://app-api.tidalcyber.com/api/v1/groups/",
"type": "groups",
"uuid": "877cdc4b-3392-4353-a7d4-2e46d40e5936",
"values": [
{
"description": "This object represents the behaviors associated with operators of 8Base ransomware, who may or may not operate as a cohesive unit. Behaviors associated with samples of 8Base ransomware are represented in the \"8Base Ransomware\" Software object.\n \nThe 8Base ransomware operation began claiming significant numbers of victims on its data leak site in June 2023, including organizations in a range of sectors. Researchers have observed considerable similarities between aspects of 8Base's operations and those of other ransomware groups, leading them to suspect that 8Base may be an evolution or offshoot of existing operations. The language in 8Base's ransom notes is similar to the language seen in RansomHouse's notes, and there is strong overlap between the code of Phobos ransomware and 8Base.<sup>[[VMWare 8Base June 28 2023](/references/573e9520-6181-4535-9ed3-2338688a8e9f)]</sup><sup>[[Acronis 8Base July 17 2023](/references/c9822477-1578-4068-9882-41e4d6eaee3f)]</sup>",
"meta": {
"group_attack_id": "G3014",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Automotive",
"Construction",
"Financial Services",
"Healthcare",
"Hospitality Leisure",
"Manufacturing",
"Non Profit",
"Technology"
]
},
"related": [],
"uuid": "00b45c13-d165-44d0-ad6b-99787d2a7ce3",
"value": "8Base Ransomware Actors"
},
{
"description": "[admin@338](https://app.tidalcyber.com/groups/8567136b-f84a-45ed-8cce-46324c7da60e) is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as [PoisonIvy](https://app.tidalcyber.com/software/1d87a695-7989-49ae-ac1a-b6601db565c3), as well as some non-public backdoors. <sup>[[FireEye admin@338](https://app.tidalcyber.com/references/f3470275-9652-440e-914d-ad4fc5165413)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0018",
"observed_countries": [
"HK",
"US"
],
"source": "MITRE",
"target_categories": [
"Financial Services"
]
},
"related": [],
"uuid": "8567136b-f84a-45ed-8cce-46324c7da60e",
"value": "admin@338"
},
{
"description": "[Ajax Security Team](https://app.tidalcyber.com/groups/e38bcb42-12c1-4202-a794-ec26cd830caa) is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 [Ajax Security Team](https://app.tidalcyber.com/groups/e38bcb42-12c1-4202-a794-ec26cd830caa) transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.<sup>[[FireEye Operation Saffron Rose 2013](https://app.tidalcyber.com/references/2f4c0941-d14e-4eb8-828c-f1d9a1e14a95)]</sup>",
"meta": {
"group_attack_id": "G0130",
"source": "MITRE"
},
"related": [],
"uuid": "e38bcb42-12c1-4202-a794-ec26cd830caa",
"value": "Ajax Security Team"
},
{
"description": "[Akira](https://app.tidalcyber.com/groups/923f478c-7ad1-516f-986d-61f96b9c553e) is a ransomware variant and ransomware deployment entity active since at least March 2023.<sup>[[Arctic Wolf Akira 2023](https://app.tidalcyber.com/references/aa34f2a1-a398-5dc4-b898-cdc02afeca5d)]</sup> [Akira](https://app.tidalcyber.com/groups/923f478c-7ad1-516f-986d-61f96b9c553e) uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.<sup>[[Arctic Wolf Akira 2023](https://app.tidalcyber.com/references/aa34f2a1-a398-5dc4-b898-cdc02afeca5d)]</sup><sup>[[Secureworks GOLD SAHARA](https://app.tidalcyber.com/references/3abb7995-4a62-56a6-9492-942965edf0a0)]</sup> [Akira](https://app.tidalcyber.com/groups/923f478c-7ad1-516f-986d-61f96b9c553e) operations are associated with \"double extortion\" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of [Akira](https://app.tidalcyber.com/software/96ae0e1e-975a-5e11-adbe-c79ee17cee11) ransomware indicates multiple overlaps with and similarities to [Conti](https://app.tidalcyber.com/software/8e995c29-2759-4aeb-9a0f-bb7cd97b06e5) malware.<sup>[[BushidoToken Akira 2023](https://app.tidalcyber.com/references/8fe09ef1-f72e-5261-b79f-5d41fad51eac)]</sup>",
"meta": {
"group_attack_id": "G1024",
"observed_countries": [
"AU",
"BD",
"BR",
"CA",
"DK",
"FR",
"IN",
"IL",
"LV",
"MX",
"NI",
"PT",
"ZA",
"TR",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"fde14c10-e749-4c04-b97f-1d9fbd6e72e7",
"0580d361-b60b-4664-9b2e-6d737e495cc1",
"9768aada-9d63-4d46-ab9f-d41b8c8e4010",
"a159c91c-5258-49ea-af7d-e803008d97d3",
"c5a258ce-9045-48d9-b254-ec2bf6437bb5",
"cc4ea215-87ce-4351-9579-cf527caf5992",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"c79f7ba7-a2f2-43ff-8c78-521807ef6c92",
"a2e000da-8181-4327-bacd-32013dbd3654",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"562e535e-19f5-4d6c-81ed-ce2aec544f09"
],
"target_categories": [
"Aerospace",
"Agriculture",
"Banks",
"Construction",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Insurance",
"Legal",
"Manufacturing",
"Non Profit",
"Retail",
"Technology",
"Telecommunications",
"Transportation"
]
},
"related": [],
"uuid": "923f478c-7ad1-516f-986d-61f96b9c553e",
"value": "Akira"
},
{
"description": "*We are no longer maintaining this object in favor of a similar object subsequently published by MITRE: \"Akira\" (Group). All relevant Tidal content extensions (e.g. additional Technique and Object relationships and metadata) have been added to the MITRE-authored object.*\n\n\nThis Group object reflects the tools & TTPs used by threat actors known to deploy Akira, a ransomware family that researchers believe has been used since at least March 2023.<sup>[[TrendMicro Akira October 5 2023](/references/8f45fb21-c6ad-4b97-b459-da96eb643069)]</sup> Researchers assess that the Akira operation relates to and possibly derives from the Conti ransomware operation (by way of the Royal ransomware operation).<sup>[[GitHub ransomware_map](/references/d995f4b2-3262-4c37-855a-61aef7d7b8a8)]</sup>\n\nTTPs associated with the Akria ransomware binary itself can be found in the separate \"Akira Ransomware\" Software object.",
"meta": {
"group_attack_id": "G5021",
"observed_countries": [
"AU",
"BD",
"BR",
"CA",
"DK",
"FR",
"IN",
"IL",
"LV",
"MX",
"NI",
"PT",
"ZA",
"TR",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c5a258ce-9045-48d9-b254-ec2bf6437bb5",
"cc4ea215-87ce-4351-9579-cf527caf5992",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"562e535e-19f5-4d6c-81ed-ce2aec544f09"
],
"target_categories": [
"Agriculture",
"Banks",
"Construction",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Insurance",
"Legal",
"Manufacturing",
"Non Profit",
"Retail",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "0fcb2205-e75b-46c9-ac54-00f218d5e331",
"value": "Akira Ransomware Actors (Deprecated)"
},
{
"description": "[Andariel](https://app.tidalcyber.com/groups/2cc997b5-5076-4eef-9974-f54387614f46) is a North Korean state-sponsored threat group that has been active since at least 2009. [Andariel](https://app.tidalcyber.com/groups/2cc997b5-5076-4eef-9974-f54387614f46) has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. [Andariel](https://app.tidalcyber.com/groups/2cc997b5-5076-4eef-9974-f54387614f46)'s notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.<sup>[[FSI Andariel Campaign Rifle July 2017](https://app.tidalcyber.com/references/bde61ee9-16f9-4bd9-a847-5cc9df21335c)]</sup><sup>[[IssueMakersLab Andariel GoldenAxe May 2017](https://app.tidalcyber.com/references/10a21964-d31f-40af-bf32-5ccd7d8c99a2)]</sup><sup>[[AhnLab Andariel Subgroup of Lazarus June 2018](https://app.tidalcyber.com/references/bbc66e9f-98f9-4e34-b568-2833ea536f2e)]</sup><sup>[[TrendMicro New Andariel Tactics July 2018](https://app.tidalcyber.com/references/b667eb44-8c2f-4319-bc93-f03610214b8b)]</sup><sup>[[CrowdStrike Silent Chollima Adversary September 2021](https://app.tidalcyber.com/references/835283b5-af3b-4baf-805e-da8ebbe8b5d2)]</sup>\n\n[Andariel](https://app.tidalcyber.com/groups/2cc997b5-5076-4eef-9974-f54387614f46) is considered a sub-set of [Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08), and has been attributed to North Korea's Reconnaissance General Bureau.<sup>[[Treasury North Korean Cyber Groups September 2019](https://app.tidalcyber.com/references/54977bb2-2929-41d7-bdea-06d39dc76174)]</sup>\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08) instead of tracking clusters or subgroups.",
"meta": {
"country": "KP",
"group_attack_id": "G0138",
"observed_countries": [
"BR",
"CA",
"CN",
"FR",
"DE",
"IN",
"IL",
"JP",
"KR",
"NG",
"NO",
"PH",
"RO",
"RU",
"SE",
"GB",
"US",
"VN"
],
"observed_motivations": [
"Cyber Espionage",
"Destruction",
"Financial Gain"
],
"source": "MITRE",
"tags": [
"af5e9be5-b86e-47af-91dd-966a5e34a186",
"27a117ce-bb19-4f79-9bc2-a851b69c5c50",
"6070668f-1cbd-4878-8066-c636d1d8659c",
"61cdbb28-cbfd-498b-9ab1-1f14337f9524",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"4f4744b0-8401-423c-9ed0-3cb2985d9fd3",
"ddfaecd0-bd3e-41ac-85c7-ca2156684343",
"0dbed83d-af67-4ce0-a1ee-16f1165fdc0f",
"6422a882-7606-4aa3-b994-f917f53c2ada",
"c1b123d2-ce58-4345-8482-d1da27b3c053",
"f166e59e-9877-4102-a39b-fae38df4b790",
"6a82d685-3f77-498d-91c3-a759292ec2da",
"a32a757a-9d6b-43ca-ac4b-5f695dd0f110",
"ac70560d-c3e7-4b40-a4d6-a3287e3d952b",
"75f62312-a7ee-4534-8c8a-e3b7366a3a4b",
"887d1cfe-d0c5-431c-8dce-0e1b9a2505aa",
"96eec53f-355c-406c-87ba-18c3be4c69a1",
"54fafdbe-1ea0-4f48-99ad-757c8fe50df2",
"35b334ec-4169-4898-ab90-487eea7feb69",
"4ac4e1b9-2192-47ac-a4d1-3a31aa0f2140",
"936a56f5-a4f1-42d8-83b7-c44399ead661",
"0d19ceed-28f6-4258-b365-f6e6f296121d",
"037cc75c-9683-49db-aaa8-c8142763bb87",
"ff71ed89-8355-4abc-9da4-eb4768a38c9c",
"6fade0a3-0c26-4a11-b81e-25d20e38bdd3",
"3b54d8a5-580f-43bf-a12d-8e011f953bad",
"0f6e72e1-ba8f-4d1d-920d-d8945a4fee59",
"7bbc5366-897a-4505-bc68-3a18e3d4cf44",
"4cd85398-c33a-4374-9a76-2bbf297cca63",
"5ec8231e-70e9-4675-b922-368bcb9e914a",
"21c64d34-e52a-42ba-a8c7-85aa82dc0b3f",
"cd9ab9e7-248f-4097-b120-a42834ce0f89",
"91ddbeac-b587-4978-a80d-543a5d96cb77",
"b8448700-7ed0-48b8-85f5-ed23e0d9ab97",
"12b074b9-6748-4ad7-880f-836cb80587e1",
"45f92502-0775-4fc6-8fcd-97b325ea49a9",
"cddb4563-fe90-4c72-be81-6256d175a698",
"69f278d7-194f-42d0-8f83-11de9f861264",
"f0c58aa3-5d21-4ade-95a0-b775dde7e8a3",
"5f9b1c23-81f8-4aa3-8d97-235302e77eec",
"d842c7ff-e3d3-4534-9ed7-283752f4bbe2",
"ecd84106-2a5b-4d25-854e-b8d1f57f6b75",
"7e6ef160-8e4f-4132-bdc4-9991f01c472e",
"532b7819-d407-41e9-9733-0d716b69eb17",
"e401022a-36ac-486d-8503-dd531410a927",
"173e1480-8d9b-49c5-854d-594dde9740d6",
"7551097a-dfdd-426f-aaa2-a2916dd9b873",
"c475ad68-3fdc-4725-8abc-784c56125e96",
"08809fa0-61b6-4394-b103-1c4d19a5be16",
"4ac8dcde-2665-4066-9ad9-b5572d5f0d28",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Aerospace",
"Agriculture",
"Casinos Gambling",
"Chemical",
"Defense",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Insurance",
"Legal",
"Media",
"Nuclear",
"Pharmaceuticals",
"Retail",
"Technology",
"Telecommunications",
"Transportation",
"Travel Services",
"Utilities"
]
},
"related": [],
"uuid": "2cc997b5-5076-4eef-9974-f54387614f46",
"value": "Andariel"
},
{
"description": "AnonGhost is an apparent hacktivist collective. In October 2023, following a series of air- and land-based attacks in the Gaza Strip, AnonGhost was one of several hacktivist groups that claimed responsibility for disruptive attacks against computer networks in Israel. Researchers indicated that they observed AnonGhost actors exploit an undisclosed API vulnerability in Red Alert, an application that provides warning of projectile attacks in Israel, using Python scripts to intercept web requests and send spam messages to the app's users.<sup>[[Group-IB Threat Intelligence Tweet October 9 2023](/references/2df546ed-6577-44b2-9b26-0a17c3622df7)]</sup>",
"meta": {
"group_attack_id": "G3024",
"observed_countries": [
"IL",
"US"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"target_categories": [
"Education",
"Government",
"Technology"
]
},
"related": [],
"uuid": "67e02e39-1db8-4842-b0b1-d250ea9a22c3",
"value": "AnonGhost"
},
{
"description": "Anonymous Sudan is an apparent hacktivist collective that has primarily used distributed denial of service (DDoS) and website defacement attacks in support of its ideology, which appears to largely align with Russian state interests. The group regularly cross-promotes communications with Killnet, another hacktivist group that appears to share similar ideologies and methods of operation.<sup>[[Flashpoint Anonymous Sudan Timeline](/references/2e7060d2-f7bc-457e-a2e6-12897d503ea6)]</sup> Researchers assess that the group is affiliated with neither the Anonymous hacktivist group nor Sudan.<sup>[[CyberCX Anonymous Sudan June 19 2023](/references/68ded9b7-3042-44e0-8bf7-cdba2174a3d8)]</sup>\n\nSince emerging in January 2023, Anonymous Sudan has claimed and is believed to be responsible for a considerable number of DDoS attacks affecting victims in a wide range of geographic locations and sectors.<sup>[[Flashpoint Anonymous Sudan Timeline](/references/2e7060d2-f7bc-457e-a2e6-12897d503ea6)]</sup> It claimed responsibility for a series of early June 2023 DDoS attacks that caused temporary interruptions to Microsoft Azure, Outlook, and OneDrive services. Microsoft security researchers attributed those attacks to the Storm-1359 group.<sup>[[The Hacker News Microsoft DDoS June 19 2023](/references/2ee27b55-b7a7-40a8-8c0b-5e28943cd273)]</sup><sup>[[Microsoft DDoS Attacks Response June 2023](/references/d64e941e-785b-4b23-a7d0-04f12024b033)]</sup> Like Killnet, Anonymous Sudan claimed responsibility for disruptive attacks against computer networks in Israel following a series of air- and land-based attacks in the Gaza Strip in October 2023.<sup>[[FalconFeedsio Tweet October 9 2023](/references/e9810a28-f060-468b-b4ea-ffed9403ae8b)]</sup>",
"meta": {
"group_attack_id": "G3023",
"observed_countries": [
"AU",
"DK",
"FR",
"DE",
"IR",
"IL",
"LV",
"NL",
"SE",
"UA",
"AE",
"US"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"62bde669-3020-4682-be68-36c83b2588a4"
],
"target_categories": [
"Aerospace",
"Banks",
"Education",
"Financial Services",
"Government",
"Healthcare",
"Technology"
]
},
"related": [],
"uuid": "132feaeb-a9a1-4ecc-b7e9-86c008c15218",
"value": "Anonymous Sudan"
},
{
"description": "[Aoqin Dragon](https://app.tidalcyber.com/groups/454402a3-0503-45bf-b2e0-177fa2e2d412) is a suspected Chinese cyber espionage threat group that has been active since at least 2013. [Aoqin Dragon](https://app.tidalcyber.com/groups/454402a3-0503-45bf-b2e0-177fa2e2d412) has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between [Aoqin Dragon](https://app.tidalcyber.com/groups/454402a3-0503-45bf-b2e0-177fa2e2d412) and UNC94, based on malware, infrastructure, and targets.<sup>[[SentinelOne Aoqin Dragon June 2022](https://app.tidalcyber.com/references/b4e792e0-b1fa-4639-98b1-233aaec53594)]</sup>",
"meta": {
"group_attack_id": "G1007",
"source": "MITRE"
},
"related": [],
"uuid": "454402a3-0503-45bf-b2e0-177fa2e2d412",
"value": "Aoqin Dragon"
},
{
"description": "[APT1](https://app.tidalcyber.com/groups/5307bba1-2674-4fbd-bfd5-1db1ae06fc5f) is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. <sup>[[Mandiant APT1](https://app.tidalcyber.com/references/865eba93-cf6a-4e41-bc09-de9b0b3c2669)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0006",
"observed_countries": [
"BE",
"CA",
"FR",
"IN",
"IL",
"JP",
"KR",
"LU",
"NO",
"SG",
"ZA",
"CH",
"TW",
"AE",
"GB",
"US",
"VN"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Agriculture",
"Chemical",
"Construction",
"Education",
"Electronics",
"Energy",
"Entertainment",
"Financial Services",
"Healthcare",
"Legal",
"Manufacturing",
"Media",
"Mining",
"Technology",
"Telecommunications",
"Transportation"
]
},
"related": [],
"uuid": "5307bba1-2674-4fbd-bfd5-1db1ae06fc5f",
"value": "APT1"
},
{
"description": "[APT12](https://app.tidalcyber.com/groups/225314a7-8f40-48d4-9cff-3ec39b177762) is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.<sup>[[Meyers Numbered Panda](https://app.tidalcyber.com/references/988dfcfc-0c16-4129-9523-a77539291951)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0005",
"observed_countries": [
"DE",
"JP",
"TW",
"US"
],
"source": "MITRE",
"target_categories": [
"Government",
"High Tech",
"Media"
]
},
"related": [],
"uuid": "225314a7-8f40-48d4-9cff-3ec39b177762",
"value": "APT12"
},
{
"description": "[APT16](https://app.tidalcyber.com/groups/06a05175-0812-44f5-a529-30eba07d1762) is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. <sup>[[FireEye EPS Awakens Part 2](https://app.tidalcyber.com/references/7fd58ef5-a0b7-40b6-8771-ca5e87740965)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0023",
"observed_countries": [
"JP",
"TW",
"TH"
],
"source": "MITRE",
"target_categories": [
"Financial Services",
"Technology"
]
},
"related": [],
"uuid": "06a05175-0812-44f5-a529-30eba07d1762",
"value": "APT16"
},
{
"description": "[APT17](https://app.tidalcyber.com/groups/5f083251-f5dc-459a-abfc-47a1aa7f5094) is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. <sup>[[FireEye APT17](https://app.tidalcyber.com/references/a303f97a-72dd-4833-bac7-a421addc3242)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0025",
"observed_countries": [
"BE",
"CN",
"DE",
"ID",
"IT",
"JP",
"NL",
"RU",
"CH",
"GB",
"US"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government",
"Legal",
"Mining",
"NGOs",
"Technology"
]
},
"related": [],
"uuid": "5f083251-f5dc-459a-abfc-47a1aa7f5094",
"value": "APT17"
},
{
"description": "[APT18](https://app.tidalcyber.com/groups/a0c31021-b281-4c41-9855-436768299fe7) is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. <sup>[[Dell Lateral Movement](https://app.tidalcyber.com/references/fcc9b52a-751f-4985-8c32-7aaf411706ad)]</sup>",
"meta": {
"group_attack_id": "G0026",
"source": "MITRE",
"target_categories": [
"Government",
"Healthcare",
"Human Rights",
"Manufacturing",
"Pharmaceuticals",
"Technology"
]
},
"related": [],
"uuid": "a0c31021-b281-4c41-9855-436768299fe7",
"value": "APT18"
},
{
"description": "[APT19](https://app.tidalcyber.com/groups/713e2963-fbf4-406f-a8cf-6a4489d90439) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. <sup>[[FireEye APT19](https://app.tidalcyber.com/references/d75508b1-8b85-47c9-a087-bc64e8e4cb33)]</sup> Some analysts track [APT19](https://app.tidalcyber.com/groups/713e2963-fbf4-406f-a8cf-6a4489d90439) and [Deep Panda](https://app.tidalcyber.com/groups/43f826a1-e8c8-47b8-9b00-38e1b3e4293b) as the same group, but it is unclear from open source information if the groups are the same. <sup>[[ICIT China's Espionage Jul 2016](https://app.tidalcyber.com/references/1a824860-6978-454d-963a-a56414a4312b)]</sup> <sup>[[FireEye APT Groups](https://app.tidalcyber.com/references/5b6b909d-870a-4d14-85ec-6aa14e598740)]</sup> <sup>[[Unit 42 C0d0so0 Jan 2016](https://app.tidalcyber.com/references/c740fc1c-093e-4389-890e-1fd88a824df4)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0073",
"observed_countries": [
"AU",
"US"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Education",
"Energy",
"Financial Services",
"Legal",
"Manufacturing",
"Pharmaceuticals",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "713e2963-fbf4-406f-a8cf-6a4489d90439",
"value": "APT19"
},
{
"description": "APT20 is a suspected China-attributed espionage actor. It has attacked organizations in a wide range of verticals for data theft. These operations appear to be motivated by the acquisition of intellectual property but also collection of information around individuals with particular political interests.<sup>[[Mandiant APT Groups List](/references/c984fcfc-1bfd-4b1e-9034-a6ff3e6ebf97)]</sup> Researchers attributed, with medium confidence, the years-long Operation Wocao espionage campaign to APT20.<sup>[[FoxIT Wocao December 2019](/references/aa3e31c7-71cd-4a3f-b482-9049c9abb631)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G3020",
"observed_countries": [
"BR",
"CN",
"FR",
"DE",
"IT",
"MX",
"PT",
"ES",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"target_categories": [
"Aerospace",
"Casinos Gambling",
"Chemical",
"Construction",
"Defense",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Insurance",
"Manufacturing",
"Non Profit",
"Retail",
"Technology",
"Transportation"
]
},
"related": [],
"uuid": "4173c301-0307-458d-89dd-2583e94247ec",
"value": "APT20"
},
{
"description": "[APT28](https://app.tidalcyber.com/groups/5b1a5b9e-4722-41fc-a15d-196a549e3ac5) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.<sup>[[NSA/FBI Drovorub August 2020](https://app.tidalcyber.com/references/d697a342-4100-4e6b-95b9-4ae3ba80924b)]</sup><sup>[[Cybersecurity Advisory GRU Brute Force Campaign July 2021](https://app.tidalcyber.com/references/e70f0742-5f3e-4701-a46b-4a58c0281537)]</sup> This group has been active since at least 2004.<sup>[[DOJ GRU Indictment Jul 2018](https://app.tidalcyber.com/references/d65f371b-19d0-49de-b92b-94a2bea1d988)]</sup><sup>[[Ars Technica GRU indictment Jul 2018](https://app.tidalcyber.com/references/a1192cb3-4536-4900-93c7-a127ca06c690)]</sup><sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup><sup>[[FireEye APT28](https://app.tidalcyber.com/references/c423b2b2-25a3-4a8d-b89a-83ab07c0cd20)]</sup><sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup><sup>[[FireEye APT28 January 2017](https://app.tidalcyber.com/references/61d80b8f-5bdb-41e6-b59a-d2d996392873)]</sup><sup>[[GRIZZLY STEPPE JAR](https://app.tidalcyber.com/references/4b26d274-497f-49bc-a2a5-b93856a49893)]</sup><sup>[[Sofacy DealersChoice](https://app.tidalcyber.com/references/ec157d0c-4091-43f5-85f1-a271c4aac1fc)]</sup><sup>[[Palo Alto Sofacy 06-2018](https://app.tidalcyber.com/references/a32357eb-3226-4bee-aeed-d2fbcfa52da0)]</sup><sup>[[Symantec APT28 Oct 2018](https://app.tidalcyber.com/references/777bc94a-6c21-4f8c-9efa-a1cf52ececc0)]</sup><sup>[[ESET Zebrocy May 2019](https://app.tidalcyber.com/references/f8b837fb-e46c-4153-8e86-dc4b909b393a)]</sup>\n\n[APT28](https://app.tidalcyber.com/groups/5b1a5b9e-4722-41fc-a15d-196a549e3ac5) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.<sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup> In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://app.tidalcyber.com/groups/5b1a5b9e-4722-41fc-a15d-196a549e3ac5) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.<sup>[[US District Court Indictment GRU Oct 2018](https://app.tidalcyber.com/references/56aeab4e-b046-4426-81a8-c3b2323492f0)]</sup> Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://app.tidalcyber.com/groups/16a65ee9-cd60-4f04-ba34-f2f45fcfc666). ",
"meta": {
"country": "RU",
"group_attack_id": "G0007",
"observed_countries": [
"AF",
"AM",
"AU",
"AZ",
"BY",
"BE",
"BR",
"BG",
"CA",
"CL",
"CN",
"HR",
"CY",
"CZ",
"FR",
"GE",
"DE",
"HU",
"IN",
"IR",
"IQ",
"IT",
"JP",
"JO",
"KZ",
"KR",
"KG",
"LV",
"LT",
"MY",
"MX",
"MN",
"ME",
"NL",
"NO",
"PK",
"PL",
"RO",
"SK",
"ZA",
"ES",
"SE",
"CH",
"TJ",
"TH",
"TR",
"UG",
"UA",
"AE",
"GB",
"US",
"UZ"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"fe28cf32-a15c-44cf-892c-faa0360d6109",
"6070668f-1cbd-4878-8066-c636d1d8659c",
"d8f7e071-fbfd-46f8-b431-e241bb1513ac",
"61cdbb28-cbfd-498b-9ab1-1f14337f9524",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"a98d7a43-f227-478e-81de-e7299639a355",
"916ea1e8-d117-45a4-8564-0597a02b06e4",
"904ad11a-20ca-479c-ad72-74bd5d9dc7e4",
"af5e9be5-b86e-47af-91dd-966a5e34a186",
"15787198-6c8b-4f79-bf50-258d55072fee",
"f01290d9-7160-44cb-949f-ee4947d04b6f",
"b20e7912-6a8d-46e3-8e13-9a3fc4813852"
],
"target_categories": [
"Aerospace",
"Chemical",
"Defense",
"Education",
"Energy",
"Government",
"Hospitality Leisure",
"Manufacturing",
"Media",
"NGOs",
"Retail",
"Technology",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "5b1a5b9e-4722-41fc-a15d-196a549e3ac5",
"value": "APT28"
},
{
"description": "[APT29](https://app.tidalcyber.com/groups/4c3e48b9-4426-4271-a7af-c3dfad79f447) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).<sup>[[White House Imposing Costs RU Gov April 2021](https://app.tidalcyber.com/references/c2bf9e2f-cd0a-411d-84bc-61454a369c6b)]</sup><sup>[[UK Gov Malign RIS Activity April 2021](https://app.tidalcyber.com/references/7fe5a605-c33e-4d3d-b787-2d1f649bee53)]</sup> They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://app.tidalcyber.com/groups/4c3e48b9-4426-4271-a7af-c3dfad79f447) reportedly compromised the Democratic National Committee starting in the summer of 2015.<sup>[[F-Secure The Dukes](https://app.tidalcyber.com/references/cc0dc623-ceb5-4ac6-bfbb-4f8514d45a27)]</sup><sup>[[GRIZZLY STEPPE JAR](https://app.tidalcyber.com/references/4b26d274-497f-49bc-a2a5-b93856a49893)]</sup><sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup><sup>[[UK Gov UK Exposes Russia SolarWinds April 2021](https://app.tidalcyber.com/references/ffbd83d7-9d4f-42b9-adc0-eb144045aef2)]</sup>\n\nIn April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://app.tidalcyber.com/campaigns/8bde8146-0656-5800-82e6-e24e008e4f4a) to the SVR; public statements included citations to [APT29](https://app.tidalcyber.com/groups/4c3e48b9-4426-4271-a7af-c3dfad79f447), Cozy Bear, and The Dukes.<sup>[[NSA Joint Advisory SVR SolarWinds April 2021](https://app.tidalcyber.com/references/43d9c469-1d54-454b-ba67-74e7f1de9c10)]</sup><sup>[[UK NSCS Russia SolarWinds April 2021](https://app.tidalcyber.com/references/f49e6780-8caa-4c3c-8d68-47a2cc4319a1)]</sup> Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.<sup>[[FireEye SUNBURST Backdoor December 2020](https://app.tidalcyber.com/references/d006ed03-a8af-4887-9356-3481d81d43e4)]</sup><sup>[[MSTIC NOBELIUM Mar 2021](https://app.tidalcyber.com/references/8688a0a9-d644-4b96-81bb-031f1f898652)]</sup><sup>[[CrowdStrike SUNSPOT Implant January 2021](https://app.tidalcyber.com/references/3a7b71cf-961a-4f63-84a8-31b43b18fb95)]</sup><sup>[[Volexity SolarWinds](https://app.tidalcyber.com/references/355cecf8-ef3e-4a6e-a652-3bf26fe46d88)]</sup><sup>[[Cybersecurity Advisory SVR TTP May 2021](https://app.tidalcyber.com/references/e18c1b56-f29d-4ea9-a425-a6af8ac6a347)]</sup><sup>[[Unit 42 SolarStorm December 2020](https://app.tidalcyber.com/references/ecbb602a-2427-5eba-8c2b-25d90c95f166)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0016",
"observed_countries": [
"AU",
"AT",
"AZ",
"BY",
"BE",
"BR",
"BG",
"CA",
"CN",
"CY",
"CZ",
"FR",
"GE",
"DE",
"HU",
"IN",
"IE",
"IL",
"JP",
"KZ",
"KR",
"KG",
"LV",
"LB",
"LT",
"LU",
"MX",
"ME",
"NL",
"NZ",
"NO",
"PL",
"PT",
"RO",
"RU",
"SK",
"SI",
"ES",
"TR",
"UG",
"UA",
"GB",
"US",
"UZ"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"af5e9be5-b86e-47af-91dd-966a5e34a186",
"08809fa0-61b6-4394-b103-1c4d19a5be16",
"4a457eb3-e404-47e5-b349-8b1f743dc657",
"15f2277a-a17e-4d85-8acd-480bf84f16b4",
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55",
"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a",
"c9c73000-30a5-4a16-8c8b-79169f9c24aa"
],
"target_categories": [
"Aerospace",
"Commercial",
"Defense",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Insurance",
"Legal",
"Manufacturing",
"Media",
"NGOs",
"Non Profit",
"Pharmaceuticals",
"Technology",
"Telecommunications",
"Think Tanks",
"Video Games"
]
},
"related": [],
"uuid": "4c3e48b9-4426-4271-a7af-c3dfad79f447",
"value": "APT29"
},
{
"description": "[APT3](https://app.tidalcyber.com/groups/9da726e6-af02-49b8-8ebe-7ea4235513c9) is a China-based threat group that researchers have attributed to China's Ministry of State Security.<sup>[[FireEye Clandestine Wolf](https://app.tidalcyber.com/references/dbb779c4-4d75-4fb4-ad3a-7d1f0f74e26f)]</sup><sup>[[Recorded Future APT3 May 2017](https://app.tidalcyber.com/references/a894d79f-5977-4ef9-9aa5-7bfec795ceb2)]</sup> This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.<sup>[[FireEye Clandestine Wolf](https://app.tidalcyber.com/references/dbb779c4-4d75-4fb4-ad3a-7d1f0f74e26f)]</sup><sup>[[FireEye Operation Double Tap](https://app.tidalcyber.com/references/4b9af128-98da-48b6-95c7-8d27979c2ab1)]</sup> As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.<sup>[[Symantec Buckeye](https://app.tidalcyber.com/references/dbf3ce3e-bcf2-4e47-ad42-839e51967395)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0022",
"observed_countries": [
"BE",
"HK",
"IT",
"LU",
"PH",
"SE",
"GB",
"US",
"VN"
],
"source": "MITRE"
},
"related": [],
"uuid": "9da726e6-af02-49b8-8ebe-7ea4235513c9",
"value": "APT3"
},
{
"description": "[APT30](https://app.tidalcyber.com/groups/be45ff95-6c74-4000-bc39-63044673d82f) is a threat group suspected to be associated with the Chinese government. While [Naikon](https://app.tidalcyber.com/groups/a80c00b2-b8b6-4780-99bb-df8fe921947d) shares some characteristics with [APT30](https://app.tidalcyber.com/groups/be45ff95-6c74-4000-bc39-63044673d82f), the two groups do not appear to be exact matches.<sup>[[FireEye APT30](https://app.tidalcyber.com/references/c48d2084-61cf-4e86-8072-01e5d2de8416)]</sup><sup>[[Baumgartner Golovkin Naikon 2015](https://app.tidalcyber.com/references/5163576f-0b2c-49ba-8f34-b7efe3f3f6db)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0013",
"observed_countries": [
"BT",
"BN",
"KH",
"IN",
"ID",
"JP",
"KR",
"LA",
"MY",
"MM",
"NP",
"PH",
"SA",
"SG",
"TH",
"US",
"VN"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government",
"Media"
]
},
"related": [],
"uuid": "be45ff95-6c74-4000-bc39-63044673d82f",
"value": "APT30"
},
{
"description": "[APT32](https://app.tidalcyber.com/groups/c0fe9859-e8de-4ce1-bc3c-b489e914a145) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.<sup>[[FireEye APT32 May 2017](https://app.tidalcyber.com/references/b72d017b-a70f-4003-b3d9-90d79aca812d)]</sup><sup>[[Volexity OceanLotus Nov 2017](https://app.tidalcyber.com/references/ed9f5545-377f-4a12-92e4-c0439cc5b037)]</sup><sup>[[ESET OceanLotus](https://app.tidalcyber.com/references/a7bcbaca-10c1-403a-9eb5-f111af1cbf6a)]</sup>",
"meta": {
"country": "VN",
"group_attack_id": "G0050",
"observed_countries": [
"KH",
"CN",
"DE",
"LA",
"PH",
"US",
"VN"
],
"source": "MITRE",
"tags": [
"115113f0-5876-4aa5-b731-5ad46f60c069"
],
"target_categories": [
"Automotive",
"Energy",
"Entertainment",
"Financial Services",
"Government",
"Hospitality Leisure",
"Insurance",
"Manufacturing",
"Media",
"NGOs",
"Non Profit",
"Retail",
"Technology"
]
},
"related": [],
"uuid": "c0fe9859-e8de-4ce1-bc3c-b489e914a145",
"value": "APT32"
},
{
"description": "[APT33](https://app.tidalcyber.com/groups/99bbbe25-45af-492f-a7ff-7cbc57828bac) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.<sup>[[FireEye APT33 Sept 2017](https://app.tidalcyber.com/references/70610469-db0d-45ab-a790-6e56309a39ec)]</sup><sup>[[FireEye APT33 Webinar Sept 2017](https://app.tidalcyber.com/references/9b378592-5737-403d-8a07-27077f5b2d61)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0064",
"observed_countries": [
"IR",
"IQ",
"IL",
"KR",
"SA",
"AE",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"cb5803f0-8ab4-4ada-8540-7758dfc126e2",
"0f1b7cb0-c4de-485e-8ff5-fe12ffccd738",
"dd24557e-a8e8-4202-872d-c2f411974cad",
"c9c73000-30a5-4a16-8c8b-79169f9c24aa",
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"
],
"target_categories": [
"Aerospace",
"Defense",
"Education",
"Energy",
"Government",
"Pharmaceuticals",
"Telecommunications"
]
},
"related": [],
"uuid": "99bbbe25-45af-492f-a7ff-7cbc57828bac",
"value": "APT33"
},
{
"description": "[APT37](https://app.tidalcyber.com/groups/013fdfdc-aa32-4779-8f6e-7920615cbf66) is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. [APT37](https://app.tidalcyber.com/groups/013fdfdc-aa32-4779-8f6e-7920615cbf66) has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.<sup>[[FireEye APT37 Feb 2018](https://app.tidalcyber.com/references/4d575c1a-4ff9-49ce-97cd-f9d0637c2271)]</sup><sup>[[Securelist ScarCruft Jun 2016](https://app.tidalcyber.com/references/04961952-9bac-48f3-adc7-40a3a2bcee84)]</sup><sup>[[Talos Group123](https://app.tidalcyber.com/references/bf8b2bf0-cca3-437b-a640-715f9cc945f7)]</sup>\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08) instead of tracking clusters or subgroups.",
"meta": {
"country": "KP",
"group_attack_id": "G0067",
"observed_countries": [
"CN",
"IN",
"JP",
"KR",
"KW",
"NP",
"RO",
"RU",
"VN"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Automotive",
"Education",
"Financial Services",
"Government",
"Healthcare",
"Human Rights",
"Manufacturing",
"Media",
"NGOs",
"Technology"
]
},
"related": [],
"uuid": "013fdfdc-aa32-4779-8f6e-7920615cbf66",
"value": "APT37"
},
{
"description": "[APT38](https://app.tidalcyber.com/groups/dfbce236-735c-436d-b433-933bd6eae17b) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.<sup>[[CISA AA20-239A BeagleBoyz August 2020](https://app.tidalcyber.com/references/a8a2e3f2-3967-4e82-a36a-2436c654fb3f)]</sup> Active since at least 2014, [APT38](https://app.tidalcyber.com/groups/dfbce236-735c-436d-b433-933bd6eae17b) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://app.tidalcyber.com/groups/dfbce236-735c-436d-b433-933bd6eae17b) stole $81 million, as well as attacks against Bancomext <sup>[[FireEye APT38 Oct 2018](https://app.tidalcyber.com/references/7c916329-af56-4723-820c-ef932a6e3409)]</sup> and Banco de Chile <sup>[[FireEye APT38 Oct 2018](https://app.tidalcyber.com/references/7c916329-af56-4723-820c-ef932a6e3409)]</sup>; some of their attacks have been destructive.<sup>[[CISA AA20-239A BeagleBoyz August 2020](https://app.tidalcyber.com/references/a8a2e3f2-3967-4e82-a36a-2436c654fb3f)]</sup><sup>[[FireEye APT38 Oct 2018](https://app.tidalcyber.com/references/7c916329-af56-4723-820c-ef932a6e3409)]</sup><sup>[[DOJ North Korea Indictment Feb 2021](https://app.tidalcyber.com/references/d702653f-a9da-4a36-8f84-97caeb445266)]</sup><sup>[[Kaspersky Lazarus Under The Hood Blog 2017](https://app.tidalcyber.com/references/a1e1ab6a-8db0-4593-95ec-78784607dfa0)]</sup>\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08) instead of tracking clusters or subgroups.",
"meta": {
"country": "KP",
"group_attack_id": "G0082",
"observed_countries": [
"AR",
"BD",
"BA",
"BR",
"BG",
"CL",
"CR",
"EC",
"GH",
"IN",
"ID",
"JP",
"JO",
"KE",
"KR",
"KW",
"MY",
"MT",
"MX",
"MZ",
"NP",
"NI",
"NG",
"PK",
"PA",
"PE",
"PH",
"PL",
"RU",
"SG",
"ZA",
"ES",
"TW",
"TZ",
"TG",
"TR",
"UG",
"US",
"UY",
"VN",
"ZM"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Banks",
"Casinos Gambling",
"Credit Unions",
"Financial Services",
"Government",
"Hospitality Leisure",
"Media"
]
},
"related": [],
"uuid": "dfbce236-735c-436d-b433-933bd6eae17b",
"value": "APT38"
},
{
"description": "[APT39](https://app.tidalcyber.com/groups/a57b52c7-9f64-4ffe-a7c3-0de738fb2af1) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://app.tidalcyber.com/groups/a57b52c7-9f64-4ffe-a7c3-0de738fb2af1) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.<sup>[[FireEye APT39 Jan 2019](https://app.tidalcyber.com/references/ba366cfc-cc04-41a5-903b-a7bb73136bc3)]</sup><sup>[[Symantec Chafer Dec 2015](https://app.tidalcyber.com/references/0a6166a3-5649-4117-97f4-7b8b5b559929)]</sup><sup>[[FBI FLASH APT39 September 2020](https://app.tidalcyber.com/references/76869199-e9fa-41b4-b045-41015e6daaec)]</sup><sup>[[Dept. of Treasury Iran Sanctions September 2020](https://app.tidalcyber.com/references/0c8ff80a-6b1d-4212-aa40-99aeef04ce05)]</sup><sup>[[DOJ Iran Indictments September 2020](https://app.tidalcyber.com/references/f30a77dd-d1d0-41b8-b82a-461dd6cd126f)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0087",
"observed_countries": [
"IL",
"JO",
"KW",
"SA",
"ES",
"TR",
"AE",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Education",
"Hospitality Leisure",
"Telecommunications",
"Travel Services"
]
},
"related": [],
"uuid": "a57b52c7-9f64-4ffe-a7c3-0de738fb2af1",
"value": "APT39"
},
{
"description": "[APT41](https://app.tidalcyber.com/groups/502223ee-8947-42f8-a532-a3b3da12b7d9) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://app.tidalcyber.com/groups/502223ee-8947-42f8-a532-a3b3da12b7d9) has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries. [APT41](https://app.tidalcyber.com/groups/502223ee-8947-42f8-a532-a3b3da12b7d9) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://app.tidalcyber.com/groups/6932662a-53a7-4e43-877f-6e940e2d744b).<sup>[[FireEye APT41 Aug 2019](https://app.tidalcyber.com/references/20f8e252-0a95-4ebd-857c-d05b0cde0904)]</sup><sup>[[Group IB APT 41 June 2021](https://app.tidalcyber.com/references/a2bf43a0-c7da-4cb9-8f9a-b34fac92b625)]</sup>\n",
"meta": {
"country": "CN",
"group_attack_id": "G0096",
"observed_countries": [
"AU",
"BH",
"BR",
"CA",
"CL",
"DK",
"FI",
"FR",
"GE",
"HK",
"IN",
"ID",
"IT",
"JP",
"KR",
"MY",
"MX",
"MM",
"NL",
"PK",
"PH",
"PL",
"QA",
"SA",
"SG",
"ZA",
"ES",
"SE",
"CH",
"TW",
"TH",
"TR",
"AE",
"GB",
"US",
"VN"
],
"observed_motivations": [
"Cyber Espionage",
"Financial Gain"
],
"source": "MITRE",
"tags": [
"fe28cf32-a15c-44cf-892c-faa0360d6109",
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55",
"a98d7a43-f227-478e-81de-e7299639a355"
],
"target_categories": [
"Aerospace",
"Automotive",
"Education",
"Energy",
"Entertainment",
"Financial Services",
"Healthcare",
"High Tech",
"Media",
"Pharmaceuticals",
"Retail",
"Technology",
"Telecommunications",
"Transportation",
"Travel Services",
"Video Games"
]
},
"related": [],
"uuid": "502223ee-8947-42f8-a532-a3b3da12b7d9",
"value": "APT41"
},
{
"description": "APT42 is an Iranian state-sponsored espionage group believed to operate on behalf of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization (IRGC-IO). APT42 primarily focuses on collecting information on and surveilling its targets, mainly individuals and organizations with strategic significance to Iran's government. The group's operations are characterized by targeted spear-phishing attacks and surveillance activity. Mandiant researchers acknowledged overlaps between APT42 and APT35, which both likely operate on behalf of the IRGC, but noted that the groups display \"substantial differences\" in targeting patterns and TTPs.<sup>[[Mandiant Crooked Charms August 12 2022](/references/53bab956-be5b-4d8d-b553-9926bc5d9fee)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G3050",
"observed_countries": [
"AU",
"BG",
"DE",
"IR",
"IL",
"IT",
"MY",
"NO",
"UA",
"AE",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"15f2277a-a17e-4d85-8acd-480bf84f16b4",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Defense",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Human Rights",
"Legal",
"Manufacturing",
"Media",
"NGOs",
"Pharmaceuticals"
]
},
"related": [],
"uuid": "ce126445-6984-45bb-9737-35448f06f27b",
"value": "APT42"
},
{
"description": "[APT5](https://app.tidalcyber.com/groups/f46d6ee9-9d1d-586a-9f2d-6bff8fb92910) is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. [APT5](https://app.tidalcyber.com/groups/f46d6ee9-9d1d-586a-9f2d-6bff8fb92910) has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.<sup>[[NSA APT5 Citrix Threat Hunting December 2022](https://app.tidalcyber.com/references/916e2137-46e6-53c2-a917-5b5b5c4bae3a)]</sup><sup>[[Microsoft East Asia Threats September 2023](https://app.tidalcyber.com/references/31f2c61e-cefe-5df7-9c2b-780bf03c88ec)]</sup><sup>[[Mandiant Pulse Secure Zero-Day April 2021](https://app.tidalcyber.com/references/0760480c-97be-5fc9-a6aa-f1df91a314a3)]</sup><sup>[[Mandiant Pulse Secure Update May 2021](https://app.tidalcyber.com/references/5620adaf-c2a7-5f0f-ae70-554ce720426e)]</sup><sup>[[FireEye Southeast Asia Threat Landscape March 2015](https://app.tidalcyber.com/references/59658f8b-af24-5df5-8f7d-cb6b9cf7579e)]</sup><sup>[[Mandiant Advanced Persistent Threats](https://app.tidalcyber.com/references/2d16615b-09fc-5925-8f59-6d20f334d236)]</sup> ",
"meta": {
"group_attack_id": "G1023",
"source": "MITRE"
},
"related": [],
"uuid": "f46d6ee9-9d1d-586a-9f2d-6bff8fb92910",
"value": "APT5"
},
{
"description": "[APT-C-23](https://app.tidalcyber.com/groups/e3c5164e-49cf-5bb1-955d-6775585abb14) is a threat group that has been active since at least 2014.<sup>[[symantec_mantis](https://app.tidalcyber.com/references/76a792b5-f3cd-566e-a87b-9fae844ce07d)]</sup> [APT-C-23](https://app.tidalcyber.com/groups/e3c5164e-49cf-5bb1-955d-6775585abb14) has primarily focused its operations on the Middle East, including Israeli military assets. [APT-C-23](https://app.tidalcyber.com/groups/e3c5164e-49cf-5bb1-955d-6775585abb14) has developed mobile spyware targeting Android and iOS devices since 2017.<sup>[[welivesecurity_apt-c-23](https://app.tidalcyber.com/references/7196226e-7d0d-5e14-a4e3-9b6322537039)]</sup>",
"meta": {
"group_attack_id": "G1028",
"observed_countries": [
"DZ",
"BH",
"IL",
"PS",
"TR"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Education",
"Government",
"Media",
"NGOs"
]
},
"related": [],
"uuid": "e3c5164e-49cf-5bb1-955d-6775585abb14",
"value": "APT-C-23"
},
{
"description": "[APT-C-36](https://app.tidalcyber.com/groups/153c14a6-31b7-44f2-892e-6d9fdc152267) is a suspected South America espionage group that has been active since at least 2018. The group mainly targets Colombian government institutions as well as important corporations in the financial sector, petroleum industry, and professional manufacturing.<sup>[[QiAnXin APT-C-36 Feb2019](https://app.tidalcyber.com/references/cae075ea-42cb-4695-ac66-9187241393d1)]</sup>",
"meta": {
"group_attack_id": "G0099",
"observed_countries": [
"CO"
],
"source": "MITRE",
"target_categories": [
"Banks",
"Energy",
"Financial Services",
"Government",
"Manufacturing"
]
},
"related": [],
"uuid": "153c14a6-31b7-44f2-892e-6d9fdc152267",
"value": "APT-C-36"
},
{
"description": "[Aquatic Panda](https://app.tidalcyber.com/groups/b8a349a6-cde1-4d95-b20f-44c62bbfc786) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://app.tidalcyber.com/groups/b8a349a6-cde1-4d95-b20f-44c62bbfc786) has primarily targeted entities in the telecommunications, technology, and government sectors.<sup>[[CrowdStrike AQUATIC PANDA December 2021](https://app.tidalcyber.com/references/fd095ef2-6fc2-4f6f-9e4f-037b2a9217d2)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0143",
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "b8a349a6-cde1-4d95-b20f-44c62bbfc786",
"value": "Aquatic Panda"
},
{
"description": "[Axiom](https://app.tidalcyber.com/groups/90f4d3f9-3fe3-4a64-8dc1-172c6d037dca) is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between [Axiom](https://app.tidalcyber.com/groups/90f4d3f9-3fe3-4a64-8dc1-172c6d037dca) and [Winnti Group](https://app.tidalcyber.com/groups/6932662a-53a7-4e43-877f-6e940e2d744b) but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.<sup>[[Kaspersky Winnti April 2013](https://app.tidalcyber.com/references/2d4834b9-61c4-478e-919a-317d97cd2c36)]</sup><sup>[[Kaspersky Winnti June 2015](https://app.tidalcyber.com/references/86504950-0f4f-42bc-b003-24f60ae97c99)]</sup><sup>[[Novetta Winnti April 2015](https://app.tidalcyber.com/references/cbe8373b-f14b-4890-99fd-35ffd7090dea)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0001",
"observed_countries": [
"JP",
"KR",
"TW",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Defense",
"Energy",
"Government",
"Manufacturing",
"Non Profit",
"Pharmaceuticals",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "90f4d3f9-3fe3-4a64-8dc1-172c6d037dca",
"value": "Axiom"
},
{
"description": "[BackdoorDiplomacy](https://app.tidalcyber.com/groups/e5b0da2b-12bc-4113-9459-9c51329c9ae0) is a cyber espionage threat group that has been active since at least 2017. [BackdoorDiplomacy](https://app.tidalcyber.com/groups/e5b0da2b-12bc-4113-9459-9c51329c9ae0) has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.<sup>[[ESET BackdoorDiplomacy Jun 2021](https://app.tidalcyber.com/references/127d4b10-8d61-4bdf-b5b9-7d86bbc065b6)]</sup>",
"meta": {
"group_attack_id": "G0135",
"observed_countries": [
"AL",
"AT",
"HR",
"GE",
"DE",
"GH",
"IN",
"LY",
"NA",
"NG",
"PL",
"QA",
"SA",
"ZA",
"AE",
"GB",
"UZ"
],
"source": "MITRE",
"target_categories": [
"Government",
"Non Profit",
"Telecommunications"
]
},
"related": [],
"uuid": "e5b0da2b-12bc-4113-9459-9c51329c9ae0",
"value": "BackdoorDiplomacy"
},
{
"description": "BianLian is an extortion-focused threat actor group. The group originally used double-extortion methods when it began its operations in June 2022, demanding payment in exchange for decrypting locked files while also threatening to leak exfiltrated data. U.S. & Australian cybersecurity officials observed BianLian actors shifting almost exclusively to exfiltration-focused extortion schemes in 2023.<sup>[[U.S. CISA BianLian Ransomware May 2023](/references/aa52e826-f292-41f6-985d-0282230c8948)]</sup>\n\n**Related Vulnerabilities**: CVE-2020-1472<sup>[[U.S. CISA BianLian Ransomware May 2023](/references/aa52e826-f292-41f6-985d-0282230c8948)]</sup>, CVE-2021-34473<sup>[[BianLian Ransomware Gang Gives It a Go! | [redacted]](/references/fc1aa979-7dbc-4fff-a8d1-b35a3b2bec3d)]</sup>, CVE-2021-34523<sup>[[BianLian Ransomware Gang Gives It a Go! | [redacted]](/references/fc1aa979-7dbc-4fff-a8d1-b35a3b2bec3d)]</sup>, CVE-2021-31207<sup>[[BianLian Ransomware Gang Gives It a Go! | [redacted]](/references/fc1aa979-7dbc-4fff-a8d1-b35a3b2bec3d)]</sup>\n\n**PulseDive (IOCs)**: https://pulsedive.com/threat/BianLian",
"meta": {
"group_attack_id": "G3002",
"observed_countries": [
"AU",
"CA",
"FR",
"DE",
"IN",
"ES",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"64d3f7d8-30b7-4b03-bee2-a6029672216c",
"3ed2343c-a29c-42e2-8259-410381164c6a",
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"35e694ec-5133-46e3-b7e1-5831867c3b55",
"15787198-6c8b-4f79-bf50-258d55072fee",
"d713747c-2d53-487e-9dac-259230f04460",
"964c2590-4b52-48c6-afff-9a6d72e68908",
"fde4c246-7d2d-4d53-938b-44651cf273f1",
"2743d495-7728-4a75-9e5f-b64854039792",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Automotive",
"Casinos Gambling",
"Construction",
"Education",
"Financial Services",
"Government",
"Healthcare",
"Legal",
"Manufacturing",
"Media",
"Mining",
"Retail",
"Technology"
]
},
"related": [],
"uuid": "a2add2a0-2b54-4623-a380-a9ad91f1f2dd",
"value": "BianLian Ransomware Group"
},
{
"description": "[BITTER](https://app.tidalcyber.com/groups/3a02aa1b-851a-43e1-b83b-58037f3c7025) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://app.tidalcyber.com/groups/3a02aa1b-851a-43e1-b83b-58037f3c7025) has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.<sup>[[Cisco Talos Bitter Bangladesh May 2022](https://app.tidalcyber.com/references/097583ed-03b0-41cd-bf85-66d473f46439)]</sup><sup>[[Forcepoint BITTER Pakistan Oct 2016](https://app.tidalcyber.com/references/9fc54fb0-b7d9-49dc-b6dd-ab4cb2cd34fa)]</sup>",
"meta": {
"group_attack_id": "G1002",
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE"
},
"related": [],
"uuid": "3a02aa1b-851a-43e1-b83b-58037f3c7025",
"value": "BITTER"
},
{
"description": "Bl00dy self-identifies as a ransomware group. It gained attention in May 2023 for a series of data exfiltration and encryption attacks against education entities in the United States that featured exploit of vulnerabilities in PaperCut print management software, which is prevalent in the sector.<sup>[[U.S. CISA PaperCut May 2023](/references/b5ef2b97-7cc7-470b-ae97-a45dc4af32a6)]</sup>\n\n**Related Vulnerabilities**: CVE-2023-27350<sup>[[U.S. CISA PaperCut May 2023](/references/b5ef2b97-7cc7-470b-ae97-a45dc4af32a6)]</sup>",
"meta": {
"group_attack_id": "G3010",
"observed_countries": [
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"fdd53e62-5bf1-41f1-8bd6-b970a866c39d",
"d431939f-2dc0-410b-83f7-86c458125444",
"1b5da77a-bf84-4fba-a6d7-8b3b8f7699e0",
"15787198-6c8b-4f79-bf50-258d55072fee",
"a98d7a43-f227-478e-81de-e7299639a355",
"992bdd33-4a47-495d-883a-58010a2f0efb",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Education",
"Healthcare",
"High Tech",
"Manufacturing",
"Technology"
]
},
"related": [],
"uuid": "393da13e-016c-41a3-9d89-b33173adecbf",
"value": "Bl00dy Ransomware Gang"
},
{
"description": "This Group object reflects the tools & TTPs associated with threat actors known to deploy Black Basta, a ransomware-as-a-service (RaaS) variant that researchers believe has been used since at least April 2022. Black Basta affiliates have attacked a very wide range of targets, including organizations in at least 12 out of 16 U.S. critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector.<sup>[[U.S. CISA Black Basta May 10 2024](/references/10fed6c7-4d73-49cd-9170-3f67d06365ca)]</sup>\n\nSpecific pre- and post-exploit behaviors may vary among intrusions carried out by different Black Basta affiliates. TTPs associated with the Black Basta ransomware binary itself can be found in the separate dedicated Software object.",
"meta": {
"group_attack_id": "G3037",
"observed_countries": [
"AU",
"AT",
"CA",
"DE",
"IT",
"CH",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"d903e38b-600d-4736-9e3b-cf1a6e436481",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"d819ae1a-e385-49fd-88d5-f66660729ecb",
"15787198-6c8b-4f79-bf50-258d55072fee",
"c40971d6-ad75-4b2d-be6c-5353c96a232d",
"3adcb409-166d-4465-ba1f-ddaecaff8282",
"dea4388a-b1f2-4f2a-9df9-108631d0d078",
"2743d495-7728-4a75-9e5f-b64854039792",
"d431939f-2dc0-410b-83f7-86c458125444",
"fdd53e62-5bf1-41f1-8bd6-b970a866c39d",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"562e535e-19f5-4d6c-81ed-ce2aec544f09"
],
"target_categories": [
"Construction",
"Financial Services",
"Healthcare",
"Legal",
"Manufacturing",
"Retail",
"Technology",
"Transportation"
]
},
"related": [],
"uuid": "7f52cadb-7a12-4b9d-9290-1ef02123fbe4",
"value": "Black Basta Affiliates"
},
{
"description": "This object represents the BlackCat/ALPHV Ransomware-as-a-Service (“RaaS”) apex group and the behaviors associated with its various affiliate ransomware operators. Specific affiliate operations defined by the research community will be tracked as separate objects.\n\nResearchers first observed BlackCat ransomware (AKA ALPHV or Noberus) in November 2021. An April 2022 U.S. FBI advisory linked BlackCat’s developers and money launderers to the defunct Blackmatter and Darkside ransomware operations (the latter was responsible for the major 2021 Colonial Pipeline incident).<sup>[[FBI BlackCat April 19 2022](/references/2640b58c-8413-4691-80e1-33aec9b6c7f6)]</sup> As of September 2023, BlackCat is believed to be responsible for attacking organizations globally and in virtually every major sector, and it consistently claims some of the highest victim tallies of any RaaS. According to data collected by the [ransomwatch project](https://github.com/joshhighet/ransomwatch) and analyzed by Tidal, BlackCat actors publicly claimed 233 victims in 2022, the third most of any ransomware operation in the dataset (considerably below Clop (558) but well above Hive (181)), and it already surpassed that number by July of 2023.<sup>[[GitHub ransomwatch](/references/62037959-58e4-475a-bb91-ff360d20c1d7)]</sup> Like many RaaS, BlackCat actors threaten to leak exfiltrated victim data, but they also threaten to carry out denial of service attacks if victims do not pay timely ransoms.<sup>[[BlackBerry BlackCat Threat Overview](/references/59f98ae1-c62d-460f-8d2a-9ae287b59953)]</sup>\n\nBlackCat developers have regularly evolved the namesake ransomware over time, and collaboration with affiliates means that a large number and variety of tools & TTPs are observed during intrusions involving BlackCat. BlackCat became the first prominent ransomware family to transition to the Rust programming language in 2022, which researchers assess provides greater customization and defense evasion capabilities and faster performance.<sup>[[X-Force BlackCat May 30 2023](/references/b80c1f70-9d05-4f4b-bdc2-6157c6837202)]</sup><sup>[[FBI BlackCat April 19 2022](/references/2640b58c-8413-4691-80e1-33aec9b6c7f6)]</sup> A BlackCat variant named Sphynx emerged in early 2023, featuring multiple defense evasion-focused enhancements. In Q3 2023, public reports suggested that Scattered Spider (AKA 0ktapus or UNC3944), a group attributed to several prominent intrusions involving telecommunications, technology, and casino entities, had begun to use BlackCat/Sphynx ransomware during its operations.<sup>[[Caesars Scattered Spider September 13 2023](/references/6915c003-7c8b-451c-8fb1-3541f00c14fb)]</sup><sup>[[BushidoToken Scattered Spider August 16 2023](/references/621a8320-0e3c-444f-b82a-7fd4fdf9fb67)]</sup>",
"meta": {
"group_attack_id": "G3019",
"observed_countries": [
"AU",
"AT",
"BO",
"BR",
"CA",
"CL",
"CN",
"CO",
"CZ",
"EC",
"EG",
"FR",
"DE",
"GR",
"HK",
"HU",
"IN",
"ID",
"IE",
"IL",
"IT",
"JM",
"JP",
"KE",
"LU",
"MY",
"MX",
"NL",
"NG",
"PA",
"PH",
"RO",
"SA",
"ES",
"CH",
"TH",
"TN",
"TR",
"AE",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c475ad68-3fdc-4725-8abc-784c56125e96",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"e499005b-adba-45bb-85e3-07043fd9edf9",
"8b1cb0dc-dd3e-44ba-828c-55c040e93b93",
"5f5e40cd-0732-4eb4-a083-06940623c3f9",
"915e7ac2-b266-45d7-945c-cb04327d6246",
"1dc8fd1e-0737-405a-98a1-111dd557f1b5",
"15787198-6c8b-4f79-bf50-258d55072fee",
"7140a6ea-2c03-4028-9da9-21d6157fdb13",
"963e4802-3d3f-4e4b-b258-0b36020997b9",
"a58fbc12-8068-4eba-89f0-64c9d5a7aaf8",
"b0098999-7465-42a0-ac7d-a55001c4e79f",
"33d22eff-59a1-47e0-b9eb-615dee314595",
"fe3eb26d-6daa-4f82-b0dd-fc1e2fffbc2b",
"e401022a-36ac-486d-8503-dd531410a927",
"c8ce7130-e134-492c-a98a-ed1d25b57e4c",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Automotive",
"Banks",
"Casinos Gambling",
"Construction",
"Education",
"Electronics",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Hospitality Leisure",
"Insurance",
"Legal",
"Manufacturing",
"Media",
"Pharmaceuticals",
"Retail",
"Technology",
"Telecommunications",
"Transportation"
]
},
"related": [],
"uuid": "33159d02-a1ce-49ec-a381-60b069db66f7",
"value": "BlackCat Ransomware Actors & Affiliates"
},
{
"description": "[BlackOasis](https://app.tidalcyber.com/groups/428dc121-a593-4981-9127-f958ae0a0fdd) is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. <sup>[[Securelist BlackOasis Oct 2017](https://app.tidalcyber.com/references/66121c37-6b66-4ab2-9f63-1adb80dcec62)]</sup> <sup>[[Securelist APT Trends Q2 2017](https://app.tidalcyber.com/references/fe28042c-d289-463f-9ece-1a75a70b966e)]</sup> A group known by Microsoft as [NEODYMIUM](https://app.tidalcyber.com/groups/3a660ef3-9954-4252-8946-f903f3f42d0c) is reportedly associated closely with [BlackOasis](https://app.tidalcyber.com/groups/428dc121-a593-4981-9127-f958ae0a0fdd) operations, but evidence that the group names are aliases has not been identified. <sup>[[CyberScoop BlackOasis Oct 2017](https://app.tidalcyber.com/references/a8224ad5-4688-4382-a3e7-1dd3ed74ebce)]</sup>",
"meta": {
"group_attack_id": "G0063",
"observed_countries": [
"AF",
"AO",
"BH",
"IR",
"IQ",
"JO",
"LY",
"NL",
"NG",
"RU",
"SA",
"TN",
"GB"
],
"source": "MITRE"
},
"related": [],
"uuid": "428dc121-a593-4981-9127-f958ae0a0fdd",
"value": "BlackOasis"
},
{
"description": "This object reflects the ATT&CK Techniques associated with threat actors who deploy BlackSuit, a ransomware capable of running on Windows and Linux systems. BlackSuit is believed to be a successor to Royal, a ransomware operation which itself derives from the notorious Russia-based Conti gang. BlackSuit operations were first observed in May 2023, and although they were relatively low in number, U.S. authorities issued a warning for healthcare sector organizations due to the ransomware's suspected pedigree.<sup>[[HC3 Analyst Note BlackSuit Ransomware November 2023](/references/d956f0c6-d90e-49e8-a64c-a46bfc177cc6)]</sup> The number of attacks claimed by BlackSuit operators increased notably in Q2 2024.<sup>[[GitHub ransomwatch](/references/62037959-58e4-475a-bb91-ff360d20c1d7)]</sup>\n\nATT&CK Techniques associated with the BlackSuit ransomware binary are tracked in a separate \"BlackSuit Ransomware\" Software object.",
"meta": {
"group_attack_id": "G3047",
"observed_countries": [
"AU",
"BR",
"CA",
"CN",
"DE",
"IL",
"IT",
"JM",
"JP",
"KR",
"NL",
"NG",
"ZA",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"a2e000da-8181-4327-bacd-32013dbd3654",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Automotive",
"Construction",
"Education",
"Financial Services",
"Government",
"Healthcare",
"Hospitality Leisure",
"Mining",
"Non Profit",
"Pharmaceuticals",
"Technology",
"Telecommunications",
"Transportation"
]
},
"related": [],
"uuid": "1d751794-ce94-4936-bf45-4ab86d0e3b6e",
"value": "BlackSuit Ransomware Actors"
},
{
"description": "[BlackTech](https://app.tidalcyber.com/groups/528ab2ea-b8f1-44d8-8831-2a89fefd97cb) is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. [BlackTech](https://app.tidalcyber.com/groups/528ab2ea-b8f1-44d8-8831-2a89fefd97cb) has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.<sup>[[TrendMicro BlackTech June 2017](https://app.tidalcyber.com/references/abb9cb19-d30e-4048-b106-eb29a6dad7fc)]</sup><sup>[[Symantec Palmerworm Sep 2020](https://app.tidalcyber.com/references/84ecd475-8d3f-4e7c-afa8-2dff6078bed5)]</sup><sup>[[Reuters Taiwan BlackTech August 2020](https://app.tidalcyber.com/references/77293f88-e336-4786-b042-7f0080bbff32)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0098",
"observed_countries": [
"CN",
"HK",
"JP",
"TW",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"b20e7912-6a8d-46e3-8e13-9a3fc4813852"
],
"target_categories": [
"Construction",
"Defense",
"Electronics",
"Financial Services",
"Government",
"Media",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "528ab2ea-b8f1-44d8-8831-2a89fefd97cb",
"value": "BlackTech"
},
{
"description": "[Blue Mockingbird](https://app.tidalcyber.com/groups/b82c6ed1-c74a-4128-8b4d-18d1e17e1134) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.<sup>[[RedCanary Mockingbird May 2020](https://app.tidalcyber.com/references/596bfbb3-72e0-4d4c-a1a9-b8d54455ffd0)]</sup>",
"meta": {
"group_attack_id": "G0108",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE"
},
"related": [],
"uuid": "b82c6ed1-c74a-4128-8b4d-18d1e17e1134",
"value": "Blue Mockingbird"
},
{
"description": "[BRONZE BUTLER](https://app.tidalcyber.com/groups/5825a840-5577-4ffc-a08d-3f48d64395cb) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.<sup>[[Trend Micro Daserf Nov 2017](https://app.tidalcyber.com/references/4ca0e6a9-8c20-49a0-957a-7108083a8a29)]</sup><sup>[[Secureworks BRONZE BUTLER Oct 2017](https://app.tidalcyber.com/references/c62d8d1a-cd1b-4b39-95b6-68f3f063dacf)]</sup><sup>[[Trend Micro Tick November 2019](https://app.tidalcyber.com/references/93adbf0d-5f5e-498e-aca1-ed3eb11561e7)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0060",
"observed_countries": [
"CN",
"HK",
"JP",
"KR",
"RU",
"SG",
"TW",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Chemical",
"Defense",
"Electronics",
"Government",
"Manufacturing"
]
},
"related": [],
"uuid": "5825a840-5577-4ffc-a08d-3f48d64395cb",
"value": "BRONZE BUTLER"
},
{
"description": "This Group object reflects the tools & TTPs observed in use by threat actors known to deploy CACTUS, a ransomware that researchers believe has been used since at least March 2023.<sup>[[Kroll CACTUS Ransomware May 10 2023](/references/f50de2f6-465f-4cae-a79c-cc135ebfee4f)]</sup> Specific pre- and post-exploit behaviors may vary among intrusions carried out by distinct actors or actor clusters. TTPs associated with the CACTUS ransomware binary itself can be found in the separate dedicated Software object.",
"meta": {
"group_attack_id": "G3030",
"observed_countries": [
"AU",
"BE",
"CA",
"DK",
"FR",
"DE",
"IT",
"MX",
"RO",
"ES",
"SE",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"0bcc4824-7e68-4aac-b883-935e62b5be39",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"3b615816-3403-46a4-bd7e-f7a723fc56da",
"a2e000da-8181-4327-bacd-32013dbd3654",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Automotive",
"Construction",
"Healthcare",
"Hospitality Leisure",
"Media",
"Mining",
"Retail",
"Technology"
]
},
"related": [],
"uuid": "fac6fbf1-935f-4106-ad8b-c8fd8389dd38",
"value": "CACTUS Ransomware Actors"
},
{
"description": "[Carbanak](https://app.tidalcyber.com/groups/72d9bea7-9ca1-43e6-8702-2fb7fb1355de) is a cybercriminal group that has used [Carbanak](https://app.tidalcyber.com/software/4cb9294b-9e4c-41b9-b640-46213a01952d) malware to target financial institutions since at least 2013. [Carbanak](https://app.tidalcyber.com/groups/72d9bea7-9ca1-43e6-8702-2fb7fb1355de) may be linked to groups tracked separately as [Cobalt Group](https://app.tidalcyber.com/groups/58db02e6-d908-47c2-bc82-ed58ada61331) and [FIN7](https://app.tidalcyber.com/groups/4348c510-50fc-4448-ab8d-c8cededd19ff) that have also used [Carbanak](https://app.tidalcyber.com/software/4cb9294b-9e4c-41b9-b640-46213a01952d) malware.<sup>[[Kaspersky Carbanak](https://app.tidalcyber.com/references/2f7e77db-fe39-4004-9945-3c8943708494)]</sup><sup>[[FireEye FIN7 April 2017](https://app.tidalcyber.com/references/6ee27fdb-1753-4fdf-af72-3295b072ff10)]</sup><sup>[[Europol Cobalt Mar 2018](https://app.tidalcyber.com/references/f9d1f2ab-9e75-48ce-bcdf-b7119687feef)]</sup><sup>[[Secureworks GOLD NIAGARA Threat Profile](https://app.tidalcyber.com/references/b11276cb-f6dd-4e91-90cd-9c287fb3e6b1)]</sup><sup>[[Secureworks GOLD KINGSWOOD Threat Profile](https://app.tidalcyber.com/references/36035bbb-1609-4461-be27-ef4a920b814c)]</sup>",
"meta": {
"group_attack_id": "G0008",
"observed_countries": [
"AU",
"AT",
"BA",
"BR",
"CA",
"CN",
"FR",
"DE",
"IS",
"IN",
"IT",
"LT",
"MA",
"NP",
"NG",
"PK",
"PL",
"RU",
"SN",
"ES",
"SE",
"CH",
"TW",
"UA",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Financial Services"
]
},
"related": [],
"uuid": "72d9bea7-9ca1-43e6-8702-2fb7fb1355de",
"value": "Carbanak"
},
{
"description": "Charcoal Stork is a threat actor believed to provide content used to fuel malvertising and search engine optimization (SEO) operations, which affiliates ultimately use to deliver malware to victim systems. Charcoal Stork is thought to be financially motivated, operating on a pay-per-install basis.<sup>[[Red Canary March 18 2024](/references/a86131cd-1a42-4222-9d39-221dd6e054ba)]</sup>",
"meta": {
"group_attack_id": "G5022",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Commercial",
"Healthcare",
"Manufacturing"
]
},
"related": [],
"uuid": "6d23e83f-fd4f-4802-bd01-daff7348741d",
"value": "Charcoal Stork"
},
{
"description": "[Chimera](https://app.tidalcyber.com/groups/ca93af75-0ffa-4df4-b86a-92d4d50e496e) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.<sup>[[Cycraft Chimera April 2020](https://app.tidalcyber.com/references/a5a14a4e-2214-44ab-9067-75429409d744)]</sup><sup>[[NCC Group Chimera January 2021](https://app.tidalcyber.com/references/70c217c3-83a2-40f2-8f47-b68d8bd4cdf0)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0114",
"observed_countries": [
"TW"
],
"source": "MITRE",
"tags": [
"ff873c9d-468f-46c4-a6ee-c8c707df0be7"
],
"target_categories": [
"Semi Conductors",
"Travel Services"
]
},
"related": [],
"uuid": "ca93af75-0ffa-4df4-b86a-92d4d50e496e",
"value": "Chimera"
},
{
"description": "A suspected ransomware-as-a-service (\"RaaS\") group first observed in June 2024, which extorts victims via traditional ransomware encryption and by threatening to leak allegedly exfiltrated data onto the web.<sup>[[Truesec AB August 30 2024](/references/de2de0a9-17d2-41c2-838b-7850762b80ae)]</sup>",
"meta": {
"group_attack_id": "G3051",
"observed_countries": [
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"a2e000da-8181-4327-bacd-32013dbd3654",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Manufacturing"
]
},
"related": [],
"uuid": "7a28cff6-80df-49e1-8457-a0305e736897",
"value": "Cicada3301 Ransomware Group"
},
{
"description": "[Cinnamon Tempest](https://app.tidalcyber.com/groups/8e059c6b-d278-5454-a234-a8ad69feb66c) is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked [Babuk](https://app.tidalcyber.com/software/0dc07eb9-66df-4116-b1bc-7020ca6395a1) source code. [Cinnamon Tempest](https://app.tidalcyber.com/groups/8e059c6b-d278-5454-a234-a8ad69feb66c) does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, [Cinnamon Tempest](https://app.tidalcyber.com/groups/8e059c6b-d278-5454-a234-a8ad69feb66c) may be motivated by intellectual property theft or cyberespionage rather than financial gain.<sup>[[Microsoft Ransomware as a Service](https://app.tidalcyber.com/references/833018b5-6ef6-5327-9af5-1a551df25cd2)]</sup><sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[Trend Micro Cheerscrypt May 2022](https://app.tidalcyber.com/references/ca7ccf2c-37f3-522a-acfb-09daa16e23d8)]</sup><sup>[[SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022](https://app.tidalcyber.com/references/0b275cf9-a885-58cc-b859-112090a711e3)]</sup>",
"meta": {
"group_attack_id": "G1021",
"source": "MITRE"
},
"related": [],
"uuid": "8e059c6b-d278-5454-a234-a8ad69feb66c",
"value": "Cinnamon Tempest"
},
{
"description": "[Cleaver](https://app.tidalcyber.com/groups/c8cc6ce8-d421-42e6-a6eb-2ea9d2d9ab07) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. <sup>[[Cylance Cleaver](https://app.tidalcyber.com/references/f0b45225-3ec3-406f-bd74-87f24003761b)]</sup> Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). <sup>[[Dell Threat Group 2889](https://app.tidalcyber.com/references/de7003cb-5127-4fd7-9475-d69e0d7f5cc8)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0003",
"observed_countries": [
"CA",
"CN",
"FR",
"DE",
"IN",
"IL",
"KR",
"KW",
"MX",
"NL",
"PK",
"QA",
"SA",
"TR",
"AE",
"GB",
"US"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Chemical",
"Defense",
"Education",
"Energy",
"Government",
"Healthcare",
"Manufacturing",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "c8cc6ce8-d421-42e6-a6eb-2ea9d2d9ab07",
"value": "Cleaver"
},
{
"description": "[Cobalt Group](https://app.tidalcyber.com/groups/58db02e6-d908-47c2-bc82-ed58ada61331) is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. [Cobalt Group](https://app.tidalcyber.com/groups/58db02e6-d908-47c2-bc82-ed58ada61331) has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.<sup>[[Talos Cobalt Group July 2018](https://app.tidalcyber.com/references/7cdfd0d1-f7e6-4625-91ff-f87f46f95864)]</sup><sup>[[PTSecurity Cobalt Group Aug 2017](https://app.tidalcyber.com/references/f4ce1b4d-4f01-4083-8bc6-931cbac9ac38)]</sup><sup>[[PTSecurity Cobalt Dec 2016](https://app.tidalcyber.com/references/2de4d38f-c99d-4149-89e6-0349a4902aa2)]</sup><sup>[[Group IB Cobalt Aug 2017](https://app.tidalcyber.com/references/2d9ef1de-2ee6-4500-a87d-b55f83e65900)]</sup><sup>[[Proofpoint Cobalt June 2017](https://app.tidalcyber.com/references/c4922659-88b2-4311-9c9b-dc9b383d746a)]</sup><sup>[[RiskIQ Cobalt Nov 2017](https://app.tidalcyber.com/references/ebf961c5-bd68-42f3-8fd3-000946c7ae9c)]</sup><sup>[[RiskIQ Cobalt Jan 2018](https://app.tidalcyber.com/references/7d48b679-d44d-466e-b12b-16f0f9858d15)]</sup> Reporting indicates there may be links between [Cobalt Group](https://app.tidalcyber.com/groups/58db02e6-d908-47c2-bc82-ed58ada61331) and both the malware [Carbanak](https://app.tidalcyber.com/software/4cb9294b-9e4c-41b9-b640-46213a01952d) and the group [Carbanak](https://app.tidalcyber.com/groups/72d9bea7-9ca1-43e6-8702-2fb7fb1355de).<sup>[[Europol Cobalt Mar 2018](https://app.tidalcyber.com/references/f9d1f2ab-9e75-48ce-bcdf-b7119687feef)]</sup>",
"meta": {
"group_attack_id": "G0080",
"observed_countries": [
"AR",
"AZ",
"BY",
"CA",
"CN",
"KZ",
"KG",
"MD",
"RU",
"TJ",
"GB",
"US",
"VN"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55",
"57859162-d54e-4f4a-a89c-3ae374f09516"
],
"target_categories": [
"Banks",
"Financial Services"
]
},
"related": [],
"uuid": "58db02e6-d908-47c2-bc82-ed58ada61331",
"value": "Cobalt Group"
},
{
"description": "[Confucius](https://app.tidalcyber.com/groups/d0f29889-7a9c-44d8-abdc-480b371f7b2b) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://app.tidalcyber.com/groups/d0f29889-7a9c-44d8-abdc-480b371f7b2b) and [Patchwork](https://app.tidalcyber.com/groups/32385eba-7bbf-439e-acf2-83040e97165a), particularly in their respective custom malware code and targets.<sup>[[TrendMicro Confucius APT Feb 2018](https://app.tidalcyber.com/references/d1d5a708-75cb-4d41-b2a3-d035a14ac956)]</sup><sup>[[TrendMicro Confucius APT Aug 2021](https://app.tidalcyber.com/references/5c16aae9-d253-463b-8bbc-f14402ce77e4)]</sup><sup>[[Uptycs Confucius APT Jan 2021](https://app.tidalcyber.com/references/d74f2c25-cd53-4587-b087-7ba0b8427dc4)]</sup>",
"meta": {
"group_attack_id": "G0142",
"observed_countries": [
"PK"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government"
]
},
"related": [],
"uuid": "d0f29889-7a9c-44d8-abdc-480b371f7b2b",
"value": "Confucius"
},
{
"description": "[CopyKittens](https://app.tidalcyber.com/groups/6a8f5eca-8ecc-4bff-9c5f-5380e044ed5b) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.<sup>[[ClearSky CopyKittens March 2017](https://app.tidalcyber.com/references/f5a42615-0e4e-4d43-937d-05d2efe636cf)]</sup><sup>[[ClearSky Wilted Tulip July 2017](https://app.tidalcyber.com/references/50233005-8dc4-4e91-9477-df574271df40)]</sup><sup>[[CopyKittens Nov 2015](https://app.tidalcyber.com/references/04e3ce40-5487-4931-98db-f55da83f412e)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0052",
"observed_countries": [
"DE",
"IL",
"JO",
"SA",
"TR",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Education",
"Government",
"Technology"
]
},
"related": [],
"uuid": "6a8f5eca-8ecc-4bff-9c5f-5380e044ed5b",
"value": "CopyKittens"
},
{
"description": "CosmicBeetle is a threat actor, active since 2020, that has been associated with multiple ransomware families. Originally known for using a set of custom tools, including ScRansom (a successor to the \"Scarab\" encryptor), researchers reported in September 2024 that they observed a suspected CosmicBeetle attack that involved deployment of tools and malware associated with the RansomHub ransomware-as-a-service operation.<sup>[[WeLiveSecurity CosmicBeetle September 10 2024](/references/8debba29-4d6d-41d2-8772-f97c7d49056b)]</sup><sup>[[BleepingComputer NoName September 10 2024](/references/79752048-f2fd-4357-9e0a-15b9a2927852)]</sup>",
"meta": {
"group_attack_id": "G3053",
"observed_countries": [
"AT",
"CZ",
"FR",
"GF",
"GE",
"GT",
"IN",
"PE",
"PL",
"ZA",
"ES",
"CH",
"TR"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"55ba9d29-7185-40eb-ba10-874cb3997a0f",
"793f4441-3916-4b3d-a3fd-686a59dc3de2",
"c40971d6-ad75-4b2d-be6c-5353c96a232d",
"3adcb409-166d-4465-ba1f-ddaecaff8282",
"33d22eff-59a1-47e0-b9eb-615dee314595",
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"09de661e-60c4-43fb-bfef-df017215d1d8",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Education",
"Financial Services",
"Government",
"Healthcare",
"Hospitality Leisure",
"Legal",
"Manufacturing",
"Pharmaceuticals",
"Technology"
]
},
"related": [],
"uuid": "04b73cf2-33f4-4206-be9e-c80c4c9b54e8",
"value": "CosmicBeetle"
},
{
"description": "A Group object to represent actors that deploy Cuba Ransomware in victim environments.<sup>[[U.S. CISA Cuba Ransomware October 2022](/references/d6ed5172-a319-45b0-b1cb-d270a2a48fa3)]</sup>",
"meta": {
"group_attack_id": "G3008",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "5216ac81-da4c-4b87-86ce-b90a651f1048",
"value": "Cuba Ransomware Actors"
},
{
"description": "[CURIUM](https://app.tidalcyber.com/groups/ab15a328-c41e-5701-993f-3cab29ac4544) is an Iranian threat group first reported in November 2021 that has invested in building a relationship with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note [CURIUM](https://app.tidalcyber.com/groups/ab15a328-c41e-5701-993f-3cab29ac4544) has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.<sup>[[Microsoft Iranian Threat Actor Trends November 2021](https://app.tidalcyber.com/references/78d39ee7-1cd5-5cb8-844a-1c3649e367a1)]</sup>",
"meta": {
"group_attack_id": "G1012",
"source": "MITRE"
},
"related": [],
"uuid": "ab15a328-c41e-5701-993f-3cab29ac4544",
"value": "CURIUM"
},
{
"description": "The Cyber Army of Russia is a threat group that appears to carry out cyber attacks in line with Russian strategic interests. The group has claimed many distributed denial of service (DDoS) attacks against a variety of targets perceived as opposed to Russian interests. More recently, it has claimed disruptive industrial software-based attacks against water utilities in the United States, France, and Poland. Researchers link the Cyber Army of Russia to APT44 / Sandworm Team, although it remains unclear what level of direct support, if any, is provided by the latter group.<sup>[[Wired Cyber Army of Russia April 17 2024](/references/53583baf-4e09-4d19-9348-6110206b88be)]</sup><sup>[[Mandiant APT44 April 17 2024](/references/a64f689e-2bb4-4253-86cd-545e7f633a7e)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G3035",
"observed_countries": [
"FR",
"PL",
"UA",
"US"
],
"observed_motivations": [
"Destruction"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Aerospace",
"Government",
"Media",
"Nuclear",
"Utilities",
"Water"
]
},
"related": [],
"uuid": "411e005e-95a4-4805-8296-0accf902d08d",
"value": "Cyber Army of Russia"
},
{
"description": "CyberAv3ngers is a cyber actor group that has claimed responsibility for numerous disruption-focused attacks against critical infrastructure organizations, including an oil refinery and electric utility in Israel and water/wastewater utilities in the United States. According to a joint advisory released by U.S. & Israeli cybersecurity authorities in December 2023, CyberAv3ngers (aka Cyber Av3ngers or Cyber Avengers) is a “cyber persona” of advanced persistent threat actors affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC). The advisory detailed how suspected CyberAv3ngers actors compromised programmable logic controller (PLC) devices that were exposed to the internet and used the vendor's default passwords and ports, leaving defacement images and possibly rendering the devices inoperable. The defacement messages suggested that the group or affiliates might carry out attacks against other technological equipment produced in or associated with Israel.<sup>[[U.S. CISA IRGC-Affiliated PLC Activity December 2023](/references/51a18523-5276-4a67-8644-2bc6997d043c)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G3028",
"observed_countries": [
"IL",
"US"
],
"observed_motivations": [
"Destruction"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647",
"841ce707-a678-4bcf-86ff-7feeacd37e55",
"15787198-6c8b-4f79-bf50-258d55072fee"
],
"target_categories": [
"Energy",
"Utilities",
"Water"
]
},
"related": [],
"uuid": "44a9c8ac-c287-45d2-9ebc-2c8a7d0a1f57",
"value": "CyberAv3ngers"
},
{
"description": "Cyber Toufan is an apparently politically motivated, destruction-focused threat actor group that has predominantly targeted organizations based in or perceived to be aligned with Israel. Cyber Toufan publicizes many of their cyber operations and in some cases has leaked victim data allegedly exfiltrated during their attacks.<sup>[[SOCRadar Cyber Toufan Profile](/references/a9aa6361-8c4d-4456-bb3f-c64ca5260695)]</sup> Check Point researchers labeled Cyber Toufan as an \"Iranian-affiliated\", \"hacktivist proxy\" group.<sup>[[Check Point Iranian Proxies December 4 2023](/references/60432d84-8f46-4934-951f-df8e0f297ff0)]</sup>",
"meta": {
"group_attack_id": "G3048",
"observed_countries": [
"IL",
"GB",
"US"
],
"observed_motivations": [
"Destruction"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"target_categories": [
"Automotive",
"Government",
"High Tech",
"Manufacturing",
"Retail",
"Technology",
"Utilities",
"Water"
]
},
"related": [],
"uuid": "42a7c134-c574-430b-8105-bf7a00e742ae",
"value": "Cyber Toufan"
},
{
"description": "Daixin Team is a ransomware- and data extortion-focused threat group first observed in mid-2022. Daixin Team is known to publicly extort its victims to pressure them into paying a ransom. It has used ransomware (believed to be based on the leaked source code for Babuk Locker) to encrypt victim data and has also exfiltrated sensitive data from victim environments and threatened to publicly leak that data.\n\nMany of Daixin Team’s victims belong to critical infrastructure sectors, especially the Healthcare and Public Health (“HPH”) sector. An October 2022 joint Cybersecurity Advisory noted Daixin Team attacks on multiple U.S. HPH organizations.<sup>[[U.S. CISA Daixin Team October 2022](/references/cbf5ecfb-de79-41cc-8250-01790ff6e89b)]</sup> Alleged victims referenced on the threat group’s extortion website belong to the healthcare, utilities, transportation (airline), automobile manufacturing, information technology, retail, and media sectors in the United States, Europe, and Asia.<sup>[[GitHub ransomwatch](/references/62037959-58e4-475a-bb91-ff360d20c1d7)]</sup>",
"meta": {
"group_attack_id": "G3007",
"observed_countries": [
"CA",
"DE",
"ID",
"MY",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"15787198-6c8b-4f79-bf50-258d55072fee",
"a2e000da-8181-4327-bacd-32013dbd3654",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Aerospace",
"Healthcare",
"Manufacturing",
"Media",
"Retail",
"Technology",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "07bdadce-905e-4337-898a-13e88cfb5a61",
"value": "Daixin Team"
},
{
"description": "[Dark Caracal](https://app.tidalcyber.com/groups/7ad94dbf-9909-42dd-8b62-a435481bdb14) is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. <sup>[[Lookout Dark Caracal Jan 2018](https://app.tidalcyber.com/references/c558f5db-a426-4041-b883-995ec56e7155)]</sup>",
"meta": {
"country": "LB",
"group_attack_id": "G0070",
"observed_countries": [
"CN",
"FR",
"DE",
"IN",
"IT",
"JO",
"KR",
"LB",
"NP",
"NL",
"PK",
"PH",
"QA",
"RU",
"SA",
"CH",
"SY",
"TH",
"US",
"VE",
"VN"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE"
},
"related": [],
"uuid": "7ad94dbf-9909-42dd-8b62-a435481bdb14",
"value": "Dark Caracal"
},
{
"description": "[Darkhotel](https://app.tidalcyber.com/groups/efa1d922-8f48-43a6-89fe-237e1f3812c8) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. [Darkhotel](https://app.tidalcyber.com/groups/efa1d922-8f48-43a6-89fe-237e1f3812c8) has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.<sup>[[Kaspersky Darkhotel](https://app.tidalcyber.com/references/3247c03a-a57c-4945-9b85-72a70719e1cd)]</sup><sup>[[Securelist Darkhotel Aug 2015](https://app.tidalcyber.com/references/5a45be49-f5f1-4d5b-b7da-0a2f38194ec1)]</sup><sup>[[Microsoft Digital Defense FY20 Sept 2020](https://app.tidalcyber.com/references/cdf74af5-ed71-4dfd-bc49-0ccfa40b65ea)]</sup>",
"meta": {
"group_attack_id": "G0012",
"observed_countries": [
"BD",
"CN",
"DE",
"HK",
"IN",
"ID",
"IE",
"JP",
"KP",
"KR",
"MZ",
"RU",
"TW",
"TH",
"US"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government",
"Healthcare",
"NGOs",
"Non Profit"
]
},
"related": [],
"uuid": "efa1d922-8f48-43a6-89fe-237e1f3812c8",
"value": "Darkhotel"
},
{
"description": "[DarkHydrus](https://app.tidalcyber.com/groups/f2b31240-0b4a-4fa4-82a4-6bb00e146e75) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. <sup>[[Unit 42 DarkHydrus July 2018](https://app.tidalcyber.com/references/800279cf-e6f8-4721-818f-46e35ec7892a)]</sup> <sup>[[Unit 42 Playbook Dec 2017](https://app.tidalcyber.com/references/9923f9ff-a7b8-4058-8213-3c83c54c10a6)]</sup>",
"meta": {
"group_attack_id": "G0079",
"source": "MITRE",
"target_categories": [
"Education",
"Government"
]
},
"related": [],
"uuid": "f2b31240-0b4a-4fa4-82a4-6bb00e146e75",
"value": "DarkHydrus"
},
{
"description": "[DarkVishnya](https://app.tidalcyber.com/groups/d428f9be-6faf-4d57-b677-4a927fea5f7e) is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.<sup>[[Securelist DarkVishnya Dec 2018](https://app.tidalcyber.com/references/da9ac5a7-c644-45fa-ab96-30ac6bfc9f81)]</sup>",
"meta": {
"group_attack_id": "G0105",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Banks",
"Financial Services"
]
},
"related": [],
"uuid": "d428f9be-6faf-4d57-b677-4a927fea5f7e",
"value": "DarkVishnya"
},
{
"description": "[Deep Panda](https://app.tidalcyber.com/groups/43f826a1-e8c8-47b8-9b00-38e1b3e4293b) is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. <sup>[[Alperovitch 2014](https://app.tidalcyber.com/references/72e19be9-35dd-4199-bc07-bd9d0c664df6)]</sup> The intrusion into healthcare company Anthem has been attributed to [Deep Panda](https://app.tidalcyber.com/groups/43f826a1-e8c8-47b8-9b00-38e1b3e4293b). <sup>[[ThreatConnect Anthem](https://app.tidalcyber.com/references/61ecd0b4-6cac-4d9f-8e8c-3d488fef6fec)]</sup> This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. <sup>[[RSA Shell Crew](https://app.tidalcyber.com/references/6872a6d3-c4ab-40cf-82b7-5c5c8e077189)]</sup> [Deep Panda](https://app.tidalcyber.com/groups/43f826a1-e8c8-47b8-9b00-38e1b3e4293b) also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. <sup>[[Symantec Black Vine](https://app.tidalcyber.com/references/0b7745ce-04c0-41d9-a440-df9084a45d09)]</sup> Some analysts track [Deep Panda](https://app.tidalcyber.com/groups/43f826a1-e8c8-47b8-9b00-38e1b3e4293b) and [APT19](https://app.tidalcyber.com/groups/713e2963-fbf4-406f-a8cf-6a4489d90439) as the same group, but it is unclear from open source information if the groups are the same. <sup>[[ICIT China's Espionage Jul 2016](https://app.tidalcyber.com/references/1a824860-6978-454d-963a-a56414a4312b)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0009",
"observed_countries": [
"AU",
"CA",
"CN",
"DK",
"IN",
"IT",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Agriculture",
"Defense",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "43f826a1-e8c8-47b8-9b00-38e1b3e4293b",
"value": "Deep Panda"
},
{
"description": "[Dragonfly](https://app.tidalcyber.com/groups/472080b0-e3d4-4546-9272-c4359fe856e1) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.<sup>[[DOJ Russia Targeting Critical Infrastructure March 2022](https://app.tidalcyber.com/references/768a0ec6-b767-4044-acad-82834508640f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup> Active since at least 2010, [Dragonfly](https://app.tidalcyber.com/groups/472080b0-e3d4-4546-9272-c4359fe856e1) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.<sup>[[Symantec Dragonfly](https://app.tidalcyber.com/references/9514c5cd-2ed6-4dbf-aa9e-1c425e969226)]</sup><sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[Symantec Dragonfly Sept 2017](https://app.tidalcyber.com/references/11bbeafc-ed5d-4d2b-9795-a0a9544fb64e)]</sup><sup>[[Fortune Dragonfly 2.0 Sept 2017](https://app.tidalcyber.com/references/b56c5b41-b8e0-4fef-a6d8-183bb283dc7c)]</sup><sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup><sup>[[CISA AA20-296A Berserk Bear December 2020](https://app.tidalcyber.com/references/c7bc4b25-2043-4f43-8320-590f82d0e09a)]</sup><sup>[[Symantec Dragonfly 2.0 October 2017](https://app.tidalcyber.com/references/a0439d4a-a3ea-4be5-9a01-f223ca259681)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0035",
"observed_countries": [
"CA",
"FR",
"DE",
"GR",
"IT",
"NO",
"PL",
"RO",
"RU",
"RS",
"ES",
"TR",
"UA",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647",
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"
],
"target_categories": [
"Energy",
"Government",
"Travel Services"
]
},
"related": [],
"uuid": "472080b0-e3d4-4546-9272-c4359fe856e1",
"value": "Dragonfly"
},
{
"description": "[DragonOK](https://app.tidalcyber.com/groups/f2c2db08-624c-46b9-b7ed-b22c21b81813) is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, [DragonOK](https://app.tidalcyber.com/groups/f2c2db08-624c-46b9-b7ed-b22c21b81813) is thought to have a direct or indirect relationship with the threat group [Moafee](https://app.tidalcyber.com/groups/4510ce41-27b9-479c-9bf3-a328b77bae29). <sup>[[Operation Quantum Entanglement](https://app.tidalcyber.com/references/c94f9652-32c3-4975-a9c0-48f93bdfe790)]</sup> It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. <sup>[[New DragonOK](https://app.tidalcyber.com/references/82c1ed0d-a41d-4212-a3ae-a1d661bede2d)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0017",
"observed_countries": [
"KH",
"JP",
"RU",
"TW"
],
"source": "MITRE",
"target_categories": [
"Manufacturing",
"Technology"
]
},
"related": [],
"uuid": "f2c2db08-624c-46b9-b7ed-b22c21b81813",
"value": "DragonOK"
},
{
"description": "[Earth Lusca](https://app.tidalcyber.com/groups/646e35d2-75de-4c1d-8ad3-616d3e155c5e) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://app.tidalcyber.com/groups/646e35d2-75de-4c1d-8ad3-616d3e155c5e) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://app.tidalcyber.com/groups/646e35d2-75de-4c1d-8ad3-616d3e155c5e) operations may be financially motivated.<sup>[[TrendMicro EarthLusca 2022](https://app.tidalcyber.com/references/f6e1bffd-e35b-4eae-b9bf-c16a82bf7004)]</sup>\n\n[Earth Lusca](https://app.tidalcyber.com/groups/646e35d2-75de-4c1d-8ad3-616d3e155c5e) has used malware commonly used by other Chinese threat groups, including [APT41](https://app.tidalcyber.com/groups/502223ee-8947-42f8-a532-a3b3da12b7d9) and the [Winnti Group](https://app.tidalcyber.com/groups/6932662a-53a7-4e43-877f-6e940e2d744b) cluster, however security researchers assess [Earth Lusca](https://app.tidalcyber.com/groups/646e35d2-75de-4c1d-8ad3-616d3e155c5e)'s techniques and infrastructure are separate.<sup>[[TrendMicro EarthLusca 2022](https://app.tidalcyber.com/references/f6e1bffd-e35b-4eae-b9bf-c16a82bf7004)]</sup>",
"meta": {
"group_attack_id": "G1006",
"source": "MITRE"
},
"related": [],
"uuid": "646e35d2-75de-4c1d-8ad3-616d3e155c5e",
"value": "Earth Lusca"
},
{
"description": "[Elderwood](https://app.tidalcyber.com/groups/51146bb6-7478-44a3-8f08-19adcdceffca) is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. <sup>[[Security Affairs Elderwood Sept 2012](https://app.tidalcyber.com/references/ebfc56c5-0490-4b91-b49f-548c00a59162)]</sup> The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. <sup>[[Symantec Elderwood Sept 2012](https://app.tidalcyber.com/references/5e908748-d260-42f1-a599-ac38b4e22559)]</sup> <sup>[[CSM Elderwood Sept 2012](https://app.tidalcyber.com/references/6b79006d-f6de-489c-82fa-8c3c28d652ef)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0066",
"observed_countries": [
"BE",
"CN",
"DE",
"ID",
"IT",
"JP",
"NL",
"RU",
"CH",
"GB",
"US"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Human Rights",
"Manufacturing",
"NGOs",
"Technology"
]
},
"related": [],
"uuid": "51146bb6-7478-44a3-8f08-19adcdceffca",
"value": "Elderwood"
},
{
"description": "This object reflects the ATT&CK Techniques associated with threat actors who deploy Eldorado, a ransomware-as-a-service (\"RaaS\") first advertised for sale on cybercrime forums in March 2024. Researchers assess that Eldorado is a \"unique\" ransomware strain that is likely not derived from previously leaked ransomware source code.<sup>[[Group-IB July 3 2024](/references/50148a85-314c-4b29-bdfc-913ab647dadf)]</sup>\n\nWindows and Linux-focused versions of the ransomware are known to exist. (ATT&CK Techniques associated with these malware binaries are tracked in a separate \"Eldorado Ransomware\" Software object.)",
"meta": {
"group_attack_id": "G3045",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"a2e000da-8181-4327-bacd-32013dbd3654",
"5e7433ad-a894-4489-93bc-41e90da90019",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Education",
"Healthcare"
]
},
"related": [],
"uuid": "26e1c52e-0c48-4cd0-bdc5-9cf981a6e714",
"value": "Eldorado Ransomware Operators"
},
{
"description": "[Ember Bear](https://app.tidalcyber.com/groups/407274be-1820-4a84-939e-629313f4de1d) is a suspected Russian state-sponsored cyber espionage group that has been active since at least March 2021. [Ember Bear](https://app.tidalcyber.com/groups/407274be-1820-4a84-939e-629313f4de1d) has primarily focused their operations against Ukraine and Georgia, but has also targeted Western European and North American foreign ministries, pharmaceutical companies, and financial sector organizations. Security researchers assess [Ember Bear](https://app.tidalcyber.com/groups/407274be-1820-4a84-939e-629313f4de1d) likely conducted the [WhisperGate](https://app.tidalcyber.com/software/791f0afd-c2c4-4e23-8aee-1d14462667f5) destructive wiper attacks against Ukraine in early 2022.<sup>[[CrowdStrike Ember Bear Profile March 2022](https://app.tidalcyber.com/references/0639c340-b495-4d91-8418-3069f3fe0df1)]</sup><sup>[[Mandiant UNC2589 March 2022](https://app.tidalcyber.com/references/63d89139-9dd4-4ed6-bf6e-8cd872c5d034)]</sup><sup>[[Palo Alto Unit 42 OutSteel SaintBot February 2022 ](https://app.tidalcyber.com/references/b0632490-76be-4018-982d-4b73b3d13881)]</sup> ",
"meta": {
"group_attack_id": "G1003",
"source": "MITRE"
},
"related": [],
"uuid": "407274be-1820-4a84-939e-629313f4de1d",
"value": "Ember Bear"
},
{
"description": "[Equation](https://app.tidalcyber.com/groups/a4704485-65b5-49ec-bebe-5cc932362dd2) is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. <sup>[[Kaspersky Equation QA](https://app.tidalcyber.com/references/34674802-fbd9-4cdb-8611-c58665c430e5)]</sup>",
"meta": {
"group_attack_id": "G0020",
"observed_countries": [
"AF",
"BD",
"BE",
"BR",
"EC",
"FR",
"DE",
"HK",
"IN",
"IR",
"IQ",
"KZ",
"LB",
"LY",
"MY",
"ML",
"MX",
"NG",
"PK",
"PS",
"PH",
"QA",
"RU",
"SG",
"SO",
"ZA",
"SD",
"CH",
"SY",
"AE",
"GB",
"US",
"YE"
],
"source": "MITRE",
"tags": [
"a98d7a43-f227-478e-81de-e7299639a355"
],
"target_categories": [
"Aerospace",
"Defense",
"Energy",
"Financial Services",
"Government",
"Telecommunications"
]
},
"related": [],
"uuid": "a4704485-65b5-49ec-bebe-5cc932362dd2",
"value": "Equation"
},
{
"description": "[Evilnum](https://app.tidalcyber.com/groups/4bdc62c9-af6a-4377-8431-58a6f39235dd) is a financially motivated threat group that has been active since at least 2018.<sup>[[ESET EvilNum July 2020](https://app.tidalcyber.com/references/6851b3f9-0239-40fc-ba44-34a775e9bd4e)]</sup>",
"meta": {
"group_attack_id": "G0120",
"observed_countries": [
"AU",
"CA",
"GB"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Financial Services"
]
},
"related": [],
"uuid": "4bdc62c9-af6a-4377-8431-58a6f39235dd",
"value": "Evilnum"
},
{
"description": "[EXOTIC LILY](https://app.tidalcyber.com/groups/396a4361-3e84-47bc-9544-58e287c05799) is a financially motivated group that has been closely linked with [Wizard Spider](https://app.tidalcyber.com/groups/0b431229-036f-4157-a1da-ff16dfc095f8) and the deployment of ransomware including [Conti](https://app.tidalcyber.com/software/8e995c29-2759-4aeb-9a0f-bb7cd97b06e5) and [Diavol](https://app.tidalcyber.com/software/d057b6e7-1de4-4f2f-b374-7e879caecd67). [EXOTIC LILY](https://app.tidalcyber.com/groups/396a4361-3e84-47bc-9544-58e287c05799) may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.<sup>[[Google EXOTIC LILY March 2022](https://app.tidalcyber.com/references/19d2cb48-bdb2-41fe-ba24-0769d7bd4d94)]</sup>",
"meta": {
"group_attack_id": "G1011",
"source": "MITRE",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
]
},
"related": [],
"uuid": "396a4361-3e84-47bc-9544-58e287c05799",
"value": "EXOTIC LILY"
},
{
"description": "[Ferocious Kitten](https://app.tidalcyber.com/groups/275ca7b0-3b21-4c3a-8b6f-57b6f0ffb6fb) is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.<sup>[[Kaspersky Ferocious Kitten Jun 2021](https://app.tidalcyber.com/references/b8f8020d-3f5c-4b5e-8761-6ecdd63fcd50)]</sup>",
"meta": {
"group_attack_id": "G0137",
"observed_countries": [
"IR"
],
"source": "MITRE"
},
"related": [],
"uuid": "275ca7b0-3b21-4c3a-8b6f-57b6f0ffb6fb",
"value": "Ferocious Kitten"
},
{
"description": "[FIN10](https://app.tidalcyber.com/groups/345e553a-164d-4c9d-8bf9-19fcf8a51533) is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations. <sup>[[FireEye FIN10 June 2017](https://app.tidalcyber.com/references/9d5c3956-7169-48d5-b4d0-f7a56a742adf)]</sup>",
"meta": {
"group_attack_id": "G0051",
"observed_countries": [
"CA",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Casinos Gambling",
"Hospitality Leisure",
"Mining"
]
},
"related": [],
"uuid": "345e553a-164d-4c9d-8bf9-19fcf8a51533",
"value": "FIN10"
},
{
"description": "FIN11 is a financially motivated adversary identified by Mandiant in 2020. Originally known for high-volume phishing campaigns leading to ransomware and data theft, the group more recently is known for carrying out wide-ranging exploitation of multiple vulnerabilities in 2023, including vulnerabilities affecting PaperCut print management software and MOVEit Transfer file transfer software to deliver Clop ransomware and for more general data theft, respectively, as well as GoAnywhere file transfer software exploits.<sup>[[Microsoft Threat Intelligence Tweet April 26 2023](/references/3b5a2349-e10c-422b-91e3-20e9033fdb60)]</sup><sup>[[Mandiant MOVEit Transfer June 2 2023](/references/232c7555-0483-4a57-88cb-71a990f7d683)]</sup>. Microsoft Threat Intelligence reports overlaps between FIN11 and Lace Tempest (DEV-0950), which it identifies as a Clop ransomware affiliate. The DFIR Report researchers attributed a May 2023 data theft and wiper campaign to FIN11 and Lace Tempest.<sup>[[The DFIR Report Truebot June 12 2023](/references/a6311a66-bb36-4cad-a98f-2b0b89aafa3d)]</sup>",
"meta": {
"group_attack_id": "G3011",
"observed_countries": [
"CA",
"IN",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"173e1480-8d9b-49c5-854d-594dde9740d6",
"1b5da77a-bf84-4fba-a6d7-8b3b8f7699e0",
"992bdd33-4a47-495d-883a-58010a2f0efb",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Financial Services",
"Hospitality Leisure",
"Retail"
]
},
"related": [],
"uuid": "ecdbd431-d62b-4b30-8663-b1ecb4304ec0",
"value": "FIN11"
},
{
"description": "FIN12 is a financially motivated threat actor group believed to be responsible for multiple high-profile ransomware attacks since 2018. The group has attacked victims in various sectors and locations, including multiple attacks on healthcare entities. An October 2021 Mandiant assessment indicated 85% of the group's victims were U.S.-based, and the large majority of them were large enterprises with more than $300 million in annual revenue. The report also assessed that initial access brokers partnering with FIN12 target a wider range of organizations and allow FIN12 actors to select victims for further malicious activity.<sup>[[Mandiant FIN12 Group Profile October 07 2021](/references/7af84b3d-bbd6-449f-b29b-2f14591c9f05)]</sup>\n\nFIN12's toolset has reportedly shifted over time. Cobalt Strike has been observed in most intrusions. While TrickBot and Empire were common post-exploitation tools historically, French authorities observed the group using SystemBC alongside Cobalt Strike during a March 2023 hospital center intrusion. Ryuk, and to a lesser degree Conti, were traditionally used ransomware payloads, with the former used in a series of attacks on U.S. healthcare entities in 2020. However, a French CERT assessment published in 2023 linked the group to multiple more recent incidents it investigated and analyzed, which featured deployment of various ransomware families, including Hive, Nokoyawa, Play, Royal, and BlackCat, along with Emotet and BazarLoader malware for initial footholds.<sup>[[Mandiant FIN12 Group Profile October 07 2021](/references/7af84b3d-bbd6-449f-b29b-2f14591c9f05)]</sup><sup>[[CERTFR-2023-CTI-007](/references/0f4a03c5-79b3-418e-a77d-305d5a32caca)]</sup>\n\n**Related Vulnerabilities**: CVE-2023-21746, CVE-2022-24521, CVE-2021-34527, CVE-2019-0708, CVE-2020-1472<sup>[[CERTFR-2023-CTI-007](/references/0f4a03c5-79b3-418e-a77d-305d5a32caca)]</sup>",
"meta": {
"group_attack_id": "G3005",
"observed_countries": [
"AU",
"CA",
"CO",
"FR",
"ID",
"KR",
"NZ",
"PG",
"PH",
"ES",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"2743d495-7728-4a75-9e5f-b64854039792",
"ecd84106-2a5b-4d25-854e-b8d1f57f6b75",
"a6ba64e1-4b4a-4bbd-a26d-ce35c22b2530",
"4bc9ab8f-7f57-4b1a-8857-ffaa7e5cc930",
"d385b541-4033-48df-93cd-237ca6e46f36"
],
"target_categories": [
"Education",
"Financial Services",
"Government",
"Healthcare",
"Manufacturing",
"Technology"
]
},
"related": [],
"uuid": "6d6ed42c-760c-4964-a81e-1d4df06a8800",
"value": "FIN12"
},
{
"description": "[FIN13](https://app.tidalcyber.com/groups/570198e3-b59c-5772-b1ee-15d7ea14d48a) is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. [FIN13](https://app.tidalcyber.com/groups/570198e3-b59c-5772-b1ee-15d7ea14d48a) achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.<sup>[[Mandiant FIN13 Aug 2022](https://app.tidalcyber.com/references/ebd9d479-1954-5a4a-b7f0-d5372489733c)]</sup><sup>[[Sygnia Elephant Beetle Jan 2022](https://app.tidalcyber.com/references/932897a6-0fa4-5be3-bf0b-20d6ddad238e)]</sup>",
"meta": {
"group_attack_id": "G1016",
"observed_countries": [
"MX"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Commercial",
"Financial Services",
"Hospitality Leisure",
"Retail"
]
},
"related": [],
"uuid": "570198e3-b59c-5772-b1ee-15d7ea14d48a",
"value": "FIN13"
},
{
"description": "[FIN4](https://app.tidalcyber.com/groups/4b6531dc-5b29-4577-8b54-fa99229ab0ca) is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.<sup>[[FireEye Hacking FIN4 Dec 2014](https://app.tidalcyber.com/references/c3ac1c2a-21cc-42a9-a214-88f302371766)]</sup><sup>[[FireEye FIN4 Stealing Insider NOV 2014](https://app.tidalcyber.com/references/b27f1040-46e5-411a-b238-0b40f6160680)]</sup> [FIN4](https://app.tidalcyber.com/groups/4b6531dc-5b29-4577-8b54-fa99229ab0ca) is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.<sup>[[FireEye Hacking FIN4 Dec 2014](https://app.tidalcyber.com/references/c3ac1c2a-21cc-42a9-a214-88f302371766)]</sup><sup>[[FireEye Hacking FIN4 Video Dec 2014](https://app.tidalcyber.com/references/6dcfe3fb-c310-49cf-a657-f2cec65c5499)]</sup>",
"meta": {
"group_attack_id": "G0085",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Financial Services",
"Healthcare",
"Pharmaceuticals"
]
},
"related": [],
"uuid": "4b6531dc-5b29-4577-8b54-fa99229ab0ca",
"value": "FIN4"
},
{
"description": "[FIN5](https://app.tidalcyber.com/groups/7902f5cc-d6a5-4a57-8d54-4c75e0c58b83) is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. <sup>[[FireEye Respond Webinar July 2017](https://app.tidalcyber.com/references/e7091d66-7faa-49d6-b16f-be1f79db4471)]</sup> <sup>[[Mandiant FIN5 GrrCON Oct 2016](https://app.tidalcyber.com/references/2bd39baf-4223-4344-ba93-98aa8453dc11)]</sup> <sup>[[DarkReading FireEye FIN5 Oct 2015](https://app.tidalcyber.com/references/afe0549d-dc1b-4bcf-9a1d-55698afd530e)]</sup>",
"meta": {
"group_attack_id": "G0053",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Entertainment",
"Hospitality Leisure"
]
},
"related": [],
"uuid": "7902f5cc-d6a5-4a57-8d54-4c75e0c58b83",
"value": "FIN5"
},
{
"description": "[FIN6](https://app.tidalcyber.com/groups/fcaadc12-7c17-4946-a9dc-976ed610854c) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.<sup>[[FireEye FIN6 April 2016](https://app.tidalcyber.com/references/8c0997e1-b285-42dd-9492-75065eac8f8b)]</sup><sup>[[FireEye FIN6 Apr 2019](https://app.tidalcyber.com/references/e8a2bc6a-04e3-484e-af67-5f57656c7206)]</sup>",
"meta": {
"group_attack_id": "G0037",
"observed_countries": [
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Financial Services",
"Hospitality Leisure",
"Retail"
]
},
"related": [],
"uuid": "fcaadc12-7c17-4946-a9dc-976ed610854c",
"value": "FIN6"
},
{
"description": "[FIN7](https://app.tidalcyber.com/groups/4348c510-50fc-4448-ab8d-c8cededd19ff) is a financially-motivated threat group that has been active since 2013. [FIN7](https://app.tidalcyber.com/groups/4348c510-50fc-4448-ab8d-c8cededd19ff) has primarily targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, and utilities industries in the U.S. A portion of [FIN7](https://app.tidalcyber.com/groups/4348c510-50fc-4448-ab8d-c8cededd19ff) was run out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://app.tidalcyber.com/groups/4348c510-50fc-4448-ab8d-c8cededd19ff) shifted operations to a big game hunting (BGH) approach including use of [REvil](https://app.tidalcyber.com/software/9314531e-bf46-4cba-9c19-198279ccf9cd) ransomware and their own Ransomware as a Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://app.tidalcyber.com/groups/72d9bea7-9ca1-43e6-8702-2fb7fb1355de) Group, but there appears to be several groups using [Carbanak](https://app.tidalcyber.com/software/4cb9294b-9e4c-41b9-b640-46213a01952d) malware and are therefore tracked separately.<sup>[[FireEye FIN7 March 2017](https://app.tidalcyber.com/references/7987bb91-ec41-42f8-bd2d-dabc26509a08)]</sup><sup>[[FireEye FIN7 April 2017](https://app.tidalcyber.com/references/6ee27fdb-1753-4fdf-af72-3295b072ff10)]</sup><sup>[[FireEye CARBANAK June 2017](https://app.tidalcyber.com/references/39105492-6044-460c-9dc9-3d4473ee862e)]</sup><sup>[[FireEye FIN7 Aug 2018](https://app.tidalcyber.com/references/54e5f23a-5ca6-4feb-8046-db2fb71b400a)]</sup><sup>[[CrowdStrike Carbon Spider August 2021](https://app.tidalcyber.com/references/36f0ddb0-94af-494c-ad10-9d3f75d1d810)]</sup><sup>[[Mandiant FIN7 Apr 2022](https://app.tidalcyber.com/references/be9919c0-ca52-593b-aea0-c5e9a262b570)]</sup>",
"meta": {
"group_attack_id": "G0046",
"observed_countries": [
"BG",
"CZ",
"FR",
"DE",
"IE",
"KW",
"LB",
"NO",
"PL",
"RO",
"RU",
"ES",
"AE",
"GB",
"US",
"YE"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"33d22eff-59a1-47e0-b9eb-615dee314595",
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Agriculture",
"Automotive",
"Education",
"Electronics",
"Financial Services",
"Government",
"Healthcare",
"Hospitality Leisure",
"Legal",
"Manufacturing",
"Media",
"Retail",
"Technology",
"Transportation"
]
},
"related": [],
"uuid": "4348c510-50fc-4448-ab8d-c8cededd19ff",
"value": "FIN7"
},
{
"description": "[FIN8](https://app.tidalcyber.com/groups/b3061284-0335-4dcb-9f8e-a3b0412fd46f) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://app.tidalcyber.com/groups/b3061284-0335-4dcb-9f8e-a3b0412fd46f) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.<sup>[[FireEye Obfuscation June 2017](https://app.tidalcyber.com/references/6d1089b7-0efe-4961-8abc-22a882895377)]</sup><sup>[[FireEye Fin8 May 2016](https://app.tidalcyber.com/references/2079101c-d988-430a-9082-d25c475b2af5)]</sup><sup>[[Bitdefender Sardonic Aug 2021](https://app.tidalcyber.com/references/8e9d05c9-6783-5738-ac85-a444810a8074)]</sup><sup>[[Symantec FIN8 Jul 2023](https://app.tidalcyber.com/references/9b08b7f0-1a33-5d76-817f-448fac0d165a)]</sup>",
"meta": {
"group_attack_id": "G0061",
"observed_countries": [
"CA",
"IT",
"ZA",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Chemical",
"Hospitality Leisure",
"Insurance",
"Retail",
"Technology"
]
},
"related": [],
"uuid": "b3061284-0335-4dcb-9f8e-a3b0412fd46f",
"value": "FIN8"
},
{
"description": "Researchers assess that Flax Typhoon is a nation-state-sponsored espionage group based in China that has targeted government, education, manufacturing, and IT organizations in Taiwan, elsewhere in Southeast Asia, North America, and Africa. Flax Typhoon is believed to overlap with the ETHEREAL PANDA group and has been active since mid-2021. Flax Typhoon has been seen establishing persistence, moving laterally, and accessing victim credentials after achieving network access, but to date, researchers have not observed the actors acting on final objectives during intrusions. Microsoft researchers assess that Flax Typhoon's techniques, which lean on legitimate, often built-in tools & utilities, could be used in attacks on victims in other regions.<sup>[[Microsoft Flax Typhoon August 24 2023](/references/ec962b72-7b7f-4f7e-b6d6-7c5380b07201)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G3018",
"observed_countries": [
"TW",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"61cdbb28-cbfd-498b-9ab1-1f14337f9524",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a",
"a159c91c-5258-49ea-af7d-e803008d97d3",
"70dc52b0-f317-4134-8a42-71aea1443707",
"b20e7912-6a8d-46e3-8e13-9a3fc4813852",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Defense",
"Education",
"Government",
"Manufacturing",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "b39d8eae-12e3-4903-a387-4c31d16a73b2",
"value": "Flax Typhoon"
},
{
"description": "[Fox Kitten](https://app.tidalcyber.com/groups/7094468a-2310-48b5-ad24-e669152bd66d) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://app.tidalcyber.com/groups/7094468a-2310-48b5-ad24-e669152bd66d) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.<sup>[[ClearkSky Fox Kitten February 2020](https://app.tidalcyber.com/references/a5ad6321-897a-4adc-9cdd-034a2538e3d6)]</sup><sup>[[CrowdStrike PIONEER KITTEN August 2020](https://app.tidalcyber.com/references/4fce29cc-ddab-4b96-b295-83c282a87564)]</sup><sup>[[Dragos PARISITE ](https://app.tidalcyber.com/references/15e974db-51a9-4ec1-9725-cff8bb9bc2fa)]</sup><sup>[[ClearSky Pay2Kitten December 2020](https://app.tidalcyber.com/references/6e09bc1a-8a5d-4512-9176-40eed91af358)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0117",
"observed_countries": [
"AU",
"AT",
"AZ",
"FI",
"FR",
"DE",
"HU",
"IE",
"IL",
"IT",
"KW",
"LB",
"MY",
"PL",
"SA",
"TR",
"AE",
"US"
],
"observed_motivations": [
"Cyber Espionage",
"Financial Gain"
],
"source": "MITRE",
"tags": [
"07f09197-1847-411e-a451-d37211ead1b2",
"0e1abd50-26be-43e7-b8f6-40f8a6aee148",
"1ff4614e-0ee6-4e04-921d-61abba7fcdb7",
"c475ad68-3fdc-4725-8abc-784c56125e96",
"45c5f939-56c4-4d12-844d-578f32d535c3",
"5e42e064-1065-44c6-836e-7dc0a2976bd4",
"ab64f2d8-8da3-48de-ac66-0fd91d634b22",
"cc370970-a67c-4c74-95e3-4fe053e9bfa9",
"0e948c57-6c10-4576-ad27-9832cc2af3a1",
"a159c91c-5258-49ea-af7d-e803008d97d3",
"fe984a01-910d-4e39-9c49-179aa03f75ab",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"9768aada-9d63-4d46-ab9f-d41b8c8e4010",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"291c006e-f77a-4c9c-ae7e-084974c0e1eb"
],
"target_categories": [
"Aerospace",
"Chemical",
"Defense",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Insurance",
"Manufacturing",
"Media",
"Retail",
"Technology",
"Telecommunications",
"Utilities"
]
},
"related": [],
"uuid": "7094468a-2310-48b5-ad24-e669152bd66d",
"value": "Fox Kitten"
},
{
"description": "[GALLIUM](https://app.tidalcyber.com/groups/15ff1ce0-44f0-4f1d-a4ef-83444570e572) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.<sup>[[Cybereason Soft Cell June 2019](https://app.tidalcyber.com/references/620b7353-0e58-4503-b534-9250a8f5ae3c)]</sup> Security researchers have identified [GALLIUM](https://app.tidalcyber.com/groups/15ff1ce0-44f0-4f1d-a4ef-83444570e572) as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.<sup>[[Cybereason Soft Cell June 2019](https://app.tidalcyber.com/references/620b7353-0e58-4503-b534-9250a8f5ae3c)]</sup><sup>[[Microsoft GALLIUM December 2019](https://app.tidalcyber.com/references/5bc76b47-ff68-4031-a347-f2dc0daba203)]</sup><sup>[[Unit 42 PingPull Jun 2022](https://app.tidalcyber.com/references/ac6491ab-6ef1-4091-8a15-50e2cbafe157)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0093",
"source": "MITRE",
"target_categories": [
"Telecommunications"
]
},
"related": [],
"uuid": "15ff1ce0-44f0-4f1d-a4ef-83444570e572",
"value": "GALLIUM"
},
{
"description": "[Gallmaker](https://app.tidalcyber.com/groups/cd483597-4eda-4e16-bb58-353488511410) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.<sup>[[Symantec Gallmaker Oct 2018](https://app.tidalcyber.com/references/f47b3e2b-acdd-4487-88b9-de5cbe45cf33)]</sup>",
"meta": {
"group_attack_id": "G0084",
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government"
]
},
"related": [],
"uuid": "cd483597-4eda-4e16-bb58-353488511410",
"value": "Gallmaker"
},
{
"description": "[Gamaredon Group](https://app.tidalcyber.com/groups/41e8b4a4-2d31-46ee-bc56-12375084d067) is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. The name [Gamaredon Group](https://app.tidalcyber.com/groups/41e8b4a4-2d31-46ee-bc56-12375084d067) comes from a misspelling of the word \"Armageddon\", which was detected in the adversary's early campaigns.<sup>[[Palo Alto Gamaredon Feb 2017](https://app.tidalcyber.com/references/3f9a6343-1db3-4696-99ed-f22c6eabee71)]</sup><sup>[[TrendMicro Gamaredon April 2020](https://app.tidalcyber.com/references/3800cfc2-0260-4b36-b629-7a336b9f9f10)]</sup><sup>[[ESET Gamaredon June 2020](https://app.tidalcyber.com/references/6532664d-2311-4b38-8960-f43762471729)]</sup><sup>[[Symantec Shuckworm January 2022](https://app.tidalcyber.com/references/3abb9cfb-8927-4447-b904-6ed071787bef)]</sup><sup>[[Microsoft Actinium February 2022](https://app.tidalcyber.com/references/5ab658db-7f71-4213-8146-e22da54160b3)]</sup>\n\nIn November 2021, the Ukrainian government publicly attributed [Gamaredon Group](https://app.tidalcyber.com/groups/41e8b4a4-2d31-46ee-bc56-12375084d067) to Russia's Federal Security Service (FSB) Center 18.<sup>[[Bleepingcomputer Gamardeon FSB November 2021](https://app.tidalcyber.com/references/c565b025-df74-40a9-9535-b630ca06f777)]</sup><sup>[[Microsoft Actinium February 2022](https://app.tidalcyber.com/references/5ab658db-7f71-4213-8146-e22da54160b3)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0047",
"observed_countries": [
"AL",
"AU",
"AT",
"BD",
"BR",
"CA",
"CL",
"CN",
"CO",
"HR",
"DK",
"GE",
"DE",
"GT",
"HN",
"IN",
"ID",
"IR",
"IL",
"IT",
"JP",
"KZ",
"KR",
"LV",
"MY",
"NL",
"NG",
"NO",
"PK",
"PG",
"PL",
"PT",
"RO",
"RU",
"ZA",
"ES",
"SE",
"TR",
"UA",
"GB",
"US",
"VN"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"NGOs",
"Non Profit"
]
},
"related": [],
"uuid": "41e8b4a4-2d31-46ee-bc56-12375084d067",
"value": "Gamaredon Group"
},
{
"description": "[GCMAN](https://app.tidalcyber.com/groups/dbc85db0-937d-47d7-9002-7364d41be48a) is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. <sup>[[Securelist GCMAN](https://app.tidalcyber.com/references/1f07f234-50f0-4c1e-942a-a01d3f733161)]</sup>",
"meta": {
"group_attack_id": "G0036",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Financial Services"
]
},
"related": [],
"uuid": "dbc85db0-937d-47d7-9002-7364d41be48a",
"value": "GCMAN"
},
{
"description": "[GOLD SOUTHFIELD](https://app.tidalcyber.com/groups/b4d068ac-9b68-4cd8-bf0c-019f910ef8e3) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://app.tidalcyber.com/software/9314531e-bf46-4cba-9c19-198279ccf9cd) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://app.tidalcyber.com/groups/b4d068ac-9b68-4cd8-bf0c-019f910ef8e3) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://app.tidalcyber.com/groups/b4d068ac-9b68-4cd8-bf0c-019f910ef8e3) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.<sup>[[Secureworks REvil September 2019](https://app.tidalcyber.com/references/8f4e2baf-4227-4bbd-bfdb-5598717dcf88)]</sup><sup>[[Secureworks GandCrab and REvil September 2019](https://app.tidalcyber.com/references/46b5d57b-17be-48ff-b723-406f6a55d84a)]</sup><sup>[[Secureworks GOLD SOUTHFIELD](https://app.tidalcyber.com/references/01d1ffaa-16b3-41c4-bb5a-afe2b41f1142)]</sup><sup>[[CrowdStrike Evolution of Pinchy Spider July 2021](https://app.tidalcyber.com/references/7578541b-1ae3-58d0-a8b9-120bd6cd96f5)]</sup>",
"meta": {
"group_attack_id": "G0115",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
]
},
"related": [],
"uuid": "b4d068ac-9b68-4cd8-bf0c-019f910ef8e3",
"value": "GOLD SOUTHFIELD"
},
{
"description": "[Gorgon Group](https://app.tidalcyber.com/groups/efb3b5ac-cd86-44a2-9de1-02e4612b8cc2) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. <sup>[[Unit 42 Gorgon Group Aug 2018](https://app.tidalcyber.com/references/d0605185-3f8d-4846-a718-15572714e15b)]</sup>",
"meta": {
"country": "PK",
"group_attack_id": "G0078",
"observed_countries": [
"RU",
"ES",
"GB",
"US"
],
"source": "MITRE",
"target_categories": [
"Government"
]
},
"related": [],
"uuid": "efb3b5ac-cd86-44a2-9de1-02e4612b8cc2",
"value": "Gorgon Group"
},
{
"description": "GreenMwizi is assessed to be an actor based in Nairobi, Kenya that has carried out scam campaigns involving social media bots. A campaign observed in May 2023 appeared to target customers of a major online travel/hospitality booking brand.<sup>[[GreenMwizi - Kenyan scamming campaign using Twitter bots](/references/3b09696a-1345-4283-a59b-e9a13124ef59)]</sup>",
"meta": {
"group_attack_id": "G3001",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Hospitality Leisure",
"Travel Services"
]
},
"related": [],
"uuid": "7d17fa48-e897-4a0c-8aa5-c7f2b6cd96a0",
"value": "GreenMwizi"
},
{
"description": "[Group5](https://app.tidalcyber.com/groups/fcc6d937-8cd6-4f2c-adb8-48caedbde70a) is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. [Group5](https://app.tidalcyber.com/groups/fcc6d937-8cd6-4f2c-adb8-48caedbde70a) has used two commonly available remote access tools (RATs), [njRAT](https://app.tidalcyber.com/software/82996f6f-0575-45cd-8f7c-ba1b063d5b9f) and [NanoCore](https://app.tidalcyber.com/software/db05dbaa-eb3a-4303-b37e-18d67e7e85a1), as well as an Android RAT, DroidJack. <sup>[[Citizen Lab Group5](https://app.tidalcyber.com/references/ffbec5e8-947a-4363-b7e1-812dfd79935a)]</sup>",
"meta": {
"group_attack_id": "G0043",
"source": "MITRE"
},
"related": [],
"uuid": "fcc6d937-8cd6-4f2c-adb8-48caedbde70a",
"value": "Group5"
},
{
"description": "H0lyGh0st is a North Korea-based ransomware-focused threat actor group.<sup>[[H0lyGh0st - North Korean Threat Group Strikes Back With New Ransomware](/references/3f66ef62-ac0d-4ece-9a4b-917ae70f1617)]</sup>",
"meta": {
"group_attack_id": "G3006",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "cd83ecfb-8e42-4b55-8d1e-fd4dbe4b68cd",
"value": "H0lyGh0st Ransomware Group"
},
{
"description": "[HAFNIUM](https://app.tidalcyber.com/groups/1bcc9382-ccfe-4b04-91f3-ef1250df5e5b) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://app.tidalcyber.com/groups/1bcc9382-ccfe-4b04-91f3-ef1250df5e5b) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.<sup>[[Microsoft HAFNIUM March 2020](https://app.tidalcyber.com/references/6a986c46-79a3-49c6-94d2-d9b1f5db08f3)]</sup><sup>[[Volexity Exchange Marauder March 2021](https://app.tidalcyber.com/references/ef0626e9-281c-4770-b145-ffe36e18e369)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0125",
"observed_countries": [
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Education",
"Legal",
"NGOs",
"Think Tanks"
]
},
"related": [],
"uuid": "1bcc9382-ccfe-4b04-91f3-ef1250df5e5b",
"value": "HAFNIUM"
},
{
"description": "[HEXANE](https://app.tidalcyber.com/groups/eecf7289-294f-48dd-a747-7705820f4735) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://app.tidalcyber.com/groups/eecf7289-294f-48dd-a747-7705820f4735)'s TTPs appear similar to [APT33](https://app.tidalcyber.com/groups/99bbbe25-45af-492f-a7ff-7cbc57828bac) and [OilRig](https://app.tidalcyber.com/groups/d01abdb1-0378-4654-aa38-1a4a292703e2) but due to differences in victims and tools it is tracked as a separate entity.<sup>[[Dragos Hexane](https://app.tidalcyber.com/references/11838e67-5032-4352-ad1f-81ba0398a14f)]</sup><sup>[[Kaspersky Lyceum October 2021](https://app.tidalcyber.com/references/b3d13a82-c24e-4b47-b47a-7221ad449859)]</sup><sup>[[ClearSky Siamesekitten August 2021](https://app.tidalcyber.com/references/9485efce-8d54-4461-b64e-0d15e31fbf8c)]</sup><sup>[[Accenture Lyceum Targets November 2021](https://app.tidalcyber.com/references/127836ce-e459-405d-a75c-32fd5f0ab198)]</sup>",
"meta": {
"group_attack_id": "G1001",
"source": "MITRE",
"tags": [
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"
]
},
"related": [],
"uuid": "eecf7289-294f-48dd-a747-7705820f4735",
"value": "HEXANE"
},
{
"description": "[Higaisa](https://app.tidalcyber.com/groups/f1477581-d485-403f-a95f-c56bf88c5d1e) is a threat group suspected to have South Korean origins. [Higaisa](https://app.tidalcyber.com/groups/f1477581-d485-403f-a95f-c56bf88c5d1e) has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. [Higaisa](https://app.tidalcyber.com/groups/f1477581-d485-403f-a95f-c56bf88c5d1e) was first disclosed in early 2019 but is assessed to have operated as early as 2009.<sup>[[Malwarebytes Higaisa 2020](https://app.tidalcyber.com/references/6054e0ab-cf61-49ba-b7f5-58b304477451)]</sup><sup>[[Zscaler Higaisa 2020](https://app.tidalcyber.com/references/26d7ee2c-d4f7-441a-9073-49c9049b017e)]</sup><sup>[[PTSecurity Higaisa 2020](https://app.tidalcyber.com/references/cf8f3d9c-0d21-4587-a707-46848a15bd46)]</sup>",
"meta": {
"country": "KR",
"group_attack_id": "G0126",
"observed_countries": [
"CN",
"JP",
"KP",
"PL",
"RU"
],
"source": "MITRE",
"target_categories": [
"Government"
]
},
"related": [],
"uuid": "f1477581-d485-403f-a95f-c56bf88c5d1e",
"value": "Higaisa"
},
{
"description": "This Group object reflects the tools & TTPs associated with threat actors known to deploy Hive, a ransomware-as-a-service (RaaS) variant first observed in June 2021.<sup>[[U.S. CISA Hive November 25 2022](/references/fce322e6-5e23-404a-acf8-cd003f00c79d)]</sup> Specific pre- and post-compromise behaviors may vary among intrusions carried out by different Hive affiliates.\n\nHive actors have targeted victims in a wide range of verticals, including the government, communications, manufacturing, information technology, financial services, education, and especially the healthcare sectors. In January 2023, international authorities announced they disrupted Hive ransomware operations, seizing control of servers and websites used for communication among Hive actors and capturing Hive decryption keys.<sup>[[U.S. Justice Department Hive January 2023](/references/81bd5579-6a8a-40d2-b7b7-5cdb879ebdf0)]</sup>",
"meta": {
"group_attack_id": "G3041",
"observed_countries": [
"DE",
"NL",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"d903e38b-600d-4736-9e3b-cf1a6e436481",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"5e9581be-dea3-42b2-a92a-4c307cedec2c",
"3ed2343c-a29c-42e2-8259-410381164c6a",
"375983b3-6e87-4281-99e2-1561519dd17b",
"64d3f7d8-30b7-4b03-bee2-a6029672216c",
"1423b5a8-cff3-48d5-a0a2-09b3afc9f195",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Construction",
"Education",
"Financial Services",
"Government",
"Healthcare",
"High Tech",
"Manufacturing",
"Telecommunications"
]
},
"related": [],
"uuid": "05cd82bb-f8fc-40f3-83ba-1586ef953d05",
"value": "Hive Ransomware Actors"
},
{
"description": "[Inception](https://app.tidalcyber.com/groups/d7c58e7f-f0b0-44c6-b205-5adcfb56f0e6) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.<sup>[[Unit 42 Inception November 2018](https://app.tidalcyber.com/references/5cb98fce-f386-4878-b69c-5c6440ad689c)]</sup><sup>[[Symantec Inception Framework March 2018](https://app.tidalcyber.com/references/166f5c44-7d8c-45d5-8d9f-3b8bd21a2af3)]</sup><sup>[[Kaspersky Cloud Atlas December 2014](https://app.tidalcyber.com/references/41a9b3e3-0953-4bde-9e1d-c2f51de1120e)]</sup>",
"meta": {
"group_attack_id": "G0100",
"observed_countries": [
"BE",
"BG",
"FR",
"GE",
"IR",
"KE",
"MY",
"MD",
"RU",
"ZA",
"SR",
"TR",
"UA",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"291c006e-f77a-4c9c-ae7e-084974c0e1eb"
],
"target_categories": [
"Aerospace",
"Defense",
"Energy",
"Government",
"Media"
]
},
"related": [],
"uuid": "d7c58e7f-f0b0-44c6-b205-5adcfb56f0e6",
"value": "Inception"
},
{
"description": "[IndigoZebra](https://app.tidalcyber.com/groups/988f5312-834e-48ea-93b7-e6e01ee0938d) is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.<sup>[[HackerNews IndigoZebra July 2021](https://app.tidalcyber.com/references/fcf8265a-3084-4162-87d0-9e77c0a5cff0)]</sup><sup>[[Checkpoint IndigoZebra July 2021](https://app.tidalcyber.com/references/cf4a8c8c-eab1-421f-b313-344aed03b42d)]</sup><sup>[[Securelist APT Trends Q2 2017](https://app.tidalcyber.com/references/fe28042c-d289-463f-9ece-1a75a70b966e)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0136",
"observed_countries": [
"AF",
"KG",
"UZ"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government"
]
},
"related": [],
"uuid": "988f5312-834e-48ea-93b7-e6e01ee0938d",
"value": "IndigoZebra"
},
{
"description": "[Indrik Spider](https://app.tidalcyber.com/groups/3c7ad595-1940-40fc-b9ca-3e649c1e5d87) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://app.tidalcyber.com/groups/3c7ad595-1940-40fc-b9ca-3e649c1e5d87) initially started with the [Dridex](https://app.tidalcyber.com/software/e3cd4405-b698-41d9-88e4-fff29e7a19e2) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://app.tidalcyber.com/software/e7dec940-8701-4c06-9865-5b11c61c046d), [WastedLocker](https://app.tidalcyber.com/software/0ba6ee8d-2b29-4980-8e55-348ea05f00ad), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://app.tidalcyber.com/groups/3c7ad595-1940-40fc-b9ca-3e649c1e5d87) changed their tactics and diversified their toolset.<sup>[[Crowdstrike Indrik November 2018](https://app.tidalcyber.com/references/0f85f611-90db-43ba-8b71-5d0d4ec8cdd5)]</sup><sup>[[Crowdstrike EvilCorp March 2021](https://app.tidalcyber.com/references/4b77d313-ef3c-4d2f-bfde-609fa59a8f55)]</sup><sup>[[Treasury EvilCorp Dec 2019](https://app.tidalcyber.com/references/074a52c4-26d9-4083-9349-c14e2639c1bc)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0119",
"observed_countries": [
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"c9c73000-30a5-4a16-8c8b-79169f9c24aa",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Healthcare",
"Insurance"
]
},
"related": [],
"uuid": "3c7ad595-1940-40fc-b9ca-3e649c1e5d87",
"value": "Indrik Spider"
},
{
"description": "[Ke3chang](https://app.tidalcyber.com/groups/26c0925f-1a3c-4df6-b27a-62b9731299b8) is a threat group attributed to actors operating out of China. [Ke3chang](https://app.tidalcyber.com/groups/26c0925f-1a3c-4df6-b27a-62b9731299b8) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.<sup>[[Mandiant Operation Ke3chang November 2014](https://app.tidalcyber.com/references/bb45cf96-ceae-4f46-a0f5-08cd89f699c9)]</sup><sup>[[NCC Group APT15 Alive and Strong](https://app.tidalcyber.com/references/02a50445-de06-40ab-9ea4-da5c37e066cd)]</sup><sup>[[APT15 Intezer June 2018](https://app.tidalcyber.com/references/0110500c-bf67-43a5-97cb-16eb6c01040b)]</sup><sup>[[Microsoft NICKEL December 2021](https://app.tidalcyber.com/references/29a46bb3-f514-4554-ad9c-35f9a5ad9870)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0004",
"observed_countries": [
"AF",
"AR",
"BB",
"BE",
"BA",
"BR",
"BG",
"CL",
"CN",
"CO",
"HR",
"CZ",
"DO",
"EC",
"EG",
"SV",
"FR",
"GT",
"HN",
"HU",
"IN",
"ID",
"IR",
"IT",
"JM",
"KZ",
"KW",
"MY",
"ML",
"MX",
"ME",
"PK",
"PA",
"PE",
"PT",
"SA",
"SK",
"CH",
"SY",
"TT",
"TR",
"GB",
"US",
"UZ",
"VE"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Energy",
"Government",
"Media",
"NGOs"
]
},
"related": [],
"uuid": "26c0925f-1a3c-4df6-b27a-62b9731299b8",
"value": "Ke3chang"
},
{
"description": "Killnet is an apparent hacktivist collective that has primarily used distributed denial of service (DDoS) attacks in support of its ideology, which appears to largely align with Russian state interests. The group emerged in October 2021, initially offering DDoS capabilities as a for-hire service. However, after the February 2022 Russian invasion of Ukraine, Killnet explicitly pledged allegiance to Russia and began to threaten and claim responsibility for attacks on targets in Ukraine and in countries perceived to support Ukraine. To date, the group has claimed and is believed to be responsible for a considerable number of DDoS attacks on government and private sector targets in a range of sectors, using a variety of discrete techniques to carry them out. It is also believed to be behind a smaller number of data exfiltration-focused attacks, and it has promoted the use of defacement tools in its communication channels with supporters.<sup>[[Flashpoint Glossary Killnet](/references/502cc03b-350b-4e2d-9436-364c43a0a203)]</sup>\n\nIn October 2023, following a series of air- and land-based attacks in the Gaza Strip, researchers observed Killnet claiming responsibility for disruptive attacks against computer networks in Israel and pledging explicit support for Palestinian interests.<sup>[[RyanW3stman Tweet October 10 2023](/references/cfd0ad64-54b2-446f-9624-9c90a9a94f52)]</sup>",
"meta": {
"group_attack_id": "G3022",
"observed_countries": [
"BE",
"CZ",
"EE",
"DE",
"IT",
"LT",
"PL",
"RO",
"UA",
"GB",
"US"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"62bde669-3020-4682-be68-36c83b2588a4"
],
"target_categories": [
"Aerospace",
"Banks",
"Energy",
"Government",
"Healthcare",
"Media",
"Transportation"
]
},
"related": [],
"uuid": "35fb7663-5c5d-43fe-a507-49612aa7960e",
"value": "Killnet"
},
{
"description": "[Kimsuky](https://app.tidalcyber.com/groups/37f317d8-02f0-43d4-8a7d-7a65ce8aadf1) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the United States, Russia, Europe, and the UN. [Kimsuky](https://app.tidalcyber.com/groups/37f317d8-02f0-43d4-8a7d-7a65ce8aadf1) has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.<sup>[[EST Kimsuky April 2019](https://app.tidalcyber.com/references/8e52db6b-5ac3-448a-93f6-96a21787a346)]</sup><sup>[[BRI Kimsuky April 2019](https://app.tidalcyber.com/references/b72dd3a1-62ca-4a05-96a8-c4bddb17db50)]</sup><sup>[[Cybereason Kimsuky November 2020](https://app.tidalcyber.com/references/ecc2f5ad-b2a8-470b-b919-cb184d12d00f)]</sup><sup>[[Malwarebytes Kimsuky June 2021](https://app.tidalcyber.com/references/9a497c56-f1d3-4889-8c1a-14b013f14668)]</sup><sup>[[CISA AA20-301A Kimsuky](https://app.tidalcyber.com/references/685aa213-7902-46fb-b90a-64be5c851f73)]</sup>\n\n[Kimsuky](https://app.tidalcyber.com/groups/37f317d8-02f0-43d4-8a7d-7a65ce8aadf1) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).<sup>[[Netscout Stolen Pencil Dec 2018](https://app.tidalcyber.com/references/6d3b31da-a784-4da0-91dd-b72c04fd520a)]</sup><sup>[[EST Kimsuky SmokeScreen April 2019](https://app.tidalcyber.com/references/15213a3c-1e9f-47fa-9864-8ef2707c7fb6)]</sup><sup>[[AhnLab Kimsuky Kabar Cobra Feb 2019](https://app.tidalcyber.com/references/4035e871-9291-4d7f-9c5f-d8482d4dc8a7)]</sup>\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08) instead of tracking clusters or subgroups.",
"meta": {
"country": "KP",
"group_attack_id": "G0094",
"observed_countries": [
"JP",
"KR",
"RU",
"TH",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Education",
"Energy",
"Government",
"Media",
"NGOs",
"Pharmaceuticals",
"Think Tanks"
]
},
"related": [],
"uuid": "37f317d8-02f0-43d4-8a7d-7a65ce8aadf1",
"value": "Kimsuky"
},
{
"description": "[LAPSUS$](https://app.tidalcyber.com/groups/0060bb76-6713-4942-a4c0-d4ae01ec2866) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://app.tidalcyber.com/groups/0060bb76-6713-4942-a4c0-d4ae01ec2866) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.<sup>[[BBC LAPSUS Apr 2022](https://app.tidalcyber.com/references/6c9f4312-6c9d-401c-b20f-12ce50c94a96)]</sup><sup>[[MSTIC DEV-0537 Mar 2022](https://app.tidalcyber.com/references/a9ce7e34-6e7d-4681-9869-8e8f2b5b0390)]</sup><sup>[[UNIT 42 LAPSUS Mar 2022](https://app.tidalcyber.com/references/50f4c1ed-b046-405a-963d-a113324355a3)]</sup>",
"meta": {
"group_attack_id": "G1004",
"source": "MITRE",
"tags": [
"fe28cf32-a15c-44cf-892c-faa0360d6109",
"2e5f6e4a-4579-46f7-9997-6923180815dd",
"c9c73000-30a5-4a16-8c8b-79169f9c24aa",
"a2e000da-8181-4327-bacd-32013dbd3654",
"5e7433ad-a894-4489-93bc-41e90da90019"
]
},
"related": [],
"uuid": "0060bb76-6713-4942-a4c0-d4ae01ec2866",
"value": "LAPSUS$"
},
{
"description": "[Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08) is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau.<sup>[[US-CERT HIDDEN COBRA June 2017](https://app.tidalcyber.com/references/8e57cea3-ee37-4507-bb56-7445050ec8ca)]</sup><sup>[[Treasury North Korean Cyber Groups September 2019](https://app.tidalcyber.com/references/54977bb2-2929-41d7-bdea-06d39dc76174)]</sup> The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by [Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.<sup>[[Novetta Blockbuster](https://app.tidalcyber.com/references/bde96b4f-5f98-4ce5-a507-4b05d192b6d7)]</sup>\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://app.tidalcyber.com/groups/0bc66e95-de93-4de7-b415-4041b7191f08) instead of tracking clusters or subgroups, such as [Andariel](https://app.tidalcyber.com/groups/2cc997b5-5076-4eef-9974-f54387614f46), [APT37](https://app.tidalcyber.com/groups/013fdfdc-aa32-4779-8f6e-7920615cbf66), [APT38](https://app.tidalcyber.com/groups/dfbce236-735c-436d-b433-933bd6eae17b), and [Kimsuky](https://app.tidalcyber.com/groups/37f317d8-02f0-43d4-8a7d-7a65ce8aadf1). ",
"meta": {
"country": "KP",
"group_attack_id": "G0032",
"observed_countries": [
"AU",
"IN",
"IL",
"KR",
"RU",
"US"
],
"observed_motivations": [
"Cyber Espionage",
"Destruction",
"Financial Gain"
],
"source": "MITRE",
"tags": [
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647",
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"
],
"target_categories": [
"Aerospace",
"Casinos Gambling",
"Defense",
"Entertainment",
"Financial Services",
"Government",
"Infrastructure"
]
},
"related": [],
"uuid": "0bc66e95-de93-4de7-b415-4041b7191f08",
"value": "Lazarus Group"
},
{
"description": "[LazyScripter](https://app.tidalcyber.com/groups/12279b62-289e-49ee-97cb-c780edd3d091) is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.<sup>[[MalwareBytes LazyScripter Feb 2021](https://app.tidalcyber.com/references/078837a7-82cd-4e26-9135-43b612e911fe)]</sup>",
"meta": {
"group_attack_id": "G0140",
"source": "MITRE",
"target_categories": [
"Travel Services"
]
},
"related": [],
"uuid": "12279b62-289e-49ee-97cb-c780edd3d091",
"value": "LazyScripter"
},
{
"description": "[Leafminer](https://app.tidalcyber.com/groups/b5c28235-d441-40d9-8da2-d49ba2f2568b) is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. <sup>[[Symantec Leafminer July 2018](https://app.tidalcyber.com/references/01130af7-a2d4-435e-8790-49933e041451)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0077",
"observed_countries": [
"IL",
"KW",
"LB",
"SA",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"15f2277a-a17e-4d85-8acd-480bf84f16b4",
"c9c73000-30a5-4a16-8c8b-79169f9c24aa"
],
"target_categories": [
"Aerospace",
"Construction",
"Energy",
"Financial Services",
"Government",
"Telecommunications",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "b5c28235-d441-40d9-8da2-d49ba2f2568b",
"value": "Leafminer"
},
{
"description": "[Leviathan](https://app.tidalcyber.com/groups/eadd78e3-3b5d-430a-b994-4360b172c871) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup> Active since at least 2009, [Leviathan](https://app.tidalcyber.com/groups/eadd78e3-3b5d-430a-b994-4360b172c871) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Europe, the Middle East, and Southeast Asia.<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[Proofpoint Leviathan Oct 2017](https://app.tidalcyber.com/references/f8c2b67b-c097-4b48-8d95-266a45b7dd4d)]</sup><sup>[[FireEye Periscope March 2018](https://app.tidalcyber.com/references/8edb5d2b-b5c4-4d9d-8049-43dd6ca9ab7f)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0065",
"observed_countries": [
"BE",
"KH",
"CA",
"DE",
"HK",
"MY",
"NO",
"PH",
"SA",
"CH",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"96d58ca1-ab18-4e53-8891-d8ba62a47e5d",
"6070668f-1cbd-4878-8066-c636d1d8659c",
"d8f7e071-fbfd-46f8-b431-e241bb1513ac",
"758c3085-2f79-40a8-ab95-f8a684737927",
"1dc8fd1e-0737-405a-98a1-111dd557f1b5",
"61cdbb28-cbfd-498b-9ab1-1f14337f9524",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"35e694ec-5133-46e3-b7e1-5831867c3b55",
"ee3188ce-20e9-4e8e-bbfd-cdc527d5a2b2",
"a10eccee-317c-40f7-988f-f79517cf42e8",
"375983b3-6e87-4281-99e2-1561519dd17b",
"3ed2343c-a29c-42e2-8259-410381164c6a",
"a46c422c-5dad-49fc-a4ac-169a075a4d9a",
"2eeef0b4-08b5-4d25-84f7-25d41fe6305b",
"64d3f7d8-30b7-4b03-bee2-a6029672216c",
"7e6ef160-8e4f-4132-bdc4-9991f01c472e",
"b20e7912-6a8d-46e3-8e13-9a3fc4813852",
"931d2342-5165-41cf-a5a9-8308d9c9f7ed"
],
"target_categories": [
"Aerospace",
"Defense",
"Education",
"Government",
"Healthcare",
"Manufacturing",
"Maritime",
"Transportation"
]
},
"related": [],
"uuid": "eadd78e3-3b5d-430a-b994-4360b172c871",
"value": "Leviathan"
},
{
"description": "This object represents the LockBit Ransomware-as-a-Service (\"RaaS\") apex group and the behaviors associated with its various affiliate ransomware operators. Specific affiliate operations defined by the research community will be tracked as separate objects.\n\nRansomware labeled \"LockBit\" was first observed in 2020. LockBit developers have introduced multiple versions of the LockBit encryption tool. According to the U.S. Cybersecurity and Infrastructure Security Agency (\"CISA\"), the following major LockBit variants have been observed (first-observed dates in parentheses): ABCD (LockBit malware's predecessor; September 2019), LockBit (January 2020), LockBit 2.0 (June 2021), LockBit Linux-ESXi Locker (October 2021), LockBit 3.0 (March 2022), LockBit Green (a variant that incorporates source code from Conti ransomware; January 2023), and variants capable of targeting macOS environments (April 2023). As of June 2023, CISA reported that the web panel that offers affiliates access to LockBit malware explicitly listed the LockBit 2.0, LockBit 3.0, LockBit Green, and LockBit Linux-ESXi Locker variants.<sup>[[U.S. CISA Understanding LockBit June 2023](/references/9c03b801-2ebe-4c7b-aa29-1b7a3625964a)]</sup>\n\nSince emerging in 2020, the LockBit group and its affiliates have carried out a very large number of attacks involving a wide range of victims around the world. In June 2023, the U.S. Federal Bureau of Investigation reported it had identified 1,700 LockBit attacks since 2020.<sup>[[U.S. CISA Understanding LockBit June 2023](/references/9c03b801-2ebe-4c7b-aa29-1b7a3625964a)]</sup> According to data collected by the [ransomwatch project](https://github.com/joshhighet/ransomwatch) and analyzed by Tidal, LockBit actors publicly claimed 970 victims in 2022 (576 associated with the LockBit 2.0 variant and 394 associated with LockBit 3.0), the most of any extortion threat that year. Through April 2023, LockBit had claimed 406 victims, more than double the number of the next threat (Clop, with 179 victims).<sup>[[GitHub ransomwatch](/references/62037959-58e4-475a-bb91-ff360d20c1d7)]</sup> CISA reported in June 2023 that U.S. ransoms paid to LockBit since January 2020 totaled $91 million.<sup>[[U.S. CISA Understanding LockBit June 2023](/references/9c03b801-2ebe-4c7b-aa29-1b7a3625964a)]</sup>\n\nLockBit affiliate operators are known to use a wide variety of techniques during their attacks. Initial access for LockBit infections has occurred via most methods (including a number of vulnerability exploits), and operators are known to abuse a range of free and open-source software tools for a variety of post-exploitation activities. In addition to victim data encryption, LockBit actors routinely exfiltrate victim data and threaten to leak this data for extortion purposes.\n\n**Related Vulnerabilities**: CVE-2021-22986, CVE-2023-0669, CVE-2023-27350, CVE-2021-44228, CVE-2021-22986, CVE-2020-1472, CVE-2019-0708, CVE-2018-13379<sup>[[U.S. CISA Understanding LockBit June 2023](/references/9c03b801-2ebe-4c7b-aa29-1b7a3625964a)]</sup>",
"meta": {
"group_attack_id": "G3013",
"observed_countries": [
"AR",
"AU",
"AT",
"BE",
"BR",
"CA",
"CO",
"EG",
"FR",
"DE",
"HK",
"IN",
"ID",
"IL",
"IT",
"JP",
"KW",
"MY",
"MX",
"MA",
"NL",
"NZ",
"NO",
"PE",
"PH",
"PL",
"PT",
"RO",
"SG",
"ZA",
"ES",
"SE",
"CH",
"TW",
"TH",
"AE",
"GB",
"US",
"VE",
"VN"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"64d3f7d8-30b7-4b03-bee2-a6029672216c",
"375983b3-6e87-4281-99e2-1561519dd17b",
"3ed2343c-a29c-42e2-8259-410381164c6a",
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"793f4441-3916-4b3d-a3fd-686a59dc3de2",
"1b5da77a-bf84-4fba-a6d7-8b3b8f7699e0",
"c79f7ba7-a2f2-43ff-8c78-521807ef6c92",
"3535caad-a155-4996-b986-70bc3cd5ce1e",
"d713747c-2d53-487e-9dac-259230f04460",
"fde4c246-7d2d-4d53-938b-44651cf273f1",
"964c2590-4b52-48c6-afff-9a6d72e68908",
"4fb4824e-1995-4c65-8c71-e818c0aa1086",
"af5e9be5-b86e-47af-91dd-966a5e34a186",
"758c3085-2f79-40a8-ab95-f8a684737927",
"2185ed93-7e1c-4553-9452-c8411b5dca93",
"904ad11a-20ca-479c-ad72-74bd5d9dc7e4",
"1dc8fd1e-0737-405a-98a1-111dd557f1b5",
"35e694ec-5133-46e3-b7e1-5831867c3b55",
"15787198-6c8b-4f79-bf50-258d55072fee",
"15b77e5c-2285-434d-9719-73c14beba8bd",
"1b98f09a-7d93-4abb-8f3e-1eacdb9f9871",
"ecd84106-2a5b-4d25-854e-b8d1f57f6b75",
"2743d495-7728-4a75-9e5f-b64854039792",
"7e6ef160-8e4f-4132-bdc4-9991f01c472e",
"992bdd33-4a47-495d-883a-58010a2f0efb",
"e401022a-36ac-486d-8503-dd531410a927",
"1a7cb7b6-d151-4fc6-8de1-78f244ac9f72",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Agriculture",
"Automotive",
"Banks",
"Casinos Gambling",
"Construction",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"High Tech",
"Hospitality Leisure",
"Insurance",
"Legal",
"Manufacturing",
"Maritime",
"Media",
"Non Profit",
"Pharmaceuticals",
"Retail",
"Technology",
"Telecommunications",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "d0f3353c-fbdd-4bd5-8793-a42e1f319b59",
"value": "LockBit Ransomware Actors & Affiliates"
},
{
"description": "[Lotus Blossom](https://app.tidalcyber.com/groups/2849455a-cf39-4a9f-bd89-c2b3c1e5dd52) is a threat group that has targeted government and military organizations in Southeast Asia. <sup>[[Lotus Blossom Jun 2015](https://app.tidalcyber.com/references/46fdb8ca-b14d-43bd-a20f-cae7b26e56c6)]</sup>",
"meta": {
"group_attack_id": "G0030",
"observed_countries": [
"HK",
"ID",
"PH",
"TW",
"VN"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government"
]
},
"related": [],
"uuid": "2849455a-cf39-4a9f-bd89-c2b3c1e5dd52",
"value": "Lotus Blossom"
},
{
"description": "[LuminousMoth](https://app.tidalcyber.com/groups/b10aa4c0-10a1-5e08-8d9d-82ce95d45e6a) is a Chinese-speaking cyber espionage group that has been active since at least October 2020. [LuminousMoth](https://app.tidalcyber.com/groups/b10aa4c0-10a1-5e08-8d9d-82ce95d45e6a) has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between [LuminousMoth](https://app.tidalcyber.com/groups/b10aa4c0-10a1-5e08-8d9d-82ce95d45e6a) and [Mustang Panda](https://app.tidalcyber.com/groups/4a4641b1-7686-49da-8d83-00d8013f4b47) based on similar targeting and TTPs, as well as network infrastructure overlaps.<sup>[[Kaspersky LuminousMoth July 2021](https://app.tidalcyber.com/references/e21c6931-fba8-52b0-b6f0-1c8222881fbd)]</sup><sup>[[Bitdefender LuminousMoth July 2021](https://app.tidalcyber.com/references/6b1ce8bb-4e77-59f3-87ff-78f4a1a10ad3)]</sup>",
"meta": {
"group_attack_id": "G1014",
"source": "MITRE"
},
"related": [],
"uuid": "b10aa4c0-10a1-5e08-8d9d-82ce95d45e6a",
"value": "LuminousMoth"
},
{
"description": "Luna Moth (aka Silent Ransom Group) is a financially-motivated, extortion-focused adversary active since at least March 2022 and through at least June 2023. The group is known for carrying out \"callback phishing\" attacks, where actors entice victims to call an actor-controlled number, for example by sending a fraudulent email that claims the victim recently registered for a popular subscription service. Once connected, actors would convince victims to join a live, actor-connected sessions with legitimate remote access tools provided via a link in a subsequent email, then install other legitimate remote administration software used to support further discovery and exfiltration activity.<sup>[[Sygnia Luna Moth July 1 2022](/references/115590b2-ab57-432c-900e-000627464a11)]</sup><sup>[[FBI Ransomware Tools November 7 2023](/references/e096e1f4-6b62-4756-8811-f263cf1dcecc)]</sup>",
"meta": {
"group_attack_id": "G3042",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Legal",
"Retail"
]
},
"related": [],
"uuid": "cca12ba9-f65f-4a29-87ab-a9fc0f99521f",
"value": "Luna Moth"
},
{
"description": "[Machete](https://app.tidalcyber.com/groups/a3be79a2-3d4f-4697-a8a1-83f0884220af) is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. [Machete](https://app.tidalcyber.com/groups/a3be79a2-3d4f-4697-a8a1-83f0884220af) generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies.<sup>[[Cylance Machete Mar 2017](https://app.tidalcyber.com/references/92a9a311-1e0b-4819-9856-2dfc8dbfc08d)]</sup><sup>[[Securelist Machete Aug 2014](https://app.tidalcyber.com/references/fc7be240-bd15-4ec4-bc01-f8891d7210d9)]</sup><sup>[[ESET Machete July 2019](https://app.tidalcyber.com/references/408d5e33-fcb6-4d21-8be9-7aa5a8bd3385)]</sup><sup>[[360 Machete Sep 2020](https://app.tidalcyber.com/references/682c843d-1bb8-4f30-9d2e-35e8d41b1976)]</sup>",
"meta": {
"group_attack_id": "G0095",
"observed_countries": [
"AR",
"BE",
"BO",
"BR",
"CA",
"CN",
"CO",
"CU",
"DO",
"EC",
"FR",
"DE",
"GT",
"MY",
"MX",
"NI",
"PE",
"RU",
"ES",
"SE",
"UA",
"GB",
"US",
"VE"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government",
"Telecommunications",
"Utilities"
]
},
"related": [],
"uuid": "a3be79a2-3d4f-4697-a8a1-83f0884220af",
"value": "Machete"
},
{
"description": "[Magic Hound](https://app.tidalcyber.com/groups/7a9d653c-8812-4b96-81d1-b0a27ca918b4) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.<sup>[[FireEye APT35 2018](https://app.tidalcyber.com/references/71d3db50-4a20-4d8e-a640-4670d642205c)]</sup><sup>[[ClearSky Kittens Back 3 August 2020](https://app.tidalcyber.com/references/a10c6a53-79bb-4454-b444-cfb9136ecd36)]</sup><sup>[[Certfa Charming Kitten January 2021](https://app.tidalcyber.com/references/c38a8af6-3f9b-40c3-8122-a2a51eb50664)]</sup><sup>[[Secureworks COBALT ILLUSION Threat Profile](https://app.tidalcyber.com/references/8d9a5b77-2516-4ad5-9710-4c8165df2882)]</sup><sup>[[Proofpoint TA453 July2021](https://app.tidalcyber.com/references/a987872f-2176-437c-a38f-58676b7b12de)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0059",
"observed_countries": [
"AF",
"CA",
"EG",
"IR",
"IQ",
"IL",
"JO",
"KW",
"MA",
"PK",
"SA",
"ES",
"SY",
"TR",
"AE",
"GB",
"US",
"VE",
"YE"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"24448a05-2337-4bc9-a889-a83f2fd1f3ad",
"3ed2343c-a29c-42e2-8259-410381164c6a",
"375983b3-6e87-4281-99e2-1561519dd17b",
"64d3f7d8-30b7-4b03-bee2-a6029672216c",
"915e7ac2-b266-45d7-945c-cb04327d6246",
"e499005b-adba-45bb-85e3-07043fd9edf9",
"8b1cb0dc-dd3e-44ba-828c-55c040e93b93",
"5f5e40cd-0732-4eb4-a083-06940623c3f9",
"1b98f09a-7d93-4abb-8f3e-1eacdb9f9871"
],
"target_categories": [
"Construction",
"Defense",
"Education",
"Energy",
"Entertainment",
"Government",
"Human Rights",
"Media",
"Telecommunications"
]
},
"related": [],
"uuid": "7a9d653c-8812-4b96-81d1-b0a27ca918b4",
"value": "Magic Hound"
},
{
"description": "[Malteiro](https://app.tidalcyber.com/groups/803f8018-6e45-5b0f-978f-1fe96b217120) is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the [Mispadu](https://app.tidalcyber.com/software/758e5226-6015-5cc7-af4b-20fa35c9bac1) banking trojan via a Malware-as-a-Service (MaaS) business model. [Malteiro](https://app.tidalcyber.com/groups/803f8018-6e45-5b0f-978f-1fe96b217120) mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).<sup>[[SCILabs Malteiro 2021](https://app.tidalcyber.com/references/c6948dfc-b133-556b-a8ac-b3a4dba09c0e)]</sup>",
"meta": {
"country": "BR",
"group_attack_id": "G1026",
"observed_countries": [
"MX",
"PT",
"ES"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Financial Services",
"Government",
"Healthcare",
"Manufacturing",
"Retail",
"Telecommunications"
]
},
"related": [],
"uuid": "803f8018-6e45-5b0f-978f-1fe96b217120",
"value": "Malteiro"
},
{
"description": "MedusaLocker is a ransomware-as-a-service (\"RaaS\") operation that has been active since September 2019. U.S. cybersecurity authorities indicate that MedusaLocker operators have primarily targeted victims in the healthcare sector, among other unspecified sectors. Initial access for MedusaLocker intrusions originally came via phishing and spam email campaigns, but since 2022 has typically occurred via exploit of vulnerable Remote Desktop Protocol devices.<sup>[[HC3 Analyst Note MedusaLocker Ransomware February 2023](/references/49e314d6-5324-41e0-8bee-2b3e08d5e12f)]</sup>\n \nThis object represents behaviors associated with operators of MedusaLocker ransomware. As MedusaLocker is licensed on a RaaS model, affiliates likely do not act as a single cohesive unit, and behaviors observed during particular attacks may vary. Behaviors associated with samples of MedusaLocker ransomware are represented in the \"MedusaLocker Ransomware\" Software object.\n\n**Malpedia (Research)**: https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker",
"meta": {
"group_attack_id": "G3015",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"65cf80be-342d-4eba-bf8d-2477923f0ce4",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"15787198-6c8b-4f79-bf50-258d55072fee",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Healthcare"
]
},
"related": [],
"uuid": "55b20209-c04a-47ab-805d-ace83522ef6a",
"value": "MedusaLocker Ransomware Actors"
},
{
"description": "Medusa is a ransomware operation that reportedly launched in June 2021. In 2023, the group launched a website used to publicize alleged victims. The group appears to be independent of the similarly named \"MedusaLocker\" operation.<sup>[[Bleeping Computer Medusa Ransomware March 12 2023](/references/21fe1d9e-17f1-49e2-b05f-78e9160f5414)]</sup>\n\nAccording to data collected by the [ransomwatch project](https://github.com/joshhighet/ransomwatch) and analyzed by Tidal, Medusa actors publicly claimed around 90 victims through September 2023, ranking it ninth out of the 50+ ransomware operations in the dataset. These victims come from a wide variety of industry sectors and localities.<sup>[[GitHub ransomwatch](/references/62037959-58e4-475a-bb91-ff360d20c1d7)]</sup>",
"meta": {
"group_attack_id": "G3021",
"observed_countries": [
"CA",
"CL",
"CY",
"CZ",
"FR",
"PF",
"IN",
"ID",
"KE",
"MX",
"MA",
"CH",
"TO",
"AE",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Aerospace",
"Automotive",
"Casinos Gambling",
"Education",
"Electronics",
"Energy",
"Financial Services",
"Healthcare",
"Hospitality Leisure",
"Insurance",
"Legal",
"Media",
"Pharmaceuticals",
"Retail",
"Telecommunications",
"Transportation"
]
},
"related": [],
"uuid": "316a49d5-5fe0-4e0b-a276-f955f4277162",
"value": "Medusa Ransomware Actors"
},
{
"description": "[menuPass](https://app.tidalcyber.com/groups/fb93231d-2ae4-45da-9dea-4c372a11f322) is a threat group that has been active since at least 2006. Individual members of [menuPass](https://app.tidalcyber.com/groups/fb93231d-2ae4-45da-9dea-4c372a11f322) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.<sup>[[DOJ APT10 Dec 2018](https://app.tidalcyber.com/references/3ddc68b4-53f1-4fa5-b7f3-4e5d7d9661f2)]</sup><sup>[[District Court of NY APT10 Indictment December 2018](https://app.tidalcyber.com/references/79ccbc74-b9c4-4dc8-91ae-1d15c4db563b)]</sup>\n\n[menuPass](https://app.tidalcyber.com/groups/fb93231d-2ae4-45da-9dea-4c372a11f322) has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.<sup>[[Palo Alto menuPass Feb 2017](https://app.tidalcyber.com/references/ba4f7d65-73ec-4726-b1f6-f2443ffda5e7)]</sup><sup>[[Crowdstrike CrowdCast Oct 2013](https://app.tidalcyber.com/references/2062a229-58b3-4610-99cb-8907e7fbb350)]</sup><sup>[[FireEye Poison Ivy](https://app.tidalcyber.com/references/c189447e-a903-4dc2-a38b-1f4accc64e20)]</sup><sup>[[PWC Cloud Hopper April 2017](https://app.tidalcyber.com/references/fe741064-8cd7-428b-bdb9-9f2ab7e92489)]</sup><sup>[[FireEye APT10 April 2017](https://app.tidalcyber.com/references/2d494df8-83e3-45d2-b798-4c3bcf55f675)]</sup><sup>[[DOJ APT10 Dec 2018](https://app.tidalcyber.com/references/3ddc68b4-53f1-4fa5-b7f3-4e5d7d9661f2)]</sup><sup>[[District Court of NY APT10 Indictment December 2018](https://app.tidalcyber.com/references/79ccbc74-b9c4-4dc8-91ae-1d15c4db563b)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0045",
"observed_countries": [
"AU",
"BE",
"BR",
"CA",
"CN",
"FI",
"FR",
"DE",
"HK",
"IN",
"IL",
"IT",
"JP",
"KR",
"ME",
"NL",
"NO",
"PH",
"SG",
"ZA",
"SE",
"CH",
"TW",
"TH",
"TR",
"AE",
"GB",
"US",
"VN"
],
"observed_motivations": [
"Cyber Espionage",
"Financial Gain"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Construction",
"Defense",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Manufacturing",
"Maritime",
"Mining",
"Pharmaceuticals",
"Technology"
]
},
"related": [],
"uuid": "fb93231d-2ae4-45da-9dea-4c372a11f322",
"value": "menuPass"
},
{
"description": "[Metador](https://app.tidalcyber.com/groups/a3a3a1d3-7fe7-5578-8c5f-9c0f2f68079b) is a suspected cyber espionage group that was first reported in September 2022. [Metador](https://app.tidalcyber.com/groups/a3a3a1d3-7fe7-5578-8c5f-9c0f2f68079b) has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group [Metador](https://app.tidalcyber.com/groups/a3a3a1d3-7fe7-5578-8c5f-9c0f2f68079b) based on the \"I am meta\" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.<sup>[[SentinelLabs Metador Sept 2022](https://app.tidalcyber.com/references/137474b7-638a-56d7-9ce2-ab906f207175)]</sup>",
"meta": {
"group_attack_id": "G1013",
"source": "MITRE"
},
"related": [],
"uuid": "a3a3a1d3-7fe7-5578-8c5f-9c0f2f68079b",
"value": "Metador"
},
{
"description": "[Moafee](https://app.tidalcyber.com/groups/4510ce41-27b9-479c-9bf3-a328b77bae29) is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group [DragonOK](https://app.tidalcyber.com/groups/f2c2db08-624c-46b9-b7ed-b22c21b81813). <sup>[[Haq 2014](https://app.tidalcyber.com/references/4e10228d-d9da-4ba4-bca7-d3bbdce42e0d)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0002",
"observed_countries": [
"JP",
"TW",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government",
"Manufacturing"
]
},
"related": [],
"uuid": "4510ce41-27b9-479c-9bf3-a328b77bae29",
"value": "Moafee"
},
{
"description": "[Mofang](https://app.tidalcyber.com/groups/8bc69792-c26d-4493-87e3-d8e47605fed8) is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.<sup>[[FOX-IT May 2016 Mofang](https://app.tidalcyber.com/references/f1a08b1c-f7d5-4a91-b3b7-0f042b297842)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0103",
"observed_countries": [
"CA",
"DE",
"IN",
"KR",
"MM",
"SG",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Automotive",
"Defense",
"Government",
"Infrastructure"
]
},
"related": [],
"uuid": "8bc69792-c26d-4493-87e3-d8e47605fed8",
"value": "Mofang"
},
{
"description": "[Molerats](https://app.tidalcyber.com/groups/679b7b6b-9659-4e56-9ffd-688a6fab01b6) is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.<sup>[[DustySky](https://app.tidalcyber.com/references/b9e0770d-f54a-4ada-abd1-65c45eee00fa)]</sup><sup>[[DustySky2](https://app.tidalcyber.com/references/4a3ecdec-254c-4eb4-9126-f540bb21dffe)]</sup><sup>[[Kaspersky MoleRATs April 2019](https://app.tidalcyber.com/references/38216a34-5ffd-4e79-80b1-7270743b728e)]</sup><sup>[[Cybereason Molerats Dec 2020](https://app.tidalcyber.com/references/81a10a4b-c66f-4526-882c-184436807e1d)]</sup>",
"meta": {
"group_attack_id": "G0021",
"observed_countries": [
"EG",
"IQ",
"IL",
"PS",
"SA",
"TR",
"AE",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Banks",
"Government",
"Media",
"NGOs"
]
},
"related": [],
"uuid": "679b7b6b-9659-4e56-9ffd-688a6fab01b6",
"value": "Molerats"
},
{
"description": "Moonstone Sleet is a North Korea state-aligned threat actor group that has targeted individuals and organizations related to the software, information technology, education, and defense industrial base sectors, for both financial gain and espionage purposes. The group is believed to be well-resourced, capable of conducting multiple distinct campaigns simultaneously. Microsoft security researchers assess that Moonstone Sleet has expanded its capabilities, with possible goals of enabling disruptive operations and/or software supply chain attacks.<sup>[[Microsoft Security Blog 5 28 2024](/references/faf315ed-71f7-4e29-8334-701da35a69ad)]</sup>",
"meta": {
"country": "KP",
"group_attack_id": "G3039",
"observed_motivations": [
"Cyber Espionage",
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Aerospace",
"Defense",
"Education",
"Technology"
]
},
"related": [],
"uuid": "3b8a2c50-5d8e-49b4-bd50-10ae66ca6c72",
"value": "Moonstone Sleet"
},
{
"description": "[Moses Staff](https://app.tidalcyber.com/groups/a41725c5-eb3a-4772-8d1e-17c3bbade79c) is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. [Moses Staff](https://app.tidalcyber.com/groups/a41725c5-eb3a-4772-8d1e-17c3bbade79c) openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.<sup>[[Checkpoint MosesStaff Nov 2021](https://app.tidalcyber.com/references/d6da2849-cff0-408a-9f09-81a33fc88a56)]</sup> \n\nSecurity researchers assess [Moses Staff](https://app.tidalcyber.com/groups/a41725c5-eb3a-4772-8d1e-17c3bbade79c) is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.<sup>[[Cybereason StrifeWater Feb 2022](https://app.tidalcyber.com/references/30c911b2-9a5e-4510-a78c-c65e84398c7e)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G1009",
"observed_countries": [
"CL",
"DE",
"IN",
"IL",
"IT",
"TR",
"AE",
"US"
],
"observed_motivations": [
"Cyber Espionage",
"Destruction"
],
"source": "MITRE",
"target_categories": [
"Energy",
"Financial Services",
"Government",
"Manufacturing",
"Travel Services",
"Utilities"
]
},
"related": [],
"uuid": "a41725c5-eb3a-4772-8d1e-17c3bbade79c",
"value": "Moses Staff"
},
{
"description": "[MoustachedBouncer](https://app.tidalcyber.com/groups/f31df12e-66ea-5a49-87bc-2bc1756a89fc) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.<sup>[[MoustachedBouncer ESET August 2023](https://app.tidalcyber.com/references/9070f14b-5d5e-5f6d-bcac-628478e01242)]</sup>",
"meta": {
"group_attack_id": "G1019",
"observed_countries": [
"BY"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government"
]
},
"related": [],
"uuid": "f31df12e-66ea-5a49-87bc-2bc1756a89fc",
"value": "MoustachedBouncer"
},
{
"description": "[MuddyWater](https://app.tidalcyber.com/groups/dcb260d8-9d53-404f-9ff5-dbee2c6effe6) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).<sup>[[CYBERCOM Iranian Intel Cyber January 2022](https://app.tidalcyber.com/references/671e1559-c7dc-4cb4-a9a1-21776f2ae56a)]</sup> Since at least 2017, [MuddyWater](https://app.tidalcyber.com/groups/dcb260d8-9d53-404f-9ff5-dbee2c6effe6) has targeted a range of government and private organizations across sectors, including telecommunications, local government, defense, and oil and natural gas organizations, in the Middle East, Asia, Africa, Europe, and North America.<sup>[[Unit 42 MuddyWater Nov 2017](https://app.tidalcyber.com/references/dcdee265-2e46-4f40-95c7-6a2683edb23a)]</sup><sup>[[Symantec MuddyWater Dec 2018](https://app.tidalcyber.com/references/a8e58ef1-91e1-4f93-b2ff-faa7a6365f5d)]</sup><sup>[[ClearSky MuddyWater Nov 2018](https://app.tidalcyber.com/references/a5f60f45-5df5-407d-9f68-bc5f7c42ee85)]</sup><sup>[[ClearSky MuddyWater June 2019](https://app.tidalcyber.com/references/9789d60b-a417-42dc-b690-24ccb77b8658)]</sup><sup>[[Reaqta MuddyWater November 2017](https://app.tidalcyber.com/references/ecd28ccf-edb6-478d-a8f1-da630df42127)]</sup><sup>[[DHS CISA AA22-055A MuddyWater February 2022](https://app.tidalcyber.com/references/e76570e1-43ab-4819-80bc-895ede67a205)]</sup><sup>[[Talos MuddyWater Jan 2022](https://app.tidalcyber.com/references/a2d79c6a-16d6-4dbd-b8a5-845dcc36212d)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0069",
"observed_countries": [
"AF",
"AM",
"AT",
"AZ",
"BH",
"BY",
"EG",
"GE",
"IN",
"IR",
"IQ",
"IL",
"JO",
"KW",
"LA",
"LB",
"ML",
"NL",
"OM",
"PK",
"RU",
"SA",
"TJ",
"TH",
"TN",
"TR",
"UA",
"AE",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"ee3188ce-20e9-4e8e-bbfd-cdc527d5a2b2",
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"0eab0089-86a5-43b1-9ddb-8960f1005267",
"992bdd33-4a47-495d-883a-58010a2f0efb"
],
"target_categories": [
"Education",
"Energy",
"Government",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "dcb260d8-9d53-404f-9ff5-dbee2c6effe6",
"value": "MuddyWater"
},
{
"description": "[Mustang Panda](https://app.tidalcyber.com/groups/4a4641b1-7686-49da-8d83-00d8013f4b47) is a China-based cyber espionage threat actor that was first observed in 2017 but may have been conducting operations since at least 2014. [Mustang Panda](https://app.tidalcyber.com/groups/4a4641b1-7686-49da-8d83-00d8013f4b47) has targeted government entities, nonprofits, religious, and other non-governmental organizations in the U.S., Europe, Mongolia, Myanmar, Pakistan, and Vietnam, among others.<sup>[[Crowdstrike MUSTANG PANDA June 2018](https://app.tidalcyber.com/references/35e72170-b1ec-49c9-aefe-a24fc4302fa6)]</sup><sup>[[Anomali MUSTANG PANDA October 2019](https://app.tidalcyber.com/references/70277fa4-60a8-475e-993a-c74241b76127)]</sup><sup>[[Secureworks BRONZE PRESIDENT December 2019](https://app.tidalcyber.com/references/019889e0-a2ce-476f-9a31-2fc394de2821)]</sup> ",
"meta": {
"country": "CN",
"group_attack_id": "G0129",
"observed_countries": [
"AU",
"BD",
"BE",
"CN",
"CY",
"ET",
"DE",
"GR",
"HK",
"IN",
"ID",
"KR",
"MN",
"MM",
"NP",
"PK",
"RU",
"SG",
"ZA",
"SS",
"TW",
"GB",
"US",
"VN"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government",
"NGOs",
"Non Profit",
"Think Tanks",
"Travel Services"
]
},
"related": [],
"uuid": "4a4641b1-7686-49da-8d83-00d8013f4b47",
"value": "Mustang Panda"
},
{
"description": "[Mustard Tempest](https://app.tidalcyber.com/groups/0898e7cb-118e-5eeb-b856-04e56ed18182) is an initial access broker that has operated the [SocGholish](https://app.tidalcyber.com/software/ab84f259-9b9a-51d8-a68a-2bcd7512d760) distribution network since at least 2017. [Mustard Tempest](https://app.tidalcyber.com/groups/0898e7cb-118e-5eeb-b856-04e56ed18182) has partnered with [Indrik Spider](https://app.tidalcyber.com/groups/3c7ad595-1940-40fc-b9ca-3e649c1e5d87) to provide access for the download of additional malware including LockBit, [WastedLocker](https://app.tidalcyber.com/software/0ba6ee8d-2b29-4980-8e55-348ea05f00ad), and remote access tools.<sup>[[Microsoft Ransomware as a Service](https://app.tidalcyber.com/references/833018b5-6ef6-5327-9af5-1a551df25cd2)]</sup><sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[Secureworks Gold Prelude Profile](https://app.tidalcyber.com/references/b16ae37d-5244-5c1e-92a9-e494b5a9ef49)]</sup><sup>[[SocGholish-update](https://app.tidalcyber.com/references/01d9c3ba-29e2-5090-b399-0e7adf50a6b9)]</sup>",
"meta": {
"group_attack_id": "G1020",
"source": "MITRE"
},
"related": [],
"uuid": "0898e7cb-118e-5eeb-b856-04e56ed18182",
"value": "Mustard Tempest"
},
{
"description": "[Naikon](https://app.tidalcyber.com/groups/a80c00b2-b8b6-4780-99bb-df8fe921947d) is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).<sup>[[CameraShy](https://app.tidalcyber.com/references/9942b6a5-6ffb-4a26-9392-6c8bb9954997)]</sup> Active since at least 2010, [Naikon](https://app.tidalcyber.com/groups/a80c00b2-b8b6-4780-99bb-df8fe921947d) has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).<sup>[[CameraShy](https://app.tidalcyber.com/references/9942b6a5-6ffb-4a26-9392-6c8bb9954997)]</sup><sup>[[Baumgartner Naikon 2015](https://app.tidalcyber.com/references/09302b4f-7f71-4289-92f6-076c685f0810)]</sup> \n\nWhile [Naikon](https://app.tidalcyber.com/groups/a80c00b2-b8b6-4780-99bb-df8fe921947d) shares some characteristics with [APT30](https://app.tidalcyber.com/groups/be45ff95-6c74-4000-bc39-63044673d82f), the two groups do not appear to be exact matches.<sup>[[Baumgartner Golovkin Naikon 2015](https://app.tidalcyber.com/references/5163576f-0b2c-49ba-8f34-b7efe3f3f6db)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0019",
"observed_countries": [
"AU",
"BN",
"KH",
"CN",
"IN",
"ID",
"KR",
"LA",
"MY",
"MM",
"NP",
"PH",
"SA",
"SG",
"TH",
"US",
"VN"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government"
]
},
"related": [],
"uuid": "a80c00b2-b8b6-4780-99bb-df8fe921947d",
"value": "Naikon"
},
{
"description": "[NEODYMIUM](https://app.tidalcyber.com/groups/3a660ef3-9954-4252-8946-f903f3f42d0c) is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called [PROMETHIUM](https://app.tidalcyber.com/groups/cc798766-8662-4b55-8536-6d057fbc58f0) due to overlapping victim and campaign characteristics. <sup>[[Microsoft NEODYMIUM Dec 2016](https://app.tidalcyber.com/references/87c9f8e4-f8d1-4f19-86ca-6fd18a33890b)]</sup> <sup>[[Microsoft SIR Vol 21](https://app.tidalcyber.com/references/619b9cf8-7201-45de-9c36-834ccee356a9)]</sup> [NEODYMIUM](https://app.tidalcyber.com/groups/3a660ef3-9954-4252-8946-f903f3f42d0c) is reportedly associated closely with [BlackOasis](https://app.tidalcyber.com/groups/428dc121-a593-4981-9127-f958ae0a0fdd) operations, but evidence that the group names are aliases has not been identified. <sup>[[CyberScoop BlackOasis Oct 2017](https://app.tidalcyber.com/references/a8224ad5-4688-4382-a3e7-1dd3ed74ebce)]</sup>",
"meta": {
"group_attack_id": "G0055",
"observed_countries": [
"TR"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE"
},
"related": [],
"uuid": "3a660ef3-9954-4252-8946-f903f3f42d0c",
"value": "NEODYMIUM"
},
{
"description": "\n[Nomadic Octopus](https://app.tidalcyber.com/groups/5f8c6ee0-f302-403b-b712-f1e3df064c0c) is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. [Nomadic Octopus](https://app.tidalcyber.com/groups/5f8c6ee0-f302-403b-b712-f1e3df064c0c) has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.<sup>[[Security Affairs DustSquad Oct 2018](https://app.tidalcyber.com/references/0e6b019c-cf8e-40a7-9e7c-6a7dc5309dc6)]</sup><sup>[[Securelist Octopus Oct 2018](https://app.tidalcyber.com/references/77407057-53f1-4fde-bc74-00f73d417f7d)]</sup><sup>[[ESET Nomadic Octopus 2018](https://app.tidalcyber.com/references/50dcb3f0-1461-453a-aab9-38c2e259173f)]</sup>",
"meta": {
"group_attack_id": "G0133",
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government"
]
},
"related": [],
"uuid": "5f8c6ee0-f302-403b-b712-f1e3df064c0c",
"value": "Nomadic Octopus"
},
{
"description": "[OilRig](https://app.tidalcyber.com/groups/d01abdb1-0378-4654-aa38-1a4a292703e2) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.<sup>[[FireEye APT34 Dec 2017](https://app.tidalcyber.com/references/88f41728-08ad-4cd8-a418-895738d68b04)]</sup><sup>[[Palo Alto OilRig April 2017](https://app.tidalcyber.com/references/fb561cdd-03f6-4867-b5b5-7e4deb11f0d0)]</sup><sup>[[ClearSky OilRig Jan 2017](https://app.tidalcyber.com/references/f19f9ad4-bb31-443b-9c26-87946469a0c3)]</sup><sup>[[Palo Alto OilRig May 2016](https://app.tidalcyber.com/references/53836b95-a30a-4e95-8e19-e2bb2f18c738)]</sup><sup>[[Palo Alto OilRig Oct 2016](https://app.tidalcyber.com/references/14bbb07b-caeb-4d17-8e54-047322a5930c)]</sup><sup>[[Unit42 OilRig Playbook 2023](https://app.tidalcyber.com/references/e38902bb-9bab-5beb-817b-668a67a76541)]</sup><sup>[[Unit 42 QUADAGENT July 2018](https://app.tidalcyber.com/references/320f49df-7b0a-4a6a-8542-17b0f56c94c9)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0049",
"observed_countries": [
"AZ",
"IQ",
"IL",
"KW",
"LB",
"MU",
"PK",
"QA",
"SA",
"TR",
"AE",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"0f1b7cb0-c4de-485e-8ff5-fe12ffccd738",
"15f2277a-a17e-4d85-8acd-480bf84f16b4",
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"
],
"target_categories": [
"Banks",
"Chemical",
"Energy",
"Financial Services",
"Government",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "d01abdb1-0378-4654-aa38-1a4a292703e2",
"value": "OilRig"
},
{
"description": "[Orangeworm](https://app.tidalcyber.com/groups/863b7013-133d-4a82-93d2-51b53a8fd30e) is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.<sup>[[Symantec Orangeworm April 2018](https://app.tidalcyber.com/references/eee5efa1-bbc6-44eb-8fae-23002f351605)]</sup> Reverse engineering of [Kwampirs](https://app.tidalcyber.com/software/35ac4018-8506-4025-a9e3-bd017700b3b3), directly associated with [Orangeworm](https://app.tidalcyber.com/groups/863b7013-133d-4a82-93d2-51b53a8fd30e) activity, indicates significant functional and development overlaps with [Shamoon](https://app.tidalcyber.com/software/840db1db-e262-4d6f-b6e3-2a64696a41c5).<sup>[[Cylera Kwampirs 2022](https://app.tidalcyber.com/references/06442111-2c71-5efb-9530-cabeba159a91)]</sup>",
"meta": {
"group_attack_id": "G0071",
"observed_countries": [
"BE",
"BR",
"CA",
"CL",
"CN",
"FR",
"DE",
"HK",
"HU",
"IN",
"JP",
"MY",
"NL",
"NO",
"PH",
"PL",
"PT",
"SA",
"ES",
"SE",
"CH",
"TR",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Healthcare",
"Pharmaceuticals"
]
},
"related": [],
"uuid": "863b7013-133d-4a82-93d2-51b53a8fd30e",
"value": "Orangeworm"
},
{
"description": "[Patchwork](https://app.tidalcyber.com/groups/32385eba-7bbf-439e-acf2-83040e97165a) is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://app.tidalcyber.com/groups/32385eba-7bbf-439e-acf2-83040e97165a) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://app.tidalcyber.com/groups/32385eba-7bbf-439e-acf2-83040e97165a) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.<sup>[[Cymmetria Patchwork](https://app.tidalcyber.com/references/d4e43b2c-a858-4285-984f-f59db5c657bd)]</sup> <sup>[[Symantec Patchwork](https://app.tidalcyber.com/references/a6172463-56e2-49f2-856d-f4f8320d7c6e)]</sup><sup>[[TrendMicro Patchwork Dec 2017](https://app.tidalcyber.com/references/15465b26-99e1-4956-8c81-cda3388169b8)]</sup><sup>[[Volexity Patchwork June 2018](https://app.tidalcyber.com/references/d3ed7dd9-0941-4160-aa6a-c0244c63560f)]</sup>",
"meta": {
"group_attack_id": "G0040",
"observed_countries": [
"CN",
"JP",
"GB",
"US"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Energy",
"Financial Services",
"Government",
"NGOs",
"Technology",
"Think Tanks"
]
},
"related": [],
"uuid": "32385eba-7bbf-439e-acf2-83040e97165a",
"value": "Patchwork"
},
{
"description": "This object represents a collection of MITRE ATT&CK® Techniques and other objects (Software and/or Campaigns) related to the Phobos ransomware-as-a-service (\"RaaS\") operation. Further background & contextual details can be found in the References tab below.",
"meta": {
"group_attack_id": "G3033",
"observed_countries": [
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"ee8be47a-dbd8-4067-8785-2fc1450587eb",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"d819ae1a-e385-49fd-88d5-f66660729ecb",
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"15787198-6c8b-4f79-bf50-258d55072fee",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Education",
"Government",
"Healthcare",
"Infrastructure"
]
},
"related": [],
"uuid": "f138c814-48c0-4638-a4d6-edc48e7ac23a",
"value": "Phobos Ransomware Actors"
},
{
"description": "[PittyTiger](https://app.tidalcyber.com/groups/60936d3c-37ed-4116-a407-868da3aa4446) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.<sup>[[Bizeul 2014](https://app.tidalcyber.com/references/a4617ef4-e6d2-47e7-8f81-68e7380279bf)]</sup><sup>[[Villeneuve 2014](https://app.tidalcyber.com/references/a156e24e-0da5-4ac7-b914-29f2f05e7d6f)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0011",
"observed_countries": [
"TW"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Energy",
"Telecommunications"
]
},
"related": [],
"uuid": "60936d3c-37ed-4116-a407-868da3aa4446",
"value": "PittyTiger"
},
{
"description": "[PLATINUM](https://app.tidalcyber.com/groups/f036b992-4c3f-47b7-a458-94ac133bce74) is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. <sup>[[Microsoft PLATINUM April 2016](https://app.tidalcyber.com/references/d0ec5037-aa7f-48ee-8d37-ff8fb2c8c297)]</sup>",
"meta": {
"group_attack_id": "G0068",
"observed_countries": [
"CN",
"IN",
"ID",
"MY",
"SG",
"TH"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Education",
"Government",
"Telecommunications"
]
},
"related": [],
"uuid": "f036b992-4c3f-47b7-a458-94ac133bce74",
"value": "PLATINUM"
},
{
"description": "*Operationalize this intelligence by pivoting to relevant defensive resources via the Techniques below. Alternatively, use the **Add to Matrix** button above, then overlay entire sets of capabilities from your own defensive stack to identify threat overlaps & potential gaps (watch a [60-second tutorial here](https://www.youtube.com/watch?v=4jBo3XLO01E)).*\n\nPlay is a ransomware operation first observed in mid-2022. Security researchers have observed filename, filepath, and TTP overlaps between Play and Hive and Nokoyawa ransomwares, which themselves are believed to be linked.<sup>[[Trend Micro Play Playbook September 06 2022](/references/2d2b527d-25b0-4b58-9ae6-c87060b64069)]</sup> According to publicly available ransomware extortion threat data, Play has claimed more than 300 victims from a wide range of sectors on its data leak site since December 2022.<sup>[[GitHub ransomwatch](/references/62037959-58e4-475a-bb91-ff360d20c1d7)]</sup>\n\n**Malpedia (Research)**: https://malpedia.caad.fkie.fraunhofer.de/details/win.play\n\n**PulseDive (IOCs)**: https://pulsedive.com/threat/PlayCrypt",
"meta": {
"group_attack_id": "G3016",
"observed_countries": [
"AR",
"BE",
"CA",
"CZ",
"FR",
"DE",
"IT",
"KR",
"NO",
"SE",
"AE",
"GB",
"US",
"VE"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"a2e000da-8181-4327-bacd-32013dbd3654",
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"17864218-bc4f-4564-8abf-97c988eea9f7",
"b6458e46-650e-4e96-8e68-8a9d70bcf045",
"bac51672-8240-4182-9087-23626023e509",
"2743d495-7728-4a75-9e5f-b64854039792"
],
"target_categories": [
"Automotive",
"Construction",
"Energy",
"Financial Services",
"Government",
"Legal",
"Media",
"Non Profit",
"Retail",
"Technology",
"Transportation"
]
},
"related": [],
"uuid": "6eb50f82-86cc-4eff-b1d1-66e1c6fd74f3",
"value": "Play Ransomware Actors"
},
{
"description": "[POLONIUM](https://app.tidalcyber.com/groups/7fbd7514-76e9-4696-8c66-9f95546e3315) is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess [POLONIUM](https://app.tidalcyber.com/groups/7fbd7514-76e9-4696-8c66-9f95546e3315) has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.<sup>[[Microsoft POLONIUM June 2022](https://app.tidalcyber.com/references/689ff1ab-9fed-4aa2-8e5e-78dac31e6fbd)]</sup>",
"meta": {
"group_attack_id": "G1005",
"source": "MITRE"
},
"related": [],
"uuid": "7fbd7514-76e9-4696-8c66-9f95546e3315",
"value": "POLONIUM"
},
{
"description": "[Poseidon Group](https://app.tidalcyber.com/groups/553e2b7b-170c-4eb5-812b-ea33fe1dd4a0) is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the [Poseidon Group](https://app.tidalcyber.com/groups/553e2b7b-170c-4eb5-812b-ea33fe1dd4a0) as a security firm. <sup>[[Kaspersky Poseidon Group](https://app.tidalcyber.com/references/e53bc63e-986f-4d48-a6b7-ed8e93494ed5)]</sup>",
"meta": {
"group_attack_id": "G0033",
"observed_countries": [
"BR",
"FR",
"IN",
"KZ",
"RU",
"AE",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Energy",
"Entertainment",
"Financial Services",
"Manufacturing",
"Utilities"
]
},
"related": [],
"uuid": "553e2b7b-170c-4eb5-812b-ea33fe1dd4a0",
"value": "Poseidon Group"
},
{
"description": "[PROMETHIUM](https://app.tidalcyber.com/groups/cc798766-8662-4b55-8536-6d057fbc58f0) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://app.tidalcyber.com/groups/cc798766-8662-4b55-8536-6d057fbc58f0) has demonstrated similarity to another activity group called [NEODYMIUM](https://app.tidalcyber.com/groups/3a660ef3-9954-4252-8946-f903f3f42d0c) due to overlapping victim and campaign characteristics.<sup>[[Microsoft NEODYMIUM Dec 2016](https://app.tidalcyber.com/references/87c9f8e4-f8d1-4f19-86ca-6fd18a33890b)]</sup><sup>[[Microsoft SIR Vol 21](https://app.tidalcyber.com/references/619b9cf8-7201-45de-9c36-834ccee356a9)]</sup><sup>[[Talos Promethium June 2020](https://app.tidalcyber.com/references/188d990e-f0be-40f2-90f3-913dfe687d27)]</sup>",
"meta": {
"group_attack_id": "G0056",
"observed_countries": [
"TR"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE"
},
"related": [],
"uuid": "cc798766-8662-4b55-8536-6d057fbc58f0",
"value": "PROMETHIUM"
},
{
"description": "[Putter Panda](https://app.tidalcyber.com/groups/6005f4a9-fe26-4237-a44e-3f6cbb1fe75c) is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). <sup>[[CrowdStrike Putter Panda](https://app.tidalcyber.com/references/413962d0-bd66-4000-a077-38c2677995d1)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0024",
"observed_countries": [
"JP",
"US"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Defense",
"Government",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "6005f4a9-fe26-4237-a44e-3f6cbb1fe75c",
"value": "Putter Panda"
},
{
"description": "7777 or Quad7 is a botnet used to compromise network devices such as TP-LINK small office/home office (\"SOHO\") routers and use the infected devices to relay password spraying attacks against Microsoft 365 accounts.<sup>[[Sekoia.io Blog July 23 2024](/references/ae84e72a-56b3-4dc4-b053-d3766764ac0d)]</sup><sup>[[Sekoia.io Blog September 9 2024](/references/eb4a1888-3b04-449b-9738-d96ae26adfee)]</sup> This object reflects the various Techniques observed in use by the threat actors known to operate this botnet.",
"meta": {
"group_attack_id": "G3052",
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"15f2277a-a17e-4d85-8acd-480bf84f16b4",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "bf3d1108-0bcd-47ae-8d71-4df48e3e2b43",
"value": "Quad7 Botnet Operators"
},
{
"description": "This Group object reflects the tools & TTPs associated with threat actors known to deploy Quantum ransomware (aka Quantum Locker, which derives from the MountLocker, AstroLocker, and XingLocker ransomware families). The Quantum group is known to publicly extort its victims.<sup>[[Cybereason Quantum Ransomware May 9 2022](/references/19027620-216a-4921-8d78-f56377778a12)]</sup> Researchers indicate the group is a rebranding of the \"Conti Team Two\" that formed after the fragmenting of the Ryuk/Conti ransom group in early 2022.<sup>[[AdvIntel Bazar Call August 10 2022](/references/5d3dff70-28c2-42a5-bf58-211fe6491fd2)]</sup>",
"meta": {
"group_attack_id": "G3043",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "e75a1b98-be68-467f-a8df-bcb7671543b3",
"value": "Quantum Ransomware Actors"
},
{
"description": "[Rancor](https://app.tidalcyber.com/groups/021b3c71-6467-4e46-a413-8b726f066f2c) is a threat group that has led targeted campaigns against the South East Asia region. [Rancor](https://app.tidalcyber.com/groups/021b3c71-6467-4e46-a413-8b726f066f2c) uses politically-motivated lures to entice victims to open malicious documents. <sup>[[Rancor Unit42 June 2018](https://app.tidalcyber.com/references/45098a85-a61f-491a-a549-f62b02dc2ecd)]</sup>",
"meta": {
"group_attack_id": "G0075",
"observed_countries": [
"KH",
"SG"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE"
},
"related": [],
"uuid": "021b3c71-6467-4e46-a413-8b726f066f2c",
"value": "Rancor"
},
{
"description": "RansomHub is an extortion group that regularly republicizes victim data allegedly stolen in other ransomware groups' attacks, but it is also believed to have developed an original ransomware payload.<sup>[[BroadcomSW June 5 2024](/references/3fa49490-cb22-4362-bf48-eaba9e83e6f5)]</sup><sup>[[The Record RansomHub June 3 2024](/references/1e474240-bd12-4472-8e69-1631b0e4c102)]</sup> This object reflects the ATT&CK Techniques and/or associated Software & Campaigns linked to attacks by actors deploying RansomHub ransomware.",
"meta": {
"group_attack_id": "G3049",
"observed_countries": [
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"d903e38b-600d-4736-9e3b-cf1a6e436481",
"d819ae1a-e385-49fd-88d5-f66660729ecb",
"15787198-6c8b-4f79-bf50-258d55072fee",
"32b1a271-7856-4dda-a802-42325f465d36",
"89c5b94b-ecf4-4d53-9b74-3465086d4565",
"09de661e-60c4-43fb-bfef-df017215d1d8",
"8046a757-48f0-4787-81ab-9dc8c1eb77cd",
"abe1c785-4f3a-4f4f-96eb-c47da570face",
"9794c389-183b-4d6b-bd59-95cfa4a5afc7",
"4ac8dcde-2665-4066-9ad9-b5572d5f0d28",
"b8448700-7ed0-48b8-85f5-ed23e0d9ab97",
"c475ad68-3fdc-4725-8abc-784c56125e96",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Agriculture",
"Financial Services",
"Government",
"Healthcare",
"Manufacturing",
"Technology",
"Telecommunications",
"Transportation",
"Utilities",
"Water"
]
},
"related": [],
"uuid": "94794e7b-8b54-4be8-885a-fd1009425ed5",
"value": "RansomHub Ransomware Actors"
},
{
"description": "This object represents the behaviors associated with operators of Rhysida ransomware, which is licensed on a ransomware-as-a-service (\"RaaS\") basis. Various affiliated ransomware operators likely do not operate as a cohesive unit. The Rhysida RaaS operation has been active since May 2023, claiming attacks on multiple sectors in several countries in North and South America, Western Europe, and Australia. Many alleged victims are education sector entities. Security researchers have observed TTP and victimology overlaps with the Vice Society extortion group.<sup>[[HC3 Analyst Note Rhysida Ransomware August 2023](/references/3f6e2821-5073-4382-b5dd-08676eaa2240)]</sup>\n\n**Related Vulnerabilities**: CVE-2020-1472<sup>[[U.S. CISA Rhysida Ransomware November 15 2023](/references/6d902955-d9a9-4ec1-8dd4-264f7594605e)]</sup>",
"meta": {
"group_attack_id": "G3017",
"observed_countries": [
"AU",
"AT",
"BR",
"CA",
"FR",
"DE",
"IN",
"ID",
"IL",
"IT",
"KE",
"NL",
"QA",
"SG",
"ES",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"1bafa336-67a8-4094-bb2e-2079a7bdaab5",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"15787198-6c8b-4f79-bf50-258d55072fee",
"2743d495-7728-4a75-9e5f-b64854039792",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Banks",
"Education",
"Government",
"Healthcare",
"Insurance",
"Manufacturing",
"Technology",
"Utilities"
]
},
"related": [],
"uuid": "0610cd57-2511-467a-97e3-3c810384074f",
"value": "Rhysida Ransomware Actors"
},
{
"description": "[Rocke](https://app.tidalcyber.com/groups/71222310-2807-4599-bb92-248eaf2e03ab) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://app.tidalcyber.com/groups/71222310-2807-4599-bb92-248eaf2e03ab) comes from the email address \"rocke@live.cn\" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://app.tidalcyber.com/groups/71222310-2807-4599-bb92-248eaf2e03ab) and the Iron Cybercrime Group, though this attribution has not been confirmed.<sup>[[Talos Rocke August 2018](https://app.tidalcyber.com/references/bff0ee40-e583-4f73-a013-4669ca576904)]</sup>",
"meta": {
"group_attack_id": "G0106",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE"
},
"related": [],
"uuid": "71222310-2807-4599-bb92-248eaf2e03ab",
"value": "Rocke"
},
{
"description": "Royal is a ransomware group believed to be responsible for hundreds of attacks on victims worldwide, including those in critical infrastructure sectors including manufacturing, communications, healthcare, and education. The actors that comprise the Royal ransomware operation are believed to be former members of other cybercriminal groups linked to Roy/Zeon ransomware, Conti ransomware, and TrickBot. Unlike many of the other most prominent ransomware groups in recent years, the developers of Royal ransomware are not known to lease the malware to affiliates as a service.<sup>[[Kroll Royal Deep Dive February 2023](/references/dcdcc965-56d0-58e6-996b-d8bd40916745)]</sup>\n\nThe Royal group often pressures victims into paying ransom demands by threatening to leak data exfiltrated during intrusions. While public data from the [ransomwatch project](https://github.com/joshhighet/ransomwatch) suggest the group has claimed roughly 200 victims since Q4 2022, a November 2023 U.S. government advisory indicated that Royal “has targeted over 350 known victims worldwide” since September 2022, with extortion demands at times exceeding $250 million.<sup>[[GitHub ransomwatch](/references/62037959-58e4-475a-bb91-ff360d20c1d7)]</sup><sup>[[CISA Royal AA23-061A March 2023](/references/81baa61e-13c3-51e0-bf22-08383dbfb2a1)]</sup>",
"meta": {
"group_attack_id": "G3003",
"observed_countries": [
"AU",
"BR",
"CA",
"DE",
"IT",
"MX",
"PT",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"e551ae97-d1b4-484e-9267-89f33829ec2c",
"a2e000da-8181-4327-bacd-32013dbd3654",
"d63754b9-0267-4a70-82a3-212ef32fa796",
"15787198-6c8b-4f79-bf50-258d55072fee",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Agriculture",
"Construction",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"High Tech",
"Hospitality Leisure",
"Insurance",
"Legal",
"Manufacturing",
"Media",
"Non Profit",
"Retail",
"Telecommunications",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "86b97a39-49c3-431e-bcc8-f4e13dbfcdf5",
"value": "Royal Ransomware Actors"
},
{
"description": "[RTM](https://app.tidalcyber.com/groups/666ab5f0-3ef1-4e74-8a10-65c60a7d1acd) is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name ([RTM](https://app.tidalcyber.com/software/1836485e-a3a6-4fae-a15d-d0990788811a)). <sup>[[ESET RTM Feb 2017](https://app.tidalcyber.com/references/ab2cced7-05b8-4788-8d3c-8eadb0aaf38c)]</sup>",
"meta": {
"group_attack_id": "G0048",
"observed_countries": [
"CZ",
"DE",
"KZ",
"RU",
"UA"
],
"source": "MITRE"
},
"related": [],
"uuid": "666ab5f0-3ef1-4e74-8a10-65c60a7d1acd",
"value": "RTM"
},
{
"description": "[Sandworm Team](https://app.tidalcyber.com/groups/16a65ee9-cd60-4f04-ba34-f2f45fcfc666) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.<sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup> This group has been active since at least 2009.<sup>[[iSIGHT Sandworm 2014](https://app.tidalcyber.com/references/63622990-5467-42b2-8f45-b675dfc4dc8f)]</sup><sup>[[CrowdStrike VOODOO BEAR](https://app.tidalcyber.com/references/ce07d409-292d-4e8e-b1af-bd5ba46c1b95)]</sup><sup>[[USDOJ Sandworm Feb 2020](https://app.tidalcyber.com/references/fefa7321-cd60-4c7e-a9d5-c723d88013f2)]</sup><sup>[[NCSC Sandworm Feb 2020](https://app.tidalcyber.com/references/d876d037-9d24-44af-b8f0-5c1555632b91)]</sup>\n\nIn October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://app.tidalcyber.com/groups/16a65ee9-cd60-4f04-ba34-f2f45fcfc666) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://app.tidalcyber.com/software/2538e0fe-1290-4ae1-aef9-e55d83c9eb23) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://app.tidalcyber.com/software/073b5288-11d6-4db0-9f2c-a1816847d15c) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.<sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup> Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://app.tidalcyber.com/groups/5b1a5b9e-4722-41fc-a15d-196a549e3ac5).<sup>[[US District Court Indictment GRU Oct 2018](https://app.tidalcyber.com/references/56aeab4e-b046-4426-81a8-c3b2323492f0)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0034",
"observed_countries": [
"AZ",
"BY",
"FR",
"GE",
"IR",
"IL",
"KZ",
"KR",
"KG",
"LT",
"PL",
"RU",
"UA",
"US"
],
"observed_motivations": [
"Cyber Espionage",
"Destruction"
],
"source": "MITRE",
"tags": [
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647",
"b20e7912-6a8d-46e3-8e13-9a3fc4813852",
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"
],
"target_categories": [
"Defense",
"Energy",
"Government",
"Media",
"NGOs",
"Transportation"
]
},
"related": [],
"uuid": "16a65ee9-cd60-4f04-ba34-f2f45fcfc666",
"value": "Sandworm Team"
},
{
"description": "SCARLETEEL is a threat actor known to leverage various cloud-based technologies in order to steal proprietary software and other data from victim environments.<sup>[[Sysdig Scarleteel February 28 2023](/references/18931f81-51bf-44af-9573-512ccb66c238)]</sup>",
"meta": {
"group_attack_id": "G3032",
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"efa33611-88a5-40ba-9bc4-3d85c6c8819b",
"4fa6f8e1-b0d5-4169-8038-33e355c08bde",
"2e5f6e4a-4579-46f7-9997-6923180815dd",
"8d95e4d6-9a1e-4920-9f5c-83d9fe07a66e",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "788ffbf6-1a36-481a-a504-bbcd9f907886",
"value": "SCARLETEEL"
},
{
"description": "Scarlet Goldfinch is a threat activity cluster that typically tricks victims into downloading files that appear to be web browser updates, with the file ultimately leading to the deployment of NetSupport Manager, a remote monitoring and management (RMM) utility that has been heavily abused by adversaries.<sup>[[Red Canary June 26 2024](/references/e0d62504-6fec-4d95-9f4a-e0dda7e7b6d9)]</sup>",
"meta": {
"group_attack_id": "G5023",
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "54a13c54-a1d5-46e9-b155-56d981a5ad8f",
"value": "Scarlet Goldfinch"
},
{
"description": "[Scarlet Mimic](https://app.tidalcyber.com/groups/6c1bdc51-f633-4512-8b20-04a11c2d97f4) is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by [Scarlet Mimic](https://app.tidalcyber.com/groups/6c1bdc51-f633-4512-8b20-04a11c2d97f4) and [Putter Panda](https://app.tidalcyber.com/groups/6005f4a9-fe26-4237-a44e-3f6cbb1fe75c), it has not been concluded that the groups are the same. <sup>[[Scarlet Mimic Jan 2016](https://app.tidalcyber.com/references/f84a5b6d-3af1-45b1-ac55-69ceced8735f)]</sup>",
"meta": {
"group_attack_id": "G0029",
"observed_countries": [
"CN"
],
"source": "MITRE",
"target_categories": [
"Human Rights"
]
},
"related": [],
"uuid": "6c1bdc51-f633-4512-8b20-04a11c2d97f4",
"value": "Scarlet Mimic"
},
{
"description": "[Scattered Spider](https://app.tidalcyber.com/groups/3d77fb6c-cfb4-5563-b0be-7aa1ad535337) is a native English-speaking cybercriminal group that has been active since at least 2022.<sup>[[CrowdStrike Scattered Spider Profile](https://app.tidalcyber.com/references/a865a984-7f7b-5f82-ac4a-6fac79a2a753)]</sup><sup>[[MSTIC Octo Tempest Operations October 2023](https://app.tidalcyber.com/references/92716d7d-3ca5-5d7a-b719-946e94828f13)]</sup> The group initially targeted customer relationship management and business-process outsourcing (BPO) firms as well as telecommunications and technology companies. Beginning in 2023, [Scattered Spider](https://app.tidalcyber.com/groups/3d77fb6c-cfb4-5563-b0be-7aa1ad535337) expanded its operations to compromise victims in the gaming, hospitality, retail, MSP, manufacturing, and financial sectors.<sup>[[MSTIC Octo Tempest Operations October 2023](https://app.tidalcyber.com/references/92716d7d-3ca5-5d7a-b719-946e94828f13)]</sup> During campaigns, [Scattered Spider](https://app.tidalcyber.com/groups/3d77fb6c-cfb4-5563-b0be-7aa1ad535337) has leveraged targeted social-engineering techniques, attempted to bypass popular endpoint security tools, and more recently, deployed ransomware for financial gain.<sup>[[CISA Scattered Spider Advisory November 2023](https://app.tidalcyber.com/references/deae8b2c-39dd-5252-b846-88e1cab099c2)]</sup><sup>[[CrowdStrike Scattered Spider BYOVD January 2023](https://app.tidalcyber.com/references/d7d86f5d-1f02-54b0-b6f4-879878563245)]</sup><sup>[[CrowdStrike Scattered Spider Profile](https://app.tidalcyber.com/references/a865a984-7f7b-5f82-ac4a-6fac79a2a753)]</sup><sup>[[MSTIC Octo Tempest Operations October 2023](https://app.tidalcyber.com/references/92716d7d-3ca5-5d7a-b719-946e94828f13)]</sup><sup>[[Crowdstrike TELCO BPO Campaign December 2022](https://app.tidalcyber.com/references/382785e1-4ef3-506e-b74f-cd07df9ae46e)]</sup>",
"meta": {
"group_attack_id": "G1015",
"observed_countries": [
"AU",
"BR",
"CA",
"CR",
"DK",
"FR",
"IN",
"IE",
"IL",
"JP",
"SE",
"CH",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"fe28cf32-a15c-44cf-892c-faa0360d6109",
"15f2277a-a17e-4d85-8acd-480bf84f16b4",
"c9c73000-30a5-4a16-8c8b-79169f9c24aa",
"15787198-6c8b-4f79-bf50-258d55072fee",
"2e5f6e4a-4579-46f7-9997-6923180815dd",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Aerospace",
"Banks",
"Casinos Gambling",
"Commercial",
"Construction",
"Defense",
"Education",
"Entertainment",
"Financial Services",
"Hospitality Leisure",
"Insurance",
"Legal",
"Media",
"Pharmaceuticals",
"Retail",
"Technology",
"Telecommunications",
"Transportation",
"Utilities",
"Video Games"
]
},
"related": [],
"uuid": "3d77fb6c-cfb4-5563-b0be-7aa1ad535337",
"value": "Scattered Spider"
},
{
"description": "[SideCopy](https://app.tidalcyber.com/groups/31bc763e-623f-4870-9780-86e43d732594) is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. [SideCopy](https://app.tidalcyber.com/groups/31bc763e-623f-4870-9780-86e43d732594)'s name comes from its infection chain that tries to mimic that of [Sidewinder](https://app.tidalcyber.com/groups/44f8bd4e-a357-4a76-b031-b7455a305ef0), a suspected Indian threat group.<sup>[[MalwareBytes SideCopy Dec 2021](https://app.tidalcyber.com/references/466569a7-1ef8-4824-bd9c-d25301184ea4)]</sup>",
"meta": {
"group_attack_id": "G1008",
"source": "MITRE"
},
"related": [],
"uuid": "31bc763e-623f-4870-9780-86e43d732594",
"value": "SideCopy"
},
{
"description": "[Sidewinder](https://app.tidalcyber.com/groups/44f8bd4e-a357-4a76-b031-b7455a305ef0) is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.<sup>[[ATT Sidewinder January 2021](https://app.tidalcyber.com/references/d6644f88-d727-4f62-897a-bfa18f86380d)]</sup><sup>[[Securelist APT Trends April 2018](https://app.tidalcyber.com/references/587f5195-e696-4a3c-8c85-90b9c002cd11)]</sup><sup>[[Cyble Sidewinder September 2020](https://app.tidalcyber.com/references/25d8d6df-d3b9-4f57-bce0-d5285660e746)]</sup>",
"meta": {
"country": "IN",
"group_attack_id": "G0121",
"observed_countries": [
"AF",
"BD",
"CN",
"MM",
"NP",
"PK",
"QA",
"LK"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Energy",
"Government",
"Mining"
]
},
"related": [],
"uuid": "44f8bd4e-a357-4a76-b031-b7455a305ef0",
"value": "Sidewinder"
},
{
"description": "[Silence](https://app.tidalcyber.com/groups/b534349f-55a4-41b8-9623-6707765c3c50) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.<sup>[[Cyber Forensicator Silence Jan 2019](https://app.tidalcyber.com/references/c328d6d3-5e8b-45a6-8487-eecd7e8cbf7e)]</sup><sup>[[SecureList Silence Nov 2017](https://app.tidalcyber.com/references/004a8877-7e57-48ad-a6ce-b9ad8577cc68)]</sup> ",
"meta": {
"group_attack_id": "G0091",
"observed_countries": [
"AZ",
"BY",
"KZ",
"PL",
"RU",
"UA"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"15787198-6c8b-4f79-bf50-258d55072fee"
],
"target_categories": [
"Banks",
"Financial Services"
]
},
"related": [],
"uuid": "b534349f-55a4-41b8-9623-6707765c3c50",
"value": "Silence"
},
{
"description": "[Silent Librarian](https://app.tidalcyber.com/groups/0e7bd4da-7974-49c9-b213-116bd7157761) is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of [Silent Librarian](https://app.tidalcyber.com/groups/0e7bd4da-7974-49c9-b213-116bd7157761) are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).<sup>[[DOJ Iran Indictments March 2018](https://app.tidalcyber.com/references/7dfdccd5-d035-4678-89c1-f5f1630d7a79)]</sup><sup>[[Phish Labs Silent Librarian](https://app.tidalcyber.com/references/d79d0510-4d49-464d-8074-daedd186f1c1)]</sup><sup>[[Malwarebytes Silent Librarian October 2020](https://app.tidalcyber.com/references/9bb8ddd0-a8ec-459b-9983-79ccf46297ca)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G0122",
"observed_countries": [
"AU",
"CA",
"CN",
"FR",
"DE",
"HK",
"IL",
"JP",
"NZ",
"NO",
"OM",
"SA",
"ZA",
"ES",
"SE",
"CH",
"TR",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Education",
"Government"
]
},
"related": [],
"uuid": "0e7bd4da-7974-49c9-b213-116bd7157761",
"value": "Silent Librarian"
},
{
"description": "[SilverTerrier](https://app.tidalcyber.com/groups/e47ae2a7-d34d-4528-ba67-c9c07daa91ba) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://app.tidalcyber.com/groups/e47ae2a7-d34d-4528-ba67-c9c07daa91ba) mainly targets organizations in high technology, higher education, and manufacturing.<sup>[[Unit42 SilverTerrier 2018](https://app.tidalcyber.com/references/59630d6e-d034-4788-b418-a72bafefe54e)]</sup><sup>[[Unit42 SilverTerrier 2016](https://app.tidalcyber.com/references/a6ba79ca-7d4a-48d3-aae3-ee766770f83b)]</sup>",
"meta": {
"country": "NG",
"group_attack_id": "G0083",
"source": "MITRE",
"target_categories": [
"Education",
"Manufacturing",
"Technology",
"Telecommunications",
"Transportation"
]
},
"related": [],
"uuid": "e47ae2a7-d34d-4528-ba67-c9c07daa91ba",
"value": "SilverTerrier"
},
{
"description": "[Sowbug](https://app.tidalcyber.com/groups/6632f07f-7c6b-4d12-8544-82edc6a7a577) is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. <sup>[[Symantec Sowbug Nov 2017](https://app.tidalcyber.com/references/14f49074-fc46-45d3-bf7e-30c896c39c07)]</sup>",
"meta": {
"group_attack_id": "G0054",
"observed_countries": [
"AR",
"BR",
"BN",
"EC",
"MY",
"PE"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government"
]
},
"related": [],
"uuid": "6632f07f-7c6b-4d12-8544-82edc6a7a577",
"value": "Sowbug"
},
{
"description": "Spandex Tempest is a financially motivated adversary group associated with Dudear campaigns, which deliver the FlawedGrace remote access Trojan for information theft purposes.<sup>[[Microsoft Threat Actor Naming](/references/de9cda86-0b23-4bc8-b524-e74fecf99448)]</sup> The group has evolved initial access techniques observed during these campaigns to evade defenses.<sup>[[Microsoft Threat Intelligence Tweet June 17 2020](/references/98fc7485-9424-412f-8162-a69d6c10c243)]</sup>",
"meta": {
"group_attack_id": "G3012",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "eb10ed9e-ea8d-4b61-bfc3-5994d30970df",
"value": "Spandex Tempest"
},
{
"description": "*Operationalize this intelligence by pivoting to relevant defensive resources via the Techniques below. Alternatively, use the **Add to Matrix** button above, then overlay entire sets of capabilities from your own defensive stack to identify threat overlaps & potential gaps (watch a [60-second tutorial here](https://www.youtube.com/watch?v=4jBo3XLO01E)).*\n\nStar Blizzard is believed to be a Russia-based cyber threat actor group. According to joint Cybersecurity Advisory AA23-341A (December 2023), U.S. and international authorities assess that Star Blizzard is “almost certainly” a subordinate of the Russian Federal Security Service (FSB) Centre 18. Star Blizzard is known to successfully use spear-phishing attacks against its targets for information-gathering purposes. The advisory indicated that authorities observed these spear-phishing attacks occurring through 2023. Star Blizzard has traditionally targeted academic, defense, government, non-governmental (NGO), and think tank organizations (and associated personnel) in the United States and United Kingdom, other NATO nations, and countries neighboring Russia. Politicians have also been targeted. According to the advisory, beginning in 2022, authorities witnessed Star Blizzard targeting expand to targets in the defense-industrial sector and U.S. Department of Energy facilities.<sup>[[U.S. CISA Star Blizzard December 2023](/references/3d53c154-8ced-4dbe-ab4e-db3bc15bfe4b)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G3029",
"observed_countries": [
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"82009876-294a-4e06-8cfc-3236a429bda4",
"15f2277a-a17e-4d85-8acd-480bf84f16b4",
"fe28cf32-a15c-44cf-892c-faa0360d6109"
],
"target_categories": [
"Defense",
"Education",
"Energy",
"Government",
"NGOs"
]
},
"related": [],
"uuid": "a13bd574-b907-4489-96ab-8d30faf7fca4",
"value": "Star Blizzard"
},
{
"description": "[Stealth Falcon](https://app.tidalcyber.com/groups/ca3016f3-642a-4ae0-86bc-7258475d6937) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. <sup>[[Citizen Lab Stealth Falcon May 2016](https://app.tidalcyber.com/references/11f46b1e-a141-4d25-bff0-e955251be7f5)]</sup>",
"meta": {
"group_attack_id": "G0038",
"observed_countries": [
"AE"
],
"source": "MITRE",
"target_categories": [
"Entertainment",
"Human Rights"
]
},
"related": [],
"uuid": "ca3016f3-642a-4ae0-86bc-7258475d6937",
"value": "Stealth Falcon"
},
{
"description": "Storm-0844 is a threat actor originally known for distributing Akira ransomware, and more recently, for distributing Fog ransomware. The actor gains initial access likely by abusing valid accounts, then uses freely available tools for discovery, lateral movement, and exfiltration prior to ransomware deployment.<sup>[[Microsoft Threat Intelligence LinkedIn July 15 2024](/references/0e7ea8d0-bdb8-48a6-9718-703f64d16460)]</sup>",
"meta": {
"group_attack_id": "G3046",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "fcbf6963-839b-4853-8b80-73ff6831b7d7",
"value": "Storm-0844"
},
{
"description": "According to Microsoft security researchers, Storm-1811 is a \"financially motivated cybercriminal group known to deploy Black Basta ransomware\".<sup>[[Microsoft Security Blog 5 15 2024](/references/0876de6e-ea0c-4717-89a4-9c7baed53b6f)]</sup>",
"meta": {
"group_attack_id": "G3038",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"562e535e-19f5-4d6c-81ed-ce2aec544f09",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "ee2da206-2532-44e3-a343-d66e9bfdbca0",
"value": "Storm-1811"
},
{
"description": "[Strider](https://app.tidalcyber.com/groups/deb573c6-071a-4b50-9e92-4aa648d8bdc1) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.<sup>[[Symantec Strider Blog](https://app.tidalcyber.com/references/664eac41-257f-4d4d-aba5-5d2e8e2117a7)]</sup><sup>[[Kaspersky ProjectSauron Blog](https://app.tidalcyber.com/references/baeaa632-3fa5-4d2b-9537-ccc7674fd7d6)]</sup>",
"meta": {
"group_attack_id": "G0041",
"observed_countries": [
"BE",
"CN",
"IR",
"RU",
"RW",
"SE"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Defense",
"Financial Services",
"Government",
"Telecommunications"
]
},
"related": [],
"uuid": "deb573c6-071a-4b50-9e92-4aa648d8bdc1",
"value": "Strider"
},
{
"description": "[Suckfly](https://app.tidalcyber.com/groups/06549082-ff70-43bf-985e-88c695c7113c) is a China-based threat group that has been active since at least 2014. <sup>[[Symantec Suckfly March 2016](https://app.tidalcyber.com/references/8711c175-e405-4cb0-8c86-8aaa471e5573)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0039",
"observed_countries": [
"IN"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE"
},
"related": [],
"uuid": "06549082-ff70-43bf-985e-88c695c7113c",
"value": "Suckfly"
},
{
"description": "[TA2541](https://app.tidalcyber.com/groups/1bfbb1e1-022c-57e9-b70e-711c601640be) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://app.tidalcyber.com/groups/1bfbb1e1-022c-57e9-b70e-711c601640be) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.<sup>[[Proofpoint TA2541 February 2022](https://app.tidalcyber.com/references/db0b1425-8bd7-51b5-bae3-53c5ccccb8da)]</sup><sup>[[Cisco Operation Layover September 2021](https://app.tidalcyber.com/references/f19b4bd5-99f9-54c0-bffe-cc9c052aea12)]</sup>",
"meta": {
"group_attack_id": "G1018",
"observed_countries": [
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Aerospace",
"Defense",
"Manufacturing",
"Transportation"
]
},
"related": [],
"uuid": "1bfbb1e1-022c-57e9-b70e-711c601640be",
"value": "TA2541"
},
{
"description": "[TA459](https://app.tidalcyber.com/groups/e343c1f1-458c-467b-bc4a-c1b97b2127e3) is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. <sup>[[Proofpoint TA459 April 2017](https://app.tidalcyber.com/references/dabad6df-1e31-4c16-9217-e079f2493b02)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0062",
"observed_countries": [
"BY",
"MN",
"RU"
],
"source": "MITRE"
},
"related": [],
"uuid": "e343c1f1-458c-467b-bc4a-c1b97b2127e3",
"value": "TA459"
},
{
"description": "[TA505](https://app.tidalcyber.com/groups/b3220638-6682-4a4e-ab64-e7dc4202a3f1) is a cyber criminal group that has been active since at least 2014. [TA505](https://app.tidalcyber.com/groups/b3220638-6682-4a4e-ab64-e7dc4202a3f1) is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving [Clop](https://app.tidalcyber.com/software/5321aa75-924c-47ae-b97a-b36f023abf2a).<sup>[[Proofpoint TA505 Sep 2017](https://app.tidalcyber.com/references/c1fff36f-802b-4436-abce-7f2787c148db)]</sup><sup>[[Proofpoint TA505 June 2018](https://app.tidalcyber.com/references/e48dec7b-5635-4ae0-b0db-229660806c06)]</sup><sup>[[Proofpoint TA505 Jan 2019](https://app.tidalcyber.com/references/b744f739-8810-4fb9-96e3-6488f9ed6305)]</sup><sup>[[NCC Group TA505](https://app.tidalcyber.com/references/45e0b869-5447-491b-9e8b-fbf63c62f5d6)]</sup><sup>[[Korean FSI TA505 2020](https://app.tidalcyber.com/references/d4e2c109-341c-45b3-9d41-3eb980724524)]</sup>",
"meta": {
"group_attack_id": "G0092",
"observed_countries": [
"AU",
"CA",
"DE",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"a98d7a43-f227-478e-81de-e7299639a355"
]
},
"related": [],
"uuid": "b3220638-6682-4a4e-ab64-e7dc4202a3f1",
"value": "TA505"
},
{
"description": "[TA551](https://app.tidalcyber.com/groups/8951bff3-c444-4374-8a9e-b2115d9125b2) is a financially-motivated threat group that has been active since at least 2018. <sup>[[Secureworks GOLD CABIN](https://app.tidalcyber.com/references/778babec-e7d3-4341-9e33-aab361f2b98a)]</sup> The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. <sup>[[Unit 42 TA551 Jan 2021](https://app.tidalcyber.com/references/8e34bf1e-86ce-4d52-a6fa-037572766e99)]</sup>",
"meta": {
"group_attack_id": "G0127",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE"
},
"related": [],
"uuid": "8951bff3-c444-4374-8a9e-b2115d9125b2",
"value": "TA551"
},
{
"description": "*Operationalize this intelligence by pivoting to relevant defensive resources via the Techniques below. Alternatively, use the **Add to Matrix** button above, then overlay entire sets of capabilities from your own defensive stack to identify threat overlaps & potential gaps (watch a [60-second tutorial here](https://www.youtube.com/watch?v=4jBo3XLO01E)).*\n\nTA577 is a cybercriminal actor that has remained highly active since mid-2020. The actor is known for carrying out email-based campaigns that result in the delivery of a wide range of payloads, including at least one leading to ransomware (REvil) deployment. These campaigns are known to impact organizations in a wide range of sectors and geographic locations.<sup>[[Proofpoint Ransomware Initial Access June 2021](/references/3b0631ae-f589-4b7c-a00a-04dcd5f3a77b)]</sup> The actor appears adept at shifting payloads in response to external factors, for example moving to deliver DarkGate and Pikabot shortly after international authorities disrupted the QakBot botnet in August 2023.<sup>[[Malwarebytes Pikabot December 15 2023](/references/50b29ef4-7ade-4672-99b6-fdf367170a5b)]</sup>",
"meta": {
"group_attack_id": "G3031",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
]
},
"related": [],
"uuid": "28f3dbcc-b248-442f-9ff3-234210bb2f2a",
"value": "TA577"
},
{
"description": "[TeamTNT](https://app.tidalcyber.com/groups/325c11be-e1ee-47db-afa6-44ac5d16f0e7) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.<sup>[[Palo Alto Black-T October 2020](https://app.tidalcyber.com/references/d4351c8e-026d-4660-9344-166481ecf64a)]</sup><sup>[[Lacework TeamTNT May 2021](https://app.tidalcyber.com/references/5908b04b-dbca-4fd8-bacc-141ef15546a1)]</sup><sup>[[Intezer TeamTNT September 2020](https://app.tidalcyber.com/references/1155a45e-86f4-497a-9a03-43b6dcb25202)]</sup><sup>[[Cado Security TeamTNT Worm August 2020](https://app.tidalcyber.com/references/8ccab4fe-155d-44b0-b0f2-941e9f8f87db)]</sup><sup>[[Unit 42 Hildegard Malware](https://app.tidalcyber.com/references/0941cf0e-75d8-4c96-bc42-c99d809e75f9)]</sup><sup>[[Trend Micro TeamTNT](https://app.tidalcyber.com/references/d6b52135-6bb2-4e37-8f94-1e1d6354bdfd)]</sup><sup>[[ATT TeamTNT Chimaera September 2020](https://app.tidalcyber.com/references/5d9f402f-4ff4-4993-8685-e5656e2f3aff)]</sup><sup>[[Aqua TeamTNT August 2020](https://app.tidalcyber.com/references/ca10ad0d-1a47-4006-8f76-c2246aee7752)]</sup><sup>[[Intezer TeamTNT Explosion September 2021](https://app.tidalcyber.com/references/e0d6208b-a4d6-45f0-bb3a-6c8681630b55)]</sup>",
"meta": {
"group_attack_id": "G0139",
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"efa33611-88a5-40ba-9bc4-3d85c6c8819b",
"82009876-294a-4e06-8cfc-3236a429bda4",
"4fa6f8e1-b0d5-4169-8038-33e355c08bde",
"2e5f6e4a-4579-46f7-9997-6923180815dd"
]
},
"related": [],
"uuid": "325c11be-e1ee-47db-afa6-44ac5d16f0e7",
"value": "TeamTNT"
},
{
"description": "[TEMP.Veles](https://app.tidalcyber.com/groups/3a54b8dc-a231-4db8-96da-1c0c1aa396f6) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://app.tidalcyber.com/software/), a malware framework designed to manipulate industrial safety systems.<sup>[[FireEye TRITON 2019](https://app.tidalcyber.com/references/49c97b85-ca22-400a-9dc4-6290cc117f04)]</sup><sup>[[FireEye TEMP.Veles 2018](https://app.tidalcyber.com/references/e41151fa-ea11-43ca-9689-c65aae63a8d2)]</sup><sup>[[FireEye TEMP.Veles JSON April 2019](https://app.tidalcyber.com/references/491783dc-7a6b-42a6-b923-c4439117e7e4)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0088",
"observed_countries": [
"SA",
"US"
],
"source": "MITRE",
"tags": [
"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"
],
"target_categories": [
"Infrastructure"
]
},
"related": [],
"uuid": "3a54b8dc-a231-4db8-96da-1c0c1aa396f6",
"value": "TEMP.Veles"
},
{
"description": "[The White Company](https://app.tidalcyber.com/groups/830079fe-9824-405b-93e0-c28592155c49) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.<sup>[[Cylance Shaheen Nov 2018](https://app.tidalcyber.com/references/57802e46-e12c-4230-8d1c-08854a0de06a)]</sup>",
"meta": {
"group_attack_id": "G0089",
"observed_countries": [
"PK"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government"
]
},
"related": [],
"uuid": "830079fe-9824-405b-93e0-c28592155c49",
"value": "The White Company"
},
{
"description": "[Threat Group-1314](https://app.tidalcyber.com/groups/0f86e871-0c6c-4227-ae28-3f3696d6ae9d) is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. <sup>[[Dell TG-1314](https://app.tidalcyber.com/references/79fc7568-b6ff-460b-9200-56d7909ed157)]</sup>",
"meta": {
"group_attack_id": "G0028",
"source": "MITRE"
},
"related": [],
"uuid": "0f86e871-0c6c-4227-ae28-3f3696d6ae9d",
"value": "Threat Group-1314"
},
{
"description": "[Threat Group-3390](https://app.tidalcyber.com/groups/79be2f31-5626-425e-844c-fd9c99e38fe5) is a Chinese threat group that has extensively used strategic Web compromises to target victims.<sup>[[Dell TG-3390](https://app.tidalcyber.com/references/dfd2d832-a6c5-40e7-a554-5a92f05bebae)]</sup> The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.<sup>[[SecureWorks BRONZE UNION June 2017](https://app.tidalcyber.com/references/42adda47-f5d6-4d34-9b3d-3748a782f886)]</sup><sup>[[Securelist LuckyMouse June 2018](https://app.tidalcyber.com/references/f974708b-598c-46a9-aac9-c5fbdd116c2a)]</sup><sup>[[Trend Micro DRBControl February 2020](https://app.tidalcyber.com/references/4dfbf26d-023b-41dd-82c8-12fe18cb10e6)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0027",
"observed_countries": [
"AU",
"CA",
"CN",
"DE",
"HK",
"IN",
"IR",
"IL",
"JP",
"KR",
"MN",
"PH",
"RU",
"ES",
"TW",
"TH",
"TR",
"GB",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"
],
"target_categories": [
"Aerospace",
"Automotive",
"Banks",
"Casinos Gambling",
"Defense",
"Education",
"Energy",
"Government",
"Manufacturing",
"Pharmaceuticals",
"Technology"
]
},
"related": [],
"uuid": "79be2f31-5626-425e-844c-fd9c99e38fe5",
"value": "Threat Group-3390"
},
{
"description": "[Thrip](https://app.tidalcyber.com/groups/a3b39b07-0bfa-4c69-9f01-acf7dc6033b4) is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as \"living off the land\" techniques. <sup>[[Symantec Thrip June 2018](https://app.tidalcyber.com/references/482a6946-b663-4789-a31f-83fb2132118d)]</sup>",
"meta": {
"group_attack_id": "G0076",
"observed_countries": [
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Telecommunications"
]
},
"related": [],
"uuid": "a3b39b07-0bfa-4c69-9f01-acf7dc6033b4",
"value": "Thrip"
},
{
"description": "[ToddyCat](https://app.tidalcyber.com/groups/0f41da7d-1e47-58fe-ba6e-ee658a985e1b) is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.<sup>[[Kaspersky ToddyCat June 2022](https://app.tidalcyber.com/references/285c038b-e5fc-57ef-9a98-d9e24c52e2cf)]</sup><sup>[[Kaspersky ToddyCat Check Logs October 2023](https://app.tidalcyber.com/references/dbdaf320-eada-5bbb-95ab-aaa987ed7960)]</sup>",
"meta": {
"group_attack_id": "G1022",
"source": "MITRE"
},
"related": [],
"uuid": "0f41da7d-1e47-58fe-ba6e-ee658a985e1b",
"value": "ToddyCat"
},
{
"description": "[Tonto Team](https://app.tidalcyber.com/groups/9f5c5672-5e7e-4440-afc8-3fdf46a1bb6c) is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. [Tonto Team](https://app.tidalcyber.com/groups/9f5c5672-5e7e-4440-afc8-3fdf46a1bb6c) has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).<sup>[[Kaspersky CactusPete Aug 2020](https://app.tidalcyber.com/references/1c393964-e717-45ad-8eb6-5df5555d3c70)]</sup><sup>[[ESET Exchange Mar 2021](https://app.tidalcyber.com/references/c83f1810-22bb-4def-ab2f-3f3d67703f47)]</sup><sup>[[FireEye Chinese Espionage October 2019](https://app.tidalcyber.com/references/d37c069c-7fb8-44e1-8377-da97e8bbcf67)]</sup><sup>[[ARS Technica China Hack SK April 2017](https://app.tidalcyber.com/references/c9c647b6-f4fb-44d6-9376-23c1ae9520b4)]</sup><sup>[[Trend Micro HeartBeat Campaign January 2013](https://app.tidalcyber.com/references/f42a36c2-1ca5-49ff-a7ec-7de90379a6d5)]</sup><sup>[[Talos Bisonal 10 Years March 2020](https://app.tidalcyber.com/references/6844e59b-d393-43df-9978-e3e3cc7b8db6)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0131",
"observed_countries": [
"IN",
"JP",
"KR",
"MN",
"RU",
"TW",
"US"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Energy",
"Financial Services",
"Government",
"Manufacturing",
"Mining",
"Technology",
"Telecommunications"
]
},
"related": [],
"uuid": "9f5c5672-5e7e-4440-afc8-3fdf46a1bb6c",
"value": "Tonto Team"
},
{
"description": "[Transparent Tribe](https://app.tidalcyber.com/groups/441b91d1-256a-4763-bac6-8f1c76764a25) is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.<sup>[[Proofpoint Operation Transparent Tribe March 2016](https://app.tidalcyber.com/references/8e39d0da-114f-4ae6-8130-ca1380077d6a)]</sup><sup>[[Kaspersky Transparent Tribe August 2020](https://app.tidalcyber.com/references/42c7faa2-f664-4e4a-9d23-93c88a09da5b)]</sup><sup>[[Talos Transparent Tribe May 2021](https://app.tidalcyber.com/references/5d58c285-bc7d-4a8a-a96a-ac7118c1089d)]</sup>",
"meta": {
"country": "PK",
"group_attack_id": "G0134",
"observed_countries": [
"AF",
"AU",
"AT",
"BD",
"BE",
"BW",
"CA",
"CN",
"CZ",
"GE",
"DE",
"IN",
"IR",
"JP",
"KE",
"LI",
"MY",
"MN",
"NP",
"NL",
"OM",
"PK",
"SA",
"ES",
"SE",
"CH",
"TH",
"TR",
"AE",
"GB",
"US"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government"
]
},
"related": [],
"uuid": "441b91d1-256a-4763-bac6-8f1c76764a25",
"value": "Transparent Tribe"
},
{
"description": "[Tropic Trooper](https://app.tidalcyber.com/groups/0a245c5e-c1a8-480f-8655-bb2594e3266b) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://app.tidalcyber.com/groups/0a245c5e-c1a8-480f-8655-bb2594e3266b) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.<sup>[[TrendMicro Tropic Trooper Mar 2018](https://app.tidalcyber.com/references/5d69d122-13bc-45c4-95ab-68283a21b699)]</sup><sup>[[Unit 42 Tropic Trooper Nov 2016](https://app.tidalcyber.com/references/cad84e3d-9506-44f8-bdd9-d090e6ce9b06)]</sup><sup>[[TrendMicro Tropic Trooper May 2020](https://app.tidalcyber.com/references/4fbc1df0-f174-4461-817d-0baf6e947ba1)]</sup>",
"meta": {
"group_attack_id": "G0081",
"observed_countries": [
"HK",
"PH",
"TW"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Government",
"Healthcare",
"High Tech",
"Transportation"
]
},
"related": [],
"uuid": "0a245c5e-c1a8-480f-8655-bb2594e3266b",
"value": "Tropic Trooper"
},
{
"description": "[Turla](https://app.tidalcyber.com/groups/47ae4fb1-fc61-4e8e-9310-66dda706e1a2) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://app.tidalcyber.com/groups/47ae4fb1-fc61-4e8e-9310-66dda706e1a2) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://app.tidalcyber.com/software/89ffc27c-b81f-473a-87d6-907cacdce61c).<sup>[[Kaspersky Turla](https://app.tidalcyber.com/references/535e9f1a-f89e-4766-a290-c5b8100968f8)]</sup><sup>[[ESET Gazer Aug 2017](https://app.tidalcyber.com/references/9d1c40af-d4bc-4d4a-b667-a17378942685)]</sup><sup>[[CrowdStrike VENOMOUS BEAR](https://app.tidalcyber.com/references/ee400057-2b26-4464-96b4-484c9eb9d5c2)]</sup><sup>[[ESET Turla Mosquito Jan 2018](https://app.tidalcyber.com/references/cd177c2e-ef22-47be-9926-61e25fd5f33b)]</sup><sup>[[Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023](https://app.tidalcyber.com/references/1931b80a-effb-59ec-acae-c0f17efb8cad)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0010",
"observed_countries": [
"AF",
"DZ",
"AR",
"AM",
"AU",
"AT",
"AZ",
"BY",
"BE",
"BO",
"BW",
"BR",
"BG",
"CL",
"CN",
"CY",
"CZ",
"DK",
"EC",
"EE",
"FI",
"FR",
"GE",
"DE",
"HK",
"HU",
"IN",
"ID",
"IR",
"IQ",
"IT",
"JM",
"JO",
"KZ",
"KR",
"KW",
"KG",
"LV",
"LT",
"MX",
"MD",
"ME",
"NL",
"PK",
"PY",
"PL",
"QA",
"RO",
"RU",
"SA",
"RS",
"SG",
"ZA",
"ES",
"SE",
"CH",
"SY",
"TJ",
"TH",
"TN",
"TR",
"TM",
"UA",
"GB",
"US",
"UY",
"UZ",
"VE",
"VN",
"YE"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"a2e000da-8181-4327-bacd-32013dbd3654"
],
"target_categories": [
"Aerospace",
"Defense",
"Education",
"Government",
"Non Profit",
"Pharmaceuticals",
"Telecommunications"
]
},
"related": [],
"uuid": "47ae4fb1-fc61-4e8e-9310-66dda706e1a2",
"value": "Turla"
},
{
"description": "UAT4356 (aka Storm-1849) is an actor attributed to the ArcaneDoor campaign targeting Cisco Adaptive Security Appliance (ASA) network devices. The suspected espionage activity targeted unspecified government institutions around the world.<sup>[[Cisco Talos ArcaneDoor April 24 2024](/references/531c3f6f-2d2b-4774-b069-e2b7a13602c1)]</sup> Anonymous sources indicated that the ArcaneDoor campaign appeared aligned with China's state interests.<sup>[[Wired ArcaneDoor April 24 2024](/references/05a8afd3-0173-41ca-b23b-196ea0f3b1c1)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G3036",
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"a159c91c-5258-49ea-af7d-e803008d97d3",
"6bb2f579-a5cd-4647-9dcd-eff05efe3679",
"c25f341a-7030-4688-a00b-6d637298e52e",
"9768aada-9d63-4d46-ab9f-d41b8c8e4010"
],
"target_categories": [
"Government"
]
},
"related": [],
"uuid": "f69c7e2f-b616-4782-b2f3-28e9b6702eb4",
"value": "UAT4356"
},
{
"description": "UNC3966 is a threat actor group tracked by Mandiant. In an intrusion documented in March 2023, UNC3966 received access to a victim network initially compromised by the group UNC961. UNC3966 primary motivations remain unclear. During the intrusion, the group was observed collecting and exfiltrating victim data. While a ransom note was also discovered, UNC3966 did not appear to deploy ransomware encryption software and did not appear to demand a ransom payment.<sup>[[Mandiant UNC961 March 23 2023](/references/cef19ceb-179f-4d49-acba-5ce40ab9f65e)]</sup>",
"meta": {
"group_attack_id": "G3027",
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "b07431f8-fcf0-4204-8e7c-138eb5cd5342",
"value": "UNC3966"
},
{
"description": "UNC5537 is a threat actor believed to be responsible for compromising a large number of database instances belonging to customers of Snowflake, a multi-cloud data warehousing platform, in Q2 2024. Initial access was largely achieved using stolen customer credentials compromised previously via infostealer malware. Actors sought to monetize their access by selling victim data on underground forums and by extorting victims. Researchers believe UNC5537 is comprised of members based in North America and at least one member in Turkey, and it has targeted hundreds of organizations globally.<sup>[[Google Cloud June 10 2024](/references/0afe3662-b55c-4189-9c9a-2be55a9b6a70)]</sup>",
"meta": {
"group_attack_id": "G3040",
"observed_countries": [
"ES",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"291c006e-f77a-4c9c-ae7e-084974c0e1eb",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Automotive",
"Banks",
"Entertainment",
"Financial Services",
"Retail",
"Technology"
]
},
"related": [],
"uuid": "809c288d-2dec-4c34-8ac1-f91d227ddfbd",
"value": "UNC5537"
},
{
"description": "UNC961 is a financially motivated group active since at least 2018. It traditionally targeted retail and \"business services\" organizations based in North America, until expanding its targeting in 2020 to also include victims in a range of additional sectors in Northern Europe and Western Asia. In all known intrusions, UNC961 gained initial access by exploiting web-facing applications.<sup>[[Mandiant Log4Shell March 28 2022](/references/62d4d685-09c4-47b6-865c-4a6096e551cd)]</sup>",
"meta": {
"group_attack_id": "G3026",
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"7e6ef160-8e4f-4132-bdc4-9991f01c472e",
"b1944c88-95cf-41db-b11c-d9284e733bf2",
"2eeef0b4-08b5-4d25-84f7-25d41fe6305b",
"f8b11afb-0876-4cd2-af74-9b305ff1b311",
"51287d7b-2674-4842-a880-c192d886eac3",
"ab64f2d8-8da3-48de-ac66-0fd91d634b22",
"8e05f5f0-6e25-448d-b08f-4c7627124fbd",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Commercial",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"High Tech",
"Media",
"Retail",
"Transportation"
]
},
"related": [],
"uuid": "e47b2958-b7c4-4fe1-a006-03137db91963",
"value": "UNC961"
},
{
"description": "Vanilla Tempest is a financially motivated threat actor that has been active since July 2022, which has used a variety of ransomware payloads during observed attacks. Microsoft Threat Intelligence researchers indicate that Vanilla Tempest, which was previously tracked under the moniker DEV-0832, \"overlaps with\" activity tracked by other research teams as the Vice Society ransomware/extortion group.<sup>[[MSTIC Vanilla Tempest September 18 2024](/references/24c11dff-21df-4ce9-b3df-2e0a886339ff)]</sup>",
"meta": {
"group_attack_id": "G3054",
"observed_countries": [
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Education",
"Healthcare",
"Manufacturing",
"Technology"
]
},
"related": [],
"uuid": "efd2fca2-45fb-4eaf-82e7-0d20c156f84f",
"value": "Vanilla Tempest"
},
{
"description": "Velvet Ant is a suspected \"China-nexus\" espionage group that has notably targeted network devices as part of its operations. In one case involving an unspecified victim located in East Asia, the group was seen abusing a legacy, internet-exposed F5 BIG-IP load balancer appliance as a command-and-control mechanism, managing to maintain network persistence for a period of three years. As part of the broader investigation into the group, researchers also observed cases of zero-day exploitation of CVE-2024-20399 in Cisco Nexus network switch devices, which allowed actors to upload and execute previously unknown, custom malware. The researchers highlighted how sophisticated threat groups are increasingly targeting network appliances as means of network access and persistence, since those appliances \"are often not sufficiently protected and monitored\".<sup>[[Sygnia Velvet Ant June 17 2024](/references/5c313af4-61a8-449d-a6c7-f7ead6c72e19)]</sup><sup>[[Sygnia Velvet Ant July 1 2024](/references/a0cfeeb6-4617-4dea-80d2-290eaf2bcf5b)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G3044",
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"a98d7a43-f227-478e-81de-e7299639a355",
"72bc70fa-3979-4d3b-a0e9-b9ebebcf2a38",
"a159c91c-5258-49ea-af7d-e803008d97d3",
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "9327f7c0-2187-4b98-9c33-8d89849be0bc",
"value": "Velvet Ant"
},
{
"description": "Vice Society is an extortion-focused threat actor group first observed in mid-2021. The group gained notoriety after targeting a considerable number of educational institutions, especially lower education institutions. Although the education sector accounts for a disproportionate amount of the group’s victims, Vice Society has claimed victims in multiple other industries too, including the healthcare, retail, financial, insurance, and public services sectors. The group regularly pressures victims into paying a ransom by threatening to leak data exfiltrated during its intrusions. Vice Society is not known to have developed its own ransomware, instead deploying other existing families, including HELLOKITTY/FIVEHANDS and Zeppelin.<sup>[[U.S. CISA Vice Society September 2022](/references/0a754513-5f20-44a0-8cea-c5d9519106c8)]</sup>\n\n**Related Vulnerabilities**: CVE-2021-1675<sup>[[Unit 42 Vice Society December 6 2022](/references/6abf7387-0857-4938-b36e-1374a66d4ed8)]</sup>, CVE-2021-34527<sup>[[Unit 42 Vice Society December 6 2022](/references/6abf7387-0857-4938-b36e-1374a66d4ed8)]</sup>",
"meta": {
"group_attack_id": "G3004",
"observed_countries": [
"AR",
"AU",
"AT",
"BR",
"CA",
"CO",
"FR",
"GF",
"DE",
"GR",
"GL",
"IN",
"ID",
"IT",
"KW",
"LB",
"MY",
"NZ",
"PL",
"PT",
"SA",
"SG",
"ES",
"SE",
"CH",
"TH",
"UA",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"4bc9ab8f-7f57-4b1a-8857-ffaa7e5cc930",
"15787198-6c8b-4f79-bf50-258d55072fee",
"a6ba64e1-4b4a-4bbd-a26d-ce35c22b2530",
"adf0c8d2-f06f-49a5-a3f4-e6cf5f502b1c",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Construction",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"High Tech",
"Hospitality Leisure",
"Insurance",
"Legal",
"Manufacturing",
"Media",
"Non Profit",
"Retail",
"Telecommunications",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "2e2d3e75-1160-4ba5-80cc-8e7685fcfc44",
"value": "Vice Society"
},
{
"description": "Void Rabisu is a threat actor believed be responsible for distributing Cuba ransomware.<sup>[[Unit 42 Cuba August 9 2022](/references/06f668d9-9a68-4d2f-b9a0-b92beb3b75d6)]</sup> Trend Micro researchers assess that, since October 2022, Void Rabisu's use of the RomCom backdoor during attacks could suggest a shift in its motivation towards more geopolitically motivated activity.<sup>[[Trend Micro Void Rabisu May 30 2023](/references/5fd628ca-f366-4f0d-b493-8be19fa4dd4e)]</sup>",
"meta": {
"group_attack_id": "G3009",
"observed_countries": [
"UA",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Defense",
"Government",
"Utilities"
]
},
"related": [],
"uuid": "c2015888-72c0-4367-b2cf-df85688a56b7",
"value": "Void Rabisu"
},
{
"description": "[Volatile Cedar](https://app.tidalcyber.com/groups/7c3ef21c-0e1c-43d5-afb0-3a07c5a66937) is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. [Volatile Cedar](https://app.tidalcyber.com/groups/7c3ef21c-0e1c-43d5-afb0-3a07c5a66937) has been operating since 2012 and is motivated by political and ideological interests.<sup>[[CheckPoint Volatile Cedar March 2015](https://app.tidalcyber.com/references/a26344a2-63ca-422e-8cf9-0cf22a5bee72)]</sup><sup>[[ClearSky Lebanese Cedar Jan 2021](https://app.tidalcyber.com/references/53944d48-caa9-4912-b42d-94a3789ed15b)]</sup>",
"meta": {
"country": "LB",
"group_attack_id": "G0123",
"observed_countries": [
"EG",
"JO",
"KW",
"LB",
"SA",
"TR",
"AE"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Defense",
"Education",
"Government",
"Media",
"Telecommunications"
]
},
"related": [],
"uuid": "7c3ef21c-0e1c-43d5-afb0-3a07c5a66937",
"value": "Volatile Cedar"
},
{
"description": "[Volt Typhoon](https://app.tidalcyber.com/groups/4ea1245f-3f35-5168-bd10-1fc49142fd4e) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021. [Volt Typhoon](https://app.tidalcyber.com/groups/4ea1245f-3f35-5168-bd10-1fc49142fd4e) typically focuses on espionage and information gathering and has targeted critical infrastructure organizations in the US including Guam. [Volt Typhoon](https://app.tidalcyber.com/groups/4ea1245f-3f35-5168-bd10-1fc49142fd4e) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.<sup>[[Microsoft Volt Typhoon May 2023](https://app.tidalcyber.com/references/8b74f0b7-9719-598c-b3ee-61d734393e6f)]</sup><sup>[[Joint Cybersecurity Advisory Volt Typhoon June 2023](https://app.tidalcyber.com/references/14872f08-e219-5c0d-a2d7-43a3ba348b4b)]</sup><sup>[[Secureworks BRONZE SILHOUETTE May 2023](https://app.tidalcyber.com/references/77624549-e170-5894-9219-a15b4aa31726)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G1017",
"observed_countries": [
"GU",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"758c3085-2f79-40a8-ab95-f8a684737927",
"af5e9be5-b86e-47af-91dd-966a5e34a186",
"35e694ec-5133-46e3-b7e1-5831867c3b55",
"1dc8fd1e-0737-405a-98a1-111dd557f1b5",
"15787198-6c8b-4f79-bf50-258d55072fee",
"97cc0c9b-3625-42c3-824a-646a91702977",
"53331b05-782f-45fc-b925-27c9598dde80"
],
"target_categories": [
"Construction",
"Education",
"Government",
"Manufacturing",
"Maritime",
"Technology",
"Telecommunications",
"Transportation",
"Utilities",
"Water"
]
},
"related": [],
"uuid": "4ea1245f-3f35-5168-bd10-1fc49142fd4e",
"value": "Volt Typhoon"
},
{
"description": "*We are no longer maintaining this object in favor of a similar object subsequently published by MITRE: \"Volt Typhoon\" (Group). All relevant Tidal content extensions (e.g. additional Technique and Object relationships and metadata) have been added to the MITRE-authored object.*\n\n\nVolt Typhoon is a China state-backed threat actor that has targeted critical infrastructure organizations in a range of specific sectors in Guam and elsewhere in the United States since mid-2021. Its activities primarily focus on espionage and information gathering. Researchers indicate the group is focused on maintaining stealth and persistence in victim networks for as long as possible, leveraging a large number of living-off-the-land techniques to accomplish these goals. Researchers assessed with moderate confidence that Volt Typhoon's activities are focused on developing capabilities that could disrupt communications infrastructure between the United States and entities in Asia in the event of a potential geopolitical crisis.<sup>[[U.S. CISA Volt Typhoon May 24 2023](/references/12320f38-ebbf-486a-a450-8a548c3722d6)]</sup>\n\n**Related Vulnerabilities**: CVE-2021-40539, CVE-2021-27860<sup>[[U.S. CISA Volt Typhoon May 24 2023](/references/12320f38-ebbf-486a-a450-8a548c3722d6)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G5001",
"observed_countries": [
"GU",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"758c3085-2f79-40a8-ab95-f8a684737927",
"af5e9be5-b86e-47af-91dd-966a5e34a186",
"35e694ec-5133-46e3-b7e1-5831867c3b55",
"1dc8fd1e-0737-405a-98a1-111dd557f1b5",
"15787198-6c8b-4f79-bf50-258d55072fee",
"97cc0c9b-3625-42c3-824a-646a91702977",
"53331b05-782f-45fc-b925-27c9598dde80"
],
"target_categories": [
"Construction",
"Education",
"Government",
"Manufacturing",
"Maritime",
"Technology",
"Telecommunications",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "3290dcb9-5781-4b87-8fa0-6ae820e152cd",
"value": "Volt Typhoon - Tidal"
},
{
"description": "[Whitefly](https://app.tidalcyber.com/groups/f0943620-7bbb-4239-8ed3-c541c36baaa1) is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.<sup>[[Symantec Whitefly March 2019](https://app.tidalcyber.com/references/d0e48356-36d9-4b4c-b621-e3c4404378d2)]</sup>",
"meta": {
"group_attack_id": "G0107",
"observed_countries": [
"SG"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Healthcare",
"Media",
"Telecommunications"
]
},
"related": [],
"uuid": "f0943620-7bbb-4239-8ed3-c541c36baaa1",
"value": "Whitefly"
},
{
"description": "The [Windigo](https://app.tidalcyber.com/groups/eeb69751-8c22-4a5f-8da2-239cc7d7746c) group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the [Ebury](https://app.tidalcyber.com/software/2375465a-e6a9-40ab-b631-a5b04cf5c689) SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, [Windigo](https://app.tidalcyber.com/groups/eeb69751-8c22-4a5f-8da2-239cc7d7746c) operators continued updating [Ebury](https://app.tidalcyber.com/software/2375465a-e6a9-40ab-b631-a5b04cf5c689) through 2019.<sup>[[ESET Windigo Mar 2014](https://app.tidalcyber.com/references/721cdb36-d3fc-4212-b324-6be2b5f9cb46)]</sup><sup>[[CERN Windigo June 2019](https://app.tidalcyber.com/references/e9f1289f-a32e-441c-8787-cb32a26216d1)]</sup>",
"meta": {
"group_attack_id": "G0124",
"source": "MITRE"
},
"related": [],
"uuid": "eeb69751-8c22-4a5f-8da2-239cc7d7746c",
"value": "Windigo"
},
{
"description": "[Windshift](https://app.tidalcyber.com/groups/4e880d01-313a-4926-8470-78c48824aa82) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.<sup>[[SANS Windshift August 2018](https://app.tidalcyber.com/references/97eac0f2-d528-4f7c-8425-7531eae4fc39)]</sup><sup>[[objective-see windtail1 dec 2018](https://app.tidalcyber.com/references/7a32c962-8050-45de-8b90-8644be5109d9)]</sup><sup>[[objective-see windtail2 jan 2019](https://app.tidalcyber.com/references/e6bdc679-ee0c-4f34-b5bc-0d6a26485b36)]</sup>",
"meta": {
"group_attack_id": "G0112",
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"target_categories": [
"Government",
"Infrastructure"
]
},
"related": [],
"uuid": "4e880d01-313a-4926-8470-78c48824aa82",
"value": "Windshift"
},
{
"description": "[Winnti Group](https://app.tidalcyber.com/groups/6932662a-53a7-4e43-877f-6e940e2d744b) is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.<sup>[[Kaspersky Winnti April 2013](https://app.tidalcyber.com/references/2d4834b9-61c4-478e-919a-317d97cd2c36)]</sup><sup>[[Kaspersky Winnti June 2015](https://app.tidalcyber.com/references/86504950-0f4f-42bc-b003-24f60ae97c99)]</sup><sup>[[Novetta Winnti April 2015](https://app.tidalcyber.com/references/cbe8373b-f14b-4890-99fd-35ffd7090dea)]</sup> Some reporting suggests a number of other groups, including [Axiom](https://app.tidalcyber.com/groups/90f4d3f9-3fe3-4a64-8dc1-172c6d037dca), [APT17](https://app.tidalcyber.com/groups/5f083251-f5dc-459a-abfc-47a1aa7f5094), and [Ke3chang](https://app.tidalcyber.com/groups/26c0925f-1a3c-4df6-b27a-62b9731299b8), are closely linked to [Winnti Group](https://app.tidalcyber.com/groups/6932662a-53a7-4e43-877f-6e940e2d744b).<sup>[[401 TRG Winnti Umbrella May 2018](https://app.tidalcyber.com/references/e3f1f2e4-dc1c-4d9c-925d-47013f44a69f)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0044",
"observed_countries": [
"BY",
"BR",
"CN",
"DE",
"IN",
"ID",
"JP",
"KR",
"PE",
"PH",
"RU",
"TW",
"TH",
"US",
"VN"
],
"source": "MITRE",
"target_categories": [
"Entertainment"
]
},
"related": [],
"uuid": "6932662a-53a7-4e43-877f-6e940e2d744b",
"value": "Winnti Group"
},
{
"description": "[WIRTE](https://app.tidalcyber.com/groups/73da066d-b25f-45ba-862b-1a69228c6baa) is a threat group that has been active since at least August 2018. [WIRTE](https://app.tidalcyber.com/groups/73da066d-b25f-45ba-862b-1a69228c6baa) has targeted government, diplomatic, financial, military, legal, and technology organizations in the Middle East and Europe.<sup>[[Lab52 WIRTE Apr 2019](https://app.tidalcyber.com/references/884b675e-390c-4f6d-8cb7-5d97d84115e5)]</sup><sup>[[Kaspersky WIRTE November 2021](https://app.tidalcyber.com/references/143b4694-024d-49a5-be3c-d9ceca7295b2)]</sup>",
"meta": {
"group_attack_id": "G0090",
"source": "MITRE",
"target_categories": [
"Defense",
"Financial Services",
"Government",
"Legal",
"Technology"
]
},
"related": [],
"uuid": "73da066d-b25f-45ba-862b-1a69228c6baa",
"value": "WIRTE"
},
{
"description": "[Wizard Spider](https://app.tidalcyber.com/groups/0b431229-036f-4157-a1da-ff16dfc095f8) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://app.tidalcyber.com/software/c2bd4213-fc7b-474f-b5a0-28145b07c51d) since at least 2016. [Wizard Spider](https://app.tidalcyber.com/groups/0b431229-036f-4157-a1da-ff16dfc095f8) possesses a diverse aresenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.<sup>[[CrowdStrike Ryuk January 2019](https://app.tidalcyber.com/references/df471757-2ce0-48a7-922f-a84c57704914)]</sup><sup>[[DHS/CISA Ransomware Targeting Healthcare October 2020](https://app.tidalcyber.com/references/984e86e6-32e4-493c-8172-3d29de4720cc)]</sup><sup>[[CrowdStrike Wizard Spider October 2020](https://app.tidalcyber.com/references/5c8d67ea-63bc-4765-b6f6-49fa5210abe6)]</sup>",
"meta": {
"country": "RU",
"group_attack_id": "G0102",
"observed_countries": [
"AU",
"BE",
"CA",
"DO",
"FR",
"DE",
"IT",
"JP",
"MX",
"NL",
"NZ",
"NO",
"SG",
"ES",
"CH",
"TW",
"GB",
"US"
],
"observed_motivations": [
"Financial Gain"
],
"source": "MITRE",
"tags": [
"5e7433ad-a894-4489-93bc-41e90da90019",
"7e7b0c67-bb85-4996-a289-da0e792d7172"
],
"target_categories": [
"Aerospace",
"Agriculture",
"Automotive",
"Chemical",
"Education",
"Energy",
"Financial Services",
"Government",
"Healthcare",
"Hospitality Leisure",
"Insurance",
"Legal",
"Manufacturing",
"Media",
"NGOs",
"Non Profit",
"Pharmaceuticals",
"Retail",
"Technology",
"Telecommunications",
"Transportation",
"Utilities"
]
},
"related": [],
"uuid": "0b431229-036f-4157-a1da-ff16dfc095f8",
"value": "Wizard Spider"
},
{
"description": "Yellow Liderc (aka Imperial Kitten, Tortoiseshell, TA456, Crimson Sandstorm) is a threat actor group based in Iran that is believed to be aligned with the Iranian Islamic Revolutionary Guard Corp (IRGC). Researchers have observed the group targeting victims in a range of sectors in the United States, Europe, the Middle East and Mediterranean, and South Asia.<sup>[[PwC Yellow Liderc October 25 2023](/references/cbeaf9b5-865f-44a1-a913-9eec28d7a5ff)]</sup>",
"meta": {
"country": "IR",
"group_attack_id": "G3025",
"observed_countries": [
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"2feda37d-5579-4102-a073-aa02e82cb49f"
],
"target_categories": [
"Aerospace",
"Automotive",
"Defense",
"Energy",
"Maritime",
"Technology"
]
},
"related": [],
"uuid": "9e8620c4-a560-4081-aefc-118c7ec3fc22",
"value": "Yellow Liderc"
},
{
"description": "[ZIRCONIUM](https://app.tidalcyber.com/groups/5e34409e-2f55-4384-b519-80747d02394c) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.<sup>[[Microsoft Targeting Elections September 2020](https://app.tidalcyber.com/references/1d7070fd-01be-4776-bb21-13368a6173b1)]</sup><sup>[[Check Point APT31 February 2021](https://app.tidalcyber.com/references/84ac99ef-106f-44e9-97f0-3eda90570932)]</sup>",
"meta": {
"country": "CN",
"group_attack_id": "G0128",
"observed_countries": [
"BY",
"CA",
"FI",
"FR",
"MN",
"NO",
"RU",
"US"
],
"observed_motivations": [
"Cyber Espionage"
],
"source": "MITRE",
"tags": [
"b20e7912-6a8d-46e3-8e13-9a3fc4813852"
],
"target_categories": [
"Aerospace",
"Construction",
"Defense",
"Education",
"Financial Services",
"Government",
"High Tech",
"Insurance",
"Media",
"Telecommunications"
]
},
"related": [],
"uuid": "5e34409e-2f55-4384-b519-80747d02394c",
"value": "ZIRCONIUM"
},
{
"description": "This object reflects the TTPs used by threat actors to distribute and deploy the Zloader trojan malware. Researchers have observed actors distributing Zloader in campaigns without attributing the activity to named adversaries, such as the operations described by ESET researchers cited in the References.<sup>[[WeLiveSecurity April 19 2022](/references/f86845b9-03c4-446b-845f-b31b79b247ee)]</sup>\n\nTTPs associated with Zloader binaries themselves can be found in the separate \"Zloader\" Software object.",
"meta": {
"group_attack_id": "G3034",
"observed_countries": [
"AF",
"AR",
"AU",
"AT",
"BE",
"BR",
"CA",
"CL",
"CN",
"CO",
"HR",
"CZ",
"EC",
"FI",
"FR",
"GF",
"DE",
"GH",
"GR",
"HU",
"IN",
"ID",
"IE",
"IL",
"IT",
"JP",
"KR",
"KW",
"MX",
"NL",
"NG",
"PK",
"PE",
"PL",
"RU",
"RW",
"SA",
"SL",
"SK",
"ZA",
"ES",
"SE",
"CH",
"TH",
"UA",
"AE",
"GB",
"US",
"YE"
],
"owner": "TidalCyberIan",
"source": "Tidal Cyber",
"tags": [
"c6e1f516-1a18-4ff9-b563-e6ac8103b104",
"39357cc1-dbb1-49e4-9fe0-ff24032b94d5",
"f8669b82-2194-49a9-8e20-92e7f9ab0a6f",
"2feda37d-5579-4102-a073-aa02e82cb49f"
]
},
"related": [],
"uuid": "d2fd3da1-e49c-4273-9add-3d15afc3b837",
"value": "Zloader Threat Actors"
}
],
"version": 1
}
Reference in a new issue View git blame Copy permalink