32 well-documented groups, their aliases, ATT&CK techniques, campaigns and the defences that stop them
Exams such as CySA+ and Security+ expect you to recognise threat actor types and motivations, map behaviour to MITRE ATT&CK, and choose controls that break an attacker's usual path. Each profile lists the techniques the group is known for, linked to ATT&CK, and the defences that counter them. The set covers 18 nation-state, 6 cybercrime, 6 ransomware, 2 hacktivist entries.
Attributions on these pages are those made publicly by governments, MITRE ATT&CK and named security vendors, and are reported as theirs. The same actor often has several names because each vendor uses its own naming scheme, and different vendors' groups only partly overlap. Each profile is a study summary that links to its primary sources; check those sources for the current picture before relying on any detail. Last reviewed 2026-10-25.
Showing 32 of 32 actors
Also: Fancy Bear, Sofacy, Sednit, STRONTIUM, Forest Blizzard, Pawn Storm
APT28 is one of the most documented state espionage groups.
Also: Cozy Bear, The Dukes, NOBELIUM, Midnight Blizzard, UNC2452, Dark Halo
APT29 is known for patient, stealthy intelligence collection.
Also: APT44, Seashell Blizzard, Voodoo Bear, IRIDIUM, ELECTRUM, Telebots
Sandworm is the group most associated with destructive cyber attacks.
Also: Snake, Venomous Bear, Waterbug, WhiteBear, Secret Blizzard, IRON HUNTER
Turla is a long-running espionage group known for sophisticated custom tooling, above all the Snake implant, which US and allied agencies describe as the FSB's most sophisticated long-term collection tool.
Also: Primitive Bear, Armageddon, Shuckworm, ACTINIUM, Aqua Blizzard
Gamaredon is a high-volume espionage group focused almost entirely on Ukraine.
Also: Wicked Panda, Brass Typhoon, BARIUM, Winnti (overlapping)
APT41 is unusual for mixing state espionage with crime for profit.
Also: menuPass, Stone Panda, Cicada, POTASSIUM, Red Apollo
APT10 is best known for compromising managed service providers and then using the trusted access those providers have to reach many customers at once.
Also: BRONZE SILHOUETTE, Vanguard Panda, Voltzite, DEV-0391, Insidious Taurus
US agencies assess that Volt Typhoon is pre-positioning inside critical infrastructure IT networks so it could disrupt or destroy services in a future crisis, which they note is not consistent with ordinary espionage.
Also: OPERATOR PANDA, RedMike, GhostEmperor, UNC5807
Salt Typhoon targets the networks that carry everyone else's traffic.
Also: TA416, RedDelta, BRONZE PRESIDENT, Stately Taurus, Earth Preta, Twill Typhoon
Mustang Panda sends tailored phishing lures with decoy documents and loads its PlugX backdoor through DLL sideloading of legitimate, signed programs.
Also: Comment Crew, Comment Panda, Comment Group
APT1 is a landmark case study.
Also: HIDDEN COBRA, Labyrinth Chollima, ZINC, Diamond Sleet, Guardians of Peace
Lazarus is linked to some of the largest thefts and most disruptive attacks on record, from the Sony Pictures wiper attack to the Bangladesh Bank heist, WannaCry and the theft of about $1.5 billion from the Bybit exchange.
Also: APT43, Velvet Chollima, Black Banshee, THALLIUM, Emerald Sleet, Springtail
Kimsuky focuses on collecting intelligence about foreign policy and nuclear issues.
Also: Peach Sandstorm, HOLMIUM, Elfin, Refined Kitten
APT33 has a long-standing interest in aviation and energy.
Also: Magic Hound, Charming Kitten, Mint Sandstorm, Phosphorus, TA453, COBALT ILLUSION
MITRE tracks APT35 and Charming Kitten under one entry, Magic Hound.
Also: Static Kitten, Seedworm, MERCURY, Mango Sandstorm, TEMP.Zagros
MuddyWater runs broad phishing campaigns and frequently abuses legitimate remote monitoring and management (RMM) tools, so its access looks like normal IT support activity.
Also: APT34, Helix Kitten, COBALT GYPSY, Hazel Sandstorm, Crambus, EUROPIUM
OilRig targets Middle Eastern organisations and is known for abusing trust relationships between organisations, custom backdoors, and command and control over DNS.
Also: Soldiers of Soloman
CyberAv3ngers presents itself as a hacktivist group, but US and allied agencies tie it to the IRGC.
Also: Carbon Spider, Sangria Tempest, ELBRUS, GOLD NIAGARA, ITG14
FIN7 became infamous for stealing payment card data from restaurant and retail point-of-sale systems using carefully crafted phishing.
Also: Octo Tempest, UNC3944, 0ktapus, Storm-0875
Scattered Spider breaks in by talking, not exploiting.
Also: UNC1878, Grim Spider, FIN12, GOLD BLACKBURN, Periwinkle Tempest, DEV-0193
Wizard Spider created the TrickBot malware and used it as a foothold for ransomware such as Ryuk and Conti.
Also: Indrik Spider, Manatee Tempest, DEV-0243, UNC2165
Evil Corp ran the Dridex banking trojan, which the US Treasury says caused more than $100 million in theft, then moved to targeted ransomware such as BitPaymer and WastedLocker.
Also: Hive0065, Spandex Tempest, CHIMBORAZO
TA505 is known for running some of the largest malicious spam campaigns ever observed, distributing banking trojans and ransomware at enormous scale, and for frequently switching malware families.
Also: DEV-0537, Strawberry Tempest
LAPSUS$ showed how far identity attacks alone can go.
Also: LockBit 2.0, LockBit 3.0, LockBit Black, ABCD (predecessor)
LockBit was the most deployed ransomware variant in the world in 2022, according to CISA.
Also: ALPHV, BlackCat, Noberus
ALPHV/BlackCat was one of the first major ransomware families written in Rust, with versions for Windows and Linux/VMware ESXi.
Also: Conti ransomware
Conti was among the most damaging ransomware operations of 2020 to 2022.
Also: CL0P, Clop
Cl0p is known for mass data-theft campaigns that exploit zero-day vulnerabilities in file transfer products, hitting many organisations at once and then extorting them, often without encrypting anything.
Also: GOLD SAHARA, PUNK SPIDER, Howling Scorpius
Akira commonly gets in through VPNs that lack MFA, often by exploiting known VPN vulnerabilities or using stolen credentials, then steals data and encrypts Windows systems and VMware ESXi hypervisors.
Also: Black Basta ransomware
Black Basta affiliates had impacted over 500 organisations by May 2024, according to CISA.
Anonymous Sudan ran high-volume application-layer (layer 7) DDoS attacks while presenting itself as a hacktivist group.
Also: NoName05716
NoName057(16) emerged days after Russia's full-scale invasion of Ukraine and runs DDoS attacks through a volunteer model: it recruits participants on Telegram, gives them its DDoSia tool and target lists, and pays contributors in cryptocurrency.
Group and technique identifiers and names are from MITRE ATT&CK®, used under the ATT&CK Terms of Use. Attribution statements are those of the governments, MITRE and vendors cited on each profile, not CyberCertPrep's own assessments. Summaries and defensive guidance are original material written by CyberCertPrep. CyberCertPrep is not affiliated with or endorsed by MITRE or any agency or vendor cited.