Adversaries.
Every field is what a source states: MISP galaxy, MITRE ATT&CK, ransomware leak sites, APTnotes. Assessed origin, observed targets, techniques by tactic, with the report that says so. A field no source states is left blank.
On the wire
last 90 days · 12 adversaries named in our dispatches
- Cyber Partisansassessed origin BelarusBelarusian hacktivists admit to 2023 breach of Russian state healthcare network2 dispatches · last
- Flax Typhoonassessed origin ChinaFBI Takes Down China-Linked Tools That Scanned US Utilities1 dispatch · last
- TraderTraitorassessed origin North KoreaSuspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware1 dispatch · last
Leading adversaries
ranked by documentation depth, not by fear · 24 listed
Techniques are the ATT&CK techniques the sources attribute; victims are the leak-site victims the pipeline holds. A blank is a field no source states.
By assessed origin
ten most assessed · 398 dossiers · as stated by the sources
| ISO | Country | Dossiers | |
|---|---|---|---|
| CN | China | 199 | Aoqin Dragon, APT1, APT10 |
| RU | Russia | 78 | APT28, APT29, ENERGETIC BEAR |
| IR | Iran | 57 | APT33, APT42, Cleaver |
| KP | North Korea | 25 | APT37, Kimsuky, Lazarus Group |
| PS | Palestine | 9 | Molerats, AridViper, WIRTE |
| TR | Türkiye | 7 | Sea Turtle, PROMETHIUM, Aslan Neferler Tim |
| UA | Ukraine | 7 | Bearlyfy, BlackJack, Cyber Alliance |
| VN | Vietnam | 6 | APT32, BatShadow, CoralRaider |
| IN | India | 5 | HAZY TIGER, QUILTED TIGER, RAZOR TIGER |
| BR | Brazil | 5 | Poseidon Group, Exilware, N4ughtysecTU |
All adversaries, A to Z
1,399 dossiers · open a letter to read it
#9 dossiers
loading…
A98 dossiers
loading…
B83 dossiers
loading…
C97 dossiers
loading…
D73 dossiers
loading…
E46 dossiers
loading…
F34 dossiers
loading…
G71 dossiers
loading…
H40 dossiers
loading…
I29 dossiers
loading…
J8 dossiers
loading…
K23 dossiers
loading…
L52 dossiers
loading…
M65 dossiers
loading…
N38 dossiers
loading…
O34 dossiers
loading…
P45 dossiers
loading…
Q6 dossiers
loading…
R72 dossiers
loading…
S159 dossiers
loading…
T103 dossiers
loading…
U117 dossiers
loading…
V31 dossiers
loading…
W41 dossiers
loading…
X10 dossiers
loading…
Y4 dossiers
loading…
Z11 dossiers
loading…
Follow the wire.
Every exploited CVE and adversary move as it lands: Telegram for the push, RSS for your reader, a keyless JSON API and per-actor STIX for your tooling.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.