Profiles of documented threat actor groups — attribution, tactics, techniques, and known campaigns.https://samithota.com/https://samithota.com/adversaries/g0041-strider/https://samithota.com/adversaries/g0041-strider/An in-depth profile of Strider (G0041), also known as ProjectSauron, a highly sophisticated, likely nation-state sponsored cyber espionage group.Sat, 18 Jul 2026 09:13:56 GMTHighDormantthreat-actorg0041Samit Hotahttps://samithota.com/adversaries/g1046-storm-1811/https://samithota.com/adversaries/g1046-storm-1811/Storm-1811 (G1046) is an active, financially motivated threat actor known for sophisticated social engineering, leading to Black Basta ransomware deployment.Sat, 18 Jul 2026 09:13:30 GMTHighActivethreat-actorg1046Samit Hotahttps://samithota.com/adversaries/g1053-storm-0501/https://samithota.com/adversaries/g1053-storm-0501/Storm-0501, a financially motivated group active since 2021, has evolved from traditional ransomware to sophisticated hybrid and cloud-native attacks.Sat, 18 Jul 2026 09:13:05 GMTHighActivethreat-actorg1053Samit Hotahttps://samithota.com/adversaries/g0038-stealth-falcon/https://samithota.com/adversaries/g0038-stealth-falcon/Stealth Falcon (G0038) is an active APT group, linked to the UAE government, conducting cyber espionage against targets in the Middle East and Africa.Sat, 18 Jul 2026 09:12:35 GMTHighActivethreat-actorg0038Samit Hotahttps://samithota.com/adversaries/g1033-star-blizzard/https://samithota.com/adversaries/g1033-star-blizzard/Star Blizzard, a highly active Russian state-sponsored cyber espionage group, employs sophisticated spear-phishing and social engineering to target critical…Sat, 18 Jul 2026 09:12:22 GMTHighActivethreat-actorg1033Samit Hotahttps://samithota.com/adversaries/g0054-sowbug/https://samithota.com/adversaries/g0054-sowbug/Sowbug (G0054) is a sophisticated cyber espionage group targeting government entities in South America and Southeast Asia, active since at least 2015.Sat, 18 Jul 2026 09:11:51 GMTHighUnknownthreat-actorg0054Samit Hotahttps://samithota.com/adversaries/g0083-silverterrier/https://samithota.com/adversaries/g0083-silverterrier/A detailed security profile of SilverTerrier (G0083), a Nigerian cybercrime group specializing in sophisticated Business Email Compromise (BEC) scams.Sat, 18 Jul 2026 09:11:29 GMTHighActivethreat-actorg0083Samit Hotahttps://samithota.com/adversaries/g0122-silent-librarian/https://samithota.com/adversaries/g0122-silent-librarian/Silent Librarian (G0122) is an Iranian state-sponsored APT group focused on intellectual property theft from academic and research institutions worldwide.Sat, 18 Jul 2026 09:11:10 GMTHighActivethreat-actorg0122Samit Hotahttps://samithota.com/adversaries/g0091-silence/https://samithota.com/adversaries/g0091-silence/Profile of Silence (G0091), a financially motivated threat actor targeting financial institutions worldwide with sophisticated tactics.Sat, 18 Jul 2026 09:10:47 GMTHighActivethreat-actorg0091Samit Hotahttps://samithota.com/adversaries/g0121-sidewinder/https://samithota.com/adversaries/g0121-sidewinder/SideWinder is a sophisticated, India-linked APT group active since 2012, primarily conducting cyber-espionage against South Asian governmental, military, and…Sat, 18 Jul 2026 09:10:24 GMTHighActivethreat-actorg0121Samit Hotahttps://samithota.com/adversaries/g0029-scarlet-mimic/https://samithota.com/adversaries/g0029-scarlet-mimic/Scarlet Mimic is an espionage threat group known for targeting minority rights activists and related government entities, notably using custom malware for…Sat, 18 Jul 2026 05:11:02 GMTHighActivethreat-actorg0029Samit Hotahttps://samithota.com/adversaries/g1045-salt-typhoon/https://samithota.com/adversaries/g1045-salt-typhoon/Salt Typhoon (G1045) is a highly sophisticated, PRC state-backed APT group conducting extensive cyber espionage and pre-positioning in global critical…Fri, 17 Jul 2026 18:36:50 GMTCriticalActivethreat-actorg1045Samit Hotahttps://samithota.com/adversaries/g1008-sidecopy/https://samithota.com/adversaries/g1008-sidecopy/A detailed security professional's profile of SideCopy (G1008), a Pakistan-linked threat group known for persistent cyber espionage against South Asian…Fri, 17 Jul 2026 14:17:35 GMTHighActivethreat-actorg1008Samit Hotahttps://samithota.com/adversaries/g1041-sea-turtle/https://samithota.com/adversaries/g1041-sea-turtle/Profile of Sea Turtle (G1041), a Türkiye-linked APT focused on espionage via DNS hijacking, vulnerability exploitation, and cloud compromise.Fri, 17 Jul 2026 14:17:06 GMTHighActivethreat-actorg1041Samit Hotahttps://samithota.com/adversaries/g1015-scattered-spider/https://samithota.com/adversaries/g1015-scattered-spider/Scattered Spider is a financially motivated, native English-speaking cybercriminal group known for sophisticated social engineering, identity-based attacks,…Fri, 17 Jul 2026 14:16:40 GMTHighActivethreat-actorg1015Samit Hotahttps://samithota.com/adversaries/g0106-rocke/https://samithota.com/adversaries/g0106-rocke/Profile of Rocke (G0106), a Chinese-speaking threat actor focused on cryptojacking, its evolving tactics, tools, and persistent operations.Fri, 17 Jul 2026 14:15:33 GMTHighActivethreat-actorg0106Samit Hotahttps://samithota.com/adversaries/g1039-redcurl/https://samithota.com/adversaries/g1039-redcurl/RedCurl (G1039) is a Russian-speaking threat actor initially focused on corporate espionage, recently evolving to deploy novel QWCrypt ransomware in targeted…Fri, 17 Jul 2026 14:15:05 GMTHighActivethreat-actorg1039Samit Hotahttps://samithota.com/adversaries/g0034-sandworm-team/https://samithota.com/adversaries/g0034-sandworm-team/A deep dive into Sandworm Team (APT44), a highly destructive Russian GRU-backed cyber threat actor known for targeting critical infrastructure and global…Fri, 17 Jul 2026 09:32:28 GMTCriticalActivethreat-actorg0034Samit Hotahttps://samithota.com/adversaries/g1031-saint-bear/https://samithota.com/adversaries/g1031-saint-bear/Saint Bear (G1031) is a Russian-nexus threat actor active since early 2021, primarily conducting cyber espionage against Ukraine and Georgia using custom…Fri, 17 Jul 2026 09:31:43 GMTHighActivethreat-actorg1031Samit Hotahttps://samithota.com/adversaries/g0048-rtm/https://samithota.com/adversaries/g0048-rtm/RTM is a long-standing cybercriminal group, initially focused on banking Trojans, that has evolved into a Ransomware-as-a-Service provider, targeting…Fri, 17 Jul 2026 09:31:09 GMTHighActivethreat-actorg0048Samit Hotahttps://samithota.com/adversaries/g1042-redecho/https://samithota.com/adversaries/g1042-redecho/An in-depth profile of RedEcho (G1042), a China-linked threat actor primarily targeting Indian critical infrastructure, particularly the power sector, for…Fri, 17 Jul 2026 09:30:38 GMTHighActivethreat-actorg1042Samit Hotahttps://samithota.com/adversaries/g0075-rancor/https://samithota.com/adversaries/g0075-rancor/Rancor (G0075) is a China-linked cyber espionage group targeting government and political entities in Southeast Asia since 2017, employing evolving custom…Fri, 17 Jul 2026 09:30:10 GMTHighActivethreat-actorg0075Samit Hotahttps://samithota.com/adversaries/g0033-poseidon-group/https://samithota.com/adversaries/g0033-poseidon-group/A profile of the Poseidon Group (G0033), a Brazilian cyber mercenary gang known for its unique data exfiltration and extortion model.Fri, 17 Jul 2026 09:29:46 GMTHighActivethreat-actorg0033Samit Hotahttps://samithota.com/adversaries/g1040-play/https://samithota.com/adversaries/g1040-play/A detailed security professional's analysis of the Play ransomware group (G1040), its evolving tactics, global targeting, and current active status.Fri, 17 Jul 2026 09:29:25 GMTCriticalActivethreat-actorg1040Samit Hotahttps://samithota.com/adversaries/g0024-putter-panda/https://samithota.com/adversaries/g0024-putter-panda/A detailed profile of Putter Panda (G0024), a Chinese state-sponsored threat group linked to the PLA's Unit 61486, focusing on its espionage motivations,…Fri, 17 Jul 2026 05:29:29 GMTHighActivethreat-actorg0024Samit Hotahttps://samithota.com/adversaries/g0056-promethium/https://samithota.com/adversaries/g0056-promethium/Profile of PROMETHIUM (StrongPity), an espionage-focused APT group active since 2012, known for using trojanized software to target diverse regions and sectors.Fri, 17 Jul 2026 05:29:18 GMTHighActivethreat-actorg0056Samit Hotahttps://samithota.com/adversaries/g1005-polonium/https://samithota.com/adversaries/g1005-polonium/POLONIUM is a Lebanon-based, Iran-affiliated cyber espionage group actively targeting critical sectors in Israel with custom backdoors and cloud-based C2.Fri, 17 Jul 2026 05:28:52 GMTHighActivethreat-actorg1005Samit Hotahttps://samithota.com/adversaries/g0068-platinum/https://samithota.com/adversaries/g0068-platinum/A deep dive into PLATINUM (G0068), an advanced, state-sponsored cyber espionage group targeting governments and critical infrastructure in South and Southeast…Fri, 17 Jul 2026 05:28:34 GMTHighActivethreat-actorg0068Samit Hotahttps://samithota.com/adversaries/g0069-muddywater/https://samithota.com/adversaries/g0069-muddywater/A deep dive into MuddyWater (G0069), an Iranian state-sponsored APT group known for persistent cyber espionage and evolving tactics.Thu, 16 Jul 2026 18:43:24 GMTHighActivethreat-actorg0069Samit Hotahttps://samithota.com/adversaries/g0011-pittytiger/https://samithota.com/adversaries/g0011-pittytiger/A detailed profile of PittyTiger (G0011), a suspected Chinese state-sponsored threat actor focused on cyber espionage.Thu, 16 Jul 2026 14:10:03 GMTMediumUnknownthreat-actorg0011Samit Hotahttps://samithota.com/adversaries/g0040-patchwork/https://samithota.com/adversaries/g0040-patchwork/An in-depth profile of Patchwork (G0040), a pro-Indian cyber espionage group actively targeting government, diplomatic, and defense sectors globally.Thu, 16 Jul 2026 14:09:52 GMTHighActivethreat-actorg0040Samit Hotahttps://samithota.com/adversaries/g0071-orangeworm/https://samithota.com/adversaries/g0071-orangeworm/Orangeworm (G0071) is a sophisticated threat actor primarily targeting the global healthcare sector for corporate espionage.Thu, 16 Jul 2026 14:09:23 GMTHighActivethreat-actorg0071Samit Hotahttps://samithota.com/adversaries/g0049-oilrig/https://samithota.com/adversaries/g0049-oilrig/OilRig, an Iranian state-sponsored APT group (G0049), actively targets Middle Eastern and international entities for cyber espionage, leveraging advanced TTPs.Thu, 16 Jul 2026 14:09:03 GMTHighActivethreat-actorg0049Samit Hotahttps://samithota.com/adversaries/g0133-nomadic-octopus/https://samithota.com/adversaries/g0133-nomadic-octopus/A profile of Nomadic Octopus (G0133), a Russia-linked cyber espionage group targeting Central Asian governments, diplomatic entities, and critical…Thu, 16 Jul 2026 14:08:34 GMTHighActivethreat-actorg0133Samit Hotahttps://samithota.com/adversaries/g0055-neodymium/https://samithota.com/adversaries/g0055-neodymium/A profile of NEODYMIUM (G0055), a cyber espionage threat actor with suspected Iranian links, known for targeting Turkish individuals and organizations.Thu, 16 Jul 2026 14:08:10 GMTHighUnknownthreat-actorg0055Samit Hotahttps://samithota.com/adversaries/g0019-naikon/https://samithota.com/adversaries/g0019-naikon/Naikon is a state-sponsored Chinese cyber espionage group (G0019) primarily targeting government, military, and civil organizations in Southeast Asia for…Thu, 16 Jul 2026 14:07:58 GMTHighActivethreat-actorg0019Samit Hotahttps://samithota.com/adversaries/g1020-mustard-tempest/https://samithota.com/adversaries/g1020-mustard-tempest/An in-depth profile of Mustard Tempest (G1020), a financially motivated initial access broker known for distributing SocGholish malware.Thu, 16 Jul 2026 14:07:29 GMTHighActivethreat-actorg1020Samit Hotahttps://samithota.com/adversaries/g0129-mustang-panda/https://samithota.com/adversaries/g0129-mustang-panda/A detailed threat actor profile of Mustang Panda (G0129), a China-aligned cyber espionage group known for its persistent and adaptive operations.Thu, 16 Jul 2026 14:07:12 GMTHighActivethreat-actorg0129Samit Hotahttps://samithota.com/adversaries/g1019-moustachedbouncer/https://samithota.com/adversaries/g1019-moustachedbouncer/An in-depth profile of MoustachedBouncer, a Belarusian-aligned cyberespionage group targeting foreign embassies through sophisticated ISP-level attacks and…Thu, 16 Jul 2026 09:40:29 GMTHighActivethreat-actorg1019Samit Hotahttps://samithota.com/adversaries/g1009-moses-staff/https://samithota.com/adversaries/g1009-moses-staff/Moses Staff (G1009), also known as DEV-0500 and Marigold Sandstorm, is an Iranian-backed threat group primarily focused on politically motivated destructive…Thu, 16 Jul 2026 09:40:06 GMTHighActivethreat-actorg1009Samit Hotahttps://samithota.com/adversaries/g1036-moonstone-sleet/https://samithota.com/adversaries/g1036-moonstone-sleet/Moonstone Sleet is a North Korean-linked threat actor conducting financially motivated and espionage operations, notable for social engineering and custom…Thu, 16 Jul 2026 09:39:51 GMTHighActivethreat-actorg1036Samit Hotahttps://samithota.com/adversaries/g0021-molerats/https://samithota.com/adversaries/g0021-molerats/A profile of Molerats (G0021), a politically-motivated, Hamas-aligned APT group active since 2012, known for cyber espionage in the Middle East and beyond.Thu, 16 Jul 2026 09:39:36 GMTHighActivethreat-actorg0021Samit Hotahttps://samithota.com/adversaries/g0103-mofang/https://samithota.com/adversaries/g0103-mofang/A detailed profile of Mofang (G0103), a likely China-based, government-affiliated cyber espionage group known for its sophisticated TTPs.Thu, 16 Jul 2026 09:39:07 GMTHighActivethreat-actorg0103Samit Hotahttps://samithota.com/adversaries/g0002-moafee/https://samithota.com/adversaries/g0002-moafee/Moafee (G0002) is a China-linked threat group primarily focused on information theft and espionage against government and military targets.Thu, 16 Jul 2026 09:38:34 GMTHighUnknownthreat-actorg0002Samit Hotahttps://samithota.com/adversaries/g1054-mirrorface/https://samithota.com/adversaries/g1054-mirrorface/MirrorFace, also known as Earth Kasha, is a sophisticated PRC-aligned cyberespionage group actively targeting government, critical infrastructure, and…Thu, 16 Jul 2026 09:38:07 GMTHighActivethreat-actorg1054Samit Hotahttps://samithota.com/adversaries/g1013-metador/https://samithota.com/adversaries/g1013-metador/Metador (G1013) is a sophisticated and highly-aware cyber espionage group targeting telecommunication companies, ISPs, and universities in the Middle East and…Thu, 16 Jul 2026 09:37:32 GMTHighActivethreat-actorg1013Samit Hotahttps://samithota.com/adversaries/g0045-menupass/https://samithota.com/adversaries/g0045-menupass/menuPass, also known as APT10, is a highly sophisticated Chinese state-sponsored cyber espionage group primarily focused on intellectual property theft and…Thu, 16 Jul 2026 09:37:07 GMTHighActivethreat-actorg0045Samit Hotahttps://samithota.com/adversaries/g1051-medusa-group/https://samithota.com/adversaries/g1051-medusa-group/Medusa Group is an aggressive Ransomware-as-a-Service (RaaS) operation known for double and triple extortion, targeting critical sectors globally with a focus…Thu, 16 Jul 2026 09:36:38 GMTHighActivethreat-actorg1051Samit Hotahttps://samithota.com/adversaries/g1026-malteiro/https://samithota.com/adversaries/g1026-malteiro/A profile of Malteiro (G1026), a Brazilian cybercrime group known for distributing the Mispadu banking trojan via a Malware-as-a-Service model.Wed, 15 Jul 2026 18:40:23 GMTHighActivethreat-actorg1026Samit Hotahttps://samithota.com/adversaries/g0059-magic-hound/https://samithota.com/adversaries/g0059-magic-hound/A detailed threat profile for Magic Hound (G0059), an Iranian-sponsored cyber espionage group, outlining their operations, targets, TTPs, and current status.Wed, 15 Jul 2026 14:26:25 GMTHighActivethreat-actorg0059Samit Hotahttps://samithota.com/adversaries/g0095-machete/https://samithota.com/adversaries/g0095-machete/Machete (G0095) is a long-standing, Spanish-speaking cyber espionage group targeting government, military, and critical infrastructure, primarily in Latin…Wed, 15 Jul 2026 14:25:55 GMTHighActivethreat-actorg0095Samit Hotahttps://samithota.com/adversaries/g1014-luminousmoth/https://samithota.com/adversaries/g1014-luminousmoth/LuminousMoth is a Chinese-speaking cyber espionage group (G1014) active since 2020, targeting government entities in Southeast Asia for intelligence gathering.Wed, 15 Jul 2026 14:25:24 GMTHighActivethreat-actorg1014Samit Hotahttps://samithota.com/adversaries/g0030-lotus-blossom/https://samithota.com/adversaries/g0030-lotus-blossom/Lotus Blossom is a China-aligned APT group focused on long-term intelligence collection against government, telecom, and critical infrastructure in Asia.Wed, 15 Jul 2026 14:24:54 GMTHighActivethreat-actorg0030Samit Hotahttps://samithota.com/adversaries/g0065-leviathan/https://samithota.com/adversaries/g0065-leviathan/A profile of Leviathan (APT40), a Chinese state-sponsored cyber espionage group targeting critical sectors for intelligence and IP theft.Wed, 15 Jul 2026 14:24:24 GMTHighActivethreat-actorg0065Samit Hotahttps://samithota.com/adversaries/g0077-leafminer/https://samithota.com/adversaries/g0077-leafminer/Leafminer (G0077), also known as Raspite, is an Iranian-nexus threat group primarily focused on intelligence collection against critical sectors in the Middle…Wed, 15 Jul 2026 09:36:14 GMTHighActivethreat-actorg0077Samit Hotahttps://samithota.com/adversaries/g0140-lazyscripter/https://samithota.com/adversaries/g0140-lazyscripter/LazyScripter (G0140) is a persistent threat group active since 2018, primarily targeting the airline industry and individuals seeking immigration, using…Wed, 15 Jul 2026 09:35:52 GMTMediumActivethreat-actorg0140Samit Hotahttps://samithota.com/adversaries/g0032-lazarus-group/https://samithota.com/adversaries/g0032-lazarus-group/A detailed profile of the Lazarus Group (G0032), North Korea's state-sponsored cyber threat, covering its origin, motivations, tactics, and recent activities.Wed, 15 Jul 2026 09:35:28 GMTCriticalActivethreat-actorg0032Samit Hotahttps://samithota.com/adversaries/g1004-lapsus/https://samithota.com/adversaries/g1004-lapsus/LAPSUS$ is a cybercriminal group specializing in social engineering and extortion, often without ransomware, targeting global organizations.Wed, 15 Jul 2026 09:35:00 GMTHighActivethreat-actorg1004Samit Hotahttps://samithota.com/adversaries/g0094-kimsuky/https://samithota.com/adversaries/g0094-kimsuky/A profile of Kimsuky, a North Korean state-sponsored APT group focused on intelligence gathering through sophisticated spear-phishing and evolving malware.Wed, 15 Jul 2026 09:34:30 GMTCriticalActivethreat-actorg0094Samit Hotahttps://samithota.com/adversaries/g0004-ke3chang/https://samithota.com/adversaries/g0004-ke3chang/Ke3chang, also known as APT15 and NICKEL, is a sophisticated Chinese state-sponsored threat group focused on long-term cyberespionage against global…Wed, 15 Jul 2026 09:33:34 GMTHighActivethreat-actorg0004Samit Hotahttps://samithota.com/adversaries/g0119-indrik-spider/https://samithota.com/adversaries/g0119-indrik-spider/A profile of Indrik Spider, a Russia-based cybercriminal group known for sophisticated banking trojans and evolving ransomware operations.Wed, 15 Jul 2026 09:33:03 GMTHighActivethreat-actorg0119Samit Hotahttps://samithota.com/adversaries/g0136-indigozebra/https://samithota.com/adversaries/g0136-indigozebra/IndigoZebra (G0136) is a suspected Chinese state-sponsored APT group active since 2014, primarily targeting Central Asian governments for cyber espionage.Wed, 15 Jul 2026 09:32:35 GMTHighActivethreat-actorg0136Samit Hotahttps://samithota.com/adversaries/g1032-inc-ransom/https://samithota.com/adversaries/g1032-inc-ransom/INC Ransom (G1032), also known as GOLD IONIC, is a prolific RaaS group active since mid-2023, primarily targeting healthcare, education, and manufacturing…Wed, 15 Jul 2026 09:32:16 GMTHighActivethreat-actorg1032Samit Hotahttps://samithota.com/adversaries/g0126-higaisa/https://samithota.com/adversaries/g0126-higaisa/An in-depth profile of Higaisa, a South Korean-suspected APT group targeting government, public, and trade organizations primarily in North Korea and Asia.Wed, 15 Jul 2026 09:31:39 GMTHighActivethreat-actorg0126Samit Hotahttps://samithota.com/adversaries/g1001-hexane/https://samithota.com/adversaries/g1001-hexane/A profile of HEXANE (G1001), an Iranian cyber espionage group targeting oil & gas, telecom, aviation, and ISPs in the Middle East and Africa.Wed, 15 Jul 2026 05:16:09 GMTHighActivethreat-actorg1001Samit Hotahttps://samithota.com/adversaries/g0100-inception/https://samithota.com/adversaries/g0100-inception/An in-depth profile of Inception (G0100), a long-running, state-aligned cyber espionage group known for its sophisticated TTPs and global intelligence…Tue, 14 Jul 2026 18:43:41 GMTHighActivethreat-actorg0100Samit Hotahttps://samithota.com/adversaries/g0125-hafnium/https://samithota.com/adversaries/g0125-hafnium/An in-depth analysis of HAFNIUM, a state-sponsored Chinese APT group known for sophisticated cyber espionage and rapid exploitation of zero-day vulnerabilities.Tue, 14 Jul 2026 18:43:17 GMTHighActivethreat-actorg0125Samit Hotahttps://samithota.com/adversaries/g0043-group5/https://samithota.com/adversaries/g0043-group5/Group5 (G0043) is an Iranian-linked threat actor engaged in cyber espionage, primarily targeting individuals associated with the Syrian opposition.Tue, 14 Jul 2026 18:42:32 GMTHighActivethreat-actorg0043Samit Hotahttps://samithota.com/adversaries/g0078-gorgon-group/https://samithota.com/adversaries/g0078-gorgon-group/A detailed profile of Gorgon Group (G0078), a Pakistan-linked threat actor known for its dual-pronged approach to cyber espionage and financially motivated…Tue, 14 Jul 2026 14:29:32 GMTHighActivethreat-actorg0078Samit Hotahttps://samithota.com/adversaries/g0115-gold-southfield/https://samithota.com/adversaries/g0115-gold-southfield/A deep dive into GOLD SOUTHFIELD (G0115), the Russian-linked cybercriminal group behind the infamous REvil and GandCrab ransomware-as-a-service operations,…Tue, 14 Jul 2026 14:29:08 GMTCriticalDisbandedthreat-actorg0115Samit Hotahttps://samithota.com/adversaries/g0036-gcman/https://samithota.com/adversaries/g0036-gcman/GCMAN (G0036) is a financially motivated threat group known for targeting financial institutions globally, employing sophisticated APT techniques and…Tue, 14 Jul 2026 14:28:33 GMTMediumDormantthreat-actorg0036Samit Hotahttps://samithota.com/adversaries/g0047-gamaredon-group/https://samithota.com/adversaries/g0047-gamaredon-group/Profile of Gamaredon Group (G0047), a Russia-aligned APT linked to the FSB, known for relentless cyber espionage against Ukraine and NATO members.Tue, 14 Jul 2026 14:28:17 GMTHighActivethreat-actorg0047Samit Hotahttps://samithota.com/adversaries/g0084-gallmaker/https://samithota.com/adversaries/g0084-gallmaker/A detailed profile of Gallmaker (G0084), a nation-state sponsored cyberespionage group targeting government, military, and defense sectors in the Middle East.Tue, 14 Jul 2026 14:27:48 GMTHighUnknownthreat-actorg0084Samit Hotahttps://samithota.com/adversaries/g0093-gallium/https://samithota.com/adversaries/g0093-gallium/GALLIUM (G0093), also known as Granite Typhoon, is a Chinese state-sponsored APT group focused on long-term cyberespionage against global telecommunications,…Tue, 14 Jul 2026 14:27:28 GMTHighActivethreat-actorg0093Samit Hotahttps://samithota.com/adversaries/g0117-fox-kitten/https://samithota.com/adversaries/g0117-fox-kitten/Fox Kitten (G0117) is an Iranian state-sponsored threat actor active since 2017, engaged in espionage and ransomware facilitation.Tue, 14 Jul 2026 14:27:03 GMTHighActivethreat-actorg0117Samit Hotahttps://samithota.com/adversaries/g0061-fin8/https://samithota.com/adversaries/g0061-fin8/FIN8, also known as Syssphinx, is a financially motivated cybercrime group that has evolved from targeting POS systems to deploying sophisticated ransomware…Tue, 14 Jul 2026 14:26:44 GMTHighActivethreat-actorg0061Samit Hotahttps://samithota.com/adversaries/g0046-fin7/https://samithota.com/adversaries/g0046-fin7/A deep dive into FIN7, a financially motivated cybercrime group known for evolving from POS attacks to sophisticated ransomware operations.Tue, 14 Jul 2026 09:32:24 GMTHighActivethreat-actorg0046Samit Hotahttps://samithota.com/adversaries/g0037-fin6/https://samithota.com/adversaries/g0037-fin6/A detailed profile of FIN6 (G0037), a financially motivated cybercrime group known for evolving from PoS compromises to ransomware and sophisticated social…Tue, 14 Jul 2026 09:31:36 GMTHighActivethreat-actorg0037Samit Hotahttps://samithota.com/adversaries/g0053-fin5/https://samithota.com/adversaries/g0053-fin5/A profile of FIN5 (G0053), a financially motivated threat group known for targeting hospitality, gaming, and restaurant sectors for payment card data.Tue, 14 Jul 2026 09:31:12 GMTHighUnknownthreat-actorg0053Samit Hotahttps://samithota.com/adversaries/g0085-fin4/https://samithota.com/adversaries/g0085-fin4/FIN4 is a financially-motivated threat group focused on stealing market-moving confidential information, primarily through credential theft and email…Tue, 14 Jul 2026 09:30:50 GMTHighActivethreat-actorg0085Samit Hotahttps://samithota.com/adversaries/g1016-fin13/https://samithota.com/adversaries/g1016-fin13/FIN13, also known as Elephant Beetle, is a patient, financially motivated threat actor primarily targeting Mexico and Latin America's financial, retail, and…Tue, 14 Jul 2026 09:30:27 GMTHighActivethreat-actorg1016Samit Hotahttps://samithota.com/adversaries/g0051-fin10/https://samithota.com/adversaries/g0051-fin10/Profile of FIN10 (G0051), a financially motivated threat group that operated in North America, primarily Canada, known for data exfiltration and extortion of…Tue, 14 Jul 2026 09:29:58 GMTMediumDormantthreat-actorg0051Samit Hotahttps://samithota.com/adversaries/g1011-exotic-lily/https://samithota.com/adversaries/g1011-exotic-lily/EXOTIC LILY (G1011) is a financially motivated initial access broker known for sophisticated spear phishing campaigns and ties to Russian cybercrime.Tue, 14 Jul 2026 09:29:39 GMTHighActivethreat-actorg1011Samit Hotahttps://samithota.com/adversaries/g0120-evilnum/https://samithota.com/adversaries/g0120-evilnum/Evilnum (G0120) is a financially motivated threat group active since 2018, primarily targeting financial technology companies and other entities for extensive…Tue, 14 Jul 2026 09:29:21 GMTHighActivethreat-actorg0120Samit Hotahttps://samithota.com/adversaries/g0020-equation/https://samithota.com/adversaries/g0020-equation/A profile of the Equation Group, a highly sophisticated threat actor widely attributed to the NSA, known for zero-days, firmware exploits, and deep cyber…Tue, 14 Jul 2026 09:28:55 GMTCriticalActivethreat-actorg0020Samit Hotahttps://samithota.com/adversaries/g1003-ember-bear/https://samithota.com/adversaries/g1003-ember-bear/Profile of Ember Bear (G1003), a Russian state-sponsored cyber espionage group linked to GRU Unit 29155, detailing their origins, motivations, targets, TTPs,…Tue, 14 Jul 2026 09:28:25 GMTCriticalActivethreat-actorg1003Samit Hotahttps://samithota.com/adversaries/g0137-ferocious-kitten/https://samithota.com/adversaries/g0137-ferocious-kitten/A profile of Ferocious Kitten (G0137), an Iranian cyberespionage group targeting Persian-speaking individuals, active since at least 2015.Tue, 14 Jul 2026 05:16:33 GMTHighActivethreat-actorg0137Samit Hotahttps://samithota.com/adversaries/g0066-elderwood/https://samithota.com/adversaries/g0066-elderwood/An in-depth profile of Elderwood (G0066), a sophisticated suspected Chinese cyber espionage group known for zero-day exploits and supply chain attacks.Tue, 14 Jul 2026 05:16:03 GMTHighDormantthreat-actorg0066Samit Hotahttps://samithota.com/adversaries/g1006-earth-lusca/https://samithota.com/adversaries/g1006-earth-lusca/A detailed profile of Earth Lusca, a China-linked APT group known for cyberespionage and financially motivated attacks across diverse global targets.Tue, 14 Jul 2026 05:15:39 GMTHighActivethreat-actorg1006Samit Hotahttps://samithota.com/adversaries/g0017-dragonok/https://samithota.com/adversaries/g0017-dragonok/DragonOK (G0017) is a China-linked APT group known for corporate espionage against high-tech and manufacturing firms, primarily in Japan.Mon, 13 Jul 2026 15:35:50 GMTMediumActivethreat-actorg0017Samit Hotahttps://samithota.com/adversaries/g0035-dragonfly/https://samithota.com/adversaries/g0035-dragonfly/An in-depth profile of Dragonfly (G0035), a Russian state-sponsored cyber espionage group targeting global critical infrastructure.Mon, 13 Jul 2026 15:35:24 GMTCriticalActivethreat-actorg0035Samit Hotahttps://samithota.com/adversaries/g0009-deep-panda/https://samithota.com/adversaries/g0009-deep-panda/A profile of Deep Panda (G0009), a sophisticated China-aligned threat group known for cyber espionage and credential theft.Mon, 13 Jul 2026 15:34:55 GMTHighActivethreat-actorg0009Samit Hotahttps://samithota.com/adversaries/g0105-darkvishnya/https://samithota.com/adversaries/g0105-darkvishnya/DarkVishnya is a financially motivated threat actor known for physically breaching Eastern European financial institutions using stealthy hardware.Mon, 13 Jul 2026 15:34:30 GMTHighDormantthreat-actorg0105Samit Hotahttps://samithota.com/adversaries/g0079-darkhydrus/https://samithota.com/adversaries/g0079-darkhydrus/DarkHydrus (G0079) is a state-sponsored threat group primarily targeting government and educational institutions in the Middle East for cyber espionage.Mon, 13 Jul 2026 15:34:10 GMTHighActivethreat-actorg0079Samit Hotahttps://samithota.com/adversaries/g0012-darkhotel/https://samithota.com/adversaries/g0012-darkhotel/Darkhotel is a sophisticated, suspected South Korean cyber espionage group known for evolving from hotel Wi-Fi attacks to advanced cloud-based operations.Mon, 13 Jul 2026 15:33:44 GMTHighActivethreat-actorg0012Samit Hotahttps://samithota.com/adversaries/g0070-dark-caracal/https://samithota.com/adversaries/g0070-dark-caracal/Dark Caracal is a state-aligned threat group (G0070) attributed to Lebanese security services, focusing on global mobile and desktop surveillance for espionage.Mon, 13 Jul 2026 15:33:19 GMTMediumActivethreat-actorg0070Samit Hotahttps://samithota.com/adversaries/g1034-daggerfly/https://samithota.com/adversaries/g1034-daggerfly/This profile details Daggerfly (G1034), a sophisticated China-linked APT group engaged in long-term cyber espionage against diverse targets across Asia and…Mon, 13 Jul 2026 15:32:55 GMTHighActivethreat-actorg1034Samit Hotahttps://samithota.com/adversaries/g1012-curium/https://samithota.com/adversaries/g1012-curium/An Iranian state-sponsored threat actor, CURIUM (G1012), known for its patient social engineering and espionage against Middle Eastern IT service providers.Mon, 13 Jul 2026 15:32:21 GMTHighActivethreat-actorg1012Samit Hotahttps://samithota.com/adversaries/g0052-copykittens/https://samithota.com/adversaries/g0052-copykittens/A profile of CopyKittens (G0052), an Iranian state-sponsored cyber espionage group targeting governments, defense, and IT sectors.Mon, 13 Jul 2026 15:32:10 GMTHighUnknownthreat-actorg0052Samit Hotahttps://samithota.com/adversaries/g1052-contagious-interview/https://samithota.com/adversaries/g1052-contagious-interview/Contagious Interview (G1052) is a North Korea-aligned threat group focused on cyberespionage and financially motivated operations targeting developers and…Mon, 13 Jul 2026 10:44:21 GMTHighActivethreat-actorg1052Samit Hotahttps://samithota.com/adversaries/g0142-confucius/https://samithota.com/adversaries/g0142-confucius/Confucius APT is an India-linked cyber espionage group active since 2013, primarily targeting military, government, and high-profile individuals in South Asia…Mon, 13 Jul 2026 10:43:55 GMTHighActivethreat-actorg0142Samit Hotahttps://samithota.com/adversaries/g0080-cobalt-group/https://samithota.com/adversaries/g0080-cobalt-group/A profile of the Cobalt Group (G0080), a highly sophisticated and persistent threat actor targeting financial institutions globally for illicit financial gain.Mon, 13 Jul 2026 10:43:29 GMTHighActivethreat-actorg0080Samit Hotahttps://samithota.com/adversaries/g0003-cleaver/https://samithota.com/adversaries/g0003-cleaver/Cleaver (G0003) is an Iranian state-sponsored threat group notorious for espionage and sabotage against global critical infrastructure.Mon, 13 Jul 2026 10:43:01 GMTHighActivethreat-actorg0003Samit Hotahttps://samithota.com/adversaries/g1021-cinnamon-tempest/https://samithota.com/adversaries/g1021-cinnamon-tempest/Cinnamon Tempest (G1021), a China-based threat group, uses ransomware as a smokescreen for cyberespionage and intellectual property theft.Mon, 13 Jul 2026 10:42:39 GMTHighActivethreat-actorg1021Samit Hotahttps://samithota.com/adversaries/g0114-chimera/https://samithota.com/adversaries/g0114-chimera/Chimera (G0114) is a suspected China-based APT group active since 2018, known for persistent cyber espionage targeting semiconductor intellectual property and…Mon, 13 Jul 2026 10:42:07 GMTHighActivethreat-actorg0114Samit Hotahttps://samithota.com/adversaries/g0008-carbanak/https://samithota.com/adversaries/g0008-carbanak/A deep dive into Carbanak (G0008), a financially motivated cybercrime group known for sophisticated attacks against global financial institutions.Mon, 13 Jul 2026 10:41:44 GMTHighActivethreat-actorg0008Samit Hotahttps://samithota.com/adversaries/g0060-bronze-butler/https://samithota.com/adversaries/g0060-bronze-butler/A detailed profile of BRONZE BUTLER (G0060), a Chinese state-sponsored cyber espionage group primarily targeting Japanese organizations for intellectual…Mon, 13 Jul 2026 10:41:28 GMTHighActivethreat-actorg0060Samit Hotahttps://samithota.com/adversaries/g0108-blue-mockingbird/https://samithota.com/adversaries/g0108-blue-mockingbird/Blue Mockingbird (G0108) is a financially motivated threat actor group focused on deploying Monero cryptocurrency miners on Windows systems.Mon, 13 Jul 2026 10:40:58 GMTHighActivethreat-actorg0108Samit Hotahttps://samithota.com/adversaries/g0098-blacktech/https://samithota.com/adversaries/g0098-blacktech/An in-depth profile of BlackTech (G0098), a sophisticated Chinese state-sponsored cyber espionage group targeting government, military, and critical…Mon, 13 Jul 2026 10:40:32 GMTHighActivethreat-actorg0098Samit Hotahttps://samithota.com/adversaries/g0063-blackoasis/https://samithota.com/adversaries/g0063-blackoasis/BlackOasis (G0063) is a sophisticated Middle Eastern threat group known for cyber-espionage against high-profile targets using zero-day exploits and FinSpy…Mon, 13 Jul 2026 05:54:45 GMTHighActivethreat-actorg0063Samit Hotahttps://samithota.com/adversaries/g1043-blackbyte/https://samithota.com/adversaries/g1043-blackbyte/Profile of BlackByte (G1043), a ransomware-as-a-service (RaaS) group active since 2021, known for double extortion and targeting critical infrastructure…Mon, 13 Jul 2026 05:54:24 GMTHighActivethreat-actorg1043Samit Hotahttps://samithota.com/adversaries/g1002-bitter/https://samithota.com/adversaries/g1002-bitter/A detailed profile of BITTER (G1002), a persistent South Asian cyber espionage group, outlining their origins, motivations, targets, TTPs, and current…Sun, 12 Jul 2026 18:30:11 GMTHighActivethreat-actorg1002Samit Hotahttps://samithota.com/adversaries/g0135-backdoordiplomacy/https://samithota.com/adversaries/g0135-backdoordiplomacy/A detailed threat profile of BackdoorDiplomacy, a China-linked APT group known for cyber espionage against diplomatic and telecommunication targets.Sun, 12 Jul 2026 14:13:33 GMTHighActivethreat-actorg0135Samit Hotahttps://samithota.com/adversaries/g0001-axiom/https://samithota.com/adversaries/g0001-axiom/A detailed profile of Axiom (G0001), a sophisticated, state-sponsored Chinese cyber espionage group targeting high-value intellectual property and sensitive…Sun, 12 Jul 2026 14:12:53 GMTHighActivethreat-actorg0001Samit Hotahttps://samithota.com/adversaries/g0143-aquatic-panda/https://samithota.com/adversaries/g0143-aquatic-panda/Aquatic Panda (G0143) is a China-linked APT conducting intelligence collection and industrial espionage, targeting diverse global sectors with advanced…Sun, 12 Jul 2026 14:12:28 GMTHighActivethreat-actorg0143Samit Hotahttps://samithota.com/adversaries/g1023-apt5/https://samithota.com/adversaries/g1023-apt5/APT5, also known as Mulberry Typhoon, is a China-based state-sponsored cyber espionage group targeting telecommunications, aerospace, and defense sectors…Sun, 12 Jul 2026 14:12:04 GMTHighActivethreat-actorg1023Samit Hotahttps://samithota.com/adversaries/g1044-apt42/https://samithota.com/adversaries/g1044-apt42/Iranian state-sponsored APT42 conducts cyber espionage and surveillance, primarily using sophisticated social engineering and credential harvesting to target…Sun, 12 Jul 2026 14:11:39 GMTHighActivethreat-actorg1044Samit Hotahttps://samithota.com/adversaries/g0096-apt41/https://samithota.com/adversaries/g0096-apt41/APT41 is a prolific Chinese state-sponsored threat group notorious for blending sophisticated cyber espionage with financially motivated operations globally.Sun, 12 Jul 2026 14:11:14 GMTHighActivethreat-actorg0096Samit Hotahttps://samithota.com/adversaries/g0087-apt39/https://samithota.com/adversaries/g0087-apt39/APT39, also known as Chafer and Remix Kitten, is an Iranian state-sponsored cyber espionage group focused on collecting personal information for surveillance.Sun, 12 Jul 2026 14:10:43 GMTHighActivethreat-actorg0087Samit Hotahttps://samithota.com/adversaries/g0082-apt38/https://samithota.com/adversaries/g0082-apt38/Profile of APT38, a North Korean state-sponsored threat group specializing in global financial cyber operations, destructive attacks, and cryptocurrency theft.Sun, 12 Jul 2026 14:10:16 GMTCriticalActivethreat-actorg0082Samit Hotahttps://samithota.com/adversaries/g0067-apt37/https://samithota.com/adversaries/g0067-apt37/APT37, a North Korean state-sponsored cyber espionage group, targets South Korea and global entities with sophisticated tactics and diverse custom malware.Sun, 12 Jul 2026 09:33:19 GMTCriticalActivethreat-actorg0067Samit Hotahttps://samithota.com/adversaries/g0064-apt33/https://samithota.com/adversaries/g0064-apt33/A detailed profile of APT33 (G0064), an Iranian state-sponsored threat group known for cyber espionage against critical infrastructure and a recent shift to…Sun, 12 Jul 2026 09:32:38 GMTHighActivethreat-actorg0064Samit Hotahttps://samithota.com/adversaries/g0050-apt32/https://samithota.com/adversaries/g0050-apt32/APT32, also known as OceanLotus, is a sophisticated, Vietnam-aligned cyber espionage group targeting governments, dissidents, and industries in Southeast Asia…Sun, 12 Jul 2026 09:32:13 GMTHighActivethreat-actorg0050Samit Hotahttps://samithota.com/adversaries/g0013-apt30/https://samithota.com/adversaries/g0013-apt30/A deep dive into APT30 (G0013), a Chinese state-sponsored cyber espionage group known for its decade-long operations targeting strategic intelligence.Sun, 12 Jul 2026 09:31:43 GMTHighActivethreat-actorg0013Samit Hotahttps://samithota.com/adversaries/g0022-apt3/https://samithota.com/adversaries/g0022-apt3/A deep dive into APT3 (G0022), a China-nexus cyber espionage group, detailing its origins, motivations, targets, TTPs, and evolution.Sun, 12 Jul 2026 09:31:20 GMTHighDormantthreat-actorg0022Samit Hotahttps://samithota.com/adversaries/g0016-apt29/https://samithota.com/adversaries/g0016-apt29/APT29, also known as Midnight Blizzard and Cozy Bear, is a highly sophisticated, state-sponsored Russian threat actor (SVR) focused on long-term cyber…Sun, 12 Jul 2026 09:31:01 GMTCriticalActivethreat-actorg0016Samit Hotahttps://samithota.com/adversaries/g0007-apt28/https://samithota.com/adversaries/g0007-apt28/A detailed profile of APT28 (Fancy Bear, Forest Blizzard), a Russian state-sponsored threat actor, detailing their origins, motivations, tactics, malware, and…Sun, 12 Jul 2026 09:30:34 GMTCriticalActivethreat-actorg0007Samit Hotahttps://samithota.com/adversaries/g0073-apt19/https://samithota.com/adversaries/g0073-apt19/A detailed profile of APT19 (G0073), a China-aligned threat group known for cyber espionage, credential harvesting, and targeting diverse sectors globally.Sun, 12 Jul 2026 09:30:08 GMTHighActivethreat-actorg0073Samit Hotahttps://samithota.com/adversaries/g0026-apt18/https://samithota.com/adversaries/g0026-apt18/APT18 (G0026), also known as Dynamite Panda, is a Chinese state-sponsored cyber espionage group targeting diverse sectors for intellectual property theft and…Sun, 12 Jul 2026 09:29:40 GMTHighActivethreat-actorg0026Samit Hotahttps://samithota.com/adversaries/g0025-apt17/https://samithota.com/adversaries/g0025-apt17/Profile of APT17 (Deputy Dog), a China-based state-sponsored threat group known for cyber espionage, targeting various sectors.Sun, 12 Jul 2026 09:29:14 GMTHighActivethreat-actorg0025Samit Hotahttps://samithota.com/adversaries/g0023-apt16/https://samithota.com/adversaries/g0023-apt16/APT16 is a China-based threat group known for cyber espionage, primarily targeting organizations in Japan and Taiwan using spearphishing.Sat, 11 Jul 2026 14:07:13 GMTMediumActivethreat-actorg0023Samit Hotahttps://samithota.com/adversaries/g0005-apt12/https://samithota.com/adversaries/g0005-apt12/A deep dive into APT12, a sophisticated Chinese state-sponsored cyber espionage group known for its adaptive tactics and targeting of East Asian governments,…Sat, 11 Jul 2026 14:07:03 GMTHighActivethreat-actorg0005Samit Hotahttps://samithota.com/adversaries/g0006-apt1/https://samithota.com/adversaries/g0006-apt1/APT1, also known as Comment Crew (G0006), is a state-sponsored Chinese cyber espionage group attributed to PLA Unit 61398, infamous for vast intellectual…Sat, 11 Jul 2026 14:06:37 GMTHighActivethreat-actorg0006Samit Hotahttps://samithota.com/adversaries/g0099-apt-c-36/https://samithota.com/adversaries/g0099-apt-c-36/Profile of APT-C-36 (Blind Eagle), a South American threat group engaging in espionage and financial operations since 2018.Sat, 11 Jul 2026 11:49:20 GMTHighActivethreat-actorg0099Samit Hotahttps://samithota.com/adversaries/g1028-apt-c-23/https://samithota.com/adversaries/g1028-apt-c-23/APT-C-23, also known as Arid Viper, is a sophisticated, likely state-sponsored group primarily targeting the Middle East with advanced mobile and Windows…Sat, 11 Jul 2026 11:48:44 GMTHighActivethreat-actorg1028Samit Hotahttps://samithota.com/adversaries/g1049-applejeus/https://samithota.com/adversaries/g1049-applejeus/AppleJeus (G1049) is a North Korean state-sponsored threat group primarily focused on financial gain through sophisticated cryptocurrency theft and supply…Sat, 11 Jul 2026 11:48:18 GMTHighActivethreat-actorg1049Samit Hotahttps://samithota.com/adversaries/g1007-aoqin-dragon/https://samithota.com/adversaries/g1007-aoqin-dragon/A profile of Aoqin Dragon (G1007), a suspected Chinese cyber espionage group actively targeting government, education, and telecom entities since 2013.Sat, 11 Jul 2026 11:47:34 GMTHighActivethreat-actorg1007Samit Hotahttps://samithota.com/adversaries/g0138-andariel/https://samithota.com/adversaries/g0138-andariel/A profile of Andariel (G0138), a North Korean state-sponsored threat group known for cyber espionage, destructive attacks, and financially motivated…Sat, 11 Jul 2026 11:47:12 GMTHighActivethreat-actorg0138Samit Hotahttps://samithota.com/adversaries/g1024-akira/https://samithota.com/adversaries/g1024-akira/Akira is a financially motivated ransomware-as-a-service (RaaS) group employing double extortion tactics against diverse sectors worldwide.Sat, 11 Jul 2026 11:36:28 GMTHighActivethreat-actorg1024Samit Hotahttps://samithota.com/adversaries/g0130-ajax-security-team/https://samithota.com/adversaries/g0130-ajax-security-team/An in-depth profile of the Iranian-nexus threat actor known as Ajax Security Team (G0130) or Rocket Kitten, detailing their origins, motivations, targets,…Sat, 11 Jul 2026 11:35:48 GMTHighActivethreat-actorg0130Samit Hotahttps://samithota.com/adversaries/g1030-agrius/https://samithota.com/adversaries/g1030-agrius/Agrius (G1030), an Iranian state-sponsored APT, specializes in destructive wiper and pseudo-ransomware attacks, primarily targeting Israeli sectors since 2020.Sat, 11 Jul 2026 11:25:28 GMTHighActivethreat-actorg1030Samit Hotahttps://samithota.com/adversaries/g0018-admin-338/https://samithota.com/adversaries/g0018-admin-338/In-depth profile of admin@338, a China-based threat group known for cyber espionage against financial, economic, and media organizations.Sat, 11 Jul 2026 11:24:57 GMTHighActivethreat-actorg0018Samit Hota