Threat Actor Registry | The CyberSec Times

APT Chronos

Eastern Europe

APT Chronos employs a refined mix of credential harvesting, custom malware deployment, and exploitation chaining through vulnerable third-party integrations. The group systematically targets high-value industrial and governmental networks via spear-phishing, leveraging compromised infrastructure to maintain long-term access and lateral movement. Their operations are characterized by stealth persistence and careful operational security, with indications suggesting regular updates to their toolkit driven by in-field learnings from prior engagements.

Government & Defense Critical Infrastructure Cloud & Technology Manufacturing

TA505

Eastern Europe

TA505 exhibits a high degree of operational adaptability and has shifted tactics over time, leveraging spear-phishing campaigns, credential harvesting, and extensive use of commodity malware. Their modus operandi has evolved to include multi-stage intrusion techniques with a pronounced focus on financial targets and large-scale ransomware deployments.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

APT Dynamo

Iran (IRGC-nexus)

APT Dynamo exploits a blend of credential abuse and software supply chain manipulation to infiltrate high-value targets in financial and governmental sectors. Their operational tactics include targeted spear-phishing, lateral movement through compromised accounts, and the exploitation of emerging zero-day vulnerabilities. The group is known to automate repetitive phases of their intrusions while maintaining low visibility across internal IT infrastructures.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology Manufacturing

ShadowRaptor

Germany

The observed shadow campaign centers on sophisticated executive impersonation coupled with rapid domain fluxing and multi-stage financial diversion techniques. The group leverages automated toolkits integrated with generative AI to refine their social engineering strategies and obfuscate attribution.

Government & Defense Financial Services Cloud & Technology

CyberRoot

India

CyberRoot has been implicated in mercenary-style cyber intrusions targeting corporate and governmental digital assets. The group is known to leverage customized malware and advanced social engineering techniques tailored for espionage and data exfiltration. Their operations typically involve targeted spear-phishing campaigns, deployment of modular remote access Trojans, and exploitation of zero-day vulnerabilities in widely used enterprise software.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

Kimsuky

North Korea (DPRK-nexus)

Kimsuky employs a blend of spear-phishing, social engineering, and custom malware implants to infiltrate governmental and financial institutions. Their operations are characterized by rapid reconnaissance, lateral movement through weakly segmented networks, and adaptive evasion techniques that leverage off-the-shelf exploits alongside tailored zero-day vulnerabilities.

Government & Defense Critical Infrastructure Cloud & Technology Manufacturing

APT-Spectre

Asia-Pacific

APT-Spectre has emerged as a persistent threat actor with a focus on compromising cloud-based multi-tenant environments and critical digital infrastructures across the region. Their operational methodology combines targeted spear-phishing campaigns with the exploitation of subtle microarchitectural weaknesses in shared hardware environments, leveraging both custom malware implants and open-source toolkits to maintain stealth. They carefully blend traditional intrusion vectors with precision lateral movement, exploiting identity and access management (IAM) weaknesses to pivot across high-value targets.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

Volt Typhoon

China (PRC-nexus)

Volt Typhoon is observed employing multi-stage intrusion techniques that pivot from initial access through meticulously orchestrated lateral movements. The group leverages phishing as an initial vector, combined with custom malware implants and multi-layered obfuscation to maintain stealth over extended campaigns targeting enterprises with critical assets.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology Manufacturing

APT41

China

APT41 is noted for its hybrid approach that combines supply chain compromise, social engineering, and custom malware implants. The group leverages multi-stage spear-phishing, lateral pivoting, and data exfiltration operations to target high-value assets in government, healthcare, and industrial sectors. Their operations have been observed to involve extensive use of encrypted command and control channels, anonymizing tools, and a modular malware framework that supports dynamic configuration changes.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology Healthcare Manufacturing

Storm-2945

Unknown Adversary (State-Sponsored Cluster)

Storm-2945 conducts covert intrusions employing spear-phishing vectors, tailored zero-day exploits, and multi-stage lateral movement to infiltrate enterprise and critical infrastructure assets. Their operational methodology emphasizes stealth persistence, rapid escalation of privileges, and data exfiltration through encrypted channels.

Critical Infrastructure

APT-Cascade

EMEA

APT-Cascade has been observed leveraging multi-vector intrusion methods that combine traditional spear-phishing with advanced lateral movement techniques. Their operational methodology emphasizes reconnaissance, initial access via compromised third-party vendors, and rapid escalation through exploitation of known software vulnerabilities. Their campaigns often target technology and critical infrastructure sectors through modular malware implants and custom-developed remote access tools.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

Gambling Goblin

China

Leveraging compromised high-reputation domains to facilitate stealthy reverse proxy attacks, the actor deploys a multi-layered Linux toolkit obfuscated with virtualization and packing. Their tactics hinge on installing custom Apache modules on targeted Brazilian government and educational sites, thereby bypassing conventional security headers and re-purposing legitimate domains to serve phishing content and illicit SEO boost campaigns.

Government & Defense Critical Infrastructure Cloud & Technology

APT-Lazarus

North Korea (DPRK-nexus)

APT-Lazarus employs a multi-phased approach combining AI-enhanced social engineering tactics with custom malware implants. Their strategy includes initial spear-phishing campaigns, lateral movement through targeted network segments, and the strategic use of cryptocurrency diversion to fund subsequent operations. Their operations are marked by precision targeting of global financial platforms and cryptocurrency exchanges, with an emphasis on evasion of traditional detection technologies.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

JSCeal

Global

Obfuscation via compiled V8 bytecode, multi-layer encryption with RC4-protected strings, control-flow flattening, and proxy function utilization. The malware is engineered to harvest credentials and intercept HTTPS traffic, specifically targeting cryptocurrency platforms and financial services.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

APT-Nova

Japan

APT-Nova operates with a high degree of operational security, employing multi-phase intrusion techniques and advanced obfuscation measures. Their operational campaigns typically begin with spear-phishing followed by the exploitation of zero-day vulnerabilities within custom-developed remote access trojans. They leverage lateral movement techniques and conduct comprehensive network reconnaissance before initiating data exfiltration or deploying payloads for long-term persistence.

Government & Defense Critical Infrastructure Cloud & Technology Manufacturing

APT29

Russia (SVR-nexus)

APT29 employs sophisticated spear-phishing campaigns, custom malware implants, and lateral movement techniques to infiltrate governmental, diplomatic, and critical infrastructure networks. Their operations typically feature meticulous reconnaissance, temporal blending of malware deployment with stealth operations, and adaptive persistence techniques to maintain long-term access within compromised systems.

Government & Defense Critical Infrastructure

APT-Kraken

APAC

APT-Kraken has emerged as a formidable adversary originating from the APAC region. Their modus operandi is characterized by multi-stage intrusion operations leveraging custom-developed malware and highly adaptive phishing campaigns. They are known to exploit misconfigured cloud services and supply chain weaknesses in order to gain initial access, establishing footholds in high-value networks. This group’s operational tempo suggests a well-resourced and disciplined organization that balances direct system exploitation with stealthy lateral movements, ensuring persistence and minimizing exposure to counter-intelligence measures.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology Manufacturing

APT-Quantum

Western Europe

APT-Quantum has been observed employing sophisticated spear-phishing campaigns, custom malware implants, and lateral movement techniques to compromise high-value targets in the technology and critical infrastructure sectors. Their operations leverage a mix of custom-built tools and widely available exploitation frameworks, with a strong focus on evading detection through obfuscation and multi-stage payloads.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology Manufacturing

APT-Redline

Eastern Europe

APT-Redline has been observed employing a sophisticated blend of ransomware deployment combined with targeted espionage activities. Their tactics, techniques, and procedures (TTPs) demonstrate an evolving operational methodology that integrates advanced initial access vectors, lateral movement through credential abuse, and extensive data exfiltration prior to deploying encryption payloads. The group focuses predominantly on enterprises with sizeable digital footprints, notably targeting cloud infrastructures and hybrid networks.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

MuddyWater

Middle East

MuddyWater is observed executing operations targeting electronics manufacturing in APAC markets with an emphasis on strategic espionage. The group leverages spearphishing and water-holing techniques combined with credential abuse to gain initial footholds in target networks.

Government & Defense Critical Infrastructure Cloud & Technology Manufacturing

Grandoreiro

Latin America

The adversary employs advanced banking Trojan techniques, integrating traditional credential harvesting with adaptable spyware capabilities. Their operations are characterized by persistent network intrusion, stealth lateral movement, and modular malware deployment designed to exfiltrate sensitive data from financial institutions and digital asset platforms.

Government & Defense Financial Services Critical Infrastructure Cloud & Technology

APT Storm-2945

Unknown Adversary (State-Sponsored Cluster)

APT Storm-2945 has consistently demonstrated the ability to leverage low-level system vulnerabilities and misconfigurations to penetrate highly secure environments. Their operations reveal a methodical progression from initial access through lateral movement and privilege escalation, emphasizing exploitation of overlooked identity and access management weaknesses. The groups tactics include the targeted compromise of cloud infrastructure elements, with a clear preference for environments where container orchestrations and multi-tenant deployments expose subtle microarchitectural vulnerabilities. Their operational playbook exhibits sophistication in evading detection while applying persistent, stealthy techniques for data exfiltration and intelligence gathering.

Critical Infrastructure Cloud & Technology

StopAndProtect

Global

Leveraging mass compromise of vulnerable WordPress sites and lateral movement through misconfigured server environments, the group has methodically exploited unpatched installations to deploy ransomware, exfiltrate sensitive data and maintain persistent footholds in infected networks. The operation demonstrates an adept use of both automated exploitation tools and manual post-compromise techniques to expand access within targeted organizations.

Government & Defense Critical Infrastructure Cloud & Technology

Lazarus Group

North Korea (DPRK-nexus)

Advanced persistent threat with a focus on financial gain and espionage.

Critical Infrastructure Cloud & Technology

TeamPCP

Unknown (Likely Eastern Europe)

TeamPCP employs sophisticated supply chain attacks, leveraging compromised maintainer accounts to inject malicious code into widely used software packages. Their tactics include self-replicating malware and credential theft, targeting npm packages and cloud environments.

Manufacturing

Gentlemen Ransomware Group

Global

Utilizes social engineering and sophisticated malware delivery methods.

Critical Infrastructure Cloud & Technology

Scattered Spider

Transnational Cybercrime Syndicate

Utilizes social engineering and advanced phishing techniques to target high-profile organizations.

Critical Infrastructure Cloud & Technology

APT28 (Fancy Bear)

Russia (GRU-nexus)

APT28 employs sophisticated phishing techniques, leveraging social engineering to compromise high-value targets, particularly in governmental and military sectors.

Government & Defense Critical Infrastructure Cloud & Technology

CL-STA-1062

China

Utilizes custom backdoors and sophisticated phishing techniques to target government entities.

Government & Defense Critical Infrastructure Cloud & Technology

Gamaredon

Russia

Gamaredon is known for its sophisticated malware deployment and evasion techniques, often targeting government and critical infrastructure.

Government & Defense Critical Infrastructure Cloud & Technology

Gentlemen Ransomware Gang

Russia

Utilizes advanced evasion techniques and targets high-value organizations.

Critical Infrastructure Cloud & Technology

Sapphire Sleet

North Korea

Utilizes supply chain attacks, focusing on software dependencies and open-source packages.

Financial Services Critical Infrastructure Cloud & Technology Manufacturing

Icarus Group

Unknown

The Icarus group employs phishing, social engineering, and technical exploits to gain access to OAuth tokens and sensitive data.

Government & Defense Critical Infrastructure Cloud & Technology

FishMonger

China

FishMonger employs sophisticated phishing techniques, often utilizing social engineering tactics to compromise targets.

Government & Defense Critical Infrastructure Cloud & Technology

UNC6508

China

Utilizes sophisticated phishing techniques and exploits vulnerabilities in critical infrastructure.

Government & Defense Critical Infrastructure Cloud & Technology

Outsider Enterprise

China

Utilizes AI for phishing and credential theft.

Government & Defense Critical Infrastructure Cloud & Technology

ShinyHunters

Global

ShinyHunters employs sophisticated phishing techniques, exploits zero-day vulnerabilities, and utilizes social engineering to gain unauthorized access to sensitive data.

Financial Services Critical Infrastructure Cloud & Technology

Qilin Ransomware Group

Ransomware-as-a-Service Syndicate

Ransomware-as-a-Service, exploiting VPN vulnerabilities.

Government & Defense Critical Infrastructure Cloud & Technology

The Glasswing Syndicate

Unknown (Likely Eastern Europe)

Specializes in the discovery and weaponization of template injection (SSTI) and sandbox bypasses in popular web frameworks.

Financial Services Cloud & Technology

The Proxy Syndicate

Global / Decentralized

Specializes in the development and distribution of 'monetization SDKs' that convert consumer IoT devices into residential proxies. Utilizes 'gray-market' app stores and bundled software to achieve massive scale.

Financial Services Cloud & Technology

TA4922

China

Utilizes a wide array of TTPs including social engineering, modular RATs (Atlas), and supply chain compromise. Known for high adaptability and lack of a specific industry focus.

Financial Services Cloud & Technology Manufacturing

The Atlas Syndicate (Tracked as APT-CN-99)

China

Specializes in aerospace espionage, multi-stage RAT deployment, and LotL persistence. Known for using modular malware with advanced anti-VM checks.

Cloud & Technology

The Synthetic Syndicate

Unknown (Global/Decentralized)

Specializes in AI-generated malware, EDR evasion, and automated Active Directory discovery.

Enterprise Infrastructure Critical Technology

DriveSurge (UNC-4822)

Eastern Europe (Attributed)

Specializes in large-scale CMS compromise, social engineering overlays (ClickFix), and PowerShell-based malware delivery. Known for using AI to localize lures.

Enterprise Infrastructure Critical Technology

The Shadow Harvesters (Tracked as APT-RU-26)

Russia

Specializes in the creation of front companies to procure Western technology. Utilizes a mix of social engineering, supply chain compromise, and targeted cyber-espionage to exfiltrate IP related to semiconductors, AI hardware, and aerospace engineering.

Cloud & Technology Manufacturing

The Shadow Brokers (2026 Resurgence)

Unknown / Distributed

Specializes in exploiting edge infrastructure (VPNs, Firewalls) and weaponizing AI-driven social engineering.

Critical Infrastructure Cloud & Technology

Storm-2697

Unknown (Likely Eastern Europe)

Specializes in Go-based malware, self-propagating ransomware, and rapid lateral movement using WMI and SMB.

Cloud & Technology

GreyVibe

Russia

Specializes in AI-augmented social engineering, polymorphic malware generation, and targeting of critical infrastructure in Eastern Europe. Utilizes public LLMs (ChatGPT, Gemini) to bypass traditional security filters.

Critical Infrastructure

Silent Ransom Group (SRG)

Unknown / Likely Eastern Europe

Physical infiltration, high-fidelity social engineering, workstation subversion, and data extortion without encryption (pure exfiltration).

Financial Services Cloud & Technology

Adversary Intelligence Directory