Threat Actors
Understanding who attacks you is as important as understanding how they attack. This guide covers major threat actor categories, notable APT groups, and their documented tactics, techniques, and procedures.
Actor Attribution
Featured Threat Actors
APT29 (Cozy Bear)
The Dukes • NOBELIUM • Midnight Blizzard +1 more
Highly sophisticated, patient operators known for SolarWinds supply chain attack (2020). Focus on intelligence gathering against government and diplomatic targets.
🎯 Target Sectors
⚔️ Key TTPs
- • Supply chain compromises
- • Living-off-the-land
- • OAuth/token theft
- • Cloud service abuse
🦠 Associated Malware
💥 Notable Attacks
- • SolarWinds (2020)
- • Microsoft Exchange (2021)
- • TeamViewer (2024)
Lazarus Group
Hidden Cobra • ZINC • Labyrinth Chollima +1 more
North Korean state-sponsored group conducting both espionage and financially motivated attacks, including cryptocurrency heists and ransomware operations.
🎯 Target Sectors
⚔️ Key TTPs
- • Spearphishing
- • Watering holes
- • Supply chain attacks
- • Cryptocurrency theft
🦠 Associated Malware
💥 Notable Attacks
- • Sony Pictures (2014)
- • Bangladesh Bank (2016)
- • WannaCry (2017)
- • Ronin Bridge ($625M)
LockBit
LockBit 3.0 • LockBit Black • ABCD Ransomware
Most prolific ransomware group responsible for ~44% of global ransomware attacks. Operates affiliate program with sophisticated double/triple extortion tactics.
🎯 Target Sectors
⚔️ Key TTPs
- • Initial access brokers
- • RDP exploitation
- • Double extortion
- • Data leak sites
🦠 Associated Malware
💥 Notable Attacks
- • Royal Mail UK (2023)
- • Boeing (2023)
- • ICBC (2023)
MITRE ATT&CK Matrix Navigator
The MITRE ATT&CK framework maps threat actor behaviors to standardized techniques. Click any technique to view detailed information and defensive countermeasures. Highlighted techniques are commonly used by nation-state APTs.
Enterprise ATT&CK Matrix - Common APT Techniques
Threat Actor Categories
Nation-State Actors (APTs)
Government-sponsored groups with significant resources. Focus on espionage, intellectual property theft, and strategic objectives. Known for persistence and sophistication.
Examples: APT28, APT29, Lazarus Group, APT41
Cybercrime Syndicates
Financially motivated groups operating ransomware, banking trojans, and fraud schemes. Often operate as Ransomware-as-a-Service (RaaS) or affiliate programs.
Examples: LockBit, BlackCat/ALPHV, FIN7, Conti
Hacktivists
Ideologically motivated groups targeting organizations for political or social causes. Tactics include DDoS, defacement, and data leaks.
Examples: Anonymous, KillNet, IT Army of Ukraine
Insider Threats
Malicious or negligent insiders with legitimate access. Can be recruited by external actors or act independently for financial gain or revenge.
Motivations: Financial, revenge, ideology, coercion
Russia-Linked Actors
APT28 (Fancy Bear)
Also: Sofacy, Sednit, STRONTIUM, Forest Blizzard
Associated with Russian military intelligence (GRU). Known for targeting government, military, and media organizations. Responsible for DNC hack (2016) and numerous espionage campaigns.
Key TTPs
- • Spearphishing with malicious attachments
- • Zero-day exploits (Windows, Office)
- • Credential harvesting via OAuth abuse
- • Custom malware: XAgent, Zebrocy, Drovorub
Target Sectors
- • Government & military
- • Defense contractors
- • Media organizations
- • Political campaigns
APT29 (Cozy Bear)
Also: The Dukes, NOBELIUM, Midnight Blizzard
Associated with Russia's Foreign Intelligence Service (SVR). Highly sophisticated, patient operators known for SolarWinds supply chain attack (2020). Focus on intelligence gathering.
Key TTPs
- • Supply chain compromises
- • Living-off-the-land techniques
- • OAuth/token theft
- • Custom malware: SUNBURST, TEARDROP
Target Sectors
- • Government agencies
- • Think tanks & NGOs
- • IT service providers
- • Healthcare & research
Sandworm
Also: Voodoo Bear, IRIDIUM, Seashell Blizzard
Destructive operations unit. Responsible for NotPetya (2017), Ukrainian power grid attacks (2015, 2016), and Olympic Destroyer (2018). Focus on sabotage and disruption.
Key TTPs
- • Destructive malware (wipers)
- • ICS/SCADA targeting
- • Supply chain attacks
- • Custom malware: Industroyer, BlackEnergy
Target Sectors
- • Critical infrastructure
- • Energy sector
- • Government (Ukraine focus)
- • Global events (Olympics)
China-Linked Actors
APT41 (Double Dragon)
Also: Winnti, BARIUM, Wicked Panda
Unique dual-mission actor conducting both state-sponsored espionage and financially motivated attacks. Known for supply chain compromises and targeting gaming/tech companies.
Key TTPs
- • Supply chain compromises
- • Code signing certificate theft
- • Rootkits and bootkits
- • Custom malware: ShadowPad, PlugX
Target Sectors
- • Gaming & technology
- • Healthcare & telecom
- • Higher education
- • Media & entertainment
APT1 (Comment Crew)
Also: Comment Panda, PLA Unit 61398
One of the first publicly attributed Chinese APT groups (Mandiant 2013 report). Focus on intellectual property theft from Western companies.
Key TTPs
- • Spearphishing campaigns
- • Webshells for persistence
- • Custom backdoors
- • Long-term data exfiltration
Target Sectors
- • Aerospace & defense
- • Energy & utilities
- • Manufacturing
- • Technology
Volt Typhoon
Also: BRONZE SILHOUETTE, Vanguard Panda
Active since 2021, targeting U.S. critical infrastructure. Notable for heavy use of living-off-the-land techniques to evade detection. Pre-positioning for potential future disruption.
Key TTPs
- • Living-off-the-land binaries (LOLBins)
- • SOHO router compromises
- • NTDS.dit extraction
- • Minimal malware footprint
Target Sectors
- • Communications
- • Energy & utilities
- • Transportation
- • Water & wastewater
North Korea-Linked Actors
Lazarus Group
Also: HIDDEN COBRA, Zinc, Diamond Sleet
Most prominent DPRK threat actor. Responsible for Sony Pictures hack (2014), Bangladesh Bank heist (2016), WannaCry (2017), and numerous cryptocurrency thefts totaling billions of dollars.
Key TTPs
- • Social engineering via fake job offers
- • Supply chain attacks (npm, PyPI)
- • Cryptocurrency bridge exploits
- • Custom malware: BLINDINGCAN, AppleJeus
Target Sectors
- • Cryptocurrency/DeFi
- • Financial institutions
- • Defense & aerospace
- • Technology companies
Kimsuky
Also: Velvet Chollima, Thallium, Emerald Sleet
Espionage-focused group targeting South Korean government, think tanks, and academics. Known for credential theft and social engineering. Often impersonates journalists and academics.
Key TTPs
- • Credential phishing
- • Malicious browser extensions
- • HWP document exploits
- • Custom malware: BabyShark, AppleSeed
Target Sectors
- • Government (Korea focus)
- • Think tanks & research
- • Academia
- • Journalists
Iran-Linked Actors
APT33 (Elfin)
Also: Refined Kitten, Magnallium, Peach Sandstorm
Targets aviation, energy, and petrochemical sectors. Known for destructive wiper attacks (Shamoon variants) and password spraying campaigns.
Key TTPs
- • Password spraying
- • Spearphishing with job lures
- • Destructive wipers
- • Custom malware: TURNEDUP, DROPSHOT
Target Sectors
- • Aviation & aerospace
- • Energy & petrochemical
- • Defense
- • Saudi Arabia focus
APT34 (OilRig)
Also: Helix Kitten, IRN2, Hazel Sandstorm
Espionage group targeting Middle Eastern governments and critical infrastructure. Known for DNS tunneling and custom tooling. Tools leaked in 2019 (Lab Dookhtegan).
Key TTPs
- • DNS tunneling for C2
- • LinkedIn social engineering
- • Webshells
- • Custom malware: TONEDEAF, VALUEVAULT
Target Sectors
- • Government (Middle East)
- • Financial services
- • Energy
- • Telecommunications
Israel-Linked Actors
Unit 8200
Also: Israeli SIGINT National Unit
Elite signals intelligence unit of the Israel Defense Forces. Alumni have founded major cybersecurity companies (NSO Group, Check Point, Palo Alto Networks). Attributed to Stuxnet development (with NSA).
Key TTPs
- • Zero-day development & exploitation
- • ICS/SCADA targeting
- • Mobile device exploitation
- • Notable: Stuxnet, Duqu, Flame
Target Sectors
- • Nuclear facilities (Iran focus)
- • Critical infrastructure
- • Regional adversaries
- • Telecommunications
NSO Group (Pegasus)
Commercial Spyware Vendor
Israeli cyber-intelligence company selling Pegasus spyware to governments. Zero-click exploits targeting iOS/Android. Sanctioned by US (2021). Linked to surveillance of journalists and activists.
Key TTPs
- • Zero-click iOS exploits (iMessage)
- • Android exploitation
- • Network injection attacks
- • Full device compromise & exfil
Capabilities
- • Real-time location tracking
- • Microphone/camera activation
- • Message interception (E2E encrypted)
- • Credential harvesting
Candiru
Also: Saito Tech Ltd, Grindavik Solutions
Israeli spyware company selling surveillance tools to governments. DevilsTongue malware targets Windows. Sanctioned by US alongside NSO Group (2021). Operates under multiple shell companies.
Key TTPs
- • Browser zero-days (Chrome, IE)
- • Windows privilege escalation
- • Watering hole attacks
- • DevilsTongue spyware
Target Sectors
- • Journalists & dissidents
- • Human rights activists
- • Politicians & diplomats
- • Civil society organizations
Predatory Sparrow
Also: Gonjeshke Darande
Hacktivist group suspected of Israeli state ties. Responsible for disruptive attacks on Iranian infrastructure including steel facilities (2022), gas stations (2021), and rail systems (2021).
Key TTPs
- • ICS/OT targeting
- • Destructive payloads
- • Public announcement of attacks
- • Video evidence release
Notable Attacks
- • Khouzestan Steel (2022) - physical damage
- • Iran gas stations (2021)
- • Iran Railways (2021)
- • Broadcast hijacking
Ransomware Groups
LockBit
Ransomware-as-a-Service (RaaS)
Most prolific ransomware operation (2019-2024). Operates affiliate program with profit sharing. Known for fast encryption and aggressive extortion. Disrupted by Operation Cronos (Feb 2024).
Key TTPs
- • Initial access via RDP, VPN exploits
- • Cobalt Strike for C2
- • Double/triple extortion
- • StealBit data exfiltration
Notable Attacks
- • ICBC (2023)
- • Royal Mail UK (2023)
- • Boeing (2023)
- • Numerous healthcare orgs
BlackCat / ALPHV
Rust-based Ransomware-as-a-Service
First professional Rust-based ransomware (2021). Cross-platform (Windows, Linux, ESXi). Known for SEC complaint extortion tactic. Exit scammed affiliates in March 2024.
Key TTPs
- • Cross-platform targeting
- • VMware ESXi focus
- • Novel extortion tactics
- • Searchable leak site
Notable Attacks
- • Change Healthcare (2024)
- • MGM Resorts (2023)
- • Reddit (2023)
- • Western Digital (2023)
Scattered Spider
Also: UNC3944, Octo Tempest, 0ktapus
Young, English-speaking cybercrime group known for social engineering and SIM swapping. Affiliated with ALPHV. Notable for targeting identity providers (Okta, Microsoft).
Key TTPs
- • IT helpdesk impersonation
- • SIM swapping for MFA bypass
- • SMS phishing (smishing)
- • Identity provider targeting
Notable Attacks
- • MGM Resorts (2023)
- • Caesars Entertainment (2023)
- • Twilio/Cloudflare (2022)
- • Numerous tech companies
Tracking Threat Actors
Query threat actor information using MITRE ATT&CK Navigator or the ATT&CK API:
# Query MITRE ATT&CK for group information
curl -s "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json" | \
jq '.objects[] | select(.type=="intrusion-set") | {name: .name, aliases: .aliases, description: .description}'
# Search for specific group
curl -s "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json" | \
jq '.objects[] | select(.type=="intrusion-set" and .name=="APT29")'Vendor Naming Cross-Reference
Different vendors use different naming conventions. Here's a quick reference:
| MITRE | Microsoft | CrowdStrike | Mandiant |
|---|---|---|---|
| APT28 | Forest Blizzard | Fancy Bear | APT28 |
| APT29 | Midnight Blizzard | Cozy Bear | APT29 |
| Lazarus Group | Diamond Sleet | Labyrinth Chollima | APT38 |
| APT41 | Brass Typhoon | Wicked Panda | APT41 |
Red Team Application
Evidence to Capture
An actor profile is only usable if the next analyst can retrace where each claim came from. Capture the artefact behind the attribution, not the conclusion.
Attribution basis: The specific report or dataset behind the attribution — publisher, title, publication date and URL or report ID — rather than the actor name on its own.
Alias set in use: Every name the source used: MITRE group name, vendor designations and any internal tracking name, so the profile does not fork into two records.
ATT&CK group identifier:
The stable key across vendors that rename freely, for example G0016 for APT29.
Campaign dates and victimology: First and last observed activity plus the sectors and geographies the source records. These two fields decide whether the actor is relevant to the estate at all.
Tooling and infrastructure: Malware families, loaders and infrastructure attributed to the actor, with family names as the source published them.
Source reliability: Whether the claim is government attribution, first-party vendor telemetry or a restatement, plus the confidence language the source itself used.
Attribution Traps and False Positives
Most actor "matches" fail at the attribution step rather than the technical one.
- Shared commodity tooling: Cobalt Strike, Mimikatz and remote management agents are used by dozens of unrelated groups. Tool overlap is not actor overlap.
- Planted false flags: Actors deliberately seed other groups malware strings, ransom note templates and language markers. One planted artefact does not move an attribution.
- Alias collision: Two vendors have used the same display name for different clusters, and one cluster often carries four names. Match on ATT&CK ID or infrastructure, never on the name.
- Ransomware-as-a-service branding: A ransomware brand is a service, not a group. An intrusion that used the binaries says nothing about the operators behind the brand.
- Claimed credit: Hacktivist and ransomware crews claim attacks they did not perform. Treat a public claim as a lead requiring corroboration.
- Copycat victimology: A shared target sector is context, not proof. Commodity phishing reaches every sector, and imitation is cheap.
Collection and Attribution Precision
There is nothing here to patch. The corrective work is keeping one accurate record per actor and stopping an attribution from outrunning its evidence.
One record per actor
- • Key the internal profile to the ATT&CK group ID rather than the display name
- • List subsidiary aliases inside the profile instead of creating parallel records
- • Re-check the ATT&CK entry quarterly; groups get merged, renamed and split
Grade claims before they propagate
- • Carry the source and its confidence into any internal brief
- • Write "assessed with medium confidence", not "attributed to"
- • Never let a vendor alias appear in a report without the ATT&CK ID beside it
Review trigger
- • A government attribution or vendor report naming the actor
- • An ATT&CK revision that merges, renames or splits the group
- • An incident where the profile was used to pick an emulation target