216.73.216.197

Intrusion sets

APT groups and intrusion sets — goals, aliases, sectors, and related campaigns.

  • Tonto Team Earth AkhlutBRONZE HUNTLEY
    The MITRE Corporation Confidence 100 1 CVE 38 MITREs 6 Malwares 29 IOCs 4 Tools

    [Tonto Team](https://attack.mitre.org/groups/G0131) is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Threat Group-3390 Earth SmilodonTG-3390
    The MITRE Corporation Confidence 100 5 CVEs 84 MITREs 21 Malwares 39 IOCs 12 Tools

    [Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Confucius Confucius APT
    The MITRE Corporation Confidence 100 30 MITREs 5 Malwares 26 IOCs

    [Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • BlackByte Hecamede
    The MITRE Corporation Confidence 100 76 MITREs 11 Malwares 25 IOCs 4 Tools

    [BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Ransomware](https://attack.mitre.org/software/S1180). [BlackByte](https://attack.mitre.org/groups/G1043) ransomware operations initially used…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Higaisa
    The MITRE Corporation Confidence 100 28 MITREs 2 Malwares 1 Tool

    [Higaisa](https://attack.mitre.org/groups/G0126) is a threat group suspected to have South Korean origins. [Higaisa](https://attack.mitre.org/groups/G0126) has targeted government, public, and trade organizations in North Korea; however, they have also carried out…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Windshift Bahamut
    The MITRE Corporation Confidence 100 52 MITREs 6 Malwares 26 IOCs

    [Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation:…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • APT30
    The MITRE Corporation Confidence 100 2 MITREs 5 Malwares

    [APT30](https://attack.mitre.org/groups/G0013) is a threat group suspected to be associated with the Chinese government. While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Sidewinder T-APT-04Rattlesnake
    The MITRE Corporation Confidence 100 3 CVEs 88 MITREs 16 Malwares 100 IOCs 1 Tool

    [Sidewinder](https://attack.mitre.org/groups/G0121) is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia,…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Gelsemium
    The MITRE Corporation Confidence 100 1 CVE 25 MITREs 8 Malwares 63 IOCs

    [Gelsemium](https://attack.mitre.org/groups/G0141) is a cyberespionage group that has been active since at least 2014, targeting governmental institutions, electronics manufacturers, universities, and religious organizations in East Asia and the Middle…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Contagious Interview Gwisin GangTAG-121
    The MITRE Corporation Confidence 100 1 CVE 116 MITREs 11 Malwares 100 IOCs

    [Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials.…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • Gorgon Group
    The MITRE Corporation Confidence 100 17 MITREs 2 Malwares 2 Tools

    [Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of…

    First seen 01/01/1970 · Last seen 16/11/5138 ·
  • FIN4
    The MITRE Corporation Confidence 100 12 MITREs

    [FIN4](https://attack.mitre.org/groups/G0085) is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.(Citation: FireEye…

    First seen 01/01/1970 · Last seen 16/11/5138 ·