The Com: Decentralized Cybercrime Collective
The Com is a decentralized cybercrime collective that includes subgroups such as Scattered Spider, ShinyHunters, and LAPSUS$. Members of The Com have…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
LAPSUS$: Notorious Cyber Extortion Group
LAPSUS$ is a cyber extortion group that has targeted major corporations. As part of The Com collective, they have been associated with…
CyberAv3ngers: Threat Group Targeting Critical Infrastructure
CyberAv3ngers is a threat actor group associated with targeting operational technology and industrial control systems, including water systems. They have been linked…
Iran-Nexus Threat Actor
An Iran-linked threat actor group associated with the BLUERABBIT backdoor, targeting Israeli organizations. Attribution is based on intelligence from Google's Threat Intelligence…
Hyadina: Developer Behind GodDamn, Beast, and Monster Ransomware
Hyadina is the moniker assigned by Broadcom's Symantec to the threat actor responsible for developing the GodDamn, Beast, and Monster ransomware families.…
Lurking Lizard: Threat Actor Behind Residential Proxy Botnet
Lurking Lizard is a China-based threat actor operating an end-to-end malicious residential proxy business since at least August 2022. The actor uses…
Russian State-Sponsored Threat Actors Exploit Ubiquiti Routers
Russian state-sponsored threat actors have been observed using compromised Ubiquiti Edge OS routers as part of a botnet to proxy malicious traffic.…
REF6045: Banking Fraud Operation Targeting Mexican Financial Institutions
REF6045 is a threat actor cluster tracked by Elastic Security Labs that uses ClickFix lures to infect victims with the SCMBANKER malware.…
EvilTokens Attack Group Uses Ghost Phishing for Microsoft 365 Account Takeover
EvilTokens is an attack group conducting ghost phishing campaigns targeting US and European businesses. They use Microsoft Device Code Phishing and AES-GCM…
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by…