FIN7: Cybercrime Group Known for Targeting Endpoint Security
FIN7 is a financially motivated cybercrime group that has been active since at least 2015. They are known for targeting the hospitality,…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Russian Hackers Exploit Google OAuth and WhatsApp Linking in Multi-Platform Account Hijacking Campaigns
Suspected Russian cyber espionage groups are abusing legitimate authentication flows, including Google OAuth and WhatsApp device linking, to hijack accounts across Europe…
UNC6293: Russian Sub-Cluster of Ice Relic Targeting Academia and Government
UNC6293 is a suspected Russian cyber espionage sub-cluster of Ice Relic (APT29), first detailed in June 2025. It conducts small-scale phishing campaigns…
UNC5976: Russian Threat Actor Automating OAuth Token Theft via Cloud Infrastructure
UNC5976 is a suspected Russian threat actor active since at least March 2026, using OAuth phishing and automated token collection. It creates…
UNC7005 (Storm-2945): Russian Espionage Group Abusing WhatsApp and OAuth
UNC7005, also known as Storm-2945, is a suspected Russian threat actor identified in February 2026. It targets academia, diplomatic, and nonprofit personnel…
Ice Relic (APT29/Cozy Bear/Midnight Blizzard): Russian State-Sponsored APT
Ice Relic, also known as APT29, Cozy Bear, and Midnight Blizzard, is a Russian state-sponsored threat group. Sub-clusters UNC6293 and UNC7005 are…
MIDNIGHT NEPTUNE: Threat Actor Behind Axios Compromise
Google Threat Intelligence Group attributes the axios npm compromise to MIDNIGHT NEPTUNE, formerly known as UNC1069. The actor is linked to North…
GoldFactory: Chinese-Speaking Threat Actor Behind Banking Trojans
GoldFactory is a Chinese-speaking threat actor linked to multiple Android and iOS banking malware families, including GoldDigger, GoldPickaxe, GoldDiggerPlus, and GoldKefu. The…
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
A newly uncovered cyber espionage operation dubbed SilkParasite has been targeting government bodies in Central Asia, according to a technical report from…
SilkParasite: China-Nexus Espionage Group Targets Central Asian Governments
SilkParasite is a China-nexus cyber espionage threat cluster first discovered in late 2025. It targets government bodies in Central Asia, using a…