OilRig (APT34): Iranian Threat Actor
OilRig, also known as APT34, is an Iranian threat actor linked to Cavern with low confidence. It has used Microsoft-hosted services for…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
A suspected China-nexus threat activity cluster, codenamed Operation DragonReturn by Seqrite Labs, has been targeting Indian taxpayers, tax professionals, and corporate finance…
Silver Fox Threat Actor: Operational Similarities in Spark RAT Campaign
Silver Fox is a threat actor known for using ValleyRAT and other custom payloads. The Spark RAT campaign shows operational similarities to…
REF3864: Intrusion Set Targeting Chinese-Speaking Regions with Malicious Installers
REF3864 is an intrusion set attributed by Elastic Security Labs for targeting Chinese-speaking regions with malicious installers for Telegram and Opera, delivering…
Conti Ransomware Group
Conti is a ransomware group that DevMan claimed to have worked with, according to an interview with security researcher Jon DiMaggio. DevMan…
Black Basta Ransomware Group
Black Basta is a ransomware group whose internal chats leaked in February 2025, revealing negotiation patterns similar to the Kairos case.
Kairos: Data-Theft Extortion Group
Kairos is a cyber extortion group that operates without encryption, relying solely on data theft and threats of public exposure. It demanded…
Silent Ransom Group: Pure Data-Theft Extortion
Silent Ransom Group, a Conti offshoot, has conducted pure data-theft extortion against U.S. law and finance firms without using encryptors.
TaskJacker: Malicious VS Code Task File Cluster in PolinRider Campaign
A cluster within the PolinRider campaign that drops malicious VS Code task files into GitHub users' repositories. The tasks use 'runOn: folderOpen'…
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
North Korean threat actors linked to the Contagious Interview campaign have published 108 unique malicious packages and browser extensions across npm, Packagist,…