UNC6508: China-Linked Espionage Group Abusing Google Workspace
UNC6508 is a China-linked cyber espionage group that compromised REDCap research servers and abused Google Workspace content compliance rules to exfiltrate sensitive…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
UAT-8616: Advanced Persistent Threat Actor Targeting Cisco SD-WAN
An advanced persistent threat (APT) actor attributed to the exploitation of multiple Cisco SD-WAN vulnerabilities in 2026, including CVE-2026-20262.
ScarCruft (APT37) – North Korean State-Sponsored Hacking Group
ScarCruft, also known as APT37, is a North Korean state-sponsored hacking group known for spear-phishing campaigns and deploying malware like RokRAT and…
APT37 (ScarCruft) – North Korean Cyber Espionage Group
APT37, also known as ScarCruft, is a North Korean cyber espionage group that has been active since at least 2012. They are…
Vanilla Tempest: Financially Motivated Threat Actor Behind Lorem Ipsum Loader
Vanilla Tempest, also known as Rapid Brigantine, Vice Society, and Vice Spider, is a financially motivated threat actor known for deploying ransomware…
Fox Tempest (Forging Marauder): Threat Actor Disrupted by Microsoft
Fox Tempest, also known as Forging Marauder, is a threat actor that advertised a malware-signing-as-a-service (MSaaS) operation. Microsoft's disruption of this service…
Rapid Brigantine — Attack group profile
Rapid Brigantine was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Vice Society — Attack group profile
Vice Society was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Forging Marauder — Attack group profile
Forging Marauder was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Turkish-Speaking Threat Actor Behind WordPress PBN Backlink Campaign
A Turkish-speaking threat actor is operating a campaign that compromises WordPress sites to inject hidden backlinks for a Private Blog Network (PBN),…