Forging Marauder — Attack group profile
Forging Marauder was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Turkish-Speaking Threat Actor Behind WordPress PBN Backlink Campaign
A Turkish-speaking threat actor is operating a campaign that compromises WordPress sites to inject hidden backlinks for a Private Blog Network (PBN),…
Sapphire Sleet: North Korean Threat Actor Behind Supply Chain Attacks
Microsoft assesses with high confidence that the Mastra npm compromise is attributable to Sapphire Sleet, a North Korean threat actor known for…
UNC1069: North Korean Cyber Espionage Group
UNC1069 is a threat group attributed to North Korea, associated with the WAVESHAPER.V2 backdoor and activities overlapping with Sapphire Sleet. It has…
Famous Chollima: North Korea’s IT Worker Operation
Famous Chollima is the name used by CrowdStrike to describe North Korea's IT worker operation, which involves placing operatives in companies worldwide…
APT31: Chinese Cyber Espionage Group
APT31, also known as Zirconium, is a Chinese state-sponsored cyber espionage group that has used Tailscale for tunneling in attacks against Russian…
Scattered Spider: Extortion Crew Behind Major Cyberattacks
Scattered Spider, also tracked as Octo Tempest, UNC3944, and 0ktapus, is an extortion crew known for data extortion, SIM swapping, and social…
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Threat actors associated with the DragonForce ransomware group have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to…
Hackledorb Threat Actor
Hackledorb is the threat actor behind DragonForce ransomware, known for pivoting to a highly organized cartel structure and deploying sophisticated backdoors like…
Medusa Ransomware Group
Medusa ransomware is a threat group that has previously used the custom malicious driver ABYSSWORKER in its attacks.