UNC6395: Threat Actor Group Linked to OAuth Abuse
UNC6395 is a threat actor group associated with prior OAuth abuse campaigns targeting Salesforce environments. The Klue incident shares similarities with their…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Russian-Speaking Threat Actors Behind FortiBleed Campaign
Suspected Russian-speaking threat actors compromised over 30,000 Fortinet firewalls across 194 countries in a large-scale credential harvesting campaign dubbed FortiBleed. They used…
Warlock — Attack group profile
Warlock was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
The Gentlemen — Attack group profile
The Gentlemen was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Qilin Ransomware Affiliate Program
Qilin is a ransomware operation that DevMan initially affiliated with before launching its own RaaS. The group is known for its ransomware-as-a-service…
MedusaLocker — Attack group profile
MedusaLocker was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
DragonForce — Attack group profile
DragonForce was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
LapDogs: Router ORB Attack Group Similar to AryStinger
LapDogs is an attack group tracked by Mandiant that operates operational relay box networks (ORBs) using compromised end-of-life routers and IoT devices.…
APT28 (Fancy Bear / Forest Blizzard)
Russian GRU-linked group whose tradecraft overlaps with CaptiveCrunch, but attribution was not made due to lack of direct technical linkage.
Volt Typhoon: China-Nexus Threat Actor Using JDY Botnet
Volt Typhoon is a Chinese state-sponsored hacking group that has been observed using the JDY botnet for reconnaissance and targeting of vulnerable…