Threat Modeler | Abstract

FIN7

fin-actor-fin7

1

GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest

Criminal

G0046

Financially motivated since 2013 across financial services, retail and hospitality; moved into big-game ransomware and its own service brand from 2020.

Money, by whichever route the estate offers

Convincing phone and email pretexts aimed at named staff by role, at times supported by mailed hardware or fake vendor personas.

Custom backdoors and scripting, credential dumping from memory, then interactive movement into card, treasury and payment systems.

Card and payment data theft, and since 2020 ransomware when the data route is closed off.

MITRE records a portion of FIN7 operating from a front company and a shift to big game hunting from 2020. In financial services it works through the people who move money, so the accounts it takes over already carry the authority it needs. The detection value sits at the identity and endpoint layer, not the perimeter.

Wizard Spider

hc-actor-wizard-spider

1

UNC1878, TEMP.MixMaster, Grim Spider, GOLD BLACKBURN

Criminal

G0102

Russia-based group behind TrickBot, Ryuk and Conti, which ran large-scale ransomware operations against hospitals and healthcare providers.

Ransom at the point of maximum operational pressure

Phishing delivering a loader, or access purchased from a broker already inside the estate.

Rapid escalation to domain admin, endpoint tooling disabled, backups located and destroyed.

Domain-wide encryption of clinical and back-office infrastructure.

MITRE records this group's ransomware campaigns against hospitals and healthcare providers specifically. The sequence is fast and consistent, which is an advantage: detections on tool tampering and backup destruction cover the whole operation rather than one variant.

APT29

tech-actor-apt29

1

Midnight Blizzard, Cozy Bear, The Dukes, NOBELIUM, UNC2452

State

G0016

Russian SVR-attributed group; the US and UK governments attributed the SolarWinds Compromise to the SVR, with industry reporting using NOBELIUM and UNC2452 for the same activity.

Persistent access to customer and government data

Password spraying and consent phishing against tenants, and access inherited through a compromised supplier or build system.

Adds credentials to service principals and OAuth applications, then disables or evades audit logging.

Mailbox and document collection held quietly for months or years, including at selected downstream customers.

For a technology company this actor is not after you, it is after who you serve, and MITRE's SolarWinds attribution is the reference case for reaching them through your release path. The techniques leave almost no endpoint evidence, so the detection surface is the cloud control plane and application-registration audit.

Sandworm Team

energy-actor-sandworm-team

1

APT44, Seashell Blizzard, Voodoo Bear, ELECTRUM

State

G0034

Russian GRU Unit 74455. Destructive operations against electrical companies and government organisations, and the NotPetya wiper.

Disruption of physical service delivery

Spearphishing and exploitation of internet-facing infrastructure, and in past operations a trusted software update channel.

Long residence on the IT side, learning the route into operational networks and the engineering workstations that reach them.

Destructive action against control systems and wipers on the IT estate, timed for maximum disruption.

MITRE attributes the 2015 and 2016 attacks on Ukrainian electrical companies and the NotPetya campaign to this group. It is the reason IT-to-OT crossing points and engineering workstations are detection surfaces for a utility rather than an architecture diagram.

APT29

gov-actor-apt29

1

Midnight Blizzard, Cozy Bear, The Dukes, NOBELIUM

State

G0016

Russian SVR. Long-running espionage against government networks in Europe and NATO member countries, research institutes and think tanks.

Durable, quiet access to policy material

Password spraying, consent phishing and access inherited through compromised suppliers.

Adds credentials to service principals and OAuth applications, then disables or evades audit logging.

Mailbox and document collection sustained over months or years.

MITRE records the SolarWinds Compromise attribution to the SVR. For a government body the distinguishing feature is patience: there is no impact event to alert on, so detection depends on cloud control-plane and application audit data retained long enough to be worth querying.

BlackByte

mfg-actor-blackbyte

1

Hecamede

Criminal

G1043

Ransomware operator active since 2021, notable for operations against critical infrastructure entities across North America.

Ransom, priced against downtime

Exploitation of exposed services and use of valid credentials against remote access.

Vulnerable-driver abuse to disable endpoint tooling, then movement to file and virtualisation infrastructure.

Encryption, with successive ransomware versions closing the decryption routes defenders found.

MITRE records that early BlackByte used a common encryption key that allowed a universal decryptor, and that later versions do not. A manufacturer cannot assume recovery will be possible, which moves the whole case for detection earlier in the intrusion.

FIN6

retail-actor-fin6

1

Skeleton Spider, Magecart Group 6, ITG08

Criminal

G0037

Cyber crime group that has stolen payment card data and sold it on underground marketplaces, aggressively targeting point-of-sale systems.

Payment card data, sold on

Social engineering against staff and use of valid credentials into corporate networks.

Escalation toward the cardholder data environment, then onto point-of-sale infrastructure.

Card data scraped from memory and sold, and in later activity ransomware.

MITRE describes this group as aggressively targeting and compromising point-of-sale systems in the hospitality and retail sectors. POS telemetry is therefore a primary detection source in this vertical and is routinely absent from the SIEM in every other one.

Salt Typhoon

telco-actor-salt-typhoon

1

-

State

G1045

PRC state-backed actor responsible for numerous compromises of network infrastructure at major US telecommunications and internet service providers.

Interception at the infrastructure layer

Compromise of network infrastructure rather than of endpoints or user accounts.

Positions inside routing and management infrastructure, where conventional endpoint tooling does not reach.

Access to communications and subscriber data at the provider level.

MITRE records this actor as responsible for numerous compromises of network infrastructure at major US telecommunications and ISP providers. Routers and switches are the target, and their logs are the detection surface, which is a different data pipeline from the one most SOCs have built.

Carbanak

fin-actor-carbanak

2

Anunak

Criminal

G0008

Cybercriminal group that has used Carbanak malware against financial institutions since at least 2013.

Direct theft from the bank, not its customers

Spearphishing against bank staff with weaponised documents.

Months of observation inside the bank, learning payment, card processing and ATM workflows before acting.

Fraudulent transfers, ATM dispensing and card processing manipulation.

MITRE notes Carbanak may be linked to groups tracked separately as Cobalt Group and FIN7, all of which have used the same malware. The distinguishing behaviour is patience: the intrusion is long enough to detect, and the detectable stage is ordinary credential and remote-session activity rather than the fraud itself.

INC Ransom

hc-actor-inc-ransom

2

GOLD IONIC

Criminal

G1032

Ransomware and data extortion group active since 2023, targeting the industrial, healthcare and education sectors in the US and Europe.

Extortion of organisations that cannot absorb downtime

Valid credentials and exploitation of exposed services on estates with long maintenance windows.

Living-off-the-land movement, with data staged before any encryption.

Theft and publication of patient and staff records, with encryption as a second lever.

MITRE lists healthcare among this group's most common targets. Exposure tracks patch latency rather than size, so the detection question is edge-appliance inventory and coverage: the appliances nobody owns are the ones used, and they usually send no telemetry.

Scattered Spider

tech-actor-scattered-spider

2

Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944

Criminal

G1015

English-speaking group that initially targeted CRM providers, business process outsourcing firms, and telecommunications and technology companies.

Money via identity, at whichever tenant is reachable

Impersonation of IT and help-desk staff to bypass multi-factor authentication.

Administrator access in Okta, AWS and Office 365, then pivots wherever trust relationships allow.

Data theft, extortion, and downstream access to your customers.

MITRE records this group obtaining administrator access in hybrid cloud and identity environments through help-desk impersonation. If you operate an identity, CRM or support platform, your own workflows are the attack path and your customers are the target, which puts support-side telemetry in the SOC rather than in a ticketing report.

Dragonfly

energy-actor-dragonfly

2

Energetic Bear, Berserk Bear, IRON LIBERTY, DYMALLOY

State

G0035

Russian FSB Center 16. Espionage against ICS-related companies and critical infrastructure via supply chain, spearphishing and drive-by compromise.

Access held in reserve, not used immediately

Supply-chain compromise of vendor software and websites, spearphishing, and watering holes aimed at engineering staff.

Credential harvesting and quiet enumeration of control-system documentation and remote access paths.

Persistent access to ICS-adjacent networks with no destructive step. The access is the objective.

This actor collects the information needed to act later: network diagrams, HMI screenshots, vendor remote access. There is no impact event to alert on, so detection depends on credential use and file access telemetry that most utilities keep only on the IT side.

APT28

gov-actor-apt28

2

Fancy Bear, Forest Blizzard, Sofacy, STRONTIUM

State

G0007

Russian GRU Unit 26165, active since at least 2004, with operations against political and international organisations.

Intelligence, and interference in political process

Credential phishing against official and personal accounts, and exploitation of internet-facing services.

Custom implants alongside living-off-the-land tooling, with close-access operations where remote access fails.

Collection of mail, documents and credentials, sometimes published.

MITRE records US indictments of five GRU officers for operations against anti-doping bodies, a nuclear facility and the OPCW. The targeting extends to staff personal accounts and to the devices they bring to work, which is a monitoring scope question a government body has to answer explicitly.

Play

mfg-actor-play

2

Playcrypt operators

Criminal

G1040

Ransomware group active since 2022 against business, government, critical infrastructure, healthcare and media in North America, South America and Europe.

Double extortion: data first, encryption second

Valid accounts and exploitation of internet-facing services.

Living-off-the-land tooling and credential access, staging data before any encryption.

Exfiltration followed by encryption, operated as a closed group rather than an affiliate model.

MITRE assesses this as a closed group, which means the tradecraft is consistent rather than varying by affiliate. That consistency is an advantage: detections written for its staging behaviour hold, instead of decaying as affiliates rotate.

FIN7

retail-actor-fin7

2

Carbon Spider, Sangria Tempest, ELBRUS

Criminal

G0046

Financially motivated group that has targeted retail, restaurant and hospitality organisations, historically via point-of-sale malware.

Card data, and since 2020 ransom

Convincing pretexts aimed at named staff by role, at times supported by mailed hardware.

Custom backdoors and scripting, credential dumping, then movement into payment infrastructure.

Card data theft, and since 2020 big-game ransomware under its own service brand.

MITRE notes a portion of FIN7 operated from a front company and often used point-of-sale malware. The group's shift to ransomware means a retailer now faces both outcomes from the same initial access, and the detections that catch the early stages serve both.

GALLIUM

telco-actor-gallium

2

Granite Typhoon

State

G0093

Chinese state-sponsored group known for Operation Soft Cell, a long-term campaign against telecommunications providers.

Subscriber records and call detail data

Exploitation of unpatched internet-facing services, particularly web application servers.

Web shells and credential harvesting, then patient movement toward subscriber data stores.

Bulk theft of call records and subscriber information over extended periods.

Operation Soft Cell is the reference case for long-dwell telecommunications intrusion. Web shells on application servers are where it starts, and web application logs with a long lookback are where it is found, often years after the fact.

Cobalt Group

fin-actor-cobalt-group

3

GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider

Criminal

G0080

Financially motivated group targeting financial institutions since 2016 through ATM systems, card processing, payment systems and SWIFT.

Money via the payment rails themselves

Spearphishing against bank employees, and access gained through other organisations already compromised.

Commodity and custom tooling toward card processing, ATM and SWIFT infrastructure.

Theft through ATM dispensing and payment system manipulation.

MITRE records this group compromising organisations in order to use that access against additional victims. For a bank that means partner and correspondent connections are an entry route, and the authentication records covering them belong in monitoring rather than in a vendor file.

Akira

hc-actor-akira

3

GOLD SAHARA, PUNK SPIDER, Howling Scorpius

Criminal

G1024

Ransomware deployment entity active since 2023 using compromised credentials against single-factor VPNs, with variants targeting Windows and VMware ESXi.

Double extortion against virtualised estates

Compromised credentials against single-factor external access, particularly VPNs.

Publicly available tools for lateral movement rather than custom implants.

Data exfiltrated before encryption, with threats to publish if the ransom is refused.

MITRE records variants capable of targeting VMware ESXi hypervisors. In a hospital that means the virtualisation layer under EHR and imaging is a direct target, and hypervisor logs are a detection source rather than an infrastructure concern.

LAPSUS$

tech-actor-lapsuss

3

DEV-0537, Strawberry Tempest

Extortion

G1004

Group specialising in large-scale social engineering and extortion, including destructive attacks without the use of ransomware.

Notoriety, then extortion

Insider recruitment, purchased credentials, and MFA prompt bombing against engineers.

Hunts secrets in repositories, wikis and CI variables to reach production directly.

Source code and internal tooling theft, published for leverage.

MITRE describes destructive attacks without ransomware, which removes the encryption event most response plans are built around. The route runs through your engineers and your own secrets hygiene, so repository audit, secret-scanning findings and token inventory are the telemetry that matters and are rarely wired into the SOC.

ALLANITE

energy-actor-allanite

3

Palmetto Fusion

State

G1000

Suspected Russian group targeting electric utilities in the US and UK; maintains ICS presence for understanding and persistence.

Understanding of the process, and persistence

Phishing and watering-hole compromise of utility staff and their suppliers.

Harvests credentials and collects operational information, without demonstrating disruptive capability.

A maintained presence in ICS environments rather than an attack.

MITRE notes this group's technical capability has not shown disruptive or destructive ability, which is exactly what makes it hard to justify detection spend. It is only visible in authentication and remote-access telemetry from the operational side.

Gamaredon Group

gov-actor-gamaredon-group

3

Armageddon, Shuckworm, Primitive Bear, Aqua Blizzard

State

G0047

Russian FSB Center 18, targeting Ukrainian military, law enforcement, judiciary and NGO organisations since 2013.

Volume collection from government bodies

High-volume spearphishing with document lures aimed at government staff.

Script-based tooling and removable-media propagation rather than sophisticated implants.

Continuous document and credential collection across many bodies at once.

This actor trades sophistication for volume, and it works because government estates are large, federated and unevenly instrumented. The detection targets are ordinary script execution and removable media, both of which are cheap to collect and frequently not collected.

Cinnamon Tempest

mfg-actor-cinnamon-tempest

3

BRONZE STARLIGHT, Emperor Dragonfly, DEV-0401

State + criminal

G1021

China-based group deploying short-lived ransomware strains built on leaked Babuk source, possibly as cover for intellectual property theft.

Possibly intellectual property, behind a ransomware front

Exploitation of internet-facing applications, operating all stages itself rather than buying access.

Hands-on movement toward design, process and engineering data.

Ransomware deployment using a variant that is then retired.

MITRE notes the short lifespan of each ransomware variant, the victimology and the use of government-linked malware, and assesses the motivation may be intellectual property theft rather than financial gain. For a manufacturer that changes the response: treat it as a design-data breach, not an outage.

FIN8

retail-actor-fin8

3

Syssphinx

Criminal

G0061

Financially motivated group targeting hospitality, retail and entertainment, which moved from point-of-sale devices to ransomware in 2021.

Whichever pays more: cards, then ransom

Spearphishing and social engineering against operational staff.

Limited, deliberate movement toward payment systems using tooling built for the purpose.

Card theft, or ransomware deployment depending on the environment.

MITRE records the 2021 switch from point-of-sale targeting to distributing ransomware variants. Retail security programmes built entirely around cardholder data scope will not see the second outcome, because it lands outside the audited boundary.

APT5

telco-actor-apt5

3

Keyhole Panda, Mulberry Typhoon, UNC2630

State

G1023

China-based espionage actor active since 2007 with significant interest in compromising networking devices and their underlying software.

Persistent access through the network layer

Zero-day exploitation of networking devices and VPN appliances.

Implants in device firmware and software that survive reboots and updates.

Durable access to traffic and to the networks the devices serve.

MITRE notes advanced tradecraft and significant interest in networking devices, including zero-day use. Appliances that cannot run an agent still produce configuration and authentication logs, and collecting those is the only available detection route.

APT38

fin-actor-apt38

4

NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet

State

G0082

North Korean state-sponsored group specialising in financial operations, attributed to the Reconnaissance General Bureau.

Revenue for the DPRK state

Extended reconnaissance, then targeted intrusion into banks, ATM networks and cryptocurrency exchanges.

Long quiet residence, learning the payment workflow and reconciliation controls before touching anything.

Fraudulent transfers through payment rails, with some operations ending destructively.

MITRE records targeting of banks, casinos, cryptocurrency exchanges, SWIFT endpoints and ATMs in at least 38 countries, including the 2016 Bank of Bangladesh heist. This is the actor that attacks the integrity of your records rather than their confidentiality, which makes core banking and database audit trails a detection surface rather than a compliance artefact.

Orangeworm

hc-actor-orangeworm

4

-

Criminal

G0071

Group targeting healthcare organisations in the US, Europe and Asia since 2015, likely for corporate espionage.

Information about healthcare operations and technology

Access to healthcare provider networks and their technology suppliers.

Aggressive internal copying of its implant across the network, including onto imaging and clinical systems.

Long-running collection with no destructive or extortion step.

MITRE notes that reverse engineering of the group's Kwampirs implant shows significant overlap with Shamoon, a wiper. The collection behaviour is noisy on the network and quiet everywhere else, which makes internal traffic between clinical systems the place it appears.

APT41

tech-actor-apt41

4

Wicked Panda, Brass Typhoon, BARIUM

State + criminal

G0096

Chinese state-sponsored group that overlaps at least partially with reporting on BARIUM and Winnti Group, known for a wide range of malware and tooling.

Espionage using your product as the delivery vehicle

Exploitation of internet-facing services and phishing aimed at developers.

Works toward build and distribution infrastructure, using signed tooling to stay unremarkable.

Implants in software that customers install and trust.

MITRE notes the group's use of a wide range of malware and tools to complete mission objectives, including against the technology sector. Supply-chain compromise turns your release process into the adversary's distribution network, and build logs and repository audit are the only place it is visible.

HEXANE

energy-actor-hexane

4

Lyceum, Siamesekitten, Spirlin

State

G1001

Espionage against oil and gas, telecommunications and aviation in the Middle East and Africa.

Long-term access to energy operators

Password spraying and credential stuffing against exposed services, plus targeted social engineering.

DNS-based tunnelling and script-based tooling, blending into normal administrative activity.

Sustained collection from oil, gas and telecommunications operators.

MITRE tracks this group separately from APT33 and OilRig despite similar tradecraft, on the basis of different victims and tools. For an energy operator the practical consequence is DNS: outbound resolver telemetry is the source where this actor is visible and the one most often not collected.

Mustang Panda

gov-actor-mustang-panda

4

TWILL TYPHOON, RedDelta, BRONZE PRESIDENT

State

G0129

China-based espionage against government, diplomatic and non-governmental organisations across the US, Europe and Asia.

Diplomatic and policy intelligence

Tailored phishing lures and decoy documents matched to the recipient's policy area.

DLL side-loading through signed legitimate binaries, then quiet persistence.

Long-running collection from ministries, missions and think tanks.

MITRE notes tailored lures and decoy documents as the group's signature. Because delivery is targeted rather than broad, volume-based email detection misses it, and the reliable signal is side-loading behaviour in process telemetry.

Chimera

mfg-actor-chimera

4

-

State

G0114

Suspected China-based group active since 2018 targeting the semiconductor industry in Taiwan and airline industry data.

Semiconductor and process intellectual property

Credential stuffing and valid accounts against exposed services.

Extended quiet residence using legitimate administrative tooling.

Theft of semiconductor design and process data over long periods.

This is the case where the loss has no operational symptom at all. Detection depends on file access audit and authentication telemetry retained long enough to reconstruct months of activity, which is a retention decision made before the intrusion, not during it.

Scattered Spider

retail-actor-scattered-spider

4

Octo Tempest, Roasted 0ktapus, UNC3944

Criminal

G1015

English-speaking group that expanded into retail and hospitality in 2023, using help-desk impersonation and MFA bypass.

Fast monetisation through identity

Impersonation of IT and help-desk staff by phone to bypass multi-factor authentication.

Administrator access in identity and cloud platforms, using the tooling already in place.

Data theft, extortion, and ransomware for financial gain.

MITRE records the 2023 expansion into gaming, hospitality and retail, and the move into hybrid cloud and identity environments. Retail's seasonal and franchise staffing makes help-desk verification hard, which is precisely the condition this group is built for.

Sea Turtle

telco-actor-sea-turtle

4

Marbled Dust, Teal Kurma, SILICON

State

G1041

Türkiye-linked actor performing DNS-based intrusions, compromising DNS providers to hijack resolution for downstream victims.

Credentials, via control of name resolution

Compromise of registrars and DNS providers rather than of the eventual victim.

Hijacks DNS resolution to redirect victims to spoofed login portals.

Credential collection at scale from organisations that were never touched directly.

MITRE describes this actor targeting registrars managing country-code top-level domains and hijacking DNS resolution to spoof login portals. A telecommunications provider is both a target and a delivery mechanism here, which puts DNS infrastructure change records inside the monitoring scope.

Scattered Spider

fin-actor-scattered-spider

5

Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944

Criminal

G1015

English-speaking group relying heavily on social engineering and help-desk impersonation, which expanded into financial services in 2023.

Fast monetisation through identity

Impersonation of IT and help-desk staff by phone to bypass multi-factor authentication. No malware required.

Enrols its own authenticator, reads internal documentation, and uses the cloud and SaaS admin tooling already in place.

Rapid data theft, extortion, and ransomware for financial gain.

MITRE records the group adapting its tooling to evade endpoint detection and expanding into hybrid cloud and identity environments. Nothing malicious executes, so the whole intrusion lives in identity provider, ITSM and SaaS audit logs, which are often not collected or not correlated.

Deep Panda

hc-actor-deep-panda

5

Shell Crew, Black Vine, WebMasters, KungFu Kittens

State

G0009

Suspected Chinese group known for targeting several industries; the intrusion into the healthcare company Anthem has been attributed to it.

Bulk personal and health records for intelligence use

Web application exploitation and credential theft against internet-facing systems.

Long quiet residence using legitimate administrative tooling and stolen credentials.

Theft of large volumes of member and patient records.

MITRE attributes the Anthem intrusion to this group. Records taken for intelligence purposes never appear on a leak site, so there is no external signal at all: the theft is visible only in database and file access telemetry retained long enough to reconstruct it.

menuPass

tech-actor-menupass

5

APT10, Stone Panda, Cicada, Red Apollo, BRONZE RIVERSIDE

State

G0045

Chinese MSS-linked group active since 2006, known to have targeted managed IT service providers in 2016 and 2017.

Many customers through one provider

Phishing and exploitation against the service provider rather than its customers.

Uses the provider's own management connections into customer environments as an authorised operator would.

Collection across many customer estates from a single position.

MITRE records the targeting of managed IT service providers specifically. If you hold management access into customer environments, that access is the asset, and the detection question is whether anyone reviews how your own support connections are used.

CyberAv3ngers

energy-actor-cyberav3ngers

5

Soldiers of Soloman

State

G1027

IRGC-affiliated group that targeted Unitronics programmable logic controllers globally, defacing device interfaces.

Visible, symbolic disruption

Directly against internet-exposed PLCs and HMIs, often still on default credentials.

No lateral movement needed. The exposed device is the target.

Defacement of the device interface and loss of local control.

MITRE records this group's 2023 global targeting of Unitronics PLCs, found in water and wastewater, energy, food and beverage and healthcare. The exposure is an asset-inventory problem before it is a detection problem: the devices involved are usually not in anyone's monitoring scope.

Ke3chang

gov-actor-ke3chang

5

APT15, Nylon Typhoon, Vixen Panda, NICKEL

State

G0004

China-attributed group targeting oil, government, diplomatic, military and NGO organisations since at least 2010.

Access to diplomatic and military correspondence

Spearphishing and exploitation of externally facing services.

Credential dumping and domain reconnaissance, with backdoors left on infrequently rebuilt hosts.

Sustained access to diplomatic and government networks across several continents.

Fifteen years of continuous operation against government targets means this actor is best understood as a permanent condition rather than an incident. Persistence on long-lived servers is where it is found, which makes host inventory and process telemetry on those servers the priority.

APT41

mfg-actor-apt41

5

Wicked Panda, Brass Typhoon, BARIUM

State + criminal

G0096

Chinese state-sponsored espionage group that also conducts financially motivated operations across manufacturing-adjacent sectors.

Espionage, with opportunistic monetisation

Exploitation of internet-facing applications and phishing against technical staff.

Signed tooling and supply-chain positioning, with beaconing that resembles normal traffic.

Theft of design and operational data, sometimes alongside criminal activity in the same intrusion.

MITRE records targeting across fourteen countries and a wide range of industries. For a manufacturer with a software or firmware product, the supply-chain dimension matters most: build and distribution infrastructure is in scope even when it sits outside the security team's remit.

ShinyHunters

retail-actor-shinyhunters

5

UNC6240, Bling Libra

Criminal

G1057

Criminal collective active since 2019 gathering credentials and personally identifiable information for resale or extortion.

Customer data, resold or used for extortion

Legitimate credentials obtained from leaks, phishing and third-party exposure.

Straight to customer data stores and SaaS platforms, without endpoint activity.

Bulk PII theft, resale, and extortion of the victim.

MITRE associates this collective with the broader community that also includes Scattered Spider and LAPSUS$, with joint operations reported under combined names. For a retailer the practical point is that loyalty and customer databases are the target, and their access logs are the only place the theft appears.

Leviathan

telco-actor-leviathan

5

APT40, Kryptonite Panda, Gingham Typhoon

State

G0065

Chinese MSS-attributed group active since 2009 across telecommunications-adjacent sectors including transportation and maritime.

Broad sectoral intelligence collection

Rapid exploitation of newly disclosed vulnerabilities in internet-facing systems.

Web shells and credential access, then lateral movement into data of interest.

Collection across the sectors it targets, sustained over years.

The distinguishing behaviour is speed against new disclosures. For a provider with a large internet-facing estate, the detection question is whether exploitation attempts against newly disclosed vulnerabilities are visible within days, not whether patching is complete.

Indrik Spider

fin-actor-indrik-spider

6

Evil Corp, Manatee Tempest, DEV-0243, UNC2165

Criminal

G0119

Russia-based group that began with the Dridex banking trojan and moved into ransomware operations from 2017.

Large ransom payments

Compromised legitimate websites and fake update prompts delivering a loader, often supplied by a partner broker.

Banking-trojan lineage tooling, credential theft and escalation to domain admin.

Targeted ransomware, with the toolset diversified after sanctions and indictment in 2019.

MITRE notes the group changed tactics and diversified its toolset following US sanctions. Those sanctions make paying a legal problem as well as a commercial one, so early endpoint detection is the only workable answer rather than one option among several.

APT41

hc-actor-apt41

6

Wicked Panda, Brass Typhoon, BARIUM

State + criminal

G0096

Chinese state-sponsored espionage group that also conducts financially motivated operations, with healthcare among its listed targets.

Research and clinical intellectual property, plus opportunistic profit

Web application exploitation and phishing aimed at research and clinical environments.

Long quiet residence using signed tooling and beaconing that resembles normal cloud traffic.

Theft of trial, genomic and device research data, sometimes alongside criminal monetisation in the same intrusion.

MITRE lists healthcare first among the industries this group targets, across fourteen countries. Where an organisation does research the threat is espionage rather than extortion, and detecting it depends on proxy, DNS, repository and file access data retained for months rather than days.

HAFNIUM

tech-actor-hafnium

6

Silk Typhoon, Operation Exchange Marauder

State

G0125

China-based group that targets remote management tools and cloud software for initial access and operationalises exploits for edge-device vulnerabilities quickly.

Rapid, broad access through the software others run

Exploitation of remote management tools and cloud software, often within days of a disclosure.

Web shells on exposed servers, then credential access and collection.

Access across many organisations at once, chosen afterwards.

MITRE notes an ability to quickly operationalise exploits for identified vulnerabilities in edge devices. For a technology company that cuts both ways: your own edge is exposed, and if you build remote management or cloud software, it is the vehicle.

APT33

energy-actor-apt33

6

Elfin, HOLMIUM, Peach Sandstorm

State

G0064

Suspected Iranian group with particular interest in the aviation and energy sectors across the US, Saudi Arabia and South Korea.

Espionage, with destructive capability held in reserve

Spearphishing with job-themed lures and password spraying against exposed authentication.

Commodity and custom backdoors, credential harvesting, persistence on long-lived hosts.

Collection, with links in public reporting to wiper tooling.

Energy sits alongside aviation as this group's stated interest. The techniques are ordinary — spraying, phishing, backdoors — which means the detection work is ordinary too, and the sector's gap is usually coverage of the corporate estate rather than exotic tradecraft.

MuddyWater

gov-actor-muddywater

6

Mango Sandstorm, Seedworm, Static Kitten, MERCURY

State

G0069

Subordinate element of Iran's Ministry of Intelligence and Security, targeting government, telecommunications, defence and energy organisations.

Regional intelligence collection

Phishing with document lures, and exploitation of exposed remote services.

Legitimate remote management tooling in place of custom implants, plus script-based execution.

Collection across government and adjacent sectors, sustained through reused infrastructure.

MITRE notes this group's reuse of domains and, more recently, commercial satellite internet for command and control. Both point the same way for a government SOC: outbound connection telemetry with a long lookback is worth more here than another endpoint rule.

LAPSUS$

mfg-actor-lapsuss

6

DEV-0537, Strawberry Tempest

Extortion

G1004

Social engineering and extortion group that has targeted manufacturing among other sectors, including destructive attacks without ransomware.

Notoriety, then extortion

Insider recruitment, purchased credentials and MFA prompt bombing.

Hunts internal documentation and secrets to reach source and production systems directly.

Theft and publication, occasionally destruction, without an encryption stage.

MITRE lists manufacturing explicitly among this group's targets and notes destructive attacks without the use of ransomware. The entry route runs through people and documentation rather than malware, so identity and collaboration-platform telemetry carry the detection.

Medusa Group

retail-actor-medusa-group

6

Spearwing

Criminal

G1051

Ransomware-as-a-service operation using living-off-the-land techniques and common remote management software, opportunistic across sectors.

Double extortion, opportunistically

Known vulnerabilities, phishing, and access purchased from initial access brokers.

Publicly available tools and common remote management software rather than custom malware.

Exfiltration before encryption, with publication threatened if the ransom is refused.

MITRE describes the group as opportunistic and sector-agnostic, which means exposure is a function of patch latency and broker activity rather than of being a retailer. The reliance on common remote management software makes an inventory of sanctioned tooling a detection prerequisite.

LAPSUS$

telco-actor-lapsuss

6

DEV-0537, Strawberry Tempest

Extortion

G1004

Social engineering and extortion group that has targeted the telecommunications sector, including through support and identity workflows.

Notoriety, then extortion

SIM swaps, insider recruitment and MFA prompt bombing against staff.

Uses support and provisioning tooling as a legitimate operator would.

Data theft and publication, with downstream effect on subscribers.

MITRE lists telecommunications explicitly among this group's targets. Subscriber provisioning and SIM management tooling is the attack surface, and its audit trail is usually held by an operations team rather than routed into security monitoring.