Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
mitre intrusion sets · 174 groups
Adversary groups mapped to ATT&CK: the techniques and tooling each is known to use, cross-linked to matching activity in the corpus. Corpus counts are a shared-technique signal, not a first-party attribution.
Kimsuky
G0094Also known as: Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM
130
techniques
19
software
APT28
G0007Also known as: IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74
93
techniques
29
software
Lazarus Group
G0032Also known as: Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC
93
techniques
26
software
Mustang Panda
G0129Also known as: TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS
85
techniques
23
software
APT41
G0096Also known as: Wicked Panda, Brass Typhoon, BARIUM
82
techniques
32
software
Volt Typhoon
G1017Also known as: BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236
81
techniques
17
software
Sandworm Team
G0034Also known as: ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group)
79
techniques
27
software
APT32
G0050Also known as: SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone
78
techniques
15
software
Magic Hound
G0059Also known as: TA453, COBALT ILLUSION, Charming Kitten, ITG18
78
techniques
13
software
OilRig
G0049Also known as: COBALT GYPSY, IRN2, APT34, Helix Kitten
76
techniques
30
software
Gamaredon Group
G0047Also known as: IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon
70
techniques
6
software
MuddyWater
G0069Also known as: Earth Vetala, MERCURY, Static Kitten, Seedworm
68
techniques
21
software
Turla
G0010Also known as: IRON HUNTER, Group 88, Waterbug, WhiteBear
68
techniques
30
software
FIN7
G0046Also known as: GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS
67
techniques
19
software
APT29
G0016Also known as: IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo
66
techniques
49
software
Scattered Spider
G1015Also known as: Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944
64
techniques
9
software
Wizard Spider
G0102Also known as: UNC1878, TEMP.MixMaster, Grim Spider, FIN12
64
techniques
22
software
VOID MANTICORE
G1055Also known as: COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma
63
techniques
0
software
Chimera
G011459
techniques
6
software
Medusa Group
G105157
techniques
5
software
Threat Group-3390
G0027Also known as: Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION
57
techniques
24
software
APT38
G0082Also known as: NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima
56
techniques
6
software
Dragonfly
G0035Also known as: TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192
56
techniques
10
software
TeamTNT
G013956
techniques
4
software
Contagious Interview
G1052Also known as: DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER
54
techniques
4
software
APT39
G0087Also known as: ITG07, Chafer, Remix Kitten
53
techniques
11
software
FIN13
G1016Also known as: Elephant Beetle
53
techniques
4
software
Leviathan
G0065Also known as: MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK
50
techniques
17
software
UNC3886
G104849
techniques
8
software
BlackByte
G1043Also known as: Hecamede
48
techniques
8
software
Ember Bear
G1003Also known as: UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard
47
techniques
11
software
Ke3chang
G0004Also known as: APT15, Mirage, Vixen Panda, GREF
46
techniques
11
software
menuPass
G0045Also known as: Cicada, POTASSIUM, Stone Panda, APT10
46
techniques
25
software
APT3
G0022Also known as: Gothic Panda, Pirpi, UPS Team, Buckeye
44
techniques
6
software
Earth Lusca
G1006Also known as: TAG-22, Charcoal Typhoon, CHROMIUM, ControlX
44
techniques
9
software
HAFNIUM
G0125Also known as: Operation Exchange Marauder, Silk Typhoon
44
techniques
6
software
LAPSUS$
G1004Also known as: DEV-0537, Strawberry Tempest
43
techniques
1
software
MirrorFace
G1054Also known as: Earth Kasha
43
techniques
16
software
Storm-0501
G105342
techniques
8
software
Fox Kitten
G0117Also known as: UNC757, Parisite, Pioneer Kitten, RUBIDIUM
41
techniques
5
software
Patchwork
G0040Also known as: Hangover Group, Dropping Elephant, Chinastrats, MONSOON
41
techniques
8
software
RedCurl
G103941
techniques
0
software
BRONZE BUTLER
G0060Also known as: REDBALDKNIGHT, Tick
40
techniques
14
software
FIN6
G0037Also known as: Magecart Group 6, ITG08, Skeleton Spider, TAAL
40
techniques
12
software
Tropic Trooper
G0081Also known as: Pirate Panda, KeyBoy
40
techniques
6
software
APT-C-36
G0099Also known as: Blind Eagle, TAG-144, AguilaCiega, APT-Q-98
38
techniques
9
software
FIN8
G0061Also known as: Syssphinx
36
techniques
11
software
HEXANE
G1001Also known as: Lyceum, Siamesekitten, Spirlin
36
techniques
12
software
Rocke
G010636
techniques
0
software
Aquatic Panda
G014335
techniques
6
software
Cobalt Group
G0080Also known as: GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider
34
techniques
6
software
TA505
G0092Also known as: Hive0065, Spandex Tempest, CHIMBORAZO
34
techniques
16
software
Indrik Spider
G0119Also known as: Evil Corp, Manatee Tempest, DEV-0243, UNC2165
33
techniques
8
software
APT42
G104432
techniques
2
software
APT33
G0064Also known as: HOLMIUM, Elfin, Peach Sandstorm
31
techniques
16
software
GALLIUM
G0093Also known as: Granite Typhoon
31
techniques
16
software
Storm-1811
G104631
techniques
7
software
Moonstone Sleet
G1036Also known as: Storm-1789
30
techniques
1
software
Sidewinder
G0121Also known as: T-APT-04, Rattlesnake
30
techniques
1
software
APT37
G0067Also known as: InkySquid, ScarCruft, Reaper, Group123
29
techniques
13
software
APT5
G1023Also known as: Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda
29
techniques
13
software
ZIRCONIUM
G0128Also known as: APT31, Violet Typhoon
29
techniques
0
software
Higaisa
G012628
techniques
3
software
LuminousMoth
G101428
techniques
2
software
Silence
G0091Also known as: Whisper Spider
28
techniques
3
software
TA2541
G101828
techniques
9
software
Sea Turtle
G1041Also known as: Teal Kurma, Marbled Dust, Cosmic Wolf, SILICON
27
techniques
1
software
Winter Vivern
G1035Also known as: TA473, UAC-0114
27
techniques
0
software
Play
G104026
techniques
9
software
WIRTE
G0090Also known as: Ashen Lepus
26
techniques
8
software
INC Ransom
G1032Also known as: GOLD IONIC
25
techniques
8
software
ToddyCat
G102225
techniques
9
software
Darkhotel
G0012Also known as: DUBNIUM, Zigzag Hail
24
techniques
0
software
APT1
G0006Also known as: Comment Crew, Comment Group, Comment Panda
23
techniques
17
software
Agrius
G1030Also known as: Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow
22
techniques
9
software
Blue Mockingbird
G010822
techniques
2
software
Inception
G0100Also known as: Inception Framework, Cloud Atlas
22
techniques
3
software
Velvet Ant
G104722
techniques
2
software
APT19
G0073Also known as: Codoso, C0d0so0, Codoso Team, Sunshop Group
21
techniques
2
software
Lotus Blossom
G0030Also known as: DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon
21
techniques
9
software
LazyScripter
G014020
techniques
7
software
Star Blizzard
G1033Also known as: SEABORGIUM, Callisto Group, TA446, COLDRIVER
20
techniques
1
software
Cinnamon Tempest
G1021Also known as: DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT
19
techniques
8
software
Confucius
G0142Also known as: Confucius APT
19
techniques
1
software
CURIUM
G1012Also known as: Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc
19
techniques
1
software
Windshift
G0112Also known as: Bahamut
19
techniques
1
software
Saint Bear
G1031Also known as: Storm-0587, TA471, UAC-0056, Lorec53
18
techniques
2
software
Akira
G1024Also known as: GOLD SAHARA, PUNK SPIDER, Howling Scorpius
17
techniques
8
software
Daggerfly
G1034Also known as: Evasive Panda, BRONZE HIGHLAND
17
techniques
6
software
Leafminer
G0077Also known as: Raspite
17
techniques
4
software
Axiom
G0001Also known as: Group 72
16
techniques
8
software
BITTER
G1002Also known as: T-APT-17
16
techniques
1
software
Gorgon Group
G007816
techniques
4
software
Molerats
G0021Also known as: Operation Molerats, Gaza Cybergang
16
techniques
6
software
SideCopy
G100816
techniques
2
software
Stealth Falcon
G003816
techniques
0
software
BackdoorDiplomacy
G013515
techniques
5
software
EXOTIC LILY
G101115
techniques
2
software
Tonto Team
G0131Also known as: Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda
15
techniques
6
software
BlackTech
G0098Also known as: Palmerworm
14
techniques
6
software
Naikon
G001914
techniques
15
software
Salt Typhoon
G104514
techniques
1
software
TA551
G0127Also known as: GOLD CABIN, Shathak
14
techniques
5
software
Transparent Tribe
G0134Also known as: COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM
14
techniques
5
software
Silent Librarian
G0122Also known as: TA407, COBALT DICKENS
13
techniques
0
software
admin@338
G001812
techniques
7
software
Andariel
G0138Also known as: Silent Chollima, PLUTONIUM, Onyx Sleet
12
techniques
2
software
APT18
G0026Also known as: TG-0416, Dynamite Panda, Threat Group-0416
12
techniques
5
software
Dark Caracal
G007012
techniques
3
software
FIN4
G008512
techniques
0
software
Malteiro
G102612
techniques
1
software
Moses Staff
G1009Also known as: DEV-0500, Marigold Sandstorm
12
techniques
4
software
Mustard Tempest
G1020Also known as: DEV-0206, TA569, GOLD PRELUDE, UNC1543
12
techniques
2
software
Evilnum
G012011
techniques
3
software
FIN10
G005111
techniques
1
software
FIN5
G005311
techniques
6
software
Machete
G0095Also known as: APT-C-43, El Machete
11
techniques
1
software
PLATINUM
G006811
techniques
3
software
PROMETHIUM
G0056Also known as: StrongPity
11
techniques
2
software
DarkVishnya
G010510
techniques
2
software
Deep Panda
G0009Also known as: Shell Crew, WebMasters, KungFu Kittens, PinkPanther
10
techniques
7
software
Aoqin Dragon
G10079
techniques
2
software
Carbanak
G0008Also known as: Anunak
9
techniques
4
software
Elderwood
G0066Also known as: Elderwood Gang, Beijing Group, Sneaky Panda
9
techniques
9
software
GOLD SOUTHFIELD
G0115Also known as: Pinchy Spider
9
techniques
2
software
Metador
G10139
techniques
2
software
Rancor
G00759
techniques
4
software
Sowbug
G00549
techniques
2
software
Whitefly
G01079
techniques
1
software
CopyKittens
G00528
techniques
4
software
MoustachedBouncer
G10198
techniques
3
software
Poseidon Group
G00338
techniques
0
software
DarkHydrus
G00797
techniques
3
software
IndigoZebra
G01367
techniques
3
software
Nomadic Octopus
G0133Also known as: DustSquad
7
techniques
1
software
POLONIUM
G1005Also known as: Plaid Rain
7
techniques
2
software
RTM
G00487
techniques
1
software
The White Company
G00897
techniques
2
software
Windigo
G01247
techniques
1
software
Ajax Security Team
G0130Also known as: Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten
6
techniques
2
software
Ferocious Kitten
G01376
techniques
2
software
Gallmaker
G00846
techniques
0
software
Mofang
G01036
techniques
2
software
TA577
G10376
techniques
3
software
Winnti Group
G0044Also known as: Blackfly
6
techniques
3
software
APT12
G0005Also known as: IXESHE, DynCalc, Numbered Panda, DNSCALC
5
techniques
3
software
Cleaver
G0003Also known as: Threat Group 2889, TG-2889
5
techniques
4
software
RedEcho
G10425
techniques
1
software
Suckfly
G00395
techniques
1
software
TA459
G00625
techniques
4
software
Volatile Cedar
G0123Also known as: Lebanese Cedar
5
techniques
2
software
Equation
G00204
techniques
0
software
Group5
G00434
techniques
2
software
Putter Panda
G0024Also known as: APT2, MSUpdater
4
techniques
4
software
SilverTerrier
G00834
techniques
5
software
TA578
G10384
techniques
3
software
Threat Group-1314
G0028Also known as: TG-1314
4
techniques
2
software
Thrip
G00764
techniques
3
software
Strider
G0041Also known as: ProjectSauron
3
techniques
1
software
Water Galura
G1050Also known as: GOLD FEATHER
3
techniques
2
software
AppleJeus
G1049Also known as: Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736
2
techniques
0
software
APT17
G0025Also known as: Deputy Dog
2
techniques
1
software
APT30
G00132
techniques
5
software
GCMAN
G00362
techniques
0
software
Orangeworm
G00712
techniques
8
software
PittyTiger
G00112
techniques
5
software
APT16
G00231
techniques
1
software
BlackOasis
G00631
techniques
0
software
Moafee
G00021
techniques
1
software
Scarlet Mimic
G00291
techniques
4
software
APT-C-23
G1028Also known as: Mantis, Arid Viper, Desert Falcon, TAG-63
0
techniques
1
software
DragonOK
G00170
techniques
2
software
NEODYMIUM
G00550
techniques
1
software
TEMP.Veles
G0088Also known as: XENOTIME
0
techniques
2
software
technique breadth
How many ATT&CK techniques each group is documented using: a proxy for how instrumented it is, not its danger.
read this carefully
A group’s corpus matches count indicators that exhibit techniques the group is known to use. That is a shared-technique signal. Many unrelated operators use the same techniques. Never read it as attribution.