APT Groups Data
Short profiles of well-documented Advanced Persistent Threat groups and the tactics, techniques, and procedures they are publicly reported to use.
These summaries are based on public reporting; attribution and naming vary between vendors. For detailed, referenced profiles see MITRE ATT&CK Groups (opens in a new tab).
Fancy Bear · Sofacy · Sednit
A prolific espionage group known for targeting political and military organizations across NATO countries.
Primary targets
TTPs
Cozy Bear · The Dukes · Nobelium
A sophisticated actor linked to major supply-chain intrusions and stealthy, long-term espionage campaigns.
Primary targets
TTPs
Double Dragon · Winnti · Barium
A dual espionage-and-cybercrime group conducting both state-sponsored operations and financially motivated attacks.
Primary targets
TTPs
Hidden Cobra · APT38 · Zinc
A state-sponsored group notorious for destructive attacks and high-value financial and cryptocurrency theft.
Primary targets
TTPs
OilRig · Helix Kitten
A Middle East–focused espionage actor known for creative DNS-based command-and-control techniques.
Primary targets
TTPs
Elfin · Refined Kitten
An actor targeting aviation and energy sectors, associated with destructive wiper malware campaigns.
Primary targets
TTPs
Carbanak · Carbon Spider
A financially motivated cybercrime syndicate responsible for large-scale payment-card and ransomware operations.
Primary targets
TTPs
Voodoo Bear · Telebots · Iron Viking
A destructive actor linked to attacks on critical infrastructure and industrial control systems.
Primary targets
TTPs
Tell us about your application, API, or software security requirements. We can discuss the appropriate scope and next steps.
What happens next