Threat Actors Database

BREEZE COMET is a financially motivated threat actor targeting Brazilian financial services, retail, and eCommerce organizations through compromised websites, custom malware, and stolen credentials to manipulate payment systems and execute fraudulent transfers. The group employs custom tools such as REALBREEZE, COBALTSPIN, KICKPLATE, MILDFROST, LIGHTPAINT, and BOATBEAM for reconnaissance, lateral movement, persistence, tunneling, and stealth. Forensic evidence indicates that BREEZE COMET has executed waves of fraudulent transactions within 24-48 hours of compromise, likely stealing tens of thousands of USD in assets. The actor has also leveraged generative AI to enhance malware and script development while expanding its infrastructure across Latin America and Africa.

Exilware is a Brazilian threat actor operating the "Infect Marketplace," which commercializes access to compromised systems using the BraZetsu malware framework. BraZetsu employs a modular architecture and AI-driven reconnaissance to optimize target value across various sectors, including banking and government systems. The actor maintains a controlled operational model, requiring customers to spend quickly to limit exposure and risk. Exilware's activities reflect a sophisticated Initial Access Broker operation, transforming compromised systems into commercial assets through automated intelligence gathering.

QTFY is a state-sponsored group from the People's Republic of China, operating as an infrastructure quartermaster that provides reconnaissance, access, and obfuscation services to various state customers, including the MSS and PLA. It developed QScan and QTRouter, leveraging high-tier commercial proxy services like fastlink.ws to obscure its traffic. QTFY personnel, including former PLA members, engage in exploit brokering and operate within a supply chain rather than merely deploying malware. The group has been linked to specific domains and infrastructure, with evidence of TLS certificate collection as part of its operational tactics.

TheHatman is a highly organized threat actor known for systematically listing and selling internal employee directories stolen from major corporations, including nine Fortune 500 enterprises across various sectors. The actor claims to have obtained the data through compromised credentials, though the initial entry point remains under investigation. The volume of data suggests that after gaining access, TheHatman employed automated scripts, likely utilizing PowerShell modules or Python libraries, to extract the directories in bulk.

CRPxO is a ransomware group that has claimed responsibility for attacks on various organizations, including Encore Enterprises, Inc., KUVEYT TURK, and Johnson & Johnson, among others. The group has targeted entities across multiple countries, including the USA, Turkey, South Korea, Australia, the UK, and China. NCC Group has noted that the claims of responsibility from CRPxO have not been confirmed and highlighted inconsistent evidence regarding their involvement in these attacks.

VantaCore is a ransomware group believed to be a rebrand of Thor, targeting Russian organizations with custom-built malware and multimillion-dollar ransom demands. F6 says the group has attacked at least seven victims, uses a ransomware-as-a-service model, and reflects a broader shift among pro-Ukrainian hackers toward in-house tooling instead of LockBit 3 Black and Babuk.

DaOnlySpark is a forum actor claiming to have leaked sensitive data from AdvaCare, including internal financial details, and from Jinko, comprising 3.7 GB of patient records, clinical profiles, and private messages. Both claims remain unverified.

ShadowByt3$ is a ransomware group known for exfiltrating sensitive data from various organizations, including John Engel Team, Abbott Laboratories, and Nintendo of America, often demanding substantial ransoms. They employ techniques such as SQL injection to breach systems and threaten to leak stolen data if negotiations are not completed within a specified timeframe. The group has also claimed to operate as a Wiper as a Service (WaaS), focusing on data theft and potential data destruction. Their activities include targeting a range of sectors, from education to healthcare, and they have been linked to mass-scanning campaigns for vulnerabilities.

IAmNotAVillain is a threat actor that claimed responsibility for a data breach at Revolut, threatening to sell confidential customer records unless a ransom of $3 million is paid. They asserted that they compromised an Italian government email system and communicated with Revolut for months. The group published an ultimatum online and created a new Telegram channel for further communication.

CikLeak is a threat actor that claims to have accessed systems of Russia’s Central Election Commission and companies involved in the Vybory platform, which administers elections. The group asserts that its objective is to expose internal workings of the Russian electoral system and potential manipulation opportunities, rather than disrupt voting. Prior to their disclosure, Russian officials conducted a security assessment of the Vybory portal and identified vulnerabilities in the video surveillance system.

GTG-20006 is a Russian espionage operator that has targeted over 20 organizations in Ukrainian and European government, defense, and diplomatic sectors, exfiltrating more than 300,000 national identity records. The actor employs an auto-rebuild loop for flagged implants to evade detection and has delivered payloads that freeze victim machines' security updates. GTG-20006 has also been linked to an intrusion into a North African government technology authority, compromising a central account server to exfiltrate a credential database. The group utilizes customized AI-driven workflows throughout its attack chain.

V0idix is a threat actor known for distributing leaked data for free on leak forums, with some files requiring a reply-to-unlock to access.

Financially motivated threat actor tracked by Microsoft Threat Intelligence as the developer and support operator of the EvilTokens phishing-as-a-service platform, advertised and sold to other cybercriminals through Telegram channels. Storm-XXXX is Microsoft's designation for a developing or emerging activity cluster: the name is provisional and may be merged or renamed once attribution matures. Its infrastructure was disrupted by Microsoft's Digital Crimes Unit with partners in September 2026.

Multiple sources reported malicious activity linked to JADEPUFFER (Storm-3168), an agentic ransomware operation, during June 2026. This attacker has been observed leveraging exposed secrets and exploiting vulnerabilities in Internet-facing software for initial access to cloud ...

According to Proofpoint, TA419 is a China-aligned, espionage-motivated threat actor conducting regular targeted credential phishing campaigns against individuals at US- and Japan-based think tanks, defense contractors, universities and law firms since at least April 2025. In 2026 it impersonated real subject-matter experts, including a former White House OSTP official and a senior Anthropic employee, to target AI policy experts. Benign rapport-building emails are followed by multi-stage URL redirection to an adversary-in-the-middle phishing page against Microsoft 365 / Entra ID, built on a customised Frameless BitB kit embedding an Evilginx phishlet. Proofpoint states the group's activity had not been previously reported publicly.

ZaWoo is a ransomware group that has claimed multiple attacks on various organizations across different countries, including France, New Zealand, Germany, the USA, Canada, and the Czech Republic. Their operations have resulted in encrypted and compromised systems, leading to potential disruptions in victim operations. Notable targets include ambpvc, zenithtechnology.co.nz, and fes-sport.de.

Sensetime, MiniMax, and the third-party reseller ecosystem

Chain-of-thought distillation and AI R&D campaign by Alibaba (Qwen / Tongyi Lab)

Sensetime, MiniMax, and the third-party reseller ecosystem

Disrupting a Russian foreign information manipulation and interference operation in the Central African Republic