Threat Actors Database

Disrupting two Iranian nexus actors building surveillance systems and malicious Firefox browsing extension

ShinyHunters smash-and-grab opportunists

From hotel bookings to the AI supply chain

Disrupting a national mass interception and surveillance platform for Mali's state intelligence service

Hacktivists targeted European political and affiliated entities

Disrupting a commercial "influence-as-a-service" operation spanning six continents

Disrupting a domestic coordinated inauthentic behavior campaign in Kenya

Disrupting an automated pro-Awami League fake-news operation on Claude targeting rural Bangladesh

Disrupting a commercial surveillance platform using Claude to profile the social media accounts of Iranian and Persian Gulf-based users

Disrupting a UAE-directed influence operation targeting the Muslim Brotherhood, Sudan conflict, and UN accountability mechanisms

Disrupting a commercial election-manipulation platform targeting Malaysia

Disrupting a distributed MEK/NCRI-aligned influence operation that used a shared AI agent to impersonate real people and recruit inside Iran

Disrupting a Yemen-based guided weapons engineering cell using Claude to develop guidance software

Uncategorized threat cluster tracked by Google Threat Intelligence Group and Mandiant, responsible for an ephemeral supply chain compromise of AOMEI Backupper between April and July 2026, investigated with ManageEngine's Threat Analysis Lab (METAL). The actor briefly modified the down_html.ini and Notifycfg.ini configuration files on AOMEI's origin servers for windows of five to ten minutes, redirecting the update and promotion flow to an attacker-hosted archive, then restored them. It deployed the CROSSROAD downloader and the SHINYROAD backdoor through trojanized Radmin components, later Adaptix C2, and on one occasion coerced NetNTLMv2 authentication through a hidden WebDAV popup. Victims were opportunistic, in IT services, telecommunications and higher education across several countries. No state nexus has been stated.

Intrusion set tracked by Elastic Security Labs, posing as a Web3 venture accelerator (Apex Accelerator / Apex Arena, Apex Foundation) to target cryptocurrency start-ups and founders. Lures offer investment, free AI credits and security audits, and lead victims to install npm packages (@apexacc/cli, @apexacc/audit) that fetch platform-specific payloads: the CloudSyncD backdoor on macOS and a custom information stealer exfiltrating through Telegram on Windows. The packages also repackage a legitimate coding agent to route LLM traffic through attacker infrastructure and register an attacker-controlled MCP server in the victim's agent configuration. Earlier npm packages from the same operation were reported by SafeDep in July 2026. Elastic makes no state or group attribution.

Software supply chain campaign and its unnamed operator, first reported by GitGuardian in September 2025: malicious GitHub Actions workflows named "Github Actions Security" injected into compromised repositories exfiltrated CI/CD secrets, with 3,325 secrets stolen from 817 repositories. In October 2026 OpenSourceMalware reported a renewed wave and a second stage that no longer needs a CI runner: a .vscode/tasks.json launcher with a folderOpen trigger runs a Node.js credential stealer disguised as public/fonts/fa-solid-400.woff2, installs a cron job polling the operator's server, and is backed by a fallback workflow. OpenSourceMalware calls this stage a copycat of the DPRK PolinRider technique rather than an extension of it, and ties it to GhostAction through shared server infrastructure. A phishing kit on the lookalike domain my-github.com, harvesting credentials and silently authorizing an OAuth application with repo and workflow scopes, was reported on the same infrastructure.

Jingle Thief is a financially motivated gift card fraud campaign documented by Palo Alto Networks Unit 42 in October 2025 and tracked as cluster CL-CRI-1032, assessed with moderate confidence to be run by Morocco-based attackers active since 2021, not affiliated with a nation-state. It targets cloud environments of large retail and consumer services organizations: phishing and smishing harvest Microsoft 365 credentials, then the actors, without malware, perform SharePoint and OneDrive reconnaissance of gift card issuance workflows, send internal phishing from compromised accounts, set forwarding rules, and persist by registering rogue authenticator apps and enrolling devices in Entra ID; in one case access lasted about 10 months across more than 60 accounts. Unit 42 assesses with moderate confidence that CL-CRI-1032 overlaps with the actors publicly tracked as Atlas Lion and Storm-0539; it is kept as a separate entry and linked to Storm-0539 as similar. In October 2026, 404 Media reported an organized crime gang that hacked Staples and issued millions of dollars in gift cards; The Hacker News related this to Jingle Thief, but the reporting does not attribute that intrusion to the cluster.

k0t (also CryptoFeel, Member19, QazWsxShop) is a financially motivated cybercriminal actor, first seen on 22 October 2025, behind a large-scale campaign against exposed network edge devices, according to a joint investigation by Group-IB and NyxLab published in October 2026. The actor finds targets by mass enumeration with FOFA and ZoomEye rather than by researching specific organizations. It gains access by exploiting known flaws such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PAN-OS/Prisma Access) with custom Python scripts, or by brute-forcing Fortinet FortiGate and Palo Alto GlobalProtect appliances, then connects over OpenConnect VPN. Post-exploitation relies on NetExec, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz, persistence on MeshCentral, Atera, Teramind, AnyDesk and AdaptixC2, and exfiltration on Rclone to Wasabi S3 and MEGA. More than 70,000 exposed credentials are linked to the campaign, with victims mostly in Asia Pacific and Latin America; the actor states that the US and Canada are its priority. Many victims were later listed by the Qilin and The Gentlemen ransomware groups, so k0t is assessed to be an initial access broker or affiliate, but the exact relationship is unclear. The activity partially overlaps in time with the FortiBleed credential-harvesting cluster, with negligible overlap in compromised data.

STAC4749 is a financially motivated activity cluster reported by Sophos in July 2026, observed between February and June 2026 against dozens of organizations, nearly 95% of them in Canada and the U.S. Operators contact victims through Microsoft Teams chats and calls impersonating IT support, using plausible employee usernames on IT-themed '.top' cloud domains rather than onmicrosoft.com tenants, and obtain a remote session through Microsoft Quick Assist or, increasingly from April 2026, the RemSupp RMM tool; RDP is then enabled for lateral movement. PowerShell retrieves a loader communicating over gRPC with hard-coded C2 addresses and checking for an appscreen.log file, later replaced by a PyArmour-obfuscated PyInstaller backdoor that fetches its AES key from a public GitHub repository and talks to workers.dev infrastructure, followed by Golang implants launched with a '--token-raw' argument and pinning embedded CA certificates (issuers such as loop-CA, connectify-CA, james-bond-CA), plus a reverse SOCKS proxy. Persistence relies on HKCU Run keys masquerading as Realtek or WinAudio components and hidden Startup shortcuts; DWAgent and AnyDesk provide redundant access. At least three intrusions ended in Chaos ransomware deployment (the RaaS reportedly launched by former BlackSuit members, not the Chaos builder lineage), in one case under 17 hours after initial access. Sophos notes a Russian-keyboard typo in operator commands, found no evidence of a link to MuddyWater, and states the evidence is insufficient for attribution. In October 2026 Arctic Wolf, analysing more than 400 Teams IT-support impersonation incidents, stated that the shift to '.top' tenants aligns with Sophos's reporting on STAC4749. The Sophos loader shares its artifacts (sekv-prefixed filename, 'Realtek HD Audio' Run value, appscreen.log check, gRPC C2) with the GoGRPC backdoor documented by Zscaler ThreatLabz, although neither vendor equates the two.

CyberCartel is a Latin American e-crime group employing a multi-agent system called CARLIY0S to coordinate attacks against financial institutions and payment providers. The group's operations utilize AI models for deep reconnaissance, zero-day vulnerability analysis, exploit code generation, and credential harvesting. They have targeted over 400 financial entities in Latin America and are linked to campaigns involving malicious Chrome extensions aimed at stealing credentials and financial data. Active since 2012, CyberCartel has evolved to incorporate Malware-as-a-Service from established malware families to breach Chromium-based browsers.