Threat Actors Database

DarkBlinders hackers are deploying a fake video meeting application to establish a backdoor and facilitate cyberespionage against Israel and the Kurdistan Region of Iraq. Their operations have led to compromises within a government cloud environment in Kurdistan and targeting a significant Israeli individual linked to security. They are also abusing GitHub repositories as part of their TTPs. The investigation has confirmed their focused efforts in this cyber campaign.

DataSuckers is a financially motivated hacking group linked to major data breaches affecting businesses in Russia and Ukraine, with claims of having stolen 2-3 TB of data from approximately 68 million customers. The group has demonstrated TTPs such as customer data theft, extortion through ransom demands, and website defacement. They have claimed responsibility for high-profile attacks on ATB Market, Dodo Pizza, and Tez Tour, and reportedly obtained sensitive customer and employee information during these breaches. While DataSuckers maintains a Telegram channel for communications, its operations have drawn the attention of Russian authorities, resulting in the detention of several key members.

Earth Sirrush has conducted sustained spear-phishing campaigns against Ukrainian governmental and defense entities, deploying PowerShell and Go-based tools such as LONEPAGE and SEAGLOW, delivered via malicious archives and exploiting CVE-2023-38831. Their operations transitioned to image-based steganography in the CINDERBLOT campaign, using phishing lures that impersonate Ukrainian state services. Despite continuously adapting their tooling, identifiable indicators of compromise can link their campaigns, demonstrating consistent development habits and delivery patterns. Their targets have included the National Police, State Border Guard Service, and various ministries related to logistics and defense supply chains.

Mimori is a data-extortion / ransomware group first observed on 2026-10-20, when it launched a leak site and listed its first two claimed victims: OpenText (Canada, technology) and AVEVA (UK, industrial software), claiming 177,234 files from AVEVA. A third claimed victim, St. James's Place (UK, financial services), was reported on 2026-10-21. The leak site, mimori.group, is a clearnet domain fronted by Cloudflare that publishes victim pages under /organizations/<victim> and threatens to publish stolen data unless victims make contact. None of the claims has been independently verified. AVEVA and OpenText have each disclosed a separate security incident (unauthorized access to AVEVA's corporate SharePoint, and to an OpenText employee account through social engineering), but neither has attributed it to Mimori. No ransomware sample, encryptor or affiliate program has been publicly linked to the group, and its operators and any links to earlier groups are unknown.

ScarlettGroup is a newly observed cyber extortion gang actively threatening companies via a dark web leak site, employing countdown timers to pressure victims. Their operational TTPs include public listing of alleged breaches and a negotiation window for communications. While the group’s intrusion methods remain unverified, their public threats and activity on forums such as PwnForums indicate a growing trend in cyber extortion.

UAT-10147 is a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers through the exploitation of publicly disclosed vulnerabilities. The group employs advanced techniques including AI-assisted workflows, deploying malware such as SPECTRE and various RATs, and utilizing capabilities like remote code execution and privilege escalation. Their operations are characterized by the integration of AI for reconnaissance, exploit refinement, and persistent access management. UAT-10147 has a target list of approximately 170,000 URLs and impacts various sectors, including government and education.

Highly sophisticated APT reported and named by Cisco Talos that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to gain unauthorized access and install the custom KeyDrift malware framework (PolyFlame, LittleFilch), designed for long-term persistent access and automated exfiltration of sensitive keying material from SD-WAN control-plane processes. Observed targeting spans space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train covert access network; this infrastructure overlap is the only link Talos reports between the two.

UAT-6275 is a cyberespionage actor targeting government organizations across Central Asia and the CIS, with a focus on diplomacy, economic development, and environmental management. The group employs custom RATs like Chvost, Laplas, and PickleShell, leveraging methods such as WinRAR exploits and malicious documents for payload delivery. Evidence indicates UAT-6275 has a Kazakhstan nexus, supported by Russian-language artifacts and specific operational hours. Its activity includes the creation of publicly accessible malware staging directories and interest in expanding to additional platforms, including Linux.

WhiteArmor is a data-theft and extortion group that appeared in October 2026. It claimed its first victim, Whirlpool, around 21 October 2026, and runs a Tor data leak site plus a clearnet mirror (whitearmor.cc). Within its first week it named 14-19 organisations, mainly in the United States, across the transportation/logistics (J.B. Hunt, Ryder, Echo Global Logistics), retail (Lovesac), consumer electronics (Hisense), online gambling (Gamdom) and political (Partido Liberal, Argentina) sectors. Its most publicised claim is 19 GB of Hisense warranty, customer, supplier and CRM data covering Malaysia and Singapore, for which it demanded USD 5 million in Bitcoin, reportedly raised from USD 500,000. Reports describe an affiliate model with a 5% operator fee and say the group is recruiting pentesters, web exploitation specialists and zero-day researchers. No encryptor has been publicly analysed, and none of the victim claims had been independently confirmed at the time of reporting.

Xuanye Group is implicated in a breach at ASOS, utilizing social engineering to impersonate a trusted contact and obtain login credentials. They claimed responsibility for the attack, asserting the theft of customer data while clarifying that financial information was not compromised. The group linked their activities to a Telegram channel and threatened to leak stolen data unless negotiations commenced. They have not provided evidence of the stolen data, despite reportedly sharing it with BBC News.

Cybercriminal group tracked by the Sophos Counter Threat Unit (CTU) that operates the Aur0ra ransomware (also known as Aurora ransomware). Sophos reports that the group used AI extensively: it tested the evasion capabilities of tools and techniques against several EDR products in an AI-assisted post-exploitation framework built with Cursor, then gave its associates similar technology for Aur0ra intrusions, in which Cursor's Composer agent and models from Anthropic, xAI and Moonshot performed network and Active Directory discovery, password spraying, Kerberoasting, NTLM coercion and relay and credential extraction, with human operators supplying VPN credentials, SOCKS access and objectives; guardrails were bypassed by framing the intrusions as authorized red team or diagnostics testing. Intrusions relied on Cobalt Strike, shared C2 infrastructure, SharpShares enumeration and exfiltration to S3-compatible storage, and victims were later named on Aur0ra's data leak site. Multiple distinct operators followed the same pattern; artifacts suggest Russian speakers.

Uncategorized threat cluster tracked by Google Threat Intelligence Group for an ARTEX-enabled intrusion campaign also tracked by Wiz Research. GTIG states that it overlaps with the PRC-nexus actor Microsoft tracks as Storm-0940. Activity dates back to at least August 2026 and affected multiple entities in the US and Europe in enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications. The actor typically moved from a first compromised account to deep system access in about four hours, once in 15 minutes, customised its tooling to victim-specific setups and fell back to open proxies when its infrastructure was blocked. The overlap with Storm-0940 is recorded as a similar relation, not as a synonym.

Previously unknown threat actor tracked by Volexity, which from 3 October 2026 exploited a zero-day chain in Ivanti Connect Secure (authentication bypass and RCE tracked as CVE-2026-104935, plus a privilege escalation) to obtain unauthenticated root code execution on a fully patched appliance (22.8R2.4). It re-ran the whole exploit chain for each command instead of deploying a web shell or backdoor, and used in-memory Python, Perl and Bash stages. Post-exploitation focused on credential theft and reconnaissance: Active Directory exports and a custom LDAP tool searching for LAPS passwords and BitLocker recovery keys, parsing of the appliance's own packet captures for LDAP, HTTP Basic and NTLM credentials, a Python Kerberos implementation, and password spraying. Anti-forensic steps included selective log tampering, restoring patched in-memory components and evading the Ivanti Integrity Checker Tool. Volexity assesses with low confidence a criminal rather than espionage motivation, and with medium confidence that the actor uses LLMs for exploit development and post-exploitation.

China-nexus targeted intrusion adversary tracked by CrowdStrike, formerly tracked as VexatiousTemper, active since at least 2021 against government, think tank, energy and extractive organisations across Europe, North America, Oceania and the UK. From 17 October 2026 CrowdStrike observed it run the agentic AI framework ARTEX, mainly with DeepSeek plus a second commercial LLM, from a single controller against more than 200 organisations in at least 14 countries, including foreign ministries in Latin America, Europe, Asia and the Middle East, US pharmaceutical, semiconductor, defense and nuclear organisations, and telecommunications providers. A human operator steered the agents in Chinese, including instructions to find hosts without the CrowdStrike Falcon sensor. Post-exploitation at nine organisations included deployment of the BLOODALCHEMY backdoor, side-loaded by a renamed GameHook binary. CrowdStrike states this campaign is separate from the ARTEX activity tracked as Storm-0940. The Hacker News reports, without a CrowdStrike quote, that the group overlaps with Trend Micro's Earth Estries; this overlap is recorded as a similar relation, not as a synonym.