Filter by

Threat profiles

Explore the latest threat group definitions and profiles published by the

Sophos® Counter Threat Unit™ (CTU) Research Team.

Showing 1-10 of 197 profiles

Name	Location	Objectives	Aliases	Tools
ALUMINUM SARATOGA	Palestine	Espionage, Hacktivism	APT-C-23, Arid Viper, Desert Falcon, Extreme Jackal (CrowdStrike), Gaza Cybergang, Molerats (FireEye), Operation DustySky (ClearSky), TA402	BlackShades, BrittleBush, DarkComet, LastConn, Micropsia, NimbleMamba, PoisonIvy, QuasarRAT, XtremeRat
ALUMINUM SHADYSIDE	Palestine	Espionage	APT-C-23 (CN360), Arid Viper (Trend Micro), Desert Falcon (Kaspersky)	Micropsia, SpyC23
ALUMINUM THORN	Palestine	Espionage	Frankenstein (Cisco), WIRTE (LAB52)	FruityC2, Powershell Empire
BRONZE ATLAS	China	Espionage	APT41 (FireEye), Axiom, BARIUM (Microsoft), Blackfly (Symantec), Brass Typhoon, CTG-2633, Earth Baku (TrendMicro), GREF, Group 72 (Talos), Red Kelpie (PWC), TA415 (Proofpoint), TG-2633 (SCWX CTU), Wicked Panda (CrowdStrike), Winnti	Acehash, CCleaner v5.33 backdoor, ChinaChopper, Cobalt Strike, Dicey MSDN, Dodgebox, DUSTPAN, ForkPlayground, HUC Proxy Malware (Htran), Mimikatz, PINEGROVE, PipeMon, PlugX, PortReuse, PowerShell Empire, RbDoor, RCMD, reg save, ShadowPad, Sidewalk, Speculoos, SPEEDBOAT, SQLULDR2, StealthVector, TeamViewer, Voldemort, vssadmin, Winnkit, Winnti
BRONZE BARTON	China	Espionage		ChinaChopper, IOX Proxy, Neo-reGeorg
BRONZE BUTLER	China	Espionage	CTG-2006 (SCWX CTU), Daserf, Stalker Panda (CrowdStrike), Swirl Typhoon (Microsoft), Tick (Palo Alto)	ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB, Windows Credential Editor, WinRAR, xmm downloader, xxmm
BRONZE CANAL	China	Espionage	BlackTech, Circuit Panda (CrowdStrike), CTG-6177 (SCWX CTU), Earth Hundun, Palmerworm (Symantec), Red Djinn, Shrouded Crossbow (Trend Micro)	Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
BRONZE DUDLEY	China	Espionage	TA428 (Proofpoint), Temp.Hex (FireEye), Vicious Panda (CrowdStrike)	NCCTrojan, PhantomNet, PoisonIvy, Royal Road
BRONZE EDGEWOOD	China	Espionage	Red Hariasa	Chinoxy, Cobalt Strike, FunnyDream, Md_client, Nishang Post Exploitation Framework, PCShare, Zuguo
BRONZE EDISON	China	Espionage	APT4 (FireEye), DarkSeoul, getkys, Maverick Panda (CrowdStrike), Salmon Typhoon (Microsoft), Sodium (Microsoft), Sykipot (Symantec), TG-0623 (SCWX CTU)	Gh0st RAT, Wkysol, ZxPortMap

…