Filter by

Threat profiles

Explore the latest threat group definitions and profiles published by the

Sophos® Counter Threat Unit™ (CTU) Research Team.

Showing 151-160 of 197 profiles

Name	Location	Objectives	Aliases	Tools
GOLD SHERWOOD	Cybercrime	Data Theft, Extortion, Financial Gain, Malware as a Service, Ransomware		AnyDesk, Cobalt Strike, GentleKiller, HavocKiller, HexKiller, Impacket, OxideHarvest, SystemBC, The Gentlemen ransomware, ThrottleBlood
GOLD SKYLINE	Cybercrime	Business Email Compromise, Financial Gain	Wire-Wire Group 1 (Secureworks CTU)	iSpySoftware
GOLD SONATA	Cybercrime	Financial Gain, Ransomware		Babuk
GOLD SOUTHFIELD	Cybercrime	Financial Gain, Ransomware		REvil
GOLD SOUVENIR	Cybercrime	Financial Gain		Black Suit, BlackSuit, Brute Ratel, Chisel, Cobalt Strike, GMER, Gootloader, Mimikatz, MobaXterm, PowerTool, PsExec, PuTTy, Qakbot, Rclone, Royal, SystemBC
GOLD SWATHMORE	Cybercrime	Botnet Operations, Financial Gain, Ransomware	Lunar Spider (CrowdStrike)	Cobalt Strike, GlobeImposter, Gozi, Gozi Trojan, IcedID, Latrodectus, TrickBot
GOLD SWATHMORE	Cybercrime	Botnet Operations, Financial Gain, Ransomware	Lunar Spider (CrowdStrike)	Cobalt Strike, GlobeImposter, Gozi, Gozi Trojan, IcedID, Latrodectus, TrickBot
GOLD SYMPHONY	Cybercrime	Financial Gain, Malware as a Service		Buer Loader
GOLD TAHOE	Cybercrime	Financial Gain, Ransomware	CL0P (group identity), FIN11 (Mandiant), GRACEFUL SPIDER (CrowdStrike), SectorJ04 (NSHC Singapore), Spandex Tempest (Microsoft), TA505 (Proofpoint)	Clop, Cobalt Strike, FlawedAmmy, Get2, GraceWire, Malichus, SDBbot, ServHelper, TrueBot
GOLD TAILWIND	Cybercrime	Data Theft, Extortion, Financial Gain, Ransomware		Advanced IP Scanner, AnyDesk, Cobalt Strike, Impacket, Level RMM, Lynx, Mimikatz, Rclone, Restic, SimpleHelp

…

…