.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Filter by
Threat profiles
Explore the latest threat group definitions and profiles published by the
Sophos® Counter Threat Unit™ (CTU) Research Team.
Showing 171-180 of 197 profiles
| Name | Location | Objectives | Aliases | Tools |
|---|---|---|---|---|
Cybercrime | Financial Gain | Silence (Group-IB) | Silence | |
Cybercrime | Financial Gain, Malware Distribution Services | Cobalt Strike, GootBot, GootKit, GootLoader, REvil | ||
 Russia | Espionage | Blue Callisto (PwC), BlueCharlie (Recorded Future), CALISTO (SEKOIA), Callisto Group (F-Secure), COLDRIVER (Google), GOSSAMER BEAR (Crowdstrike), Gossamer Bear (Crowdstrike), SEABORGIUM (Microsoft), Star Blizzard (Microsoft), TA446 (Proofpoint) | Evilginx2, Galileo RCS, SPICA | |
| Russia | Espionage | Laundry Bear (AIVD), TA488 (Proofpoint), UAC-0190 (CERT-UA), UNK_PitStop (Proofpoint), Void Blizzard (Microsoft) | Evilginx2, PLUGGYAPE, ZimReaper | |
| Russia | Espionage | APT29 (FireEye), ATK7 (Thales), Blue Kitsune (PwC), Cozy Bear (CrowdStrike), The Dukes, UNC2452 (Mandiant), YTTRIUM (Microsoft) | CosmicDuke, CozyCar, CozyDuke, DiefenDuke, FatDuke, HAMMERTOSS, LiteDuke, MiniDuke, OnionDuke, PolyglotDuke, RegDuke, RegDuke Loader, SeaDuke, Sliver | |
| Russia | Espionage | ATK13 (Thales), Belugasturgeon (Accenture), Blue Python (PwC), CTG-8875 (SCWX CTU), ITG12 (IBM), KRYPTON (Microsoft), MAKERSMARK (CSE), Pensive Ursa (Palo Alto), Secret Blizzard (Microsoft), Turla, UAC-0003 (CERT-UA), UAC-0024 (CERT-UA), UNC4210 (Mandiant), Venomous Bear (CrowdStrike), Waterbug (Symantec) | Carbon-DLL, ComRAT, Kazuar, KopiLuwak, LightNeuron, Mosquito, Nautilus, Neuron, Penquin, PoisonFrog, PyFlash, Skipper, Snake, STOCKSTAY, Tavdig, TinyTurla, Tunnus | |
| Russia | Espionage | ATK13 (Thales), Belugasturgeon (Accenture), Blue Python (PwC), CTG-8875 (SCWX CTU), ITG12 (IBM), KRYPTON (Microsoft), MAKERSMARK (CSE), Pensive Ursa (Palo Alto), Secret Blizzard (Microsoft), Turla, UAC-0003 (CERT-UA), UAC-0024 (CERT-UA), UNC4210 (Mandiant), Venomous Bear (CrowdStrike), Waterbug (Symantec) | Carbon-DLL, ComRAT, Kazuar, KopiLuwak, LightNeuron, Mosquito, Nautilus, Neuron, Penquin, PoisonFrog, PyFlash, Skipper, Snake, STOCKSTAY, Tavdig, TinyTurla, Tunnus | |
| Russia | Espionage | ALLANITE (Dragos), ATK6 (Thales), BROMINE (Microsoft), CASTLE (SCWX CTU), Crouching Yeti (Kaspersky), Dragonfly (Symantec), DYMALLOY (Dragos), Energetic Bear / Berserk Bear (CrowdStrike), Ghost Blizzard (Microsoft), TEMP.Isotope (FireEye), TG-4192 (SCWX CTU) | ClientX, Ddex Loader, Havex, Karagany, Loek, MCMD, Sysmain, xfrost | |
| Russia | Espionage | APT29, Blue Dev 5 (PwC), BlueBravo (Recorded Future), Cloaked Ursa (Palo Alto), CozyLarch (Volexity), Dark Halo (Volexity), Midnight Blizzard (Microsoft), NOBELIUM (Microsoft), StellarParticle (CrowdStrike), UNC2452 (FireEye) | Brute Ratel C4, Cobalt Strike, EnvyScout, GoldFinder, GoldMax, NativeZone, RAINDROP, Sibot, SUNBURST, TEARDROP, VaporRage | |
| Russia | Espionage | ACTINIUM (Microsoft), Aqua Blizzard (Microsoft), Armageddon, Blue Otso (PwC), BlueAlpha (Recorded Future), Dancing Salome (Kaspersky), Gamaredon, Gamaredon Group, Hive0051 (IBM), Primitive Bear (CrowdStrike), Shuckworm (Symantec), Trident Ursa (Palo Alto), UAC-0010 (CERT-UA), UNC530 (Google), WinterFlounder (iDefense) | Pterodo |