Threat profiles

Espionage

APT28 (FireEye), ATK5 (Thales), Blue Athena (PwC), BlueDelta (Recorded Future), Fancy Bear (Crowdstrike), Fighting Ursa (Palo Alto), Forest Blizzard (Microsoft), FROZENLAKE (Google), GRAPHITE (Dragos), Group 74 (Talos), PawnStorm (Trend Micro), Sednit (ESET), Snakemackerel (iDefense), Sofacy (Palo Alto), STRONTIUM (Microsoft), Swallowtail (Broadcom), TA422 (Proofpoint), TG-4127 (SCWX CTU), Tsar Team (iSight), UAC-0001 (CERT-UA)

DEALERSCHOICE, Downdelph, Drovorub, EVILTOSS, Headlace, HIDEDRV, LAMEHUG, LoJack, PowerShell Empire, reGeorg, Scaramouche, SCONATO, Sedkit Exploit Kit, SEDUPLOADER, SHARPFRONT, SimpleLoader, Sofacy downloader, X-Agent, X-Tunnel, Zebrocy

Disruption

APT44 (Google), ATK14 (Thales), BlackEnergy Group, Blue Echidna (PwC), CTG-7263 (SCWX CTU), ELECTRUM (Dragos), FROZENBARENTS (Google), Hades/OlympicDestroyer (Kaspersky), IRIDIUM (Microsoft), Qudedagh (F-Secure), Sandworm Team (Trend Micro), Seashell Blizzard (Microsoft), Telebots (ESET), TEMP.Noble (FireEye), UAC-0002 (CERT-UA), UAC-0145 (CERT-UA), Voodoo Bear (CrowdStrike)

BadRabbit, BlackEnergy, Cyclops Blink, GCat, GreyEnergy, Industroyer, KillDisk, NotPetya, PSCrypt, TeleBot, TeleDoor, VPNFilter, xData

Disruption

APT44 (Google), ATK14 (Thales), BlackEnergy Group, Blue Echidna (PwC), CTG-7263 (SCWX CTU), ELECTRUM (Dragos), FROZENBARENTS (Google), Hades/OlympicDestroyer (Kaspersky), IRIDIUM (Microsoft), Qudedagh (F-Secure), Sandworm Team (Trend Micro), Seashell Blizzard (Microsoft), Telebots (ESET), TEMP.Noble (FireEye), UAC-0002 (CERT-UA), UAC-0145 (CERT-UA), Voodoo Bear (CrowdStrike)

BadRabbit, BlackEnergy, Cyclops Blink, GCat, GreyEnergy, Industroyer, KillDisk, NotPetya, PSCrypt, TeleBot, TeleDoor, VPNFilter, xData

Espionage

TA445 (Proofpoint), UAC-0051 (CERT-UA), UNC1151 (Mandiant)

Disruption, Espionage, Financial Gain

ATK3 (Thales), Black Artemis (PWC), Citrine Sleet (Microsoft), COVELLITE (Dragos), CTG-2460 (SCWX CTU), Diamond Sleet (Microsoft), Guardians of Peace, HIDDEN COBRA (US Government), High Anonymous, Labyrinth Chollima (CrowdStrike), Lazarus Group (Generic), New Romanic Cyber Army Team, NNPT Group, Temp.Hermit (Mandiant), UNC577 (Mandiant), Who Am I?, Whois Team, ZINC (Microsoft)

Brambul, DarkMessenger, Destover, Duuzer, HOPLIGHT, Joanap, KorHigh, LiveJinx, Volgmer

Espionage, Surveillance

CL-STA-0240 (Palo Alto), PurpleBravo (Recorded Future), Storm-1877 (Microsoft), Tenacious Pungsan (Data Dog)

Espionage

APT37 (FireEye), ATK4 (Thales), Group 123 (Talos), InkySquid (Volexity), Moldy Pisces (Palo Alto), Operation Daybreak (Kaspersky), Operaton Erebus (Kaspersky), Reaper (FireEye), RICOCHET CHOLLIMA (CrowdStrike), ScarCruft (Kaspersky), TA-RedAnt (ASEC), Venus 121 (ESRC)

Bluelight, Chinotto, final1stpy, GOLDBACKDOOR, KevDroid, KoSpy, PoorWeb, ROKRAT

Financial Gain

Alluring Pisces (Palo Alto), APT38 (FireEye), ATK 117 (Thales), Black Alicanto (PWC), Bluenoroff (Kaspersky), Citrine Sleet (Microsoft), CTG-6459 (SCWX CTU), HIDDEN COBRA (U.S. Government), Lazarus Group, Sapphire Sleet (Microsoft), Selective Pisces (Palo Alto), Stardust Chollima (CrowdStrike), T-APT-15 (Tencent), TA444 (Proofpoint), TAG-71 (Recorded Future)

AlphaNC, Bankshot, CATCH22, CCGC_Proxy, Cur1Agent, KANDYKORN, Ratankba, RustBucket, Server_TrafficForwarder, SUGARLOADER, SwiftLoader, Wcry

Espionage, Financial Gain

Andariel, APT45 (Mandiant), Dark Seoul, Jumpy Pisces (Palo Alto), Onyx Sleet (Microsoft), RIFLE Campaign, Silent Chollima (CrowdStrike), Stonefly (Symantec), UN614 (Mandiant)

ActiveX 0-day, DTrack, HazyLoad, HotCriossant, Rifle, UnitBot, Valefor

Espionage

Konni, Opal Sleet (Microsoft), OSMIUM (Microsoft)

Konni