.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Filter by
Threat profiles
Explore the latest threat group definitions and profiles published by the
Sophos® Counter Threat Unit™ (CTU) Research Team.
Showing 21-30 of 197 profiles
| Name | Location | Objectives | Aliases | Tools |
|---|---|---|---|---|
 China | Espionage | APT17 (FireEye), Aurora Panda (CrowdStrike), DeputyDog (FireEye), Group 72 (Talos), Hidden Lynx (Symantec), Tailgater Team, TG-8153 (SCWX CTU) | 9002, BlackCoffee, DeputyDog, Derusbi, Gh0stHTTPSDropper, HiKit, InternalCMD, PlugX, PoisonIvy, ZxShell | |
| China | Espionage | APT3 (FireEye), Gothic Panda (CrowdStrike), Pirpi, TG-0110 (SCWX CTU), UPSTeam | Cookiecutter, ctt, ctx, HUC Proxy Malware (Htran), Pirpi, PlugX, SplitVPN, UPS | |
| China | Espionage | Calypso | Mimikatz, PlugX, Whitebird | |
| China | Espionage | APT40 (Fireeye), GADOLINIUM (Microsoft), Gingham Typhoon (Microsoft), Kryptonite Panda (Crowdstrike), Leviathan (Proofpoint), Nanhaishu (F-Secure), Pickleworm (Symantec), Red Ladon (PWC), TA423 (Proofpoint), Temp.Jumper (Fireeye), Temp.Periscope (Fireeye) | AIRBREAK, BlackCoffee, China Chopper, Cobalt Strike, DadJoke, Derusbi, Donut, FUSIONBLAZE, GreenCrash, HOMEFRY, Metasploit, Meterpreter, MURKYTOP, Nanhaishu, Orz, ScanBox, SeDll | |
| China | Espionage | APT22 (Fireeye), Barista, Group 46 (Talos), Suckfly (Symantec) | Angryrebel, DestroyRAT, PlugX | |
| China | Espionage | Danti (Kaspersky), DragonOK (Palo Alto), Samurai Panda (CrowdStrike), Shallow Taurus (Palo Alto), Temp.DragonOK (FireEye) | Aveo, DDKONG, Godzilla Webshell, HelloBridge, IsSpace, NFLog Trojan, PLAINTEE, PlugX, Rambo | |
| China | Espionage | APT15 (FireEye), BRONZE DAVENPORT (SCWX CTU), BRONZE IDLEWOOD (SCWX CTU), CTG-6119 (CTU), CTG-6119 (SCWX CTU), CTG-9246 (SCWX CTU), Ke3chang (FireEye), NICKEL (Microsoft), Nylon Typhoon (Microsoft), Playful Dragon, Vixen Panda (CrowdStrike) | BMW, BS2005, Enfal, Mirage, RoyalCLI, RoyalDNS | |
| China | Espionage | Aoqin Dragon (Sentinel Labs), Earth Preta (Trend Micro), Fireant (Symantec), HoneyMyte (Kaspersky), Mustang Panda (Crowdstrike), Red Delta (Recorded Future), Red Lich (PWC), RedDelta (recorded Future), Stately Taurus (Palo Alto), TA416 (ProofPoint), TA416 (Proofpoint), Temp.Hex (FireEye), Twill Typhoon (Microsoft), UNC6384 (Google) | BlueShell, China Chopper, Claimloader, Cobalt Strike, CoolClient, FDMTP Backdoor, HIUPAN, ORat, PlugX, PTSOCKET, PUBLOAD, RCSession, TinyNote, TONESHELL | |
| China | Espionage | Aoqin Dragon (Sentinel Labs), Earth Preta (Trend Micro), Fireant (Symantec), HoneyMyte (Kaspersky), Mustang Panda (Crowdstrike), Red Delta (Recorded Future), Red Lich (PWC), RedDelta (recorded Future), Stately Taurus (Palo Alto), TA416 (ProofPoint), TA416 (Proofpoint), Temp.Hex (FireEye), Twill Typhoon (Microsoft), UNC6384 (Google) | BlueShell, China Chopper, Claimloader, Cobalt Strike, CoolClient, FDMTP Backdoor, HIUPAN, ORat, PlugX, PTSOCKET, PUBLOAD, RCSession, TinyNote, TONESHELL | |
| China | Espionage | APT10 (FireEye), CTG-5938 (SCWX CTU), CVNX (BAE Applied Intelligence), Hogfish (iDefense), MenuPass (Trend Micro), MirrorFace (ESET), POTASSIUM (Microsoft), Purple Typhoon (Microsoft), Purple Typhoon (Micrsoft), Red Apollo (PWC), Stone Panda (CrowdStrike) | ANEL, AsyncRAT, AysncRAT, ChChes, Cobalt Strike, FlowCloud, HiddenFace, LODEINFO, LodeInfo, PlugX, PoisonIvy, QuasarRAT, QuasarRAT Loader, RedLeaves |