.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Filter by
Threat profiles
Explore the latest threat group definitions and profiles published by the
Sophos® Counter Threat Unit™ (CTU) Research Team.
Showing 71-80 of 197 profiles
| Name | Location | Objectives | Aliases | Tools |
|---|---|---|---|---|
 Iran | Espionage | APT33 (Mandiant), Elfin (Symantec), HOLMIUM (Microsoft), MAGNALIUM (Dragos), Peach Sandstorm (Microsoft), Refined Kitten (CrowdStrike), TA451 (Proofpoint) | AutoCore, Cadlotcorg, Dello RAT, FalseFont, Imminent Monitor, KDALogger, Koadic, NanoCore, NetWire, PoshC2, POWERTON, Poylog, PupyRAT, Schoolbag | |
| Iran | Espionage | Boggy Serpens (Palo Alto), Earth Vetala (Trend Micro), ENT-11 (NTTSH), ITG17 (IBM), Mango Sandstorm (Microsoft), MERCURY (Microsoft), MuddyWater (Palo Alto), Seedworm (Symantec), STAC 1171 (Sophos), Static Kitten (CrowdStrike), TA450 (Proofpoint), TEMP.Zagros (FireEye), UNC3313 (Mandiant), Yellow Nix (PwC) | AnyDesk, Canopy, CrackMapExec, CredNinja, Dindoor, Empire, FORELORD, Koadic, LaZagne, Ligolo, Metasploit, Mimikatz, MiniDump, MKL64, Mori, MuddyC2Go, MuddyC3, PhonyC2, Plink, PowerStats, PowGoop, RemoteUtilities, Revsocks, ScreenConnect, SimpleHelp, Small Sieve, Syncro, Tsundere, Venom Proxy, WMIExec | |
 Pakistan | Espionage | APT36 (FireEye), Earth Karkaddan (Trend Micro), Gorgon Group (Palo Alto), Green Havildar (PWC), Mythic Leopard (CrowdStrike), Operation C-Major (Trend Micro), Operation Transparent Tribe (Proofpoint), Pasty Draco (Palo Alto), ProjectM (Palo Alto), Storm-0156 (Microsoft) | CapraRAT, Crimson RAT, DarkComet, ElizaRAT, LuminosityLink, njRAT, ObliqueRAT, Peppy | |
Cybercrime | Financial Gain, Malware Distribution Services | Smoky Spider (CrowdStrike) | Smoke Loader | |
Cybercrime | Extortion, Financial Gain | Dark Angels | Advanced IP Scanner, FileShredder, FileZilla, Godzilla webshell, Neo-Georg webshell, WinSCP | |
Cybercrime | Financial Gain | Aurora | ||
Cybercrime | Financial Gain | BadPotato, Cobalt Strike, GodPotato, Godzilla Webshell, HTran, SharpToken | ||
Cybercrime | Financial Gain | Trigona Team | Advanced Port Scanner, AnyDesk, Atera, Cobalt Strike, dControl, Filezilla, LogMeIn, Mimikatz, Netscan, PsExec, ScreenConnect, Splashtop, TeamViewer, Trigona | |
Cybercrime | Botnet Operations, Financial Gain | ITG23 (IBM), Periwinkle Tempest (Microsoft), Wizard Spider (CrowdStrike) | BazarLoader, Buer loader, Bumblebee, Dyre, Team9, Trickbot | |
Cybercrime | Espionage, Financial Gain | Earth Kapre (Trend Micro), Red Wolf (BI.ZONE), RedCurl (Group-IB) | RedLoader |