Threat profiles.

Espionage

APT29 (FireEye), ATK7 (Thales), Blue Kitsune (PwC), Cozy Bear (CrowdStrike), The Dukes, UNC2452 (Mandiant), YTTRIUM (Microsoft)

CosmicDuke, CozyCar, CozyDuke, DiefenDuke, FatDuke, HAMMERTOSS, LiteDuke, MiniDuke, OnionDuke, PolyglotDuke, RegDuke, RegDuke Loader, SeaDuke, Sliver

Espionage

ATK13 (Thales), Belugasturgeon (Accenture), Blue Python (PwC), CTG-8875 (SCWX CTU), ITG12 (IBM), KRYPTON (Microsoft), MAKERSMARK (CSE), Pensive Ursa (Palo Alto), Secret Blizzard (Microsoft), Turla, UAC-0003 (CERT-UA), UAC-0024 (CERT-UA), UNC4210 (Mandiant), Venomous Bear (CrowdStrike), Waterbug (Symantec)

Carbon-DLL, ComRAT, Kazuar, KopiLuwak, LightNeuron, Mosquito, Nautilus, Neuron, Penquin, PoisonFrog, PyFlash, Skipper, Snake, STOCKSTAY, Tavdig, TinyTurla, Tunnus

Espionage

ALLANITE (Dragos), ATK6 (Thales), BROMINE (Microsoft), CASTLE (SCWX CTU), Crouching Yeti (Kaspersky), Dragonfly (Symantec), DYMALLOY (Dragos), Energetic Bear / Berserk Bear (CrowdStrike), Ghost Blizzard (Microsoft), TEMP.Isotope (FireEye), TG-4192 (SCWX CTU)

ClientX, Ddex Loader, Havex, Karagany, Loek, MCMD, Sysmain, xfrost

Espionage

APT29, Blue Dev 5 (PwC), BlueBravo (Recorded Future), Cloaked Ursa (Palo Alto), CozyLarch (Volexity), Dark Halo (Volexity), Midnight Blizzard (Microsoft), NOBELIUM (Microsoft), StellarParticle (CrowdStrike), UNC2452 (FireEye)

Brute Ratel C4, Cobalt Strike, EnvyScout, GoldFinder, GoldMax, NativeZone, RAINDROP, Sibot, SUNBURST, TEARDROP, VaporRage

Espionage

ACTINIUM (Microsoft), Aqua Blizzard (Microsoft), Armageddon, Blue Otso (PwC), BlueAlpha (Recorded Future), Dancing Salome (Kaspersky), Gamaredon, Gamaredon Group, Hive0051 (IBM), Primitive Bear (CrowdStrike), Shuckworm (Symantec), Trident Ursa (Palo Alto), UAC-0010 (CERT-UA), UNC530 (Google), WinterFlounder (iDefense)

Pterodo

Espionage

APT28 (FireEye), ATK5 (Thales), Blue Athena (PwC), BlueDelta (Recorded Future), Fancy Bear (Crowdstrike), Fighting Ursa (Palo Alto), Forest Blizzard (Microsoft), FROZENLAKE (Google), GRAPHITE (Dragos), Group 74 (Talos), PawnStorm (Trend Micro), Sednit (ESET), Snakemackerel (iDefense), Sofacy (Palo Alto), STRONTIUM (Microsoft), Swallowtail (Broadcom), TA422 (Proofpoint), TG-4127 (SCWX CTU), Tsar Team (iSight), UAC-0001 (CERT-UA)

DEALERSCHOICE, Downdelph, Drovorub, EVILTOSS, Headlace, HIDEDRV, LAMEHUG, LoJack, PowerShell Empire, reGeorg, Scaramouche, SCONATO, Sedkit Exploit Kit, SEDUPLOADER, SHARPFRONT, SimpleLoader, Sofacy downloader, X-Agent, X-Tunnel, Zebrocy

Disruption

APT44 (Google), ATK14 (Thales), BlackEnergy Group, Blue Echidna (PwC), CTG-7263 (SCWX CTU), ELECTRUM (Dragos), FROZENBARENTS (Google), Hades/OlympicDestroyer (Kaspersky), IRIDIUM (Microsoft), Qudedagh (F-Secure), Sandworm Team (Trend Micro), Seashell Blizzard (Microsoft), Telebots (ESET), TEMP.Noble (FireEye), UAC-0002 (CERT-UA), UAC-0145 (CERT-UA), Voodoo Bear (CrowdStrike)

BadRabbit, BlackEnergy, Cyclops Blink, GCat, GreyEnergy, Industroyer, KillDisk, NotPetya, PSCrypt, TeleBot, TeleDoor, VPNFilter, xData

Espionage

TA445 (Proofpoint), UAC-0051 (CERT-UA), UNC1151 (Mandiant)

Disruption, Espionage, Financial Gain

ATK3 (Thales), Black Artemis (PWC), Citrine Sleet (Microsoft), COVELLITE (Dragos), CTG-2460 (SCWX CTU), Diamond Sleet (Microsoft), Guardians of Peace, HIDDEN COBRA (US Government), High Anonymous, Labyrinth Chollima (CrowdStrike), Lazarus Group (Generic), New Romanic Cyber Army Team, NNPT Group, Temp.Hermit (Mandiant), UNC577 (Mandiant), Who Am I?, Whois Team, ZINC (Microsoft)

Brambul, DarkMessenger, Destover, Duuzer, HOPLIGHT, Joanap, KorHigh, LiveJinx, Volgmer

Espionage, Surveillance

CL-STA-0240 (Palo Alto), PurpleBravo (Recorded Future), Storm-1877 (Microsoft), Tenacious Pungsan (Data Dog)