위협 조직 정보

APT28 (G0007) 뉴스 12건

별칭: IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associa

관련 CVE: CVE-2026-21509 CVE-2026-77554 CVE-2026-78541 CVE-2026-79054 CVE-2026-79224 CVE-2026-82078

MITRE ATT&CK 프로필 ↗

APT29 (G0016) 뉴스 14건

별칭: IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Duk

관련 CVE: CVE-2021-41379 CVE-2026-12645 CVE-2026-12744 CVE-2026-26084 CVE-2026-44756 CVE-2026-61578

MITRE ATT&CK 프로필 ↗

Kimsuky (G0094) 뉴스 34건

별칭: Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy a

관련 CVE: CVE-2026-3564 CVE-2024-1709 CVE-2026-82988 CVE-2026-86510 CVE-2026-86555 CVE-2026-87902

MITRE ATT&CK 프로필 ↗

Lazarus Group (G0032) 뉴스 44건

별칭: Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rai

관련 CVE: CVE-2026-109619 CVE-2026-68820 CVE-2026-109618 CVE-2026-115560 CVE-2021-21551 CVE-2026-63688

MITRE ATT&CK 프로필 ↗

Scattered Spider (G1015) 뉴스 9건

별칭: Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain

관련 CVE: CVE-2015-2291 CVE-2024-0244 CVE-2026-28324 CVE-2026-68490 CVE-2026-75689 CVE-2026-75907

MITRE ATT&CK 프로필 ↗

Volt Typhoon (G1017) 뉴스 4건

별칭: BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite, Insidious Taurus, DazedToad

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-t

관련 CVE: CVE-2025-30237 CVE-2025-30241 CVE-2025-8875 CVE-2025-30238 CVE-2026-88772 CVE-2025-8876

MITRE ATT&CK 프로필 ↗

ExfilSquad

Only exfiltration

Global Secret Group (GSG)

조직 자체 설명은 아직 없음 — 최근 피해 사례: Graves Fireplaces, Inc. (US) · Manufacturing · 2026-10-20
Country: Cumming, Georgia, US | Website: www.gravesfireplaces.com | Revenue: $5.3 Million | Industry: Hearth Products, Fireplace Sales and Installation | Employees: 20-50 | Properties: 76.1 GB (77,117

GodDamn ransomwhere

설명·피해 사례 정보 없음

Section9

🚨 This is a fake group with fake victims.

D1R

D1R Claims Synopsys and Bosch Breaches, but Synopsys Disputes Intrusion

CRPxO (CRPx0)

CRPxO is actively recruiting affiliates, offering: 🔹 70% revenue share 🔹 XMR/BTC payouts 🔹 Claimed payouts within 24 hours 🔹 $333 one-time affiliate access

Orova

First seen 2026-07-07

Booba Project (Booba Team)

Booba

Doommageddon

Direct Extortion Double Extortion

Blackfield

조직 자체 설명은 아직 없음 — 최근 피해 사례: redeplastrs.com.br (BR) · Manufacturing · 2026-07-03
Redeplast is a Brazilian footwear manufacturer with over 20 years of experience in the industry. The...

Redact

조직 자체 설명은 아직 없음 — 최근 피해 사례: Baker Donelson (US) · Professional Services · 2026-10-19
Sector: Law Firm

settra

조직 자체 설명은 아직 없음 — 최근 피해 사례: adapt-global.com · Professional Services · 2026-09-30
The company sells to federal customers under a GSA MAS contract and calls its products "U.S.-made / Made in the USA," yet its own documents reveal Taiwanese and Chinese suppliers, Hong Kong-based deve

Wallstreet

조직 자체 설명은 아직 없음 — 최근 피해 사례: Bristol City Council (GB) · Government & Defense · 2026-10-27
Bristol City Council is the local authority for Bristol, England. It provides public services for residents, businesses, and visitors, including council tax and benefits, housing, schools, social care

Deadlock

조직 자체 설명은 아직 없음 — 최근 피해 사례: Trinity Custom Homes (US) · Manufacturing · 2026-10-24
Trinity Custom Homes is a custom home builder that specializes in building 100% custom, solid wood homes directly on the customer’s land across several states in the Southeast, including Georgia, Alab

Triple X (triplex)

조직 자체 설명은 아직 없음 — 최근 피해 사례: Henshaw Law (GB) · Professional Services · 2026-08-04
1 terabytes of people's data https://henshawlawak.com/ Henshaw Law, Despite repeated recommendations, no action was taken. The problem remains unresolved, the system is full of bugs, people's document

ULose

조직 자체 설명은 아직 없음 — 최근 피해 사례: zzq-test · Not Found · 2026-10-27
Country: c | Status: Sale

Black X

조직 자체 설명은 아직 없음 — 최근 피해 사례: lopay (GB) · Financial Services · 2026-10-09
Lopay is a UK-based fintech company that provides a payment platform enabling small and medium-sized enterprises (SMEs) and sole traders to accept credit card and mobile payments, as well as manage th

0day Syndicate

조직 자체 설명은 아직 없음 — 최근 피해 사례: Braincell Braincell.sa rfcargo.braincell.solutions rf.braincell.solutions governata.com · Technology · 2026-05-29
Braincell is a Saudi technology startup that optimizes business decision-making through AI-powered automation and data integration

titan

Founded 4 April 2026

LeakBazaar

조직 자체 설명은 아직 없음 — 최근 피해 사례: Wayne Brothers (US) · Manufacturing · 2026-05-09
Wayne Brothers, Inc. is a site development and concrete construction services provider serving Alabama, Georgia, Tennessee, South Carolina, North Carolina, Virginia and West Virginia

Icarus

조직 자체 설명은 아직 없음 — 최근 피해 사례: H* · Not Found · 2026-06-23
Salesforce data of H*. Data stolen: SF data - Compressed

PrinzEugen

조직 자체 설명은 아직 없음 — 최근 피해 사례: Spratley's of Mortimer · Retail & E-Commerce · 2026-06-04
spratleys.co.uk Hundreds of GBs of data encrypted across company file shares, If you would like the decryption key you just need to ask.

CMDOrganization

CMD is a new kind of company that specializes in corporate system security and in identifying vulnerabilities across all aspects of the software used by a company. CMD operates on a global scale recognizing the critical importance of timeliness and confidentiality.

fulcrumsec

FulcrumSec is a data extortion group active since approximately September 2025, specializing in high-speed exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions rather than deploying encryption, with known victims including Australian fintech youX and LexisNexis.

mnt6

MNT6 is a lower-profile ransomware group claiming victims across legal, manufacturing, construction, healthcare, and logistics sectors in the US, Canada, New Zealand, and Spain, with notable claimed targets including Silfab Solar; some victim listings have been flagged as potentially unverified.

aurora

Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.

m3rx

M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eight claimed victims including a Sydney-based property firm.

lamashtu

Lamashtu is an extortion group that first appeared in April 2026, claiming attacks against organizations in France, Romania, and Thailand across energy, pharmaceutical, and film sectors; it has not yet been confirmed as operating actual file-encrypting ransomware rather than pure data-theft extortion.

blackwater

Blackwater is a ransomware group that first surfaced in early 2026, combining file encryption with data theft and targeting healthcare organizations, with known victims including Minidoka Memorial Hospital in Idaho.

TiMc

TiMc is a ransomware group that emerged in early 2026, claiming high-impact attacks against Spanish IT services leader Seidor (1 TB+ data) and oncology organization Oncologica (100 GB+), targeting Business Services, Healthcare, and IT sectors with a focus on Spanish-speaking and European targets.

AuditTeam

AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data leak site consistent with double-extortion methodology.

krybit

Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.

netrunner

NetRunner is a ransomware group active from at least 2025 targeting diverse sectors including healthcare, telecommunications, manufacturing, and agriculture across Japan, Italy, the US, and Jordan, notably demanding a $100M ransom from Nippon Medical School Musashi Kosugi Hospital.

ALP-001

⚠️ The group appears unreliable. Most, if not all, of its alleged victims cannot be verified. WE HAVE DECIDED TO REMOVE ENTRIES FOR THIS GROUP

exitium

Exitium is a data extortion group first observed in early 2026, operating a Tor-based double extortion site and targeting victims via bulk data exfiltration followed by public naming-and-shaming, with known victims including a Brazilian agro-industrial firm and a US county appraisal district.

xp95

XP95 is a cyber-extortion group that emerged in March 2026, using a pure data-theft-and-extortion model with a Windows XP/95-themed leak site, with notable targets including Statistics South Africa (154 GB exfiltrated) and the Gauteng Provincial Government.

AiLock

AiLock is a ransomware operation that emerged in early 2025, marketing itself as AI-assisted ransomware using a hybrid ChaCha20/NTRUEncrypt encryption scheme and double-extortion tactics, actively recruiting affiliates and threatening regulatory reporting if ransoms are unpaid.

lapsus$

Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.

ShadowByt3$

ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.

cipherforce

CipherForce is a newly emerged ransomware group first detected in early 2026, operating a dark web leak site and targeting technology, business services, and logistics companies across the US, China, Vietnam, India, and UAE, with at least 6 claimed victims.