Threat actors

RansomHub is a rapidly growing ransomware group believed to be an updated version of the older Knight ransomware.

Russian-speaking ransomware-as-a-service operation, dominant 2022–2024 until law-enforcement seizure (Operation Cronos).

DragonForce is a hacktivist group based in Malaysia that has been involved in cyberattacks targeting government institutions and commercial organizations in India.

ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain.

SpaceBears is a ransomware group believed to be based in Moscow, Russia, that has taken credit for several high-profile cyberattacks while primarily operating as a Data Broker.

Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector.

This group started operating during the first quarter of 2022.

Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, extortion, and destructive attacks using custom wiper malware.

North Korean state-sponsored actor (DPRK Reconnaissance General Bureau). Mixes espionage, financial theft, and cryptocurrency heists to fund the regime.

The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms.

An actor group conducting large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements.

This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes.

The hacker said that he put up the data for sale mainly because these companies had failed to protect passwords with strong encryption algorithms like bcrypt.

Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.

TA505, the name given by Proofpoint, has been in the cybercrime business for at least four years.

TraderTraitor targets blockchain companies through spear-phishing messages.

Wizard Spider is reportedly associated with Grim Spider and Lunar Spider.