APAC Threat Actors¶
Last updated: 2026-04-01 07:21 UTC | Source: MITRE ATT&CK
State-sponsored and advanced persistent threat (APT) groups with known activity targeting Australia, the Indo-Pacific, and Five Eyes nations. Data is automatically refreshed from MITRE ATT&CK on each build.
Classification Note
Attribution of cyber operations to specific nation-states is inherently complex. The attributions listed here reflect publicly available reporting from government agencies and reputable threat intelligence firms.
Russia¶
Kimsuky¶
| Attribution | Russia |
| Also known as | Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM |
| Status | }Active |
| Primary Targets | Government, Education |
| ATT&CK Techniques | 109 known techniques |
| Australia Relevance | Targets APAC policy researchers and diplomats. Credential harvesting campaigns. |
| MITRE Reference | G0094 |
Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing ...
APT28¶
| Attribution | Russia / GRU |
| Also known as | IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74 |
| Status | }Active |
| Primary Targets | Military |
| ATT&CK Techniques | 91 known techniques |
| Australia Relevance | Global operations affecting Five Eyes partners. Active disinformation campaigns. |
| MITRE Reference | G0007 |
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictme...
Sandworm Team¶
| Attribution | Russia / GRU |
| Also known as | ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group) |
| Status | }Active |
| Primary Targets | Government, Military |
| ATT&CK Techniques | 79 known techniques |
| Australia Relevance | Destructive attacks on critical infrastructure. NotPetya, Industroyer operations. |
| MITRE Reference | G0034 |
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2...
Gamaredon Group¶
| Attribution | Russia / FSB |
| Also known as | IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon |
| Status | }Active |
| Primary Targets | Government, Military |
| ATT&CK Techniques | 70 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0047 |
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.(Citation: Palo ...
Turla¶
| Attribution | Russia / FSB |
| Also known as | IRON HUNTER, Group 88, Waterbug, WhiteBear |
| Status | }Active |
| Primary Targets | Government, Military, Education |
| ATT&CK Techniques | 68 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0010 |
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is ...
APT29¶
| Attribution | Russia / SVR |
| Also known as | IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 66 known techniques |
| Australia Relevance | SolarWinds supply chain attack. Persistent targeting of Western government networks. |
| MITRE Reference | G0016 |
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT2...
Wizard Spider¶
| Attribution | Russia |
| Also known as | UNC1878, TEMP.MixMaster, Grim Spider, FIN12 |
| Status | }Active |
| Primary Targets | Financial, Healthcare |
| ATT&CK Techniques | 64 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0102 |
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organization...
Dragonfly¶
| Attribution | Russia / FSB |
| Also known as | TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192 |
| Status | }Active |
| Primary Targets | Government, Defence, Critical Infrastructure |
| ATT&CK Techniques | 56 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0035 |
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, Dragonfly has targeted defense and aviation companies, govern...
Ember Bear¶
| Attribution | Russia / GRU |
| Also known as | UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard |
| Status | }Active |
| Primary Targets | Government, Telecommunications, Critical Infrastructure |
| ATT&CK Techniques | 48 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1003 |
Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).(Citation: CISA GRU29155 2024) Ember Bear has primarily focused operations against Ukrainian gov...
RedCurl¶
| Attribution | Russia |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 41 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1039 |
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.(Citation: group-ib_redcurl1) RedCurl is allegedl...
Indrik Spider¶
| Attribution | Russia |
| Also known as | Evil Corp, Manatee Tempest, DEV-0243, UNC2165 |
| Status | }Active |
| Primary Targets | Financial |
| ATT&CK Techniques | 33 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0119 |
Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S057...
Silence¶
| Attribution | Russia |
| Also known as | Whisper Spider |
| Status | }Active |
| Primary Targets | Financial |
| ATT&CK Techniques | 28 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0091 |
Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and car...
Winter Vivern¶
| Attribution | Russia |
| Also known as | TA473, UAC-0114 |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 27 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1035 |
Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow...
Inception¶
| Attribution | Russia |
| Also known as | Inception Framework, Cloud Atlas |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 22 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0100 |
Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Cit...
Star Blizzard¶
| Attribution | Russia |
| Also known as | SEABORGIUM, Callisto Group, TA446, COLDRIVER |
| Status | }Active |
| Primary Targets | Government, Defence |
| ATT&CK Techniques | 19 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1033 |
Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizatio...
Saint Bear¶
| Attribution | Russia |
| Also known as | Storm-0587, TA471, UAC-0056, Lorec53 |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 18 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1031 |
Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. [Saint Bear](https://attack.mitre....
Gorgon Group¶
| Attribution | Russia |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 16 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0078 |
Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)
Machete¶
| Attribution | Russia |
| Also known as | APT-C-43, El Machete |
| Status | }Active |
| Primary Targets | Government, Military, Telecommunications |
| ATT&CK Techniques | 11 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0095 |
Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. Machete generally targets high-profile organizations ...
FIN5¶
| Attribution | Russia |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Financial |
| ATT&CK Techniques | 11 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0053 |
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. (Citation: FireEye Respond Webinar July 2017) (Citation: Mand...
RTM¶
| Attribution | Russia |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Financial |
| ATT&CK Techniques | 7 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0048 |
RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM). (Citation: ESET RTM Feb 2017)
Nomadic Octopus¶
| Attribution | Russia |
| Also known as | DustSquad |
| Status | }Active |
| Primary Targets | Government, Diplomatic |
| ATT&CK Techniques | 7 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0133 |
Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi...
Water Galura¶
| Attribution | Russia |
| Also known as | GOLD FEATHER |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 3 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1050 |
Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G...
TEMP.Veles¶
| Attribution | Russia |
| Also known as | XENOTIME |
| Status | }Active |
| Primary Targets | Critical Infrastructure |
| ATT&CK Techniques | N/A |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0088 |
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)
North Korea¶
Lazarus Group¶
| Attribution | North Korea / RGB |
| Also known as | Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC |
| Status | }Active |
| Primary Targets | Financial |
| ATT&CK Techniques | 93 known techniques |
| Australia Relevance | Major cryptocurrency theft operations. Active against APAC financial institutions. |
| MITRE Reference | G0032 |
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) Lazarus Group has been active since at least 2009 and is reportedly responsible for the ...
APT38¶
| Attribution | North Korea / RGB |
| Also known as | NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima |
| Status | }Active |
| Primary Targets | Financial, Cryptocurrency |
| ATT&CK Techniques | 56 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0082 |
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency ex...
Contagious Interview¶
| Attribution | North Korea |
| Also known as | DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER |
| Status | }Active |
| Primary Targets | Financial, Cryptocurrency |
| ATT&CK Techniques | 52 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1052 |
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individua...
Moonstone Sleet¶
| Attribution | North Korea |
| Also known as | Storm-1789 |
| Status | }Active |
| Primary Targets | Financial |
| ATT&CK Techniques | 30 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1036 |
Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. [Moonstone Sleet](https://attack.mitre...
Andariel¶
| Attribution | North Korea / RGB |
| Also known as | Silent Chollima, PLUTONIUM, Onyx Sleet |
| Status | }Active |
| Primary Targets | Government, Military, Financial, Cryptocurrency |
| ATT&CK Techniques | 12 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0138 |
Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted c...
AppleJeus¶
| Attribution | North Korea / RGB |
| Also known as | Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736 |
| Status | }Active |
| Primary Targets | Government, Financial, Cryptocurrency |
| ATT&CK Techniques | 2 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1049 |
AppleJeus is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader Lazarus Group umbrella of actors, AppleJeus has been active since at least 2018 and is closely aligned in resources with TEMP.hermit, anothe...
China¶
Mustang Panda¶
| Attribution | China |
| Also known as | TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS |
| Status | }Active |
| Primary Targets | Government, Diplomatic |
| ATT&CK Techniques | 85 known techniques |
| Australia Relevance | Active in Southeast Asia and Oceania. PlugX malware campaigns targeting APAC. |
| MITRE Reference | G0129 |
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplom...
APT41¶
| Attribution | China |
| Also known as | Wicked Panda, Brass Typhoon, BARIUM |
| Status | }Active |
| Primary Targets | Financial, Telecommunications, Healthcare, Technology, Education |
| ATT&CK Techniques | 82 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0096 |
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, ...
Volt Typhoon¶
| Attribution | China |
| Also known as | BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236 |
| Status | }Active |
| Primary Targets | Technology, Critical Infrastructure |
| ATT&CK Techniques | 81 known techniques |
| Australia Relevance | Living-off-the-land techniques against Western critical infrastructure. Five Eyes joint advisory. |
| MITRE Reference | G1017 |
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable ...
Chimera¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 59 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0114 |
Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)
Threat Group-3390¶
| Attribution | China |
| Also known as | Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION |
| Status | }Active |
| Primary Targets | Government, Defence, Energy, Technology, Aerospace |
| ATT&CK Techniques | 57 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0027 |
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION Ju...
Leviathan¶
| Attribution | China / MSS |
| Also known as | MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK |
| Status | }Active |
| Primary Targets | Government, Defence, Healthcare, Aerospace, Maritime |
| ATT&CK Techniques | 50 known techniques |
| Australia Relevance | Directly targeted Australian organisations. Subject of joint ASD advisory (2024). |
| MITRE Reference | G0065 |
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, Leviathan has targeted the following sectors: acade...
UNC3886¶
| Attribution | China / PLA |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Defence, Telecommunications, Technology |
| ATT&CK Techniques | 49 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1048 |
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologie...
Ke3chang¶
| Attribution | China |
| Also known as | APT15, Mirage, Vixen Panda, GREF |
| Status | }Active |
| Primary Targets | Government, Military, Diplomatic |
| ATT&CK Techniques | 46 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0004 |
Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Al...
menuPass¶
| Attribution | China / MSS |
| Also known as | Cicada, POTASSIUM, Stone Panda, APT10 |
| Status | }Active |
| Primary Targets | Government, Defence, Energy, Healthcare, Technology |
| ATT&CK Techniques | 46 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0045 |
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.(Citation: DOJ AP...
Earth Lusca¶
| Attribution | China / PLA |
| Also known as | TAG-22, Charcoal Typhoon, CHROMIUM, ControlX |
| Status | }Active |
| Primary Targets | Government, Financial, Telecommunications, Education, Media |
| ATT&CK Techniques | 44 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1006 |
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States....
HAFNIUM¶
| Attribution | China |
| Also known as | Operation Exchange Marauder, Silk Typhoon |
| Status | }Active |
| Primary Targets | Defence, Education |
| ATT&CK Techniques | 44 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0125 |
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractor...
APT3¶
| Attribution | China |
| Also known as | Gothic Panda, Pirpi, UPS Team, Buckeye |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 44 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0022 |
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.(Citation: FireEye Clandestine Wolf)(Ci...
BRONZE BUTLER¶
| Attribution | China |
| Also known as | REDBALDKNIGHT, Tick |
| Status | }Active |
| Primary Targets | Government, Technology |
| ATT&CK Techniques | 40 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0060 |
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citati...
Rocke¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Cryptocurrency |
| ATT&CK Techniques | 36 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0106 |
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers ...
Aquatic Panda¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government, Telecommunications, Technology |
| ATT&CK Techniques | 35 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0143 |
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)
GALLIUM¶
| Attribution | China |
| Also known as | Granite Typhoon |
| Status | }Active |
| Primary Targets | Government, Financial, Telecommunications |
| ATT&CK Techniques | 31 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0093 |
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-t...
Sidewinder¶
| Attribution | China |
| Also known as | T-APT-04, Rattlesnake |
| Status | }Active |
| Primary Targets | Government, Military |
| ATT&CK Techniques | 30 known techniques |
| Australia Relevance | Active in APAC region targeting government and military entities. |
| MITRE Reference | G0121 |
Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.(Citation: ATT Sidewinder January 2021)(Citation: Securelist APT Trends April 2018)(Citation: Cyble Sidew...
APT5¶
| Attribution | China / PLA |
| Also known as | Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda |
| Status | }Active |
| Primary Targets | Defence, Telecommunications, Aerospace |
| ATT&CK Techniques | 29 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1023 |
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying...
APT37¶
| Attribution | China |
| Also known as | InkySquid, ScarCruft, Reaper, Group123 |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 29 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0067 |
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following ...
ZIRCONIUM¶
| Attribution | China |
| Also known as | APT31, Violet Typhoon |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 29 known techniques |
| Australia Relevance | Targeted Australian Parliament (2019). Active against Five Eyes nations. |
| MITRE Reference | G0128 |
ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.(Citation: Microsoft Targeting Elections September 2020)(Citation: Check Point APT31 February 2021)
LuminousMoth¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 28 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1014 |
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is...
Higaisa¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 28 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0126 |
Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in ...
APT1¶
| Attribution | China / PLA |
| Also known as | Comment Crew, Comment Group, Comment Panda |
| Status | }Active |
| Primary Targets | Military |
| ATT&CK Techniques | 23 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0006 |
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)
APT19¶
| Attribution | China |
| Also known as | Codoso, C0d0so0, Codoso Team, Sunshop Group |
| Status | }Active |
| Primary Targets | Defence, Energy, Telecommunications, Education |
| ATT&CK Techniques | 21 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0073 |
APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://atta...
Cinnamon Tempest¶
| Attribution | China |
| Also known as | DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT |
| Status | }Active |
| Primary Targets | Government, Financial |
| ATT&CK Techniques | 19 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1021 |
Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears ...
Daggerfly¶
| Attribution | China |
| Also known as | Evasive Panda, BRONZE HIGHLAND |
| Status | }Active |
| Primary Targets | Government, Telecommunications |
| ATT&CK Techniques | 17 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1034 |
Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of [MgBot](https://attack....
BITTER¶
| Attribution | China |
| Also known as | T-APT-17 |
| Status | }Active |
| Primary Targets | Government, Energy |
| ATT&CK Techniques | 16 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1002 |
BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct...
Axiom¶
| Attribution | China |
| Also known as | Group 72 |
| Status | }Active |
| Primary Targets | Government, Defence, Aerospace, Media |
| ATT&CK Techniques | 16 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0001 |
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct...
Tonto Team¶
| Attribution | China |
| Also known as | Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda |
| Status | }Active |
| Primary Targets | Government, Military, Financial, Energy, Healthcare |
| ATT&CK Techniques | 15 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0131 |
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, milita...
BlackTech¶
| Attribution | China |
| Also known as | Palmerworm |
| Status | }Active |
| Primary Targets | Financial, Media |
| ATT&CK Techniques | 14 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0098 |
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construc...
Salt Typhoon¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Telecommunications |
| ATT&CK Techniques | 14 known techniques |
| Australia Relevance | Compromised major telecommunications providers. Potential APAC impact. |
| MITRE Reference | G1045 |
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco Salt Typhoon FEB 2025)
Naikon¶
| Attribution | China / PLA |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government, Military |
| ATT&CK Techniques | 14 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0019 |
Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).(Citation: CameraShy) Active since at least 2010, Naikon has primarily conducted operatio...
admin@338¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Financial |
| ATT&CK Techniques | 12 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0018 |
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. (Citatio...
Deep Panda¶
| Attribution | China |
| Also known as | Shell Crew, WebMasters, KungFu Kittens, PinkPanther |
| Status | }Active |
| Primary Targets | Government, Defence, Financial, Telecommunications, Healthcare |
| ATT&CK Techniques | 10 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0009 |
Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. (Citation: Alperovitch 2014) The intrusion into healthcare company Anthem has been attributed to Deep Panda. (Citation: ThreatConnect Anthem) This group is also known as...
Elderwood¶
| Attribution | China |
| Also known as | Elderwood Gang, Beijing Group, Sneaky Panda |
| Status | }Active |
| Primary Targets | Government, Defence |
| ATT&CK Techniques | 9 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0066 |
Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. (Citation: Security Affairs Elderwood Sept 2012) The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. (Citatio...
Aoqin Dragon¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government, Telecommunications, Education |
| ATT&CK Techniques | 9 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1007 |
Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association bet...
IndigoZebra¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 7 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0136 |
IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)
Winnti Group¶
| Attribution | China |
| Also known as | Blackfly |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 6 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0044 |
Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015) Some reporting suggests a number of other g...
Mofang¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government, Military, Critical Infrastructure |
| ATT&CK Techniques | 6 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0103 |
Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weap...
Suckfly¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 5 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0039 |
Suckfly is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)
RedEcho¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Critical Infrastructure |
| ATT&CK Techniques | 5 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1042 |
RedEcho is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. RedEcho overlaps with various other PRC-linked threat groups, such as APT41, and is linked to [ShadowPad](https://attack.mitre.or...
APT12¶
| Attribution | China |
| Also known as | IXESHE, DynCalc, Numbered Panda, DNSCALC |
| Status | }Active |
| Primary Targets | Government, Media |
| ATT&CK Techniques | 5 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0005 |
APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)
TA459¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 5 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0062 |
TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. (Citation: Proofpoint TA459 April 2017)
Putter Panda¶
| Attribution | China / PLA |
| Also known as | APT2, MSUpdater |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 4 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0024 |
Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). (Citation: CrowdStrike Putter Panda)
Strider¶
| Attribution | China |
| Also known as | ProjectSauron |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 3 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0041 |
Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)
APT30¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 2 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0013 |
APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.(Citation: FireEye APT30)(Citation: Baumgartner Golovkin Naikon 2015)
PittyTiger¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 2 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0011 |
PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)
APT17¶
| Attribution | China |
| Also known as | Deputy Dog |
| Status | }Active |
| Primary Targets | Government, Defence, Technology |
| ATT&CK Techniques | 2 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0025 |
APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)
Scarlet Mimic¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 1 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0029 |
Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and [Putter Panda](...
APT16¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 1 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0023 |
APT16 is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)
Moafee¶
| Attribution | China |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 1 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0002 |
Moafee is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group DragonOK. (Citation: Haq 2014)
Iran¶
Magic Hound¶
| Attribution | Iran |
| Also known as | TA453, COBALT ILLUSION, Charming Kitten, ITG18 |
| Status | }Active |
| Primary Targets | Government, Military, Healthcare |
| ATT&CK Techniques | 79 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0059 |
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), ...
OilRig¶
| Attribution | Iran |
| Also known as | COBALT GYPSY, IRN2, APT34, Helix Kitten |
| Status | }Active |
| Primary Targets | Government, Financial, Energy, Telecommunications |
| ATT&CK Techniques | 76 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0049 |
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to...
MuddyWater¶
| Attribution | Iran / MOIS |
| Also known as | Earth Vetala, MERCURY, Static Kitten, Seedworm |
| Status | }Active |
| Primary Targets | Government, Defence, Telecommunications |
| ATT&CK Techniques | 58 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0069 |
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecomm...
APT39¶
| Attribution | Iran / MOIS |
| Also known as | ITG07, Chafer, Remix Kitten |
| Status | }Active |
| Primary Targets | Telecommunications |
| ATT&CK Techniques | 53 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0087 |
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and a...
Fox Kitten¶
| Attribution | Iran |
| Also known as | UNC757, Parisite, Pioneer Kitten, RUBIDIUM |
| Status | }Active |
| Primary Targets | Government, Defence, Healthcare, Technology |
| ATT&CK Techniques | 41 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0117 |
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense,...
APT42¶
| Attribution | Iran |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 31 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1044 |
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.(Citation: Mandiant APT42-charms) The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.(Citation: Mandiant APT42-charms) APT42 starts cyb...
APT33¶
| Attribution | Iran |
| Also known as | HOLMIUM, Elfin, Peach Sandstorm |
| Status | }Active |
| Primary Targets | Energy |
| ATT&CK Techniques | 31 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0064 |
APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)
Agrius¶
| Attribution | Iran / MOIS |
| Also known as | Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 22 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1030 |
Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.(Citation: SentinelOne Agrius 2021)(Citation: CheckPoint Agrius 2023) Public reporting has linked Agrius to Iran's Ministry of Intelligence and Securit...
CURIUM¶
| Attribution | Iran |
| Also known as | Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc |
| Status | }Active |
| Primary Targets | Media |
| ATT&CK Techniques | 19 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1012 |
CURIUM is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.(Citation: Symantec Tortoiseshell 2019) CURIUM has since invested in building relationships with potential targets via social media over a period of months to e...
Leafminer¶
| Attribution | Iran |
| Also known as | Raspite |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 17 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0077 |
Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. (Citation: Symantec Leafminer July 2018)
Silent Librarian¶
| Attribution | Iran / IRGC |
| Also known as | TA407, COBALT DICKENS |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 13 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0122 |
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at th...
Moses Staff¶
| Attribution | Iran |
| Also known as | DEV-0500, Marigold Sandstorm |
| Status | }Active |
| Primary Targets | Government, Energy |
| ATT&CK Techniques | 12 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1009 |
Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.(Ci...
CopyKittens¶
| Attribution | Iran |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 8 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0052 |
CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.(Citation: ClearSky CopyKittens March 2017)(Citation: ClearSky Wilted Tulip July 2017)(Citat...
POLONIUM¶
| Attribution | Iran / MOIS |
| Also known as | Plaid Rain |
| Status | }Active |
| Primary Targets | Defence, Technology |
| ATT&CK Techniques | 7 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1005 |
POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Ira...
Ajax Security Team¶
| Attribution | Iran |
| Also known as | Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten |
| Status | }Active |
| Primary Targets | Defence |
| ATT&CK Techniques | 6 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0130 |
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship techno...
Ferocious Kitten¶
| Attribution | Iran |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 6 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0137 |
Ferocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Cleaver¶
| Attribution | Iran |
| Also known as | Threat Group 2889, TG-2889 |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 5 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0003 |
Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)
Group5¶
| Attribution | Iran |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 4 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0043 |
Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), ...
Vietnam¶
APT32¶
| Attribution | Vietnam |
| Also known as | SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 78 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0050 |
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web comprom...
India¶
Patchwork¶
| Attribution | India (suspected) |
| Also known as | Hangover Group, Dropping Elephant, Chinastrats, MONSOON |
| Status | }Active |
| Primary Targets | Government, Diplomatic |
| ATT&CK Techniques | 41 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0040 |
Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of t...
SideCopy¶
| Attribution | India (suspected) |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government |
| ATT&CK Techniques | 16 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G1008 |
SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat g...
Transparent Tribe¶
| Attribution | India (suspected) |
| Also known as | COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM |
| Status | }Active |
| Primary Targets | Defence, Diplomatic |
| ATT&CK Techniques | 14 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0134 |
Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021)
Unknown¶
TA505¶
| Attribution | Unknown |
| Also known as | Hive0065, Spandex Tempest, CHIMBORAZO |
| Status | }Active |
| Primary Targets | Multiple sectors |
| ATT&CK Techniques | 34 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0092 |
TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofp...
Darkhotel¶
| Attribution | Unknown |
| Also known as | DUBNIUM, Zigzag Hail |
| Status | }Active |
| Primary Targets | Defence |
| ATT&CK Techniques | 24 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0012 |
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing cam...
Pakistan¶
The White Company¶
| Attribution | Pakistan |
| Also known as | None listed |
| Status | }Active |
| Primary Targets | Government, Military |
| ATT&CK Techniques | 7 known techniques |
| Australia Relevance | APAC-relevant based on MITRE ATT&CK attribution and targeting data. |
| MITRE Reference | G0089 |
The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)
Total APAC-relevant groups tracked: 105
Data sourced from MITRE ATT&CK Enterprise and enriched with Australian-specific context.