Threat Actor Profiles
Know Your Enemy
Every APT group, ransomware operation, and named campaign we've covered — with their linked CVEs prioritized by exploit probability and KEV status, IOCs, and detection rules, all in one profile instead of scattered across individual briefings.
20 tracked
FSB Center
Active1 post · last seen 7/19/2026
UAT-7810
Active1 post · last seen 7/12/2026
EtherRAT
Active1 post · last seen 7/8/2026
Armored Likho
Active1 post · last seen 7/5/2026
ShinyHunters
Active3 posts · last seen 6/28/2026
Sapphire-Sleet
Active1 post · last seen 6/24/2026
APT34 OilRig
Active1 post · last seen 6/21/2026
DragonForce
Active1 post · last seen 6/17/2026
JINX-0164
1 post · last seen 5/28/2026
The Gentlemen
1 post · last seen 5/20/2026
CyberAv3ngers
2 posts · last seen 5/17/2026
Nitrogen
1 post · last seen 5/13/2026
Water Saci
1 post · last seen 5/10/2026
UNC5221
1 post · last seen 5/3/2026
BlueNoroff
1 post · last seen 4/30/2026
BlackFile
1 post · last seen 4/27/2026
GopherWhisper
1 post · last seen 4/26/2026
Anubis
1 post · last seen 4/18/2026
UNC1069
1 post · last seen 4/10/2026
Qilin
1 post · last seen 4/8/2026
Grouped by the primary identifying tag on each post — a handful of vendor-zero-day campaigns with no attributed actor may appear as a one-post profile under a non-actor name. Profiles aggregate our own editorial coverage; they are not a claim of exhaustive threat-actor intelligence.