One group, forty-six names.

Vendors each name the same threat actor differently. APT Explorer lines up five public datasets, shows which source uses which name, and links every fact to the report it came from.

APT28, as five sources name it. A filled square means that source lists the name. The rows sample the 46 names, most widely listed first.

Name used in reports	ATT&CK	MISP	ETDA	Malpedia	Microsoft
APT28	Lists this name	Lists this name	Does not list this name	Lists this name	Lists this name
Sednit	Lists this name	Lists this name	Lists this name	Lists this name	Lists this name
Swallowtail	Lists this name	Lists this name	Lists this name	Lists this name	Does not list this name
STRONTIUM	Lists this name	Lists this name	Does not list this name	Lists this name	Lists this name
IRON TWILIGHT	Lists this name	Lists this name	Does not list this name	Lists this name	Does not list this name
ITG05	Does not list this name	Lists this name	Lists this name	Lists this name	Does not list this name
Fighting Ursa	Does not list this name	Lists this name	Lists this name	Lists this name	Does not list this name
Grey-Cloud	Does not list this name	Does not list this name	Lists this name	Lists this name	Does not list this name
LAKE RELIC	Does not list this name	Lists this name	Does not list this name	Lists this name	Does not list this name
HELLFIRE	Does not list this name	Does not list this name	Does not list this name	Lists this name	Lists this name
Iron Twilight	Does not list this name	Does not list this name	Lists this name	Does not list this name	Does not list this name
Group-4127	Does not list this name	Does not list this name	Does not list this name	Lists this name	Does not list this name

and 34 more names for this group

Ways in

Explore reports
Every report and campaign in one table you can filter by actor, source, date or CVE.
29,483 reports
Actors
One page per group: names, malware, techniques, CVEs, and the reports behind them.
1,096 actors
Trends
Which groups and techniques show up in the last two years of reporting.
Since 1 October 2024
Name guesses
Names from the paper's reports that match no known group. A program labels each one and gives a score and the evidence.
95 guesses
Sources
Where every fact comes from, what we may publish from it, and when it was last fetched.
13 sources

Where the data comes from

Source	What we use	What we publish	Terms
MITRE ATT&CK Current 5 October 2026, 1,192 records	Groups, aliases, campaigns, techniques and software.	Full	MITRE ATT&CK® Terms of Use
MISP galaxy threat-actor cluster Current 5 October 2026, 1,058 records	Actors, synonyms, origin, motive and claimed sectors.	Full	CC0 1.0
ETDA Threat Group Cards Current 16 August 2025, 503 records	Actor names, aliases and short values such as origin.	Derived facts only	CC BY-NC-SA 4.0
Malpedia Current 5 October 2026, 4,876 records	Links from actors to malware families and reports, and report dates.	Derived facts only	CC BY-NC-SA 3.0
ORKL Current 5 October 2026, 29,542 records	Report titles, dates and links. Its actor tags are used only as matching evidence.	Links only	No license stated
CISA Known Exploited Vulnerabilities Catalog Current 5 October 2026, 1,734 records	Exploited CVEs, the date each was added and the ransomware flag.	Full	CC0 1.0
The DFIR Report Current 5 October 2026, 97 records	Titles, dates and links for intrusion write-ups.	Links only	All rights reserved
Yuldoshkhujaev et al., CCS '25 dataset Current 5 October 2026, 1,509 records	Reports from 2014 to 2023, shown as a labeled layer.	Full	CC BY 4.0
Microsoft threat actor naming table Current 5 October 2026, 170 records	Microsoft's names for actors, with the aliases other vendors use and the origin it gives.	Full	CC BY 4.0
EPSS exploit prediction scores Current 5 October 2026, 382,621 records	The modeled chance that each listed CVE is exploited in the next 30 days.	Full	FIRST EPSS Usage Agreement
Cisco Talos blog Current 5 October 2026, 18 records	Titles, dates and links for Talos research posts, and the names a post says are one actor.	Derived facts only	No license stated
ESET WeLiveSecurity blog Current 5 October 2026, 24 records	Titles, dates and links for ESET blog posts, and the names a post says are one actor.	Derived facts only	No license stated
Microsoft Security blog Current 5 October 2026, 14 records	Titles, dates and links for Microsoft Security blog posts, and the names a post says are one actor.	Derived facts only	No license stated

Sources are fetched weekly. A failed fetch keeps the last good snapshot and marks the source stale. Full license table and fetch dates

Built on the dataset of Yuldoshkhujaev et al. (CCS '25). About has the full credit.