All actors

Suckfly

Also reported as APT22, BRONZE OLIVE, Group 46, Wicked Spider, APT 22 and 2 other names. Linked to China by three sources.

Reports
168
Last reported
Known CVEs
139
Techniques in ATT&CK
5
Origin
China
ID
G0039
Merge evidence
10 alias matches

Reports per quarter

  1. 2013 Q1: 1 report
  2. 2013 Q2: no reports
  3. 2013 Q3: no reports
  4. 2013 Q4: no reports
  5. 2014 Q1: no reports
  6. 2014 Q2: no reports
  7. 2014 Q3: no reports
  8. 2014 Q4: no reports
  9. 2015 Q1: 1 report
  10. 2015 Q2: no reports
  11. 2015 Q3: 2 reports
  12. 2015 Q4: no reports
  13. 2016 Q1: 3 reports
  14. 2016 Q2: 9 reports
  15. 2016 Q3: 1 report
  16. 2016 Q4: no reports
  17. 2017 Q1: no reports
  18. 2017 Q2: 4 reports
  19. 2017 Q3: no reports
  20. 2017 Q4: 2 reports
  21. 2018 Q1: 2 reports
  22. 2018 Q2: 1 report
  23. 2018 Q3: 2 reports
  24. 2018 Q4: no reports
  25. 2019 Q1: 1 report
  26. 2019 Q2: 2 reports
  27. 2019 Q3: no reports
  28. 2019 Q4: 5 reports
  29. 2020 Q1: 9 reports
  30. 2020 Q2: 3 reports
  31. 2020 Q3: 8 reports
  32. 2020 Q4: 7 reports
  33. 2021 Q1: 9 reports
  34. 2021 Q2: 4 reports
  35. 2021 Q3: 6 reports
  36. 2021 Q4: 2 reports
  37. 2022 Q1: 7 reports
  38. 2022 Q2: 15 reports
  39. 2022 Q3: 7 reports
  40. 2022 Q4: 6 reports
  41. 2023 Q1: 7 reports
  42. 2023 Q2: 3 reports
  43. 2023 Q3: 6 reports
  44. 2023 Q4: 1 report
  45. 2024 Q1: 5 reports
  46. 2024 Q2: 4 reports
  47. 2024 Q3: 3 reports
  48. 2024 Q4: 1 report
  49. 2025 Q1: 7 reports
  50. 2025 Q2: no reports
  51. 2025 Q3: 1 report
  52. 2025 Q4: 4 reports
  53. 2026 Q1: 2 reports
  54. 2026 Q2: 5 reports
Dated reports, 2013 Q1 to 2026 Q2.

Techniques seen in the last two years

Show all 38 techniques Show fewer

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

CVEs named in reports

Show all 139 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it fromORKL

Show all 168 reports Show fewer
  1. Advanced Persistent Threats (APTs)

    date in the title fromORKL

  2. yir-cyber-threats-annex-download.pdf

    Malpedia library date fromORKL

  3. Advanced Persistent Threats (APTs)

    date in the title fromORKL

  4. Mustang Panda PlugX - 45.251.240.55 Pivot

    Malpedia library date fromORKL

  5. High Value Malicious Domains.

    date in the title fromORKL

  6. PowerPoint Presentation

    file creation date Ganesan, Brittany (OS/ASA) (CTR) fromORKL

  7. Is APT 27 Abusing COVID-19 To Attack People !

    date in the CCS '25 data Yoroi fromCCS '25 data

  8. 2020.02.22_APT_threat_report_2019_CN_version

    Malpedia library date fromORKL

  9. Analytics

    Malpedia library date Positive Technologies fromORKLCCS '25 data

  10. Into the Fog - The Return of ICEFOG APT

    Malpedia library date fromORKL

  11. Advanced Persistent Threat Groups

    date in the title fromORKL

  12. APT32- New Cyber Espionage Group

    date in the title fromORKL

  13. security_report_20160613.pdf

    Malpedia library date fromORKL

  14. Suckfly APT

    date in the CCS '25 data IBM Security fromCCS '25 data

  15. Indian organizations targeted in Suckfly attacks

    date in the title fromORKL

  16. Indian organizations targeted in Suckfly attacks | Symantec Connect

    date in the CCS '25 data Symantec fromORKLCCS '25 data

  17. Indian organizations targeted in Suckfly attacks

    date in the CCS '25 data Symantec fromORKLCCS '25 data

  18. Uncovering the Seven Pointed Dagger

    Malpedia library date Arbor Networks fromORKLCCS '25 data

  19. BSI - IT Security Situation in Germany - 2014 (DE).pdf

    file creation date fromORKL

Newest first. Details opens the report in Explore.