Name Guesses

How Good Are the Guesses

The method was scored on 64 names whose answer a source already lists, each with its own entry hidden. The label was right for 45 of them.

70% of labels were right

• This method 70%
• Name shape only 73%
• Always "actor" 69%

The method is 2 points above the answer that always gives the most common label, and 3 points below a version that uses only the shape of the name. The names are few, so a gap of a few points is within noise. No guess reaches the High band.

Confidence

Each actor or malware guess carries a confidence: the share of scored names with a similar score that the method labelled correctly, using a calibration made without that name. High means 0.85 or more and medium means 0.70 or more. A band is used only when enough scored names reached it. A guess that would fall in a band that is not used is shown one band lower, with its confidence held just under that band's threshold. A guess that rests on no measured signal is always low.

By Label

Precision is the share of names given a label that truly carry it. Recall is the share of names that truly carry the label and were given it. No known name is labelled tool or not an entity in enough numbers to test, so guesses with those labels are shown as unvalidated and carry no confidence.

Confusion

Rows are the known label and columns are the label the method gave.

Matches to a Known Actor

For a name labelled actor, the method also looks for the closest known actor. Of the 44 known actor names, 27 have another name in the registry that a match could find. A kind of match is shown on a guess only when it was right at least half the time here.

Signals

A signal is one thing the program checks about a name. A signal is kept only when the model does worse without it. The model separates actor from malware. In a guess, a positive weight supports it and a negative weight argues against it.

• cluster_id kept

  The name follows a numbered cluster pattern such as UNC1234 or APT-C-15.

  fires on 7, mostly actor, right 100%, pushes toward actor, strength 0.9

  Kept: the model does worse without it.

• vendor_suffix kept

  The name ends in a vendor naming word such as Panda, Bear or Team, or starts with Water.

  fires on 4, mostly actor, right 100%, pushes toward actor, strength 0.7

  Kept: the model does worse without it.

• malware_word kept

  The name ends in a word that usually names malware, such as RAT, Spy or Loader.

  fires on 3, mostly malware, right 100%, pushes toward malware, strength 1.0

  Kept: the model does worse without it.

• actor_resemblance kept

  The name is a close spelling of, or contains, the name of a known actor.

  fires on 7, mostly actor, right 100%, pushes toward actor, strength 0.8

  Kept: the model does worse without it.

• software_resemblance kept

  The name is a close spelling of the name of known malware or a known tool.

  fires on 4, mostly malware, right 75%, pushes toward malware, strength 0.8

  Kept: the model does worse without it.

• cooc_actor kept

  The paper lists the name in the same report row as an actor the resolver knows.

  fires on 3, mostly malware, right 100%, pushes toward malware, strength 1.1

  Kept: the model does worse without it.

• cve_actor dropped

  A report that uses the name cites a rare CVE that other reports tie to a known actor.

  fires on 9, mostly actor, right 89%

  Dropped: removing it did not make the model worse.

• non_latin dropped

  The name is written in a script other than Latin.

  fires on 0

  Dropped: it fires on fewer than 3 ground-truth names, too few to measure.

• title_malware_ctx dropped

  Report titles write the name next to a word for malware, as in 'Name stealer' or 'Name ransomware'.

  fires on 6, mostly malware, right 67%

  Dropped: removing it did not make the model worse.

• title_actor_ctx dropped

  Report titles write the name next to a word for an actor, as in 'Name threat actor' or 'Name APT'.

  fires on 10, mostly actor, right 80%

  Dropped: removing it did not make the model worse.

• exact_name_listed not measured

  Every ground-truth name is labeled because a source lists it, so leaving that source out removes the signal, and keeping it would make the test circular. A guess that rests on it is shown as unvalidated.

Limitations

• The ground truth has fewer than 10 names labeled tool or not-an-entity, so guesses with those labels are shown as unvalidated.
• The ground-truth names are ones that a source lists, so they are better known than a typical unresolved name.
• Signals were chosen on the same 64 names that score them, so the figures are likely a little optimistic. Confidence is calibrated without each name in turn, which removes a second source of the same bias.
• No guess is shown as high confidence. The band needs at least 20 held-out names with 85% or more right, and 15 qualified, of which 15 were right.
• No guess is shown as medium confidence. The band needs at least 20 held-out names with 70% or more right, and 15 qualified, of which 15 were right.
• Three fixed rules set some labels without any measurement: a placeholder word such as "unclassified", the word "operation" or "campaign", and an alias that a source lists for an actor and never for software. Those guesses are shown as unvalidated.
• Names that differ only by a suffix or a plural can look like the same actor when they are not. A proposed actor is a lead to check, not an identification.

The Guesses

95 names resolve to no actor, the most often seen first.

The bar is measured confidence, from 0 to 100%. Ticks mark the Medium (70%) and High (85%) thresholds.

1. Winnti Umbrella 592 reports

   Actor Low, 69% pending confirmation

   Evidence (1)

   • The name contains 'Winnti', the distinctive part of 'Winnti Group', a name of the actor Winnti Group. +0.7 supports the guess
2. Operation Armageddon 24 reports

   Not an entity Unvalidated pending confirmation

   Evidence (2)

   • The name begins or ends with 'operation' or 'campaign', which names an operation, not an actor. context only
   • The name matches the actor Star Blizzard (as 'Armageddon') after removing the word 'operation'. context only
3. COBALT GIPSY 19 reports

   Actor Low, 69% pending confirmation

   Evidence (1)

   • The name contains 'Cobalt', the distinctive part of 'Cobalt Group', a name of the actor Cobalt Group. +0.7 supports the guess
4. Kimsuki 19 reports

   Actor Low, 31% pending confirmation

   Evidence (2)

   • The name is 1 edit away from 'Kimsuky', a name of the actor Kimsuky. +0.7 supports the guess
   • The name is 1 edit away from 'Kimsuky', a malware listed by Malpedia. -0.7 argues against it
5. Timberworm 19 reports

   Actor Unvalidated pending confirmation

   Evidence (2)

   • MISP, ETDA and Malpedia list this exact name as an actor alias. context only
   • The name ends in 'worm', a word that usually names malware. -1.0 argues against it
6. nso group 5 reports

   Actor Low, 69% pending confirmation

   Evidence (4)

   • The name uses the vendor naming word 'group', which appears in names of tracked groups. +0.7 supports the guess
   • A report that uses this name cites CVE-2016-4655, which the dataset's other reports tie to Stealth Falcon. context only
   • 7 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
   • 38 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
7. LOTUS PANDA 4 reports

   Actor Unvalidated pending confirmation

   Evidence (2)

   • MISP, ETDA, Malpedia and Microsoft list this exact name as an actor alias. context only
   • The name uses the vendor naming word 'panda', which appears in names of tracked groups. +0.7 supports the guess
8. grand theft auto panda 3 reports

   Actor Low, 69% pending confirmation

   Evidence (2)

   • The name uses the vendor naming word 'panda', which appears in names of tracked groups. +0.7 supports the guess
   • A report that uses this name cites CVE-2012-1856, which the dataset's other reports tie to Patchwork. context only
9. Oktropys 3 reports

   Actor Low, 67% pending confirmation

   Evidence (1)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
10. uac-0056 3 reports

    Actor Unvalidated pending confirmation

    Evidence (3)

    • ATT&CK, MISP, ETDA and Malpedia list this exact name as an actor alias. context only
    • The name follows the cluster-ID pattern UAC-<number>, which vendors use for groups they track by number. +0.9 supports the guess
    • 4 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
11. chessmaster 2 reports

    Actor Low, 67% pending confirmation

    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • A report that uses this name cites CVE-2017-5689, which the dataset's other reports tie to Lazarus Group. context only
12. iron group 2 reports

    Actor Unvalidated pending confirmation

    Evidence (2)

    • MISP, ETDA and Malpedia list this exact name as an actor alias. context only
    • The name uses the vendor naming word 'group', which appears in names of tracked groups. +0.7 supports the guess
13. kovcoreg 2 reports

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
14. newsbeef 2 reports

    Actor Unvalidated pending confirmation

    Evidence (1)

    • MISP, ETDA and Malpedia list this exact name as an actor alias. context only
15. outlaw 2 reports

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
16. shadow force 2 reports

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
17. Sphinx (APT-C-15) 2 reports

    Actor Low, 69% pending confirmation

    Closest known actor: Sphinx

    Evidence (1)

    • The name matches the actor Sphinx (as 'Sphinx') after taking the part outside the brackets. +0.8 supports the guess
18. thrip 2 reports

    Actor Unvalidated pending confirmation

    Evidence (1)

    • ATT&CK, MISP, ETDA and Malpedia list this exact name as an actor alias. context only
19. 3ve 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
20. 85th gtsss 1 report

    Malware Low, 31% pending confirmation

    Evidence (2)

    • A report in the paper's dataset lists this name together with APT28. +1.1 supports the guess
    • A report that uses this name cites CVE-2020-0688, which the dataset's other reports tie to Threat Group-3390. context only
21. a 공격 그룹 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
22. a41apt 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
23. aleksandr 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
24. appin security group 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'group', which appears in names of tracked groups. +0.7 supports the guess
25. apt sidewinder 1 report

    Actor Low, 31% pending confirmation

    Closest known actor: Sidewinder

    Evidence (2)

    • The name matches the actor Sidewinder (as 'Sidewinder') after removing the leading 'apt'. +0.8 supports the guess
    • The name matches the malware 'SideWinder' listed by Malpedia after removing the leading 'apt'. -0.8 argues against it
26. apt-c-01 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name follows the cluster-ID pattern APT-C-NN, which vendors use for groups they track by number. +0.9 supports the guess
27. apt-c-47 1 report

    Actor Low, 69% pending confirmation

    Evidence (2)

    • The name follows the cluster-ID pattern APT-C-NN, which vendors use for groups they track by number. +0.9 supports the guess
    • The name is 1 edit away from 'APT-K-47', a name of the actor Mysterious Elephant. +0.7 supports the guess
28. apt-c-59 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name follows the cluster-ID pattern APT-C-NN, which vendors use for groups they track by number. +0.9 supports the guess
29. black mafia 1 report

    Actor Low, 31% pending confirmation

    Evidence (1)

    • The name is 2 edits away from 'BlackMagic', a malware listed by Malpedia. -0.6 argues against it
30. black peace 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
31. blackenergy gang 1 report

    Actor Low, 31% pending confirmation

    Closest known actor: Sandworm Team

    Evidence (2)

    • The name matches the actor Sandworm Team (as 'BlackEnergy (Group)') after removing the word 'gang'. +0.8 supports the guess
    • The name matches the malware 'BlackEnergy' listed by ATT&CK and Malpedia after removing the word 'gang'. -0.8 argues against it
32. blue termit 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name is 1 edit away from 'Blue Termite', a name of the actor Blue Termite. +0.7 supports the guess
33. c-23 1 report

    Actor Low, 67% pending confirmation

    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
34. c.rufus security team 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'team', which appears in names of tracked groups. +0.7 supports the guess
35. clouddragon 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
36. cosmic banker 1 report

    Malware Low, 31% pending confirmation

    Evidence (1)

    • The name ends in 'banker', a word that usually names malware. +1.0 supports the guess
37. edbitss 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
38. emotet gang 1 report

    Actor Low, 31% pending confirmation

    Evidence (1)

    • The name matches the malware 'Emotet' listed by ATT&CK and Malpedia after removing the word 'gang'. -0.8 argues against it
39. fhappi 1 report

    Actor Low, 67% pending confirmation

    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • A report that uses this name cites CVE-2014-6271, which the dataset's other reports tie to Threat Group-3390. context only
40. french intelligence 1 report

    Actor Low, 67% pending confirmation

    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • A report that uses this name cites CVE-2011-4369, which the dataset's other reports tie to SNOWGLOBE. context only
41. gholee6 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
42. ghost dragon 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
43. great 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
44. hafnuim 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name is 1 edit away from 'HAFNIUM', a name of the actor HAFNIUM. +0.7 supports the guess
45. inception attackers 1 report

    Actor Low, 69% pending confirmation

    Closest known actor: Inception

    Evidence (2)

    • The name matches the actor Inception (as 'Inception') after removing the word 'attackers'. +0.8 supports the guess
    • A report that uses this name cites CVE-2012-1856, which the dataset's other reports tie to APT30. context only
46. isis-linked hackers 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
47. jolly roger’s patrons 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
48. kelvinsecurityteam 1 report

    Actor Low, 69% pending confirmation

    Evidence (2)

    • The name uses the vendor naming word 'team', which appears in names of tracked groups. +0.7 supports the guess
    • A report that uses this name cites CVE-2019-11510, which the dataset's other reports tie to APT29. context only
49. keyboys 1 report

    Actor Low, 31% pending confirmation

    Closest known actor: Tropic Trooper

    Evidence (2)

    • The name matches the actor Tropic Trooper (as 'KeyBoy') after removing a plural 's'. +0.8 supports the guess
    • The name matches the malware 'KeyBoy' listed by ATT&CK and Malpedia after removing a plural 's'. -0.8 argues against it
50. king kong elephant 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'elephant', which appears in names of tracked groups. +0.7 supports the guess
51. leery turtle 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
52. lucky elephant 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'elephant', which appears in names of tracked groups. +0.7 supports the guess
53. luminousmoth 1 report

    Actor Unvalidated pending confirmation

    Evidence (2)

    • ATT&CK, MISP, ETDA, Malpedia and Microsoft list this exact name as an actor alias. context only
    • 3 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
54. mirrorthief 1 report

    Actor Low, 67% pending confirmation

    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • A report that uses this name cites CVE-2019-2215, which the dataset's other reports tie to Sidewinder. context only
55. mykings 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
56. negg 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
57. nilephish 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
58. operation falcon 1 report

    Not an entity Unvalidated pending confirmation

    Evidence (1)

    • The name begins or ends with 'operation' or 'campaign', which names an operation, not an actor. context only
59. operation kingphish 1 report

    Not an entity Unvalidated pending confirmation

    Evidence (1)

    • The name begins or ends with 'operation' or 'campaign', which names an operation, not an actor. context only
60. operation oceansalt 1 report

    Not an entity Unvalidated pending confirmation

    Evidence (2)

    • The name begins or ends with 'operation' or 'campaign', which names an operation, not an actor. context only
    • The name matches the malware 'OceanSalt' listed by ATT&CK and Malpedia after removing the word 'operation'. context only
61. operation transparent tribe 1 report

    Not an entity Unvalidated pending confirmation

    Evidence (2)

    • The name begins or ends with 'operation' or 'campaign', which names an operation, not an actor. context only
    • The name matches the actor Transparent Tribe (as 'Transparent Tribe') after removing the word 'operation'. context only
62. ozie team 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'team', which appears in names of tracked groups. +0.7 supports the guess
63. praying mantis 1 report

    Actor Low, 69% pending confirmation

    Evidence (2)

    • The name contains 'Mantis', a name of the actor APT-C-23. +0.7 supports the guess
    • A report that uses this name cites CVE-2019-18935, which the dataset's other reports tie to Blue Mockingbird. context only
64. quantum ransomware 1 report

    Malware Low, 69% pending confirmation

    Evidence (2)

    • The name ends in 'ransomware', a word that usually names malware. +1.0 supports the guess
    • A report in the paper's dataset lists this name together with Play. +1.1 supports the guess
65. raqqah 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
66. reconhellcat 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
67. red hacker alliance 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
68. redoctober 1 report

    Actor Low, 67% pending confirmation

    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
69. right sector 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
70. romcom threat actor 1 report

    Actor Low, 69% pending confirmation

    Closest known actor: RomCom

    Evidence (1)

    • The name matches the actor RomCom (as 'RomCom') after removing the words 'actor' and 'threat'. +0.8 supports the guess
71. russian gru 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
72. sectora05 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
73. sectorb06 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
74. shadow chaser 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
75. shiqiang 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
76. shun wang technologies 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
77. silverhawk 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
78. soraj bear 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'bear', which appears in names of tracked groups. +0.7 supports the guess
79. sun team folder 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
80. sunshop digital quartermaster 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name contains 'Sunshop', the distinctive part of 'Sunshop Group', a name of the actor APT19. +0.7 supports the guess
81. tag-26 1 report

    Actor Low, 69% pending confirmation

    Evidence (2)

    • The name follows the cluster-ID pattern TAG-<number>, which vendors use for groups they track by number. +0.9 supports the guess
    • The name is 1 edit away from 'ATG26', a name of the actor Turla. +0.6 supports the guess
82. tarh andishan 1 report

    Actor Unvalidated pending confirmation

    Evidence (1)

    • MISP, ETDA and Malpedia list this exact name as an actor alias. context only
83. teleport crew 1 report

    Actor Low, 31% pending confirmation

    Evidence (1)

    • The name matches the malware 'Teleport' listed by Malpedia after removing the word 'crew'. -0.8 argues against it
84. TopHat 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
85. uac-0098 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name follows the cluster-ID pattern UAC-<number>, which vendors use for groups they track by number. +0.9 supports the guess
86. ucid902 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
87. unc2727 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name follows the cluster-ID pattern UNC<number>, which vendors use for groups they track by number. +0.9 supports the guess
88. unclassified 1 report

    Not an entity Unvalidated pending confirmation

    Evidence (2)

    • The name is a placeholder word such as 'unclassified', not a name. context only
    • A report that uses this name cites CVE-2010-2568, which the dataset's other reports tie to APT28. context only
89. valkyrie-x security research group 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'group', which appears in names of tracked groups. +0.7 supports the guess
90. water kappa 1 report

    Actor Low, 69% pending confirmation

    Evidence (2)

    • The name uses the vendor naming word 'water', which appears in names of tracked groups. +0.7 supports the guess
    • A report that uses this name cites CVE-2020-1380, which the dataset's other reports tie to APT37. context only
91. water pamola 1 report

    Actor Low, 69% pending confirmation

    Evidence (1)

    • The name uses the vendor naming word 'water', which appears in names of tracked groups. +0.7 supports the guess
92. zebra2104 1 report

    Actor Low, 67% pending confirmation

    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • A report that uses this name cites CVE-2021-40444, which the dataset's other reports tie to APT28. context only
93. عقارب ليبيا 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
94. 伪猎者apt组织 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
95. 海莲花 1 report

    Actor Low, 67% pending confirmation

    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only

Seen in Titles

Not actors. These are phrases that report titles repeat. No source lists them as an actor, and none appears as one anywhere else on this site.

A phrase that 3 or more titles repeat, from 2 or more publishers, may be a name the sources have not caught up with. This list holds 130 such phrases, found in 29,406 titles. Each phrase goes through the same guesser as the names above, so every label is a guess.

A publisher is the organization a report lists, or the website it links to when none is listed. Only titles this site already shows are read, and nothing else from a report is used.

1. RedLine 58 reports from 27 publishers

   Actor Low, 67% pending confirmation

   Seen 2016-06-20 to 2026-04-07

   • 2016 1
   • 2020 6
   • 2021 8
   • 2022 27
   • 2023 7
   • 2026 9
   Example titles (3)

   • U.S. Joins International Action Against RedLine and META Infostealers 2026-04-07
   • RedLine/Vidar Abuses EV Certificates, Shifts to Ransomware 2026-04-06
   • Tackling Anti-Analysis Techniques of GuLoader and RedLine Stealer 2026-04-06
   Evidence (2)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
   • 46 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
2. Basta 57 reports from 28 publishers

   Actor Low, 67% pending confirmation

   Seen 2022-04-26 to 2026-04-09

   • 2022 30
   • 2023 4
   • 2024 6
   • 2025 12
   • 2026 5
   Example titles (3)

   • Black Basta and the Unnoticed Delivery 2026-04-09
   • Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike 2026-04-06
   • Black basta Ransomware Goes Cross-Platform, Now Targets ESXi Systems 2026-04-06
   Evidence (2)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
   • 30 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
3. NSO 53 reports from 19 publishers

   Actor Low, 67% pending confirmation

   Seen 2016-08-24 to 2026-05-01

   • 2016 2
   • 2018 2
   • 2020 4
   • 2021 26
   • 2022 4
   • 2023 2
   • 2026 13
   Example titles (3)

   • Finland says it found NSO's Pegasus spyware on diplomats' phones 2026-05-01
   • Dusting off Old Fingerprints: NSO Group's Unknown MMS Hack 2026-04-06
   • Moroccan Journalist Targeted With Network Injection Attacks Using NSO Group’s Tools 2026-04-06
   Evidence (4)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
   • A report that uses this name cites CVE-2016-4655, which the dataset's other reports tie to Stealth Falcon. context only
   • 7 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
   • 38 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
4. Lumma 36 reports from 26 publishers

   Actor Low, 67% pending confirmation

   Seen 2023-02-27 to 2026-04-23

   • 2023 5
   • 2024 9
   • 2025 11
   • 2026 11
   Example titles (3)

   • Lumma Infostealer – Down but Not Out? 2026-04-23
   • Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer 2026-04-07
   • Lumma Stealer’s GitHub-Based Delivery Explored via Managed Detection and Response 2026-04-06
   Evidence (2)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
   • 28 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
5. ClickFix 27 reports from 21 publishers

   Actor Low, 31% pending confirmation

   Seen 2024-10-17 to 2026-09-08

   • 2024 2
   • 2025 12
   • 2026 13
   Example titles (3)

   • ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2 Cisco Talos, 2026-09-08
   • A ClickFix cluster: Observed activity from recent ClickFix campaigns 2026-08-24
   • SmartApeSG ClickFix Campaign Delivers Unknown RAT 2026-08-05
   Evidence (2)

   • The name is 1 edit away from 'IClickFix', a malware listed by Malpedia. -0.7 argues against it
   • 2 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
6. QuickNote 27 reports from 3 publishers

   Actor Low, 67% pending confirmation

   Seen 2021-08-04 to 2026-07-21

   • 2021 2
   • 2022 12
   • 2023 7
   • 2024 5
   • 2026 1
   Example titles (3)

   • [QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis 2026-07-21
   • [QuickNote] Uncovering Suspected Malware Distributed By Individuals from Vietnam 2023-04-08
   • [QuickNote] Analysis of malware suspected to be an APT attack targeting Vietnam VinCSS, 2022-01-26
   Evidence (1)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
7. Quasar 26 reports from 13 publishers

   Actor Low, 67% pending confirmation

   Seen 2017-01-30 to 2026-05-04

   • 2017 4
   • 2018 3
   • 2019 1
   • 2020 2
   • 2021 1
   • 2022 4
   • 2023 3
   • 2024 1
   • 2026 7
   Example titles (3)

   • Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities 2026-05-04
   • GitHub - quasar/Quasar: Remote Administration Tool for Windows 2026-04-06
   • Quasar Open-Source Remote Administration Tool | CISA 2026-04-06
   Evidence (2)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
   • 17 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
8. Rabbit 21 reports from 8 publishers

   Actor Low, 67% pending confirmation

   Seen 2017-08-24 to 2026-04-29

   • 2017 10
   • 2018 2
   • 2019 1
   • 2021 2
   • 2022 3
   • 2024 1
   • 2026 2
   Example titles (3)

   • Down the Rabbit Hole of Unicode Obfuscation | Veracode 2026-04-29
   • Pulling Linux Rabbit/Rabbot Malware Out of a Hat 2026-04-06
   • Inside the Rabbit Hole: BunnyLoader 3.0 Unveiled 2024-03-15
   Evidence (2)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
   • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
9. Orcus 16 reports from 8 publishers

   Actor Low, 67% pending confirmation

   Seen 2016-07-21 to 2026-04-06

   • 2016 4
   • 2017 2
   • 2019 3
   • 2022 2
   • 2023 2
   • 2026 3
   Example titles (3)

   • Orcus – Birth of an unusual plugin builder RAT 2026-04-06
   • A Peculiar Case of Orcus RAT Targeting Bitcoin Investors 2026-04-06
   • New Campaign Delivers Orcus RAT 2026-04-06
   Evidence (2)

   • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
   • 13 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
10. Revenge 15 reports from 10 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-03-15 to 2026-04-09

    • 2017 2
    • 2019 1
    • 2020 3
    • 2021 1
    • 2022 1
    • 2024 2
    • 2026 5
    Example titles (3)

    • Revenge telecom hacking by DESORDEN Group; third attack threatened - DataBreaches.Net 2026-04-09
    • Fileless Revenge RAT Malware - ASEC 2026-04-06
    • Revenge RAT (Malware Family) 2026-04-06
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 10 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
11. LummaC2 14 reports from 10 publishers

    Actor Low, 67% pending confirmation

    Seen 2023-01-06 to 2026-04-06

    • 2023 8
    • 2024 1
    • 2025 1
    • 2026 4
    Example titles (3)

    • LummaC2 Malware Distributed Disguised as Total Commander Crack 2026-04-06
    • Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations | CISA 2026-04-06
    • Obfuscated PowerShell leads to Lumma C2 Stealer 2026-04-06
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 8 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
12. Nokoyawa 14 reports from 6 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-03-09 to 2023-05-22

    • 2022 10
    • 2023 4
    Example titles (3)

    • IcedID Macro Ends in Nokoyawa Ransomware The DFIR Report, 2023-05-22
    • IcedID Macro Ends in Nokoyawa Ransomware 2023-05-22
    • Nevada Ransomware, Nokoyawa Variant | ThreatLabz 2023-03-06
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 10 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
13. Gh0st 13 reports from 9 publishers

    Actor Low, 67% pending confirmation

    Seen 2011-07-27 to 2025-08-05

    • 2011 1
    • 2012 1
    • 2015 2
    • 2018 4
    • 2020 1
    • 2023 2
    • 2024 1
    • 2025 1
    Example titles (3)

    • Lost in Translation: Threat Actors Use SEO Poisoning and Fake DeepL Sites to Distribute Gh0st RAT 2025-08-05
    • Analysis of Nood RAT Used in Attacks Against Linux (Gh0st RAT’s Variant) - ASEC 2024-02-19
    • Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release 2023-04-24
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 10 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
14. Mimic 12 reports from 9 publishers

    Actor Low, 67% pending confirmation

    Seen 2016-01-24 to 2026-04-06

    • 2016 4
    • 2022 2
    • 2023 2
    • 2024 2
    • 2026 2
    Example titles (3)

    • Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists 2026-04-06
    • Scarlet Mimic - Threat Group Cards: A Threat Actor Encyclopedia 2026-04-06
    • Trigona Ransomware Threat Actor Uses Mimic Ransomware 2024-01-30
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
15. PrintNightmare 11 reports from 6 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-08-11 to 2022-06-30

    • 2021 7
    • 2022 4
    Example titles (3)

    • Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit 2022-06-30
    • Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit 2022-06-30
    • Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability | CISA 2022-03-15
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
16. OverWatch 10 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-09-17 to 2022-05-11

    • 2021 5
    • 2022 5
    Example titles (3)

    • Proactive Threat Hunting Bears Fruit- Falcon OverWatch Detects Novel IceApple Post-Exploitation Framework 2022-05-11
    • Falcon OverWatch Contributes to BlackCat Protection | CrowdStrike 2022-03-23
    • Falcon OverWatch Threat Hunting Contributes to Seamless Protection Against Novel BlackCat Attack 2022-03-23
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
17. Campo 9 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-03-21 to 2021-08-05

    • 2021 9
    Example titles (3)

    • Prometheus TDS The key to success for Campo Loader, Hancitor, IcedID, and QBot 2021-08-05
    • Campo, a New Attack Campaign Targeting Japan - Mal-Eats 2021-05-11
    • Campo Loader - Simple but effective 2021-03-30
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 5 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
18. Spring4Shell 9 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-03-31 to 2022-04-20

    • 2022 9
    Example titles (3)

    • Analyzing Attempts to Exploit the Spring4Shell Vulnerability CVE-2022-22965 to Deploy Cryptocurrency Miners 2022-04-20
    • Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware 2022-04-08
    • CVE-2022-22965 Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware 2022-04-08
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
19. Eternity 9 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-05-12 to 2022-10-05

    • 2022 9
    Example titles (3)

    • Analysis of LilithBot Malware and Eternity Threat Group | Zscaler 2022-10-05
    • Analysis of LilithBot Malware and Eternity Threat Group 2022-10-05
    • Eternity malware kit offers stealer, miner, worm, ransomware tools 2022-05-12
    Evidence (3)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 5 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
    • 3 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
20. Injector 9 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-10-09 to 2026-04-06

    • 2017 2
    • 2019 2
    • 2021 2
    • 2023 1
    • 2026 2
    Example titles (3)

    • GitHub - ryhanson/phishery: An SSL Enabled Basic Auth Credential Harvester with a Word Document Template URL Injector 2026-04-06
    • OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan 2026-04-06
    • DotRunPEX - Demystifying New Virtualized .NET Injector used in the Wild 2023-03-15
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
21. WizardOpium 9 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-11-01 to 2020-06-03

    • 2019 5
    • 2020 4
    Example titles (3)

    • The WizardOpium LPE- Exploiting CVE-2019-1458 2020-06-03
    • The zero-day exploits of Operation WizardOpium 2020-05-28
    • The zero-day exploits of Operation WizardOpium _ Securelist Kaspersky, 2020-05-28
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
22. SecurityScorecard 9 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-06-18 to 2026-04-06

    • 2021 1
    • 2022 5
    • 2024 1
    • 2025 1
    • 2026 1
    Example titles (3)

    • Inside a North Korean Phishing Operation Targeting DevOps Employees - SecurityScorecard 2026-04-06
    • SecurityScorecard Discovers new botnet, ‘Zhadnost,’ responsible for Ukraine DDoS attacks 2022-03-10
    • Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign - SecurityScorecard 2025-01-29
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
23. Colibri 8 reports from 5 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-02-13 to 2022-11-30

    • 2022 8
    Example titles (3)

    • Unpacking Colibri Loader- A Russian APT linked Campaign 2022-11-30
    • Unpacking Colibri Loader: A Russian APT linked Campaign BitSight, 2022-11-30
    • Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique 2022-04-05
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 8 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
24. Netfilter 8 reports from 5 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-03-20 to 2025-05-19

    • 2021 7
    • 2025 1
    Example titles (3)

    • Reversing a Microsoft-Signed Rootkit: The Netfilter Driver 2025-05-19
    • Fast Insights for a Microsoft-Signed Netfilter Rootkit 2021-08-10
    • Fast Insights for a Microsoft-Signed Netfilter Rootkit 2021-08-10
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 6 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
25. BackConnect 8 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-11-21 to 2025-12-10

    • 2017 1
    • 2022 4
    • 2023 1
    • 2025 2
    Example titles (3)

    • Latrodectus BackConnect 2025-12-10
    • Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal 2025-03-03
    • Inside the IcedID BackConnect Protocol (Part 2) 2023-07-28
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
26. ChessMaster 8 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-07-27 to 2018-03-29

    • 2017 4
    • 2018 4
    Example titles (3)

    • ChessMaster Adds Updated Tools to Its Arsenal 2018-03-29
    • ChessMaster Adds Updated Tools to Its Arsenal 2018-03-29
    • ChessMaster Adds Updated Tools to Its Arsenal - TrendLabs Security Intelligence Blog ESET, 2018-03-29
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • A report that uses this name cites CVE-2017-5689, which the dataset's other reports tie to Lazarus Group. context only
27. CryptXXX 8 reports from 4 publishers

    Actor Low, 31% pending confirmation

    Seen 2016-05-05 to 2016-08-10

    • 2016 8
    Example titles (3)

    • CryptXXX - CrypMIC – intensywnie dystrybuowany ransomware w ramach exploit-kitów 2016-08-10
    • CryptXXX \ CrypMIC – intensywnie dystrybuowany ransomware w ramach exploit-kitów 2016-08-10
    • Malware-Traffic-Analysis.net - 2016-05-09 - pseudo-Darkleech Angler EK from 185.118.66[.]154 sends Bedep/CryptXXX ransomware 2016-05-09
    Evidence (2)

    • The name is 1 edit away from 'CryptXXXX', a malware listed by Malpedia. -0.7 argues against it
    • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
28. Trouble 8 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2020-09-24 to 2026-04-06

    • 2020 3
    • 2021 3
    • 2026 2
    Example titles (3)

    • Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger 2026-04-06
    • Trouble in Paradise 2026-04-06
    • Trouble in Asia and the Middle East. Tracking the TransparentTribe threat actor. 2021-10-13
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
29. Bandit 7 reports from 6 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-10-24 to 2023-07-31

    • 2019 2
    • 2022 1
    • 2023 4
    Example titles (3)

    • Bandit Stealer Garbled 2023-07-31
    • Breaking into the Bandit Stealer Malware Infrastructure 2023-07-11
    • Bandit Stealer | ThreatLabz 2023-06-03
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
30. Strela 7 reports from 6 publishers

    Actor Low, 67% pending confirmation

    Seen 2014-11-12 to 2026-04-06

    • 2014 1
    • 2023 1
    • 2024 1
    • 2025 3
    • 2026 1
    Example titles (3)

    • Strela Stealer Today's Invoice Tomorrow’s Phish 2026-04-06
    • Detour Dog: DNS Malware Powers Strela Stealer Campaigns 2025-09-30
    • Hive0145 back in German inboxes with Strela Stealer and a backdoor 2025-07-10
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 7 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
31. Spook 7 reports from 5 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-10-05 to 2026-04-06

    • 2021 4
    • 2022 2
    • 2026 1
    Example titles (3)

    • eSentire vs. Phantom: Unveiling the Cyber Spook's Dance of Darkness 2026-04-06
    • The story of a ransomware builder- from Thanos to Spook and beyond (Part 1) 2022-02-17
    • The story of a ransomware builder: from Thanos to Spook and beyond (Part 1) 2022-02-17
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
32. InPage 7 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2016-11-23 to 2018-11-29

    • 2016 2
    • 2017 4
    • 2018 1
    Example titles (3)

    • Analysis Of Targeted Attack Against Pakistan By Exploiting InPage Vulnerability And Related APT Groups 2018-11-29
    • Recent InPage Exploits Lead to Multiple Malware Families 2017-11-02
    • Recent InPage Exploits Lead to Multiple Malware Families Palo Alto, 2017-11-02
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
33. Maui 7 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-07-06 to 2026-04-06

    • 2022 6
    • 2026 1
    Example titles (3)

    • North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector | CISA 2026-04-06
    • Andariel deploys DTrack and Maui ransomware 2022-08-09
    • Andariel deploys DTrack and Maui ransomware 2022-08-09
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 7 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
34. Oski 7 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-01-07 to 2022-02-01

    • 2021 5
    • 2022 2
    Example titles (3)

    • Mars Stealer Oski refactoring 2022-02-01
    • Mars Stealer: Oski refactoring 2022-02-01
    • Oski Stealer : A Credential Theft Malware 2021-01-16
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 5 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
35. BlackNET 7 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2019-12-25 to 2026-04-06

    • 2019 1
    • 2020 4
    • 2021 1
    • 2026 1
    Example titles (3)

    • Dark Side Of BlackNET RAT 2026-04-06
    • Github Repository- BlackNET 3.7.0.1 2021-01-13
    • Fake "Corona Antivirus" distributes BlackNET remote administration tool | Malwarebytes Labs 2020-03-23
    Evidence (2)

    • The name is 1 edit away from 'BackNet', a malware listed by Malpedia. -0.7 argues against it
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
36. Hermetic 6 reports from 5 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-02-25 to 2026-04-06

    • 2022 5
    • 2026 1
    Example titles (3)

    • Hermetic Wiper Malware Report - CYFIRMA 2026-04-06
    • Hermetic Malware: Multi-component Threat Targeting Ukraine Organizations 2022-03-04
    • Technical Analysis of The Hermetic Wiper Malware Used to Target Ukraine 2022-03-03
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 6 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
37. RATatouille 6 reports from 5 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-08-28 to 2025-06-06

    • 2019 4
    • 2025 2
    Example titles (3)

    • RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise) 2025-06-06
    • RATatouille: Cooking Up Chaos in the I2P Kitchen 2025-02-11
    • Malicious ratatouille ?????? 2019-09-07
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
38. HCrypt 6 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-03-16 to 2022-01-23

    • 2021 4
    • 2022 2
    Example titles (3)

    • HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET 2022-01-23
    • HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET 2022-01-23
    • Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads 2021-09-20
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
39. InSideCopy 6 reports from 4 publishers

    Actor Low, 69% pending confirmation

    Seen 2021-07-02 to 2021-07-07

    • 2021 6
    Example titles (3)

    • InSideCopy- How this APT continues to evolve its arsenal 2021-07-07
    • InSideCopy: How this APT continues to evolve its arsenal 2021-07-07
    • InSideCopy: How this APT continues to evolve its arsenal Cisco, 2021-07-07
    Evidence (1)

    • The name is 2 edits away from 'SideCopy', a name of the actor SideCopy. +0.6 supports the guess
40. Parallax 6 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2020-02-13 to 2023-02-28

    • 2020 4
    • 2023 2
    Example titles (3)

    • Cryptocurrency Entities at Risk- Threat Actor Uses Parallax RAT for Infiltration 2023-02-28
    • Parallax RAT: Cryptocurrency Entities Affected by Threat Actor Exploit 2023-02-28
    • Parallax: The New RAT on the Block 2020-03-18
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
41. ADSelfService 6 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-09-08 to 2021-11-08

    • 2021 6
    Example titles (3)

    • Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus 2021-11-08
    • Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer PaloAlto, 2021-11-07
    • Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer 2021-11-07
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
42. Haron 6 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2021-05-10 to 2021-09-07

    • 2021 6
    Example titles (3)

    • Decoding SmartAssembly strings, a Haron ransomware case study 2021-09-07
    • BlackMatter & Haron- Evil Ransomware Newborns or Rebirths 2021-07-28
    • BlackMatter & Haron: Evil Ransomware Newborns or Rebirths 2021-07-28
    Evidence (2)

    • The name is 1 edit away from 'Charon', a malware listed by Malpedia. -0.6 argues against it
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
43. Mischa 6 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2016-05-19 to 2016-12-15

    • 2016 6
    Example titles (3)

    • Goldeneye Ransomware - the Petya/Mischa combo rebranded | Malwarebytes Labs 2016-12-15
    • Goldeneye Ransomware – the Petya-Mischa combo rebranded 2016-12-15
    • Inside Petya and Mischa ransomware 2016-09-20
    Evidence (2)

    • The name is 1 edit away from 'Misha', a malware listed by Malpedia. -0.6 argues against it
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
44. Rorschach 6 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2023-04-04 to 2023-04-19

    • 2023 6
    Example titles (3)

    • Rorschach Ransomware Analysis with Attack Flow 2023-04-19
    • Rorschach Ransomware Analysis with Attack Flow 2023-04-19
    • Rorschach – A New Sophisticated and Fast Ransomware 2023-04-04
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
45. CyberThreatIntel 6 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-10-10 to 2021-03-27

    • 2019 1
    • 2020 4
    • 2021 1
    Example titles (3)

    • CyberThreatIntel/Additional Analysis/Terraloader/2021-03-25/Analysis.md at master · StrangerealIntel/CyberThreatIntel 2021-03-27
    • CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel Github (StrangerealIntel), 2020-10-11
    • CyberThreatIntel/Additional Analysis/UnknownTA/2020-09-07/Analysis.md at master · StrangerealIntel/CyberThreatIntel 2020-09-07
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
46. StrangerealIntel 6 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-10-10 to 2021-03-27

    • 2019 1
    • 2020 4
    • 2021 1
    Example titles (3)

    • CyberThreatIntel/Additional Analysis/Terraloader/2021-03-25/Analysis.md at master · StrangerealIntel/CyberThreatIntel 2021-03-27
    • CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel Github (StrangerealIntel), 2020-10-11
    • CyberThreatIntel/Additional Analysis/UnknownTA/2020-09-07/Analysis.md at master · StrangerealIntel/CyberThreatIntel 2020-09-07
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
47. NukeSped 5 reports from 5 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-06-22 to 2026-04-06

    • 2021 3
    • 2026 2
    Example titles (3)

    • A Deep-Dive Analysis of the NukeSped RATs 2026-04-06
    • Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC 2026-04-06
    • Lazarus-%EA%B7%B8%EB%A3%B9%EC%9D%98-NukeSped-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf AhnLab, Inc., 2021-11-10
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
48. Castling 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-03-21 to 2026-04-06

    • 2022 4
    • 2026 1
    Example titles (3)

    • Operation Dragon Castling: APT group targeting betting companies 2026-04-06
    • Operation Dragon Castling- APT group targeting betting companies 2022-03-22
    • Operation Dragon Castling: APT group targeting betting companies Avast, 2022-03-22
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
49. DarkCloud 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2018-03-06 to 2025-03-31

    • 2018 2
    • 2022 1
    • 2023 1
    • 2025 1
    Example titles (3)

    • DarkCloud 2025-03-31
    • DarkCloud Infostealer Being Distributed via Spam Emails 2023-05-23
    • DarkCloud Stealer Triage 2022-10-01
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
50. DCSync 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2026-04-06 to 2026-08-06

    • 2026 5
    Example titles (3)

    • Mimikatz and DCSync and ExtraSids, Oh My 2026-08-06
    • GitHub - shellster/DCSYNCMonitor: Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events. 2026-04-06
    • Mimikatz and DCSync and ExtraSids, Oh My 2026-04-06
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
51. InterPlanetary 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-06-11 to 2023-06-28

    • 2019 2
    • 2020 2
    • 2023 1
    Example titles (3)

    • Charming Kitten Updates POWERSTAR with an InterPlanetary Twist 2023-06-28
    • Threat Spotlight: New InterPlanetary Storm variant targeting IoT devices 2020-10-01
    • Threat Spotlight- New InterPlanetary Storm variant targeting IoT devices 2020-10-01
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
52. KovCoreG 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-10-01

    • 2019 5
    Example titles (3)

    • New Fileless Botnet Novter Distributed by KovCoreG Malvertising Campaign Trend Micro, 2019-10-01
    • Fileless Botnet Novter Spread Via KovCoreG Campaign 2019-10-01
    • New Fileless Botnet Novter Distributed by KovCoreG Malvertising Campaign 2019-10-01
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
53. PRB 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2018-05-12 to 2018-06-19

    • 2018 5
    Example titles (3)

    • Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor - TrendLabs Security Intelligence Blog 2018-06-19
    • Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor 2018-06-14
    • Potential MuddyWater Campaign uses PRB-Backdoor 2018-06-14
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 5 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
54. PureLogs 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2025-07-02 to 2026-07-27

    • 2025 3
    • 2026 2
    Example titles (3)

    • PureLogs, PureRAT and misleading zgRAT 2026-07-27
    • Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis 2026-01-19
    • Dissecting-a-new-malspam-chain-delivering-Purelogs-infostealer.pdf 2025-11-25
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
55. React2Shell 5 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2025-12-04 to 2025-12-19

    • 2025 5
    Example titles (3)

    • Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell) 2025-12-19
    • EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2 2025-12-16
    • Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) 2025-12-12
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
56. FreeMilk 5 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-10-05 to 2018-10-03

    • 2017 3
    • 2018 2
    Example titles (3)

    • APT37- Final1stspy Reaping the FreeMilk 2018-10-03
    • APT37 Final1stspy Reaping the FreeMilk Intezer, 2018-10-03
    • FreeMilk: A Highly Targeted Spear Phishing Campaign 2017-10-05
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
57. HUI 5 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2018-12-01 to 2023-08-02

    • 2018 1
    • 2022 3
    • 2023 1
    Example titles (3)

    • HUI Loader — Malware Analysis Note 2023-08-02
    • BRONZE STARLIGHT Ransomware Operations Use HUI Loader 2022-06-23
    • HUI Loaderの分析 - JPCERT/CC Eyes 2022-05-16
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
58. PowerFall 5 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2020-08-12 to 2020-09-02

    • 2020 5
    Example titles (3)

    • Operation PowerFall- CVE-2020-0986 and variants 2020-09-02
    • Operation PowerFall: CVE-2020-0986 and variants 2020-09-02
    • Internet Explorer and Windows zero-day exploits used in Operation PowerFall _ Securelist Kaspersky, 2020-08-12
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
59. SockDetour 5 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-02-24 to 2022-02-25

    • 2022 5
    Example titles (3)

    • New -SockDetour- Fileless, Socketless Backdoor Targets U.S. Defense Contractors 2022-02-25
    • SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors 2022-02-24
    • SockDetour Backdoor Targets U.S. Defense Contractors palo alto networks, 2022-02-24
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
60. TrickBoot 5 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2020-12-03 to 2026-04-06

    • 2020 3
    • 2021 1
    • 2026 1
    Example titles (3)

    • Supermicro, Pulse Secure release fixes for 'TrickBoot' attacks 2026-04-06
    • TrickBot’s Survival Instinct Prevails — What’s Different About the TrickBoot Version- 2021-01-26
    • TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf 2020-12-04
    Evidence (1)

    • The name is 1 edit away from 'TrickBot', a malware listed by ATT&CK and Malpedia. -0.7 argues against it
61. CuckooBees 5 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-05-04 to 2026-04-06

    • 2022 4
    • 2026 1
    Example titles (3)

    • Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation 2026-04-06
    • Operation CuckooBees- Deep-Dive into Stealthy Winnti Techniques 2022-05-04
    • Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques 2022-05-04
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
62. Xtreme 5 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2012-06-21 to 2017-08-02

    • 2012 3
    • 2015 1
    • 2017 1
    Example titles (3)

    • Malspam delivers Xtreme RAT 8-1-2017 2017-08-02
    • Malware.lu - Xtreme RAT analysis 2012-07-22
    • Colombians major target of email campaigns delivering Xtreme RAT 2015-12-03
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 5 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
63. Yanbian 5 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2018-11-26 to 2021-04-07

    • 2018 4
    • 2021 1
    Example titles (3)

    • Yanbian Gang Malware Continues with Wide-Scale Distribution and C2 2021-04-07
    • Examining XLoader, FakeSpy, and the Yanbian Gang 2018-11-26
    • Examining XLoader, FakeSpy, and the Yanbian Gang 2018-11-26
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 5 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
64. DCShadow 4 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-08-15 to 2026-04-06

    • 2022 2
    • 2026 2
    Example titles (3)

    • GitHub - shellster/DCSYNCMonitor: Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events. 2026-04-06
    • Détecter DCShadow, impossible ? 2026-04-06
    • DCShadow Attacks: Detecting a Rogue Domain Controller 2022-08-15
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
65. HackingTeam 4 reports from 4 publishers

    Actor Low, 69% pending confirmation

    Seen 2014-04-21 to 2018-01-16

    • 2014 1
    • 2018 3
    Example titles (3)

    • Skygofree: Following in the footsteps of HackingTeam 2018-01-16
    • Skygofree- Following in the footsteps of HackingTeam 2018-01-16
    • Skygofree_ Following in the footsteps of HackingTeam - Securelist Kaspersky, 2018-01-16
    Evidence (1)

    • The name uses the vendor naming word 'team', which appears in names of tracked groups. +0.7 supports the guess
66. KeyBoys 4 reports from 4 publishers

    Actor Low, 31% pending confirmation

    Possibly the same as Tropic Trooper

    Seen 2017-11-02 to 2026-04-06

    • 2017 3
    • 2026 1
    Example titles (3)

    • The KeyBoys are back in town 2026-04-06
    • The KeyBoys are back in town 2017-11-03
    • The KeyBoys are back in town PWC, 2017-11-02
    Evidence (2)

    • The name matches the actor Tropic Trooper (as 'KeyBoy') after removing a plural 's'. +0.8 supports the guess
    • The name matches the malware 'KeyBoy' listed by ATT&CK and Malpedia after removing a plural 's'. -0.8 argues against it
67. MacProStorage02 4 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2018-02-01 to 2019-06-25

    • 2018 1
    • 2019 3
    Example titles (3)

    • MacProStorage02:_2019CLF:Bitdefender-Whitepaper-Hard-creat3095-A4-v2-en_EN:Bitdefender-Whitepaper-Hard-creat3095-A4-v2-en_EN.indd Bitdefender Brand Department € Dan-Mihai Iorgulescu-Stavri, 2019-06-25
    • MacProStorage02:_Final:Bitdefender-WhitePaper-APTBluePrint-CREAT3496-31M1416s-en_EN:Bitdefender-WhitePaper-APTBluePrint-CREAT3496-31M1416s-en_EN.indd Bitdefender € Dan-Mihai Iorgulescu-Stavri, 2019-06-04
    • MacProStorage02:_2019CLF:Bitdefender-Whitepaper-Hard-creat3095-A4-v2-en_EN:Bitdefender-Whitepaper-Hard-creat3095-A4-v2-en_EN.indd 2019-04-12
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
68. MuddyC3 4 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-06-25 to 2021-01-13

    • 2019 1
    • 2020 1
    • 2021 2
    Example titles (3)

    • Reviving MuddyC3 Used by MuddyWater (IRAN) APT 2021-01-13
    • Reviving MuddyC3 Used by MuddyWater (IRAN) APT 2021-01-13
    • Reviving MuddyC3 Used by MuddyWater (IRAN) APT Shells.Systems, 2020-01-13
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
69. PupyRAT 4 reports from 4 publishers

    Malware Low, 31% pending confirmation

    Seen 2017-02-15 to 2020-01-23

    • 2017 3
    • 2020 1
    Example titles (3)

    • European Energy Sector Organization Targeted by PupyRAT Malware in Late 2019 2020-01-23
    • Iranian PupyRAT Bites Middle Eastern Organizations | SecureWorks 2017-02-28
    • Iranian PupyRAT Bites Middle Eastern Organizations 2017-02-15
    Evidence (1)

    • The name ends in 'rat', a word that usually names malware. +1.0 supports the guess
70. Shady 4 reports from 4 publishers

    Actor Low, 31% pending confirmation

    Seen 2011-08-08 to 2026-04-06

    • 2011 1
    • 2013 1
    • 2026 2
    Example titles (3)

    • Operation Shady RAT - Threat Group Cards: A Threat Actor Encyclopedia 2026-04-06
    • Operation Shady RAT 2026-04-06
    • Shady RAT Vanity Fair, 2013-09-25
    Evidence (2)

    • The name is 1 edit away from 'Shade', a malware listed by Malpedia. -0.6 argues against it
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
71. SneakyPastes 4 reports from 4 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-04-10 to 2026-04-06

    • 2019 3
    • 2026 1
    Example titles (3)

    • Gaza Cybergang Group1, operation SneakyPastes 2026-04-06
    • The Gaza cybergang and its SneakyPastes campaign 2019-04-10
    • The Gaza cybergang and its SneakyPastes campaign 2019-04-10
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
72. BadUSB 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2020-09-01 to 2026-04-06

    • 2020 1
    • 2023 1
    • 2026 2
    Example titles (3)

    • FBI: FIN7 hackers target US companies with BadUSB devices to install ransomware 2026-04-06
    • Rare BadUSB attack detected in the wild against US hospitality provider 2026-04-06
    • Forensic Log-Based Detection of Keystroke Injection BadUSB Attacks 2023-02-10
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
73. BlackWater 4 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2019-05-20 to 2026-04-06

    • 2019 2
    • 2020 1
    • 2026 1
    Example titles (3)

    • BlackWater Malware Abuses Cloudflare Workers for C2 Communication 2026-04-06
    • BlackWater Malware Leveraging Beirut Tragedy in New Targeted Campaign 2020-08-07
    • Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques 2019-05-20
    Evidence (2)

    • The name is 2 edits away from 'BlackMatter', a malware listed by Malpedia. -0.6 argues against it
    • 2 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
74. Clandestine Wolf 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2015-06-23 to 2015-07-05

    • 2015 4
    Example titles (3)

    • Operation Clandestine Wolf FireEye, 2015-07-05
    • Operation Clandestine Wolf — Adobe Flash Zero-Day in APT3 Phishing Campaign | Mandiant 2015-06-23
    • Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign 2015-06-23
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
75. Cobian 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-08-31 to 2017-09-01

    • 2017 4
    Example titles (3)

    • Vxer is offering Cobian RAT in the underground, but it is backdoored 2017-09-01
    • Vxer is offering Cobian RAT in the underground, but it is backdoored 2017-09-01
    • Cobian RAT – A backdoored RAT | Zscaler 2017-08-31
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
76. EITest 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-01-17 to 2017-09-01

    • 2017 4
    Example titles (3)

    • EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware 2017-09-01
    • EITest- HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware 2017-09-01
    • Malware-Traffic-Analysis.net - 2017-01-17 - EITest Rig-V from 92.53.127[.]86 sends Spora ransomware 2017-01-17
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
77. FakeSecurity 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-11-08 to 2020-12-09

    • 2019 1
    • 2020 3
    Example titles (3)

    • The footprints of Raccoon_ a story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer 2020-12-09
    • Massive malicious campaign by FakeSecurity JS-sniffer 2020-12-07
    • Massive malicious campaign by FakeSecurity JS-sniffer Microsoft, 2019-11-08
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
78. IPfuscation 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-03-29 to 2022-03-30

    • 2022 4
    Example titles (3)

    • Hive ransomware uses new 'IPfuscation' trick to hide payload 2022-03-30
    • Hive ransomware uses new 'IPfuscation' trick to hide payload 2022-03-30
    • From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection 2022-03-29
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
79. LagTime 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2019-07-23 to 2020-11-26

    • 2019 1
    • 2020 3
    Example titles (3)

    • Actor behind Operation LagTime targets Russia 2020-11-26
    • Actor behind Operation LagTime targets Russia 2020-11-26
    • VB2020 paper: Operation LagTime IT: colourful Panda footprint 2020-09-30
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
80. Lime 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2018-08-27 to 2026-04-06

    • 2018 1
    • 2019 2
    • 2026 1
    Example titles (3)

    • njRAT Pushes Lime Ransomware & Bitcoin Stealer |Zscaler Blog 2026-04-06
    • GitHub - NYAN-x-CAT/Lime-RAT: LimeRAT | Simple, yet powerful remote administration tool for Windows (RAT) 2019-06-24
    • Lime Downloader v4.2 2019-05-12
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
81. PetitPotam 4 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2021-08-20 to 2026-04-06

    • 2021 3
    • 2026 1
    Example titles (3)

    • PetitPotam Attack Chain Can Compromise Windows Domains Running AD CS | Rapid7 Blog 2026-04-06
    • Detecting and Hunting for the PetitPotam NTLM Relay Attack 2021-09-23
    • LockFile: Ransomware Uses PetitPotam Exploit to Compromise Windows Domain Controllers 2021-08-20
    Evidence (1)

    • The name is 2 edits away from 'PetitPotato', a malware listed by Malpedia. -0.6 argues against it
82. Prynt 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-04-21 to 2022-09-01

    • 2022 4
    Example titles (3)

    • No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed 2022-09-01
    • Prynt Stealer’s Backdoor Exposed | Zscaler Blog 2022-09-01
    • Cyble - Prynt Stealer Spotted In The Wild 2022-04-21
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
83. ServiceDesk 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-12-02

    • 2021 4
    Example titles (3)

    • APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus | CISA 2021-12-02
    • APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus 2021-12-02
    • Alert (AA21-336A)- APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus 2021-12-02
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
84. SmoothOperator 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2023-03-29 to 2023-04-01

    • 2023 4
    Example titles (3)

    • SmoothOperator 2023-04-01
    • Malware-Analysis/SmoothOperator/SmoothOperator.md at main · dodo-sec/Malware-Analysis 2023-04-01
    • 3CX SmoothOperator | 3CXDesktopApp in Supply Chain Attack 2023-03-29
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
85. SSHBearDoor 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2016-01-03 to 2026-04-06

    • 2016 3
    • 2026 1
    Example titles (3)

    • BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry 2026-04-06
    • BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry 2016-01-06
    • BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry ESET, 2016-01-03
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
86. TopHat 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2018-01-26 to 2026-04-06

    • 2018 3
    • 2026 1
    Example titles (3)

    • The TopHat Campaign: Attacks Within The Middle East Region Using Popular Third-Party Services 2026-04-06
    • unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services Palo Alto, 2018-01-26
    • The TopHat Campaign- Attacks Within The Middle East Region Using Popular Third-Party Services 2018-01-26
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
87. Water Pamola 4 reports from 3 publishers

    Actor Low, 69% pending confirmation

    Seen 2021-04-28 to 2022-04-04

    • 2021 3
    • 2022 1
    Example titles (3)

    • Confirmation of damage to domestic e-commerce sites, actual situation of Web skimming attacks and examples of countermeasures that Rack thinks (Water Pamola) 2022-04-04
    • Water Pamola Attacked Online Shops Via Malicious Orders Trend Micro, 2021-04-28
    • Water Pamola Attacked Online Shops Via Malicious Orders 2021-04-28
    Evidence (1)

    • The name uses the vendor naming word 'water', which appears in names of tracked groups. +0.7 supports the guess
88. Xeno 4 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2024-02-23 to 2024-07-06

    • 2024 4
    Example titles (3)

    • GitHub - moom825/xeno-rat: Xeno-RAT is an open-source remote access tool (RAT) developed in C#, providing a comprehensive set of features for remote system management. Has features such as HVNC, live microphone, reverse proxy, and much much more! 2024-07-06
    • Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub 2024-06-25
    • Xeno RAT: A New Remote Access Trojan with Advance Capabilities - CYFIRMA 2024-02-23
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
89. Avos 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-12-22 to 2026-04-06

    • 2021 1
    • 2022 2
    • 2026 1
    Example titles (3)

    • Avos ransomware group expands with new attack arsenal 2026-04-06
    • Avos ransomware group expands with new attack arsenal 2022-06-21
    • Avos ransomware group expands with new attack arsenal 2022-06-21
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
90. BlueCrab 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-01-28 to 2021-02-01

    • 2021 4
    Example titles (3)

    • BlueCrab ransomware, CobaltStrike hacking tool installed in corporate environment 2021-02-01
    • BlueCrab 랜섬웨어, 기업 환경에서는 CobaltStrike 해킹툴 설치 - ASEC 2021-02-01
    • 지속적으로 탐지 우회를 시도 중인 BlueCrab 랜섬웨어 - ASEC 2021-01-28
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 2 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
91. Haskers 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-04-14

    • 2022 4
    Example titles (3)

    • -Haskers Gang- Introduces New ZingoStealer 2022-04-14
    • Threat Spotlight: "Haskers Gang" Introduces New ZingoStealer 2022-04-14
    • Threat Spotlight: "Haskers Gang" Introduces New ZingoStealer 2022-04-14
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
92. LemonCat 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2021-07-22 to 2021-07-29

    • 2021 4
    Example titles (3)

    • When coin miners evolve, Part 2- Hunting down LemonDuck and LemonCat attacks 2021-07-29
    • When coin miners evolve, Part 2: Hunting down LemonDuck and LemonCat attacks 2021-07-29
    • When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure | Microsoft Security Blog 2021-07-22
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
93. PlainSight 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2023-01-26 to 2023-01-29

    • 2023 4
    Example titles (3)

    • Hiding In PlainSight - Indirect Syscall is Dead! Long Live Custom Call Stacks 2023-01-29
    • Hiding In PlainSight - Indirect Syscall is Dead! Long Live Custom Call Stacks 2023-01-29
    • Hiding In PlainSight - Proxying DLL Loads To Hide From ETWTI Stack Tracing 2023-01-26
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
94. Rehashed 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2017-09-05 to 2026-04-06

    • 2017 2
    • 2026 2
    Example titles (3)

    • Rehashed RAT Used in APT Campaign Against Vietnamese Organizations 2026-04-06
    • Rehashed RAT Used in APT Campaign Against Vietnamese Organizations 2017-09-05
    • Rehashed RAT Used in APT Campaign Against Vietnamese Organizations 2026-04-06
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 4 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
95. ShortAndMalicious 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-11-08 to 2023-09-19

    • 2022 2
    • 2023 2
    Example titles (3)

    • #ShortAndMalicious — DarkGate 2023-09-19
    • ShortAndMalicious- StrelaStealer aims for mail credentials 2022-11-08
    • #ShortAndMalicious — PikaBot and the Matanbuchus connection 2023-02-10
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
96. TransferXL 4 reports from 2 publishers

    Actor Low, 67% pending confirmation

    Seen 2022-05-19 to 2022-05-20

    • 2022 4
    Example titles (3)

    • Bumblebee Malware from TransferXL URLs 2022-05-20
    • Bumblebee Malware from TransferXL URLs - SANS ISC 2022-05-19
    • Bumblebee Malware from TransferXL URLs 2022-05-19
    Evidence (1)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
97. Atlas RedOctober 3 reports from 3 publishers

    Actor Low, 67% pending confirmation

    Seen 2014-12-10

    • 2014 3
    Example titles (3)

    • Cloud Atlas- RedOctober APT is back in style 2014-12-10
    • Cloud Atlas: RedOctober APT is back in style - Securelist Kaspersky, 2014-12-10
    • Cloud Atlas: RedOctober APT is back in style 2014-12-10
    Evidence (2)

    • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
    • 3 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
98. CCleanup 3 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2017-09-18

    • 2017 3
    Example titles (3)

    • CCleanup- A Vast Number of Machines at Risk 2017-09-18
    • CCleanup: A Vast Number of Machines at Risk 2017-09-18
    • CCleanup Symantec, 2017-09-18
    Evidence (1)

    • The name is 1 edit away from 'CleanUp', a malware listed by Malpedia. -0.7 argues against it
99. CKing 3 reports from 3 publishers

    Actor Low, 31% pending confirmation

    Seen 2018-10-01 to 2020-05-14

    • 2018 1
    • 2020 2
    Example titles (3)

    • ATT&CKing ProLock Ransomware 2020-05-14
    • ATT&CKing ProLock Ransomware 2020-05-14
    • CDS2018-Technical-S5-ATT&CKing FIN7_The Value of Using Frameworks for Threat Intelligence-FINAL_clean 2018-10-01
    Evidence (1)

    • The name is 1 edit away from 'Cring', a malware listed by Malpedia. -0.6 argues against it
100. CryWiper 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2022-12-01 to 2026-04-06

     • 2022 2
     • 2026 1
     Example titles (3)

     • New CryWiper data wiper targets Russian courts, mayor&rsquo;s offices 2026-04-06
     • Новый троянец CryWiper прикидывается шифровальщиком 2022-12-01
     • Новый троянец CryWiper прикидывается шифровальщиком 2022-12-01
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
101. Dissident NSO 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2016-08-24 to 2026-04-06

     • 2016 2
     • 2026 1
     Example titles (3)

     • The Million Dollar Dissident: NSO Group's iPhone Zero-Days Used Against A UAE Human Rights Defender - The Citizen Lab 2026-04-06
     • The Million Dollar Dissident: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender - The Citizen Lab 2016-08-26
     • The Million Dollar Dissident: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender Citizen Lab, 2016-08-24
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
102. DRBControl 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2020-02-18

     • 2020 3
     Example titles (3)

     • Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations 2020-02-18
     • Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia 2020-02-18
     • Uncovering DRBControl- Inside the Cyberespionage Campaign Targeting Gambling Operations 2020-02-18
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
103. DriveGuard 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2022-02-15

     • 2022 3
     Example titles (3)

     • Guard Your Drive from DriveGuard- Moses Staff Campaigns Against Israeli Organizations Span Several Months 2022-02-15
     • Guard Your Drive from DriveGuard: Moses Staff Campaigns Against Israeli Organizations Span Several Months fortinet, 2022-02-15
     • Guard Your Drive from DriveGuard: Moses Staff Campaigns Against Israeli Organizations Span Several Months | FortiGuard Labs 2022-02-15
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
104. ElephantRAT 3 reports from 3 publishers

     Malware Low, 31% pending confirmation

     Seen 2021-02-01 to 2021-02-17

     • 2021 3
     Example titles (3)

     • blog.vincss.net-RE020 ElephantRAT Kunming version our latest discovered RAT of Panda and the similarities with recent 2021-02-17
     • [RE020] ElephantRAT (Kunming version)- our latest discovered RAT of Panda and the similarities with recently Smanager RAT 2021-02-17
     • VinCSS Blog_ [RE020] ElephantRAT (Kunming version)_ our latest discovered RAT of Panda and the similarities with recently Smanager RAT VinCSS, 2021-02-01
     Evidence (1)

     • The name ends in 'rat', a word that usually names malware. +1.0 supports the guess
105. FriarFox 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2021-02-25 to 2026-04-06

     • 2021 2
     • 2026 1
     Example titles (3)

     • TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organizations | Proofpoint UK 2026-04-06
     • proofpoint.com-TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organiz Microsoft, 2021-02-25
     • TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organizations 2021-02-25
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
106. KitKat 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2014-09-23 to 2026-04-06

     • 2014 2
     • 2026 1
     Example titles (3)

     • Getting Your SMS Apps Ready for KitKat 2026-04-06
     • Android malware based on SMS encryption and with KitKat support 2014-09-23
     • Android malware based on SMS encryption and with KitKat support 2014-09-23
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
107. KMSPico 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2021-12-02 to 2021-12-04

     • 2021 3
     Example titles (3)

     • Malicious KMSPico installers steal your cryptocurrency wallets 2021-12-04
     • Malicious KMSPico installers steal your cryptocurrency wallets 2021-12-04
     • KMSPico-V5.pdf 2021-12-02
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
108. Kraken Cryptor 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2018-09-14 to 2018-10-30

     • 2018 3
     Example titles (3)

     • Kraken Cryptor Ransomware Gains Popularity Among Cybercriminals 2018-10-30
     • Kraken Cryptor Ransomware Masquerading as SuperAntiSpyware Security Program 2018-09-14
     • Kraken Cryptor Ransomware Masquerading as SuperAntiSpyware Security Program 2018-09-14
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
109. MyKings 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2019-12-16 to 2021-10-12

     • 2019 1
     • 2021 2
     Example titles (3)

     • The King is Dead, Long Live MyKings! (Part 1 of 2) 2021-10-12
     • The King is Dead, Long Live MyKings! (Part 1 of 2) 2021-10-12
     • SophosLabs Uncut MyKings Report RSA, 2019-12-16
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
110. NetSupportManager 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2022-04-11 to 2026-04-06

     • 2022 2
     • 2026 1
     Example titles (3)

     • NetSupportManager RAT (Malware Family) 2026-04-06
     • eSentire | Threat Intelligence Malware Analysis | Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer 2022-04-11
     • Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer 2022-04-11
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
111. NoName 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2023-04-04 to 2024-06-27

     • 2023 2
     • 2024 1
     Example titles (3)

     • AzzaSec & NoName Join Forces: Threat To Ukraine's Allies? 2024-06-27
     • A Blog with NoName 2023-04-04
     • A Blog with NoName 2023-04-04
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
112. SCANdalous 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2020-07-13 to 2026-04-06

     • 2020 2
     • 2026 1
     Example titles (3)

     • SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant 2026-04-06
     • SCANdalous! (External Detection Using Network Scan Data and Automation) 2020-07-13
     • SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant 2020-07-13
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
113. SettingContent 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2018-07-19 to 2026-04-06

     • 2018 2
     • 2026 1
     Example titles (3)

     • The Tale of SettingContent-ms Files 2026-04-06
     • TA505 Abusing SettingContent-ms within PDF files to Distribute FlawedAmmyy RAT | Proofpoint US 2018-07-19
     • TA505 Abusing SettingContent-ms within PDF files to Distribute FlawedAmmyy RAT 2018-07-19
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
114. SpyAgent 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2022-10-11 to 2026-04-06

     • 2022 2
     • 2026 1
     Example titles (3)

     • SpyAgent malware targets crypto wallets, stealing screenshots 2026-04-06
     • The Russian SpyAgent – a Decade Later and RAT Tools Remain at Risk | Deep Instinct 2022-10-11
     • The Russian SpyAgent – a Decade Later and RAT Tools Remain at Risk 2022-10-11
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
115. StrongPity3 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2020-06-29

     • 2020 3
     Example titles (3)

     • PROMETHIUM extends global reach with StrongPity3 APT 2020-06-29
     • PROMETHIUM extends global reach with StrongPity3 APT 2020-06-29
     • Talos Blog __ Cisco Talos Intelligence Group - Comprehensive Threat Intelligence_ PROMETHIUM extends global reach with StrongPity3 APT Cisco, 2020-06-29
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
116. SugarGh0st 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2023-11-30 to 2024-06-25

     • 2023 1
     • 2024 2
     Example titles (3)

     • SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques 2024-06-25
     • SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques 2024-06-21
     • New SugarGh0st RAT targets Uzbekistan government and South Korea Cisco, 2023-11-30
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
117. Tempting Cedar 3 reports from 3 publishers

     Actor Low, 67% pending confirmation

     Seen 2018-02-21

     • 2018 3
     Example titles (3)

     • Avast tracks down Tempting Cedar Spyware 2018-02-21
     • Avast tracks down Tempting Cedar Spyware RSA, 2018-02-21
     • Avast tracks down Tempting Cedar Spyware 2018-02-21
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
118. Aura 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2025-07-29 to 2025-10-29

     • 2025 3
     Example titles (3)

     • Aura Stealer #2 beatin the obfuscation 2025-10-29
     • AURA Stealer: A Crude Clone of LummaC2 – Technical Analysis and Threat Breakdown 2025-07-29
     • Aura Stealer #1 36bytesmademelosemymind 2025-10-22
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
119. C2aaS 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2018-04-13 to 2022-08-04

     • 2018 2
     • 2022 1
     Example titles (3)

     • Attackers leveraging Dark Utilities -C2aaS- platform in malware campaigns 2022-08-04
     • Say “Cheese”: WebMonitor RAT Comes with C2-as-a-Service (C2aaS) 2018-04-13
     • Say “Cheese”- WebMonitor RAT Comes with C2-as-a-Service (C2aaS) 2018-04-13
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
120. ChainVeil 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2026-06-16 to 2026-07-17

     • 2026 3
     Example titles (3)

     • ChainVeil and ViteVenom are DPRK’s PolinRider Campaign 2026-07-17
     • Sequel to ChainVeil npm malware: ViteVenom - Checkmarx Zero 2026-07-14
     • ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey - Checkmarx 2026-06-16
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
121. ChinaZ 3 reports from 2 publishers

     Actor Low, 31% pending confirmation

     Seen 2019-01-07 to 2026-04-06

     • 2019 2
     • 2026 1
     Example titles (3)

     • ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups 2026-04-06
     • ChinaZ Revelations- Revealing ChinaZ Relationships with other Chinese Threat Actor Groups 2019-01-07
     • ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups 2019-01-07
     Evidence (1)

     • The name is 1 edit away from 'Chinad', a malware listed by Malpedia. -0.6 argues against it
122. Kardon 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2018-06-19 to 2018-06-23

     • 2018 3
     Example titles (3)

     • Malware Analysis- Kardon Loader 2018-06-23
     • Kardon Loader Looks for Beta Testers | NETSCOUT 2018-06-19
     • Kardon Loader Looks for Beta Testers 2018-06-19
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
123. M00nD3V 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2020-06-30 to 2020-07-10

     • 2020 3
     Example titles (3)

     • Deep Dive into the M00nD3V Logger | Zscaler Blog 2020-07-10
     • Deep Dive Into the M00nD3V Logger 2020-07-10
     • M00nD3v, HawkEye threat actor, sells malware after COVID-19 diagnosis 2020-06-30
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
124. MacProStorage 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2017-02-21 to 2021-05-18

     • 2017 1
     • 2019 1
     • 2021 1
     Example titles (3)

     • MacProStorage-T3:4Work:Bitdefender-PR-Whitepaper-creat4279-en_EN:Bitdefender-PR-Whitepaper-creat4279-en_EN.indd 2021-05-18
     • MacProStorage:_2017Final:Bitdefender-Whitepaper-APT-Mac-A4-en_EN:Bitdefender-Whitepaper-APT-Mac-A4-en_EN.indd Bitdefender, 2017-02-21
     • MacProStorage-T3:4Work:Bitdefender-WhitePaper-RDPA-CREA4155-en_EN:Bitdefender-WhitePaper-RDPA-CREA4155-en_EN.indd 2019-12-18
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
125. NCC 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2020-06-23 to 2026-09-04

     • 2020 1
     • 2021 1
     • 2026 1
     Example titles (3)

     • NCC Group Monthly Threat Pulse – Review of July 2026 2026-09-04
     • TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access – NCC Group Research NCC Group, 2021-11-08
     • WastedLocker_ A New Ransomware Variant Developed By The Evil Corp Group – NCC Group Research NCC Group, 2020-06-23
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for an actor, such as 'threat actor' or 'APT'. context only
126. RestyLink 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2022-05-11 to 2026-04-06

     • 2022 2
     • 2026 1
     Example titles (3)

     • Operation RestyLink: APT campaign targeting Japanese companies 2026-04-06
     • Operation RestyLink- Targeted attack campaign targeting Japanese companies 2022-05-11
     • Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン 2022-05-11
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
127. SLServer 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2016-04-18 to 2016-05-14

     • 2016 3
     Example titles (3)

     • Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaign Citizen Lab, 2016-05-14
     • Between Hong Kong and Burma_ Tracking UP007 and SLServer Espionage Campaigns - The Citizen Lab 2016-04-20
     • Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaigns - The Citizen Lab Citizen Lab, 2016-04-18
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
128. Socketless 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2022-02-24 to 2022-02-25

     • 2022 3
     Example titles (3)

     • New -SockDetour- Fileless, Socketless Backdoor Targets U.S. Defense Contractors 2022-02-25
     • SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors 2022-02-24
     • SockDetour - a Silent Fileless Socketless Backdoor - Targets US Defense Contractors 2022-02-24
     Evidence (2)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
     • 3 report titles write this name next to a word for malware, such as 'stealer' or 'loader'. context only
129. TA02 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2022-01-27

     • 2022 3
     Example titles (3)

     • Threat Advisory: STRT-TA02 - Destructive Software | Splunk 2022-01-27
     • Threat Advisory- STRT-TA02 - Destructive Software 2022-01-27
     • Threat Advisory: STRT-TA02 - Destructive Software | Splunk 2022-01-27
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only
130. ThreeDollars 3 reports from 2 publishers

     Actor Low, 67% pending confirmation

     Seen 2018-02-23

     • 2018 3
     Example titles (3)

     • OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan 2018-02-23
     • OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan 2018-02-23
     • OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan 2018-02-23
     Evidence (1)

     • No measured signal fired, so this is only the most common label in the ground truth (actor, 44 of 64 names). context only