D
Country of origin

Unattributed

77 systems in the database.

Cyber

SystemOriginCategoryAttributed sponsorActive sincePayload optionsStatus
AkiraUnattributedCybercriminal groupRansomware operation2023—Tracked
APT-C-36UnattributedUnattributed cyber threat groupSuspected South American group2018—Tracked
APT18UnattributedUnattributed cyber threat groupNot attributed by ATT&CK2009—Tracked
BackdoorDiplomacyUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2017—Tracked
BITTERUnattributedSuspected state-linked cyber threat groupSuspected South Asian group2013—Tracked
BlackByteUnattributedCybercriminal groupRansomware operation2021—Tracked
BlackOasisUnattributedSuspected state-linked cyber threat groupMiddle Eastern group; believed customer of Gamma Group——Tracked
Blue MockingbirdUnattributedCybercriminal groupCryptocurrency-mining activity cluster——Tracked
CarbanakUnattributedCybercriminal groupCybercriminal group2013—Tracked
Cobalt GroupUnattributedCybercriminal groupFinancially motivated group2016—Tracked
ConfuciusUnattributedSuspected state-linked cyber threat groupSouth Asia focus; similarities to Patchwork2013—Tracked
DarkHydrusUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2016—Tracked
DarkVishnyaUnattributedCybercriminal groupFinancially motivated group——Tracked
EquationUnattributedUnattributed cyber threat groupNot attributed by ATT&CK——Tracked
EvilnumUnattributedCybercriminal groupFinancially motivated group2018—Tracked
EXOTIC LILYUnattributedCybercriminal groupInitial access broker linked to Wizard Spider2021—Tracked
Ferocious KittenUnattributedUnattributed cyber threat groupTargets Persian-speaking individuals in Iran2015—Tracked
FIN10UnattributedCybercriminal groupFinancially motivated group2013—Tracked
FIN13UnattributedCybercriminal groupFinancially motivated group2016—Tracked
FIN4UnattributedCybercriminal groupFinancially motivated group2013—Tracked
FIN5UnattributedCybercriminal groupFinancially motivated group; members likely Russian-speaking2008—Tracked
FIN6UnattributedCybercriminal groupCybercriminal group——Tracked
FIN7UnattributedCybercriminal groupFinancially motivated group; operated front company Combi Security2013—Tracked
FIN8UnattributedCybercriminal groupFinancially motivated group2016—Tracked
GallmakerUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2017—Tracked
GCMANUnattributedCybercriminal groupFinancially motivated group——Tracked
GOLD SOUTHFIELDUnattributedCybercriminal groupOperator of REvil ransomware-as-a-service2018—Tracked
HEXANEUnattributedUnattributed cyber threat groupNot attributed by ATT&CK; TTPs similar to APT33 and OilRig2017—Tracked
INC RansomUnattributedCybercriminal groupRansomware and extortion group2023—Tracked
InceptionUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2014—Tracked
LAPSUS$UnattributedCybercriminal groupCybercriminal extortion group2021—Tracked
LazyScripterUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2018—Tracked
Lotus BlossomUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2009—Tracked
LuminousMothUnattributedSuspected state-linked cyber threat groupChinese-speaking group2020—Tracked
MacheteUnattributedSuspected state-linked cyber threat groupSuspected Spanish-speaking group2010—Tracked
Medusa GroupUnattributedCybercriminal groupRansomware-as-a-service operation2021—Tracked
MetadorUnattributedUnattributed cyber threat groupNot attributed by ATT&CK——Tracked
MoleratsUnattributedSuspected state-linked cyber threat groupArabic-speaking, politically motivated group2012—Tracked
MoustachedBouncerUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2014—Tracked
Mustard TempestUnattributedCybercriminal groupInitial access broker (SocGholish)2017—Tracked
NEODYMIUMUnattributedUnattributed cyber threat groupNot attributed by ATT&CK——Tracked
Nomadic OctopusUnattributedSuspected state-linked cyber threat groupRussian-speaking group2014—Tracked
OrangewormUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2015—Tracked
PLATINUMUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2009—Tracked
PlayUnattributedCybercriminal groupRansomware group2022—Tracked
Poseidon GroupUnattributedCybercriminal groupPortuguese-speaking group2005—Tracked
PROMETHIUMUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2012—Tracked
RancorUnattributedUnattributed cyber threat groupNot attributed by ATT&CK——Tracked
RedCurlUnattributedCybercriminal groupCorporate espionage; allegedly Russian-speaking2018—Tracked
RockeUnattributedCybercriminal groupAlleged Chinese-speaking cryptojacking group——Tracked
RTMUnattributedCybercriminal groupCybercriminal group2015—Tracked
Scarlet MimicUnattributedSuspected state-linked cyber threat groupMotivations overlap with Chinese government interests (no direct link)——Tracked
Scattered SpiderUnattributedCybercriminal groupNative English-speaking cybercriminal group2022—Tracked
ShinyHuntersUnattributedCybercriminal groupCybercriminal collective2019—Tracked
SilenceUnattributedCybercriminal groupFinancially motivated group——Tracked
SowbugUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2015—Tracked
Storm-0501UnattributedCybercriminal groupRansomware affiliate2021—Tracked
Storm-1811UnattributedCybercriminal groupLinked to Black Basta ransomware——Tracked
StriderUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2011—Tracked
TA2541UnattributedCybercriminal groupCybercriminal group2017—Tracked
TA505UnattributedCybercriminal groupCybercriminal group2014—Tracked
TA551UnattributedCybercriminal groupFinancially motivated group2018—Tracked
TA577UnattributedCybercriminal groupInitial access broker——Tracked
TA578UnattributedCybercriminal groupMalware distributor——Tracked
TeamPCPUnattributedCybercriminal groupFinancially motivated, cloud-focused group2025—Tracked
TeamTNTUnattributedCybercriminal groupCryptojacking group2019—Tracked
The GentlemenUnattributedCybercriminal groupRansomware-as-a-service operator——Tracked
The White CompanyUnattributedSuspected state-linked cyber threat groupLikely state-sponsored (sponsor not named)——Tracked
Threat Group-1314UnattributedUnattributed cyber threat groupUnattributed——Tracked
ThripUnattributedUnattributed cyber threat groupNot attributed by ATT&CK——Tracked
ToddyCatUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2020—Tracked
Tropic TrooperUnattributedUnattributed cyber threat groupUnaffiliated2011—Tracked
Velvet AntUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2021—Tracked
Water GaluraUnattributedCybercriminal groupOperators of Qilin ransomware-as-a-service2022—Tracked
WhiteflyUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2017—Tracked
WindigoUnattributedCybercriminal groupBotnet operators2011—Tracked
WindshiftUnattributedUnattributed cyber threat groupNot attributed by ATT&CK2017—Tracked