import type { APTGroup } from '@/types'; export const APT_GROUPS: APTGroup[] = [ // === RUSSIA === { id: 'apt28', name: 'APT28', aka: 'Fancy Bear / Forest Blizzard / Sednit', sponsor: 'Russia (GRU Unit 26165)', lat: 55.75, lon: 37.6, mitreId: 'G0007', mitreUrl: 'https://attack.mitre.org/groups/G0007/', description: 'GRU-linked group active since 2004. Compromised the DNC and Hillary Clinton campaign in 2016. Targets governments, military, and defense contractors across NATO countries.', tactics: ['Initial Access', 'Persistence', 'Credential Access', 'Exfiltration'], targetSectors: ['Government', 'Defense', 'NATO', 'Energy', 'Media'], active: true, }, { id: 'apt29', name: 'APT29', aka: 'Cozy Bear / Midnight Blizzard / NOBELIUM', sponsor: 'Russia (SVR)', lat: 55.8, lon: 37.3, mitreId: 'G0016', mitreUrl: 'https://attack.mitre.org/groups/G0016/', description: 'SVR foreign intelligence group responsible for the SolarWinds supply chain compromise. Specializes in stealthy long-term access to diplomatic and government targets.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Think Tanks', 'Healthcare', 'Technology', 'Diplomatic'], active: true, }, { id: 'sandworm', name: 'Sandworm Team', aka: 'Voodoo Bear / BlackEnergy / APT44', sponsor: 'Russia (GRU Unit 74455)', lat: 55.7, lon: 37.5, mitreId: 'G0034', mitreUrl: 'https://attack.mitre.org/groups/G0034/', description: 'Most destructive nation-state actor on record. Responsible for Ukraine power grid attacks, NotPetya ($10B damages), and Olympic Destroyer. Specializes in wiper malware against critical infrastructure.', tactics: ['Initial Access', 'Execution', 'Impact', 'Defense Evasion', 'Lateral Movement'], targetSectors: ['Energy', 'Critical Infrastructure', 'Government', 'Finance', 'Transportation'], active: true, }, { id: 'turla', name: 'Turla', aka: 'Snake / Uroburos / Venomous Bear', sponsor: 'Russia (FSB)', lat: 55.75, lon: 37.62, mitreId: 'G0010', mitreUrl: 'https://attack.mitre.org/groups/G0010/', description: 'Highly sophisticated FSB group active since the 1990s. Known for hijacking satellite links for C2 and compromising other APT infrastructure to piggyback on their access.', tactics: ['Persistence', 'Command and Control', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Defense', 'Embassies', 'Research', 'Military'], active: true, }, { id: 'dragonfly', name: 'Dragonfly', aka: 'Berserk Bear / Energetic Bear / Ghost Blizzard', sponsor: 'Russia (FSB Center 16)', lat: 55.6, lon: 37.4, mitreId: 'G0035', mitreUrl: 'https://attack.mitre.org/groups/G0035/', description: 'FSB group targeting energy and ICS sectors since 2010 via supply chain, spearphishing, and drive-by attacks. Has pre-positioned for potential disruptive attacks on Western power grids.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection'], targetSectors: ['Energy', 'ICS', 'Defense', 'Aviation', 'Government'], active: true, }, { id: 'gamaredon', name: 'Gamaredon Group', aka: 'Primitive Bear / ACTINIUM / Armageddon', sponsor: 'Russia (FSB Center 18)', lat: 44.95, lon: 34.1, mitreId: 'G0047', mitreUrl: 'https://attack.mitre.org/groups/G0047/', description: 'FSB group operating from occupied Crimea targeting Ukrainian government, military, and NGOs since 2013 with high-volume, persistent campaigns.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'NGO', 'Law Enforcement'], active: true, }, { id: 'temp_veles', name: 'TEMP.Veles', aka: 'XENOTIME', sponsor: 'Russia (CNIIHM)', lat: 55.5, lon: 37.3, mitreId: 'G0088', mitreUrl: 'https://attack.mitre.org/groups/G0088/', description: 'Russia-based group that deployed TRITON malware against industrial safety systems (SIS) at a Middle East petrochemical facility — the first malware designed to directly attack safety instrumented systems.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'], targetSectors: ['Oil & Gas', 'ICS', 'Critical Infrastructure'], active: false, }, { id: 'ember_bear', name: 'Ember Bear', aka: 'Cadet Blizzard / UAC-0056 / DEV-0586', sponsor: 'Russia (GRU Unit 29155)', lat: 55.6, lon: 37.7, mitreId: 'G1003', mitreUrl: 'https://attack.mitre.org/groups/G1003/', description: 'GRU Unit 29155 responsible for WhisperGate destructive wiper attacks against Ukraine in January 2022, just weeks before the full invasion. Also targets European critical infrastructure.', tactics: ['Initial Access', 'Execution', 'Impact', 'Defense Evasion'], targetSectors: ['Government', 'Telecommunications', 'Critical Infrastructure'], active: true, }, { id: 'saint_bear', name: 'Saint Bear', aka: 'Storm-0587 / Lorec53 / TA471', sponsor: 'Russia (GRU-linked)', lat: 55.65, lon: 37.55, mitreId: 'G1031', mitreUrl: 'https://attack.mitre.org/groups/G1031/', description: 'Russian-nexus actor active since 2021 primarily targeting Ukraine and Georgia with Saint Bot RAT and OutSteel infostealer. Distinct from Ember Bear despite some overlap.', tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'NGO'], active: true, }, { id: 'star_blizzard', name: 'Star Blizzard', aka: 'SEABORGIUM / Callisto Group / COLDRIVER', sponsor: 'Russia (FSB)', lat: 59.95, lon: 30.3, mitreId: 'G1033', mitreUrl: 'https://attack.mitre.org/groups/G1033/', description: 'FSB-linked espionage and influence group active since 2019, conducting persistent phishing and credential theft against NATO governments, academia, defense, and think tanks.', tactics: ['Initial Access', 'Credential Access', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Academia', 'Defense', 'NGO', 'Think Tanks'], active: true, }, { id: 'allanite', name: 'ALLANITE', aka: 'Palmetto Fusion', sponsor: 'Russia (suspected)', lat: 55.4, lon: 37.2, mitreId: 'G1000', mitreUrl: 'https://attack.mitre.org/groups/G1000/', description: 'Suspected Russian group primarily targeting US and UK electric utility sectors. Maintains ICS access for intelligence gathering without yet exhibiting destructive capabilities.', tactics: ['Initial Access', 'Persistence', 'Collection'], targetSectors: ['Energy', 'Electric Utilities', 'ICS'], active: true, }, { id: 'indrik_spider', name: 'Indrik Spider', aka: 'Evil Corp / Manatee Tempest', sponsor: 'Russia (Criminal)', lat: 55.5, lon: 37.8, mitreId: 'G0119', mitreUrl: 'https://attack.mitre.org/groups/G0119/', description: 'Russia-based cybercriminal group behind Dridex banking trojan and multiple ransomware strains. Sanctioned by US Treasury in 2019 but continues operating under new brand names.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact', 'Exfiltration'], targetSectors: ['Finance', 'Healthcare', 'Government', 'Manufacturing'], active: true, }, { id: 'nomadic_octopus', name: 'Nomadic Octopus', aka: 'DustSquad', sponsor: 'Russia (suspected)', lat: 55.3, lon: 37.9, mitreId: 'G0133', mitreUrl: 'https://attack.mitre.org/groups/G0133/', description: 'Russian-speaking espionage group primarily targeting Central Asian governments, diplomatic missions, and individuals since 2014 using Android and Windows malware.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Diplomatic', 'NGO'], active: true, }, { id: 'inception', name: 'Inception', aka: 'Inception Framework / Cloud Atlas', sponsor: 'Russia (suspected)', lat: 55.2, lon: 37.1, mitreId: 'G0100', mitreUrl: 'https://attack.mitre.org/groups/G0100/', description: 'Cyber espionage group active since 2014 primarily targeting Russia, but also active in the US, Europe, Asia, Africa, and the Middle East across multiple industries and government entities.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Finance', 'Energy', 'Research'], active: true, }, { id: 'redcurl', name: 'RedCurl', aka: 'RedCurl', sponsor: 'Russia (suspected)', lat: 55.9, lon: 37.8, mitreId: 'G1039', mitreUrl: 'https://attack.mitre.org/groups/G1039/', description: 'Russian-speaking corporate espionage group active since 2018 targeting travel, insurance, and banking companies in Ukraine, Canada, and the UK for intellectual property and financial data theft.', tactics: ['Initial Access', 'Discovery', 'Collection', 'Exfiltration'], targetSectors: ['Travel', 'Insurance', 'Banking', 'Legal'], active: true, }, // === CHINA === { id: 'apt1', name: 'APT1', aka: 'Comment Crew / Comment Panda', sponsor: 'China (PLA Unit 61398)', lat: 31.2, lon: 121.5, mitreId: 'G0006', mitreUrl: 'https://attack.mitre.org/groups/G0006/', description: 'PLA Unit 61398 exposed by Mandiant in 2013. Conducted massive IP theft against 141 organizations over 7 years, exfiltrating terabytes of data across 20 industries.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Aerospace', 'Defense', 'Energy', 'Telecommunications', 'Manufacturing'], active: false, }, { id: 'apt3', name: 'APT3', aka: 'Gothic Panda / Buckeye / UPS Team', sponsor: 'China (MSS)', lat: 23.1, lon: 113.3, mitreId: 'G0022', mitreUrl: 'https://attack.mitre.org/groups/G0022/', description: 'MSS group responsible for Operation Clandestine Fox. Was found repurposing NSA TAO hacking tools before the Shadow Brokers leak. Shifted focus to Hong Kong political organizations by 2015.', tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Defense Evasion', 'Exfiltration'], targetSectors: ['Aerospace', 'Defense', 'Construction', 'Engineering', 'Technology'], active: false, }, { id: 'apt5', name: 'APT5', aka: 'Mulberry Typhoon / Keyhole Panda / UNC2630', sponsor: 'China (MSS)', lat: 39.9, lon: 116.3, mitreId: 'G1023', mitreUrl: 'https://attack.mitre.org/groups/G1023/', description: 'China-based espionage actor active since 2007 targeting telecoms, aerospace, and defense with advanced tradecraft and zero-day exploits against networking devices.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Telecommunications', 'Aerospace', 'Defense'], active: true, }, { id: 'apt10', name: 'menuPass', aka: 'APT10 / Stone Panda / Cicada', sponsor: 'China (MSS Tianjin)', lat: 39.1, lon: 117.2, mitreId: 'G0045', mitreUrl: 'https://attack.mitre.org/groups/G0045/', description: 'MSS group conducting Cloud Hopper — a global attack on managed service providers to gain upstream access to hundreds of client organizations simultaneously across 45+ countries.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Managed Service Providers', 'Healthcare', 'Defense', 'Aviation', 'Satellite'], active: true, }, { id: 'apt12', name: 'APT12', aka: 'IXESHE / Numbered Panda / DynCalc', sponsor: 'China', lat: 39.9, lon: 116.4, mitreId: 'G0005', mitreUrl: 'https://attack.mitre.org/groups/G0005/', description: 'China-attributed threat group targeting media outlets, high-tech companies, and multiple governments using spearphishing campaigns.', tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'], targetSectors: ['Media', 'Technology', 'Government'], active: false, }, { id: 'apt16', name: 'APT16', aka: 'APT16', sponsor: 'China', lat: 31.2, lon: 121.4, mitreId: 'G0023', mitreUrl: 'https://attack.mitre.org/groups/G0023/', description: 'China-based group that launched spearphishing campaigns targeting Japanese and Taiwanese organizations.', tactics: ['Initial Access', 'Execution', 'Collection'], targetSectors: ['Government', 'Technology'], active: false, }, { id: 'apt17', name: 'APT17', aka: 'Deputy Dog', sponsor: 'China', lat: 39.9, lon: 116.5, mitreId: 'G0025', mitreUrl: 'https://attack.mitre.org/groups/G0025/', description: 'China-based group targeting US government entities, defense industry, law firms, IT companies, mining companies, and NGOs.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Defense', 'Law Firms', 'Mining', 'NGO'], active: false, }, { id: 'apt18', name: 'APT18', aka: 'Dynamite Panda / TG-0416', sponsor: 'China', lat: 30.6, lon: 104.1, mitreId: 'G0026', mitreUrl: 'https://attack.mitre.org/groups/G0026/', description: 'Threat group active since at least 2009 targeting technology, manufacturing, human rights groups, government, and medical sectors.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Technology', 'Manufacturing', 'Healthcare', 'Government', 'Human Rights'], active: false, }, { id: 'apt19', name: 'APT19', aka: 'Codoso / C0d0so0 / Sunshop Group', sponsor: 'China', lat: 39.9, lon: 116.2, mitreId: 'G0073', mitreUrl: 'https://attack.mitre.org/groups/G0073/', description: 'Chinese group targeting defense, finance, energy, pharma, telecoms, education, manufacturing, and legal services. In 2017 targeted seven law and investment firms.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Exfiltration'], targetSectors: ['Defense', 'Finance', 'Energy', 'Pharmaceutical', 'Legal'], active: false, }, { id: 'apt30', name: 'APT30', aka: 'APT30', sponsor: 'China (suspected)', lat: 22.5, lon: 114.1, mitreId: 'G0013', mitreUrl: 'https://attack.mitre.org/groups/G0013/', description: 'Suspected Chinese government-associated group. Shares some characteristics with Naikon but appears to be a distinct entity.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Defense', 'Technology'], active: false, }, { id: 'apt32', name: 'APT32', aka: 'OceanLotus / Canvas Cyclone / BISMUTH', sponsor: 'Vietnam', lat: 21.0, lon: 105.8, mitreId: 'G0050', mitreUrl: 'https://attack.mitre.org/groups/G0050/', description: 'Suspected Vietnam-based group active since 2014 targeting foreign governments, dissidents, and journalists with strategic web compromises and a strong focus on Southeast Asia.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Media', 'Dissidents', 'Manufacturing', 'Hospitality'], active: true, }, { id: 'apt40', name: 'Leviathan', aka: 'APT40 / BRONZE MOHAWK / Gingham Typhoon', sponsor: 'China (MSS Hainan)', lat: 20.0, lon: 110.3, mitreId: 'G0065', mitreUrl: 'https://attack.mitre.org/groups/G0065/', description: 'MSS Hainan bureau group targeting maritime, naval defense, and aviation. Actively exploits newly disclosed vulnerabilities within days of publication. Indicted by US DOJ in 2021.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Naval Defense', 'Maritime', 'Aviation', 'Research', 'Government'], active: true, }, { id: 'apt41', name: 'APT41', aka: 'Double Dragon / Wicked Panda / BARIUM', sponsor: 'China (MSS)', lat: 38.0, lon: 118.0, mitreId: 'G0096', mitreUrl: 'https://attack.mitre.org/groups/G0096/', description: 'Dual-purpose Chinese group conducting state-sponsored espionage and financially motivated cybercrime. Unique in targeting healthcare and tech for IP theft alongside ransomware operations.', tactics: ['Initial Access', 'Execution', 'Privilege Escalation', 'Collection', 'Exfiltration'], targetSectors: ['Healthcare', 'Telecommunications', 'Technology', 'Finance', 'Government'], active: true, }, { id: 'hafnium', name: 'HAFNIUM', aka: 'Silk Typhoon', sponsor: 'China (MSS)', lat: 39.9, lon: 116.4, mitreId: 'G0125', mitreUrl: 'https://attack.mitre.org/groups/G0125/', description: 'Responsible for the 2021 Microsoft Exchange Server zero-day exploitation affecting 250,000+ servers globally. Targets US defense contractors, law firms, and infectious disease researchers.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Defense Evasion', 'Exfiltration'], targetSectors: ['Defense Contractors', 'Law Firms', 'Research', 'NGO', 'Government'], active: true, }, { id: 'volt_typhoon', name: 'Volt Typhoon', aka: 'Bronze Silhouette / Vanguard Panda', sponsor: 'China (PLA)', lat: 32.0, lon: 118.8, mitreId: 'G1017', mitreUrl: 'https://attack.mitre.org/groups/G1017/', description: 'Pre-positioning group focused on US critical infrastructure for potential disruption in a Taiwan conflict. Uses living-off-the-land techniques exclusively, leaving minimal forensic traces.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Command and Control', 'Impact'], targetSectors: ['Critical Infrastructure', 'Energy', 'Water', 'Telecommunications', 'Transportation'], active: true, }, { id: 'salt_typhoon', name: 'Salt Typhoon', aka: 'Salt Typhoon', sponsor: 'China (PRC State-backed)', lat: 39.9, lon: 116.5, mitreId: 'G1045', mitreUrl: 'https://attack.mitre.org/groups/G1045/', description: 'PRC state-backed actor responsible for numerous compromises of major US telecommunications and internet service providers since 2019, including wiretapping systems.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Telecommunications', 'ISP', 'Government'], active: true, }, { id: 'mustang_panda', name: 'Mustang Panda', aka: 'TA416 / RedDelta / BRONZE PRESIDENT / EARTH PRETA', sponsor: 'China', lat: 30.6, lon: 104.0, mitreId: 'G0129', mitreUrl: 'https://attack.mitre.org/groups/G0129/', description: 'China-based espionage group active since 2012 using tailored phishing lures against governments, diplomatic organizations, religious institutions, and NGOs globally.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Diplomatic', 'NGO', 'Religious', 'Research'], active: true, }, { id: 'axiom', name: 'Axiom', aka: 'Group 72', sponsor: 'China (suspected)', lat: 39.9, lon: 116.3, mitreId: 'G0001', mitreUrl: 'https://attack.mitre.org/groups/G0001/', description: 'Suspected Chinese espionage group targeting aerospace, defense, government, manufacturing, and media sectors since at least 2008.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Aerospace', 'Defense', 'Government', 'Manufacturing', 'Media'], active: false, }, { id: 'deep_panda', name: 'Deep Panda', aka: 'Shell Crew / Black Vine / KungFu Kittens', sponsor: 'China', lat: 31.2, lon: 121.3, mitreId: 'G0009', mitreUrl: 'https://attack.mitre.org/groups/G0009/', description: 'Suspected Chinese group attributed to the Anthem healthcare breach affecting 80M Americans. Also known as Black Vine. Some overlap with APT19.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Healthcare', 'Defense', 'Finance', 'Government', 'Telecommunications'], active: false, }, { id: 'gallium', name: 'GALLIUM', aka: 'Granite Typhoon', sponsor: 'China (suspected)', lat: 39.9, lon: 116.2, mitreId: 'G0093', mitreUrl: 'https://attack.mitre.org/groups/G0093/', description: 'Cyberespionage group active since 2012 known for Operation Soft Cell — a long-term campaign targeting global telecommunications providers for subscriber data collection.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'], targetSectors: ['Telecommunications', 'Finance', 'Government'], active: true, }, { id: 'ke3chang', name: 'Ke3chang', aka: 'APT15 / Vixen Panda / NICKEL / Nylon Typhoon', sponsor: 'China', lat: 39.9, lon: 116.6, mitreId: 'G0004', mitreUrl: 'https://attack.mitre.org/groups/G0004/', description: 'Chinese group active since 2010 targeting oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Oil & Gas', 'Government', 'Diplomatic', 'Military', 'NGO'], active: true, }, { id: 'naikon', name: 'Naikon', aka: 'Naikon', sponsor: 'China (PLA Unit 78020)', lat: 30.6, lon: 104.1, mitreId: 'G0019', mitreUrl: 'https://attack.mitre.org/groups/G0019/', description: 'PLA Chengdu unit primarily targeting Southeast Asian governments and militaries as well as UN bodies since at least 2010.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'UN Bodies', 'ASEAN'], active: true, }, { id: 'elderwood', name: 'Elderwood', aka: 'Elderwood Gang / Sneaky Panda', sponsor: 'China', lat: 39.9, lon: 116.1, mitreId: 'G0066', mitreUrl: 'https://attack.mitre.org/groups/G0066/', description: 'Suspected Chinese group responsible for the 2009 Google intrusion (Operation Aurora). Targets defense, supply chain, human rights NGOs, and IT service providers.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Defense', 'Supply Chain', 'Human Rights', 'IT Services'], active: false, }, { id: 'blacktech', name: 'BlackTech', aka: 'Palmerworm', sponsor: 'China (suspected)', lat: 25.03, lon: 121.5, mitreId: 'G0098', mitreUrl: 'https://attack.mitre.org/groups/G0098/', description: 'Suspected Chinese group primarily targeting Taiwan, Japan, and Hong Kong organizations in media, construction, engineering, electronics, and financial sectors since 2013.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Media', 'Construction', 'Engineering', 'Electronics', 'Finance'], active: true, }, { id: 'bronze_butler', name: 'BRONZE BUTLER', aka: 'REDBALDKNIGHT / Tick', sponsor: 'China', lat: 39.9, lon: 116.7, mitreId: 'G0060', mitreUrl: 'https://attack.mitre.org/groups/G0060/', description: 'Chinese-origin group active since 2008 primarily targeting Japanese organizations in government, biotechnology, electronics manufacturing, and industrial chemistry.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Biotechnology', 'Electronics', 'Industrial Chemistry'], active: true, }, { id: 'threat_group_3390', name: 'Threat Group-3390', aka: 'APT27 / Iron Tiger / LuckyMouse / Linen Typhoon', sponsor: 'China', lat: 39.9, lon: 116.8, mitreId: 'G0027', mitreUrl: 'https://attack.mitre.org/groups/G0027/', description: 'Chinese group using strategic web compromises since at least 2010 targeting aerospace, government, defense, technology, energy, manufacturing, and gambling sectors.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Aerospace', 'Government', 'Defense', 'Technology', 'Energy'], active: true, }, { id: 'putter_panda', name: 'Putter Panda', aka: 'APT2 / MSUpdater', sponsor: 'China (PLA Unit 61486)', lat: 31.3, lon: 121.4, mitreId: 'G0024', mitreUrl: 'https://attack.mitre.org/groups/G0024/', description: 'Chinese threat group attributed to PLA Unit 61486 of the 3rd General Staff Department targeting government and defense organizations.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Defense', 'Satellite', 'Aerospace'], active: false, }, { id: 'lotus_blossom', name: 'Lotus Blossom', aka: 'DRAGONFISH / Spring Dragon / Bilbug / Thrip', sponsor: 'China', lat: 22.5, lon: 114.0, mitreId: 'G0030', mitreUrl: 'https://attack.mitre.org/groups/G0030/', description: 'Long-standing Chinese threat group targeting Asian governments and related organizations since at least 2009, including digital certificate issuers.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Defense', 'Telecommunications', 'Digital Certificates'], active: true, }, { id: 'aquatic_panda', name: 'Aquatic Panda', aka: 'Aquatic Panda', sponsor: 'China (suspected)', lat: 30.6, lon: 104.2, mitreId: 'G0143', mitreUrl: 'https://attack.mitre.org/groups/G0143/', description: 'Suspected Chinese group with dual intelligence collection and industrial espionage missions, primarily targeting telecoms, technology, and government since 2020.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Telecommunications', 'Technology', 'Government'], active: true, }, { id: 'chimera', name: 'Chimera', aka: 'Chimera', sponsor: 'China (suspected)', lat: 25.03, lon: 121.4, mitreId: 'G0114', mitreUrl: 'https://attack.mitre.org/groups/G0114/', description: 'Suspected Chinese group targeting Taiwan semiconductor industry and airline data since at least 2018 using Cobalt Strike and living-off-the-land techniques.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'], targetSectors: ['Semiconductor', 'Airline', 'Technology'], active: true, }, { id: 'earth_lusca', name: 'Earth Lusca', aka: 'TAG-22 / Charcoal Typhoon / CHROMIUM', sponsor: 'China (suspected)', lat: 22.3, lon: 114.2, mitreId: 'G1006', mitreUrl: 'https://attack.mitre.org/groups/G1006/', description: 'Chinese espionage group active since 2019 targeting governments, media, gambling, COVID-19 research, and cryptocurrency platforms across 20+ countries.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Media', 'Gambling', 'Research', 'Cryptocurrency'], active: true, }, { id: 'cinnamon_tempest', name: 'Cinnamon Tempest', aka: 'DEV-0401 / Emperor Dragonfly / BRONZE STARLIGHT', sponsor: 'China', lat: 39.9, lon: 116.9, mitreId: 'G1021', mitreUrl: 'https://attack.mitre.org/groups/G1021/', description: 'Chinese group deploying multiple ransomware strains based on leaked Babuk source code since 2021, likely motivated by IP theft rather than financial gain.', tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact'], targetSectors: ['Technology', 'Manufacturing', 'Healthcare', 'Government'], active: true, }, { id: 'daggerfly', name: 'Daggerfly', aka: 'Evasive Panda / BRONZE HIGHLAND', sponsor: 'China (PRC-linked)', lat: 30.6, lon: 104.3, mitreId: 'G1034', mitreUrl: 'https://attack.mitre.org/groups/G1034/', description: 'PRC-linked APT active since 2012 targeting individuals, government/NGO entities, and telecoms in Asia and Africa, exclusively using MgBot malware.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'NGO', 'Telecommunications'], active: true, }, { id: 'admin338', name: 'admin@338', aka: 'admin@338', sponsor: 'China', lat: 39.9, lon: 116.1, mitreId: 'G0018', mitreUrl: 'https://attack.mitre.org/groups/G0018/', description: 'China-based group using newsworthy events as lures to deliver publicly available RATs like PoisonIvy, primarily targeting financial, economic, and trade policy organizations.', tactics: ['Initial Access', 'Execution', 'Collection'], targetSectors: ['Finance', 'Trade Policy', 'Government', 'Think Tanks'], active: false, }, { id: 'aoqin_dragon', name: 'Aoqin Dragon', aka: 'Aoqin Dragon', sponsor: 'China (suspected)', lat: 22.3, lon: 114.1, mitreId: 'G1007', mitreUrl: 'https://attack.mitre.org/groups/G1007/', description: 'Suspected Chinese espionage group active since 2013 primarily targeting government, education, and telecoms in Australia, Cambodia, Hong Kong, Singapore, and Vietnam.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Education', 'Telecommunications'], active: true, }, { id: 'backdoor_diplomacy', name: 'BackdoorDiplomacy', aka: 'BackdoorDiplomacy', sponsor: 'China (suspected)', lat: 39.9, lon: 116.4, mitreId: 'G0135', mitreUrl: 'https://attack.mitre.org/groups/G0135/', description: 'Cyber espionage group active since 2017 targeting Ministries of Foreign Affairs and telecom companies in Africa, Europe, Middle East, and Asia.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Foreign Affairs', 'Telecommunications', 'Government'], active: true, }, { id: 'dragonok', name: 'DragonOK', aka: 'DragonOK', sponsor: 'China', lat: 39.9, lon: 117.0, mitreId: 'G0017', mitreUrl: 'https://attack.mitre.org/groups/G0017/', description: 'Chinese group targeting Japanese organizations with phishing. Uses PlugX, PoisonIvy, and FormerFirstRat. Thought to have direct or indirect relationship with Moafee.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Technology', 'Manufacturing'], active: false, }, { id: 'gallmaker', name: 'Gallmaker', aka: 'Gallmaker', sponsor: 'Unknown (Middle East)', lat: 33.3, lon: 44.4, mitreId: 'G0084', mitreUrl: 'https://attack.mitre.org/groups/G0084/', description: 'Cyberespionage group active since at least 2017 targeting victims in the Middle East, with a focus on defense, military, and government sectors.', tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'], targetSectors: ['Defense', 'Military', 'Government'], active: false, }, { id: 'indigozebra', name: 'IndigoZebra', aka: 'IndigoZebra', sponsor: 'China (suspected)', lat: 39.9, lon: 116.5, mitreId: 'G0136', mitreUrl: 'https://attack.mitre.org/groups/G0136/', description: 'Suspected Chinese cyber espionage group targeting Central Asian governments since at least 2014.', tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Diplomatic'], active: false, }, { id: 'luminousmoth', name: 'LuminousMoth', aka: 'LuminousMoth', sponsor: 'China', lat: 39.9, lon: 116.3, mitreId: 'G1014', mitreUrl: 'https://attack.mitre.org/groups/G1014/', description: 'Chinese-speaking espionage group active since 2020 targeting high-profile government entities in Myanmar, Philippines, Thailand, and Southeast Asia.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Diplomatic'], active: true, }, { id: 'moafee', name: 'Moafee', aka: 'Moafee', sponsor: 'China (Guangdong)', lat: 23.1, lon: 113.2, mitreId: 'G0002', mitreUrl: 'https://attack.mitre.org/groups/G0002/', description: 'Chinese group from Guangdong with overlapping TTPs and custom tools with DragonOK, suggesting a direct or indirect relationship.', tactics: ['Initial Access', 'Execution', 'Collection'], targetSectors: ['Government', 'Technology'], active: false, }, { id: 'mofang', name: 'Mofang', aka: 'Mofang', sponsor: 'China (likely)', lat: 39.9, lon: 116.6, mitreId: 'G0103', mitreUrl: 'https://attack.mitre.org/groups/G0103/', description: 'Likely Chinese group known for imitating victim infrastructure. Targeting government and critical infrastructure in Myanmar plus military, automobile, and weapons industries since 2012.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Critical Infrastructure', 'Military', 'Automobile'], active: false, }, { id: 'pitty_tiger', name: 'PittyTiger', aka: 'PittyTiger', sponsor: 'China', lat: 39.9, lon: 116.7, mitreId: 'G0011', mitreUrl: 'https://attack.mitre.org/groups/G0011/', description: 'Chinese group using multiple malware types for command and control to maintain persistent access to victim networks.', tactics: ['Initial Access', 'Persistence', 'Command and Control'], targetSectors: ['Government', 'Defense', 'Technology'], active: false, }, { id: 'rancor', name: 'Rancor', aka: 'Rancor', sponsor: 'China (suspected)', lat: 22.3, lon: 114.2, mitreId: 'G0075', mitreUrl: 'https://attack.mitre.org/groups/G0075/', description: 'Threat group leading targeted campaigns against Southeast Asia using politically-motivated lures to deliver malicious documents.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Military', 'Political Organizations'], active: true, }, { id: 'redecho', name: 'RedEcho', aka: 'RedEcho', sponsor: 'China (PRC-linked)', lat: 39.9, lon: 116.2, mitreId: 'G1042', mitreUrl: 'https://attack.mitre.org/groups/G1042/', description: 'PRC-linked actor with long-running intrusions into Indian critical infrastructure. Associated with ShadowPad malware and overlaps with APT41.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Critical Infrastructure', 'Energy', 'Government'], active: true, }, { id: 'rocke', name: 'Rocke', aka: 'Iron Cybercrime Group', sponsor: 'China (suspected)', lat: 30.6, lon: 104.4, mitreId: 'G0106', mitreUrl: 'https://attack.mitre.org/groups/G0106/', description: 'Suspected Chinese cryptojacking group stealing victim system resources for cryptocurrency mining using the email address rocke@live.cn.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'], targetSectors: ['Cloud', 'Technology', 'General'], active: false, }, { id: 'scarlet_mimic', name: 'Scarlet Mimic', aka: 'Scarlet Mimic', sponsor: 'China (suspected)', lat: 39.9, lon: 116.3, mitreId: 'G0029', mitreUrl: 'https://attack.mitre.org/groups/G0029/', description: 'Group targeting minority rights activists. Motivations appear aligned with the Chinese government. Some IP overlap with Putter Panda.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Civil Society', 'Human Rights', 'Minority Groups'], active: false, }, { id: 'suckfly', name: 'Suckfly', aka: 'Suckfly', sponsor: 'China', lat: 39.9, lon: 117.0, mitreId: 'G0039', mitreUrl: 'https://attack.mitre.org/groups/G0039/', description: 'China-based threat group active since at least 2014 conducting targeted intrusion campaigns.', tactics: ['Initial Access', 'Persistence', 'Collection'], targetSectors: ['Government', 'Technology', 'Defense'], active: false, }, { id: 'ta459', name: 'TA459', aka: 'TA459', sponsor: 'China (suspected)', lat: 39.9, lon: 116.6, mitreId: 'G0062', mitreUrl: 'https://attack.mitre.org/groups/G0062/', description: 'China-linked group targeting Russia, Belarus, Mongolia, and other countries using spearphishing with RATs.', tactics: ['Initial Access', 'Execution', 'Collection'], targetSectors: ['Government', 'Military', 'Finance'], active: false, }, { id: 'thrip', name: 'Thrip', aka: 'Thrip', sponsor: 'China', lat: 22.5, lon: 114.1, mitreId: 'G0076', mitreUrl: 'https://attack.mitre.org/groups/G0076/', description: 'Espionage group targeting satellite communications, telecoms, and defense contractors in the US and Southeast Asia using both custom malware and living-off-the-land techniques.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Satellite', 'Telecommunications', 'Defense'], active: true, }, { id: 'toddycat', name: 'ToddyCat', aka: 'ToddyCat', sponsor: 'China (suspected)', lat: 39.9, lon: 116.3, mitreId: 'G1022', mitreUrl: 'https://attack.mitre.org/groups/G1022/', description: 'Sophisticated group active since 2020 using custom loaders and multi-stage infection chains against government and military targets in Europe and Asia.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Technology'], active: true, }, { id: 'tonto_team', name: 'Tonto Team', aka: 'Earth Akhlut / CactusPete / Karma Panda', sponsor: 'China (suspected)', lat: 39.9, lon: 117.1, mitreId: 'G0131', mitreUrl: 'https://attack.mitre.org/groups/G0131/', description: 'Suspected Chinese state-sponsored espionage group targeting Russia, Japan, South Korea, and US entities in government, military, finance, and energy sectors.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Finance', 'Energy'], active: true, }, // === NORTH KOREA === { id: 'lazarus', name: 'Lazarus Group', aka: 'Hidden Cobra / ZINC / Diamond Sleet', sponsor: 'North Korea (RGB)', lat: 39.0, lon: 125.75, mitreId: 'G0032', mitreUrl: 'https://attack.mitre.org/groups/G0032/', description: 'DPRK group responsible for the Sony Pictures hack, $81M Bangladesh Bank heist, and WannaCry. Primary mission is sanctions evasion through cryptocurrency theft to fund the weapons program.', tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact', 'Exfiltration'], targetSectors: ['Finance', 'Cryptocurrency', 'Defense', 'Media', 'Critical Infrastructure'], active: true, }, { id: 'kimsuky', name: 'Kimsuky', aka: 'Velvet Chollima / Emerald Sleet / APT43 / TA427', sponsor: 'North Korea (RGB)', lat: 39.0, lon: 125.8, mitreId: 'G0094', mitreUrl: 'https://attack.mitre.org/groups/G0094/', description: 'DPRK intelligence collection group targeting Korean Peninsula policy experts, nuclear specialists, and sanctions officials. Uses highly tailored spearphishing posing as journalists and academics.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration', 'Reconnaissance'], targetSectors: ['Government', 'Think Tanks', 'Nuclear Research', 'Defense', 'Academia'], active: true, }, { id: 'apt37', name: 'APT37', aka: 'Reaper / ScarCruft / InkySquid / Ricochet Chollima', sponsor: 'North Korea (RGB)', lat: 37.5, lon: 126.9, mitreId: 'G0067', mitreUrl: 'https://attack.mitre.org/groups/G0067/', description: 'DPRK group targeting South Korean defectors, journalists, and human rights activists using zero-day exploits in Hangul Word Processor and Android mobile malware.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Human Rights', 'Defectors', 'Media', 'Government', 'Healthcare'], active: true, }, { id: 'apt38', name: 'APT38', aka: 'Bluenoroff / Stardust Chollima / Sapphire Sleet', sponsor: 'North Korea (RGB)', lat: 39.0, lon: 125.7, mitreId: 'G0082', mitreUrl: 'https://attack.mitre.org/groups/G0082/', description: 'DPRK financial crime unit responsible for over $2B in theft from global banks via SWIFT network manipulation. Focus on long-term bank network infiltration before executing large transfers.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Lateral Movement', 'Impact'], targetSectors: ['Banking', 'Financial Institutions', 'SWIFT Network', 'Cryptocurrency'], active: true, }, { id: 'andariel', name: 'Andariel', aka: 'Silent Chollima / PLUTONIUM / Onyx Sleet', sponsor: 'North Korea (RGB)', lat: 39.0, lon: 125.6, mitreId: 'G0138', mitreUrl: 'https://attack.mitre.org/groups/G0138/', description: 'North Korean group primarily targeting South Korean government agencies, military, and domestic companies since 2009. Also conducts cyber financial operations against ATMs and cryptocurrency exchanges.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Finance', 'Cryptocurrency', 'Defense'], active: true, }, { id: 'applejeus', name: 'AppleJeus', aka: 'Gleaming Pisces / Citrine Sleet / UNC4736', sponsor: 'North Korea (RGB)', lat: 39.0, lon: 125.9, mitreId: 'G1049', mitreUrl: 'https://attack.mitre.org/groups/G1049/', description: 'DPRK group responsible for the 3CX supply chain attack. Deploys malicious cryptocurrency software to compromise high-value financial targets and generate revenue for the regime.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Exfiltration'], targetSectors: ['Cryptocurrency', 'Finance', 'Technology'], active: true, }, { id: 'moonstone_sleet', name: 'Moonstone Sleet', aka: 'Storm-1789', sponsor: 'North Korea', lat: 38.9, lon: 125.7, mitreId: 'G1036', mitreUrl: 'https://attack.mitre.org/groups/G1036/', description: 'DPRK-linked actor executing financial and espionage operations. Notable for creating fake companies and personas to interact with targets, and delivering malware via fully functional games.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Technology', 'Defense', 'Cryptocurrency', 'Finance'], active: true, }, { id: 'contagious_interview', name: 'Contagious Interview', aka: 'DeceptiveDevelopment / Tenacious Pungsan / DEV#POPPER', sponsor: 'North Korea', lat: 39.1, lon: 125.8, mitreId: 'G1052', mitreUrl: 'https://attack.mitre.org/groups/G1052/', description: 'North Korea-aligned group active since 2023 targeting software developers and cryptocurrency professionals with fake job interview lures that deliver cross-platform malware.', tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'], targetSectors: ['Technology', 'Cryptocurrency', 'Finance'], active: true, }, // === IRAN === { id: 'apt33', name: 'APT33', aka: 'Elfin / Peach Sandstorm / HOLMIUM', sponsor: 'Iran (IRGC)', lat: 34.0, lon: 53.0, mitreId: 'G0064', mitreUrl: 'https://attack.mitre.org/groups/G0064/', description: 'Iranian group targeting aerospace, energy, and petrochemical sectors since 2013. Known for Shamoon malware deployments against Saudi Arabia and spearphishing US defense contractors.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Impact'], targetSectors: ['Aerospace', 'Energy', 'Petrochemical', 'Government', 'Defense'], active: true, }, { id: 'apt34', name: 'OilRig', aka: 'APT34 / Helix Kitten / Hazel Sandstorm / EUROPIUM', sponsor: 'Iran (MOIS)', lat: 35.7, lon: 51.4, mitreId: 'G0049', mitreUrl: 'https://attack.mitre.org/groups/G0049/', description: 'Iranian MOIS group conducting long-term espionage against Middle East financial, government, and energy sectors. Known for DNS hijacking and LinkedIn-based recruitment phishing.', tactics: ['Initial Access', 'Persistence', 'Credential Access', 'Collection', 'Command and Control'], targetSectors: ['Financial', 'Government', 'Energy', 'Telecoms', 'Chemical'], active: true, }, { id: 'apt35', name: 'Magic Hound', aka: 'APT35 / Charming Kitten / Mint Sandstorm / TA453', sponsor: 'Iran (IRGC)', lat: 35.6, lon: 51.3, mitreId: 'G0059', mitreUrl: 'https://attack.mitre.org/groups/G0059/', description: 'IRGC-linked group conducting long-term social engineering campaigns since 2014 against government/military personnel, academics, journalists, and international organizations like WHO.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Academia', 'Media', 'Healthcare'], active: true, }, { id: 'apt39', name: 'APT39', aka: 'Remix Kitten / Chafer / ITG07', sponsor: 'Iran (MOIS)', lat: 35.5, lon: 52.0, mitreId: 'G0087', mitreUrl: 'https://attack.mitre.org/groups/G0087/', description: 'Iranian MOIS group focused on tracking dissidents and monitoring individuals of interest to the regime across 30+ countries using custom backdoors.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration', 'Reconnaissance'], targetSectors: ['Telecommunications', 'Travel', 'Government', 'Dissidents', 'Media'], active: true, }, { id: 'apt42', name: 'APT42', aka: 'APT42', sponsor: 'Iran (IRGC)', lat: 35.8, lon: 51.5, mitreId: 'G1044', mitreUrl: 'https://attack.mitre.org/groups/G1044/', description: 'Iranian-sponsored espionage group focused on Middle East targets since 2015, using spearphishing and PINEFLOWER Android malware to collect and exfiltrate data.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Civil Society', 'Media', 'Diplomatic'], active: true, }, { id: 'muddywater', name: 'MuddyWater', aka: 'Static Kitten / Seedworm / MERCURY / Mango Sandstorm', sponsor: 'Iran (MOIS)', lat: 32.4, lon: 53.7, mitreId: 'G0069', mitreUrl: 'https://attack.mitre.org/groups/G0069/', description: 'MOIS subordinate element targeting government, telecom, defense, and oil & gas organizations across Middle East, Asia, Africa, Europe, and North America since 2017.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Defense Evasion', 'Command and Control'], targetSectors: ['Government', 'Telecoms', 'Defense', 'Oil & Gas', 'Airlines'], active: true, }, { id: 'agrius', name: 'Agrius', aka: 'Pink Sandstorm / AMERICIUM / Agonizing Serpens', sponsor: 'Iran (MOIS)', lat: 35.7, lon: 51.5, mitreId: 'G1030', mitreUrl: 'https://attack.mitre.org/groups/G1030/', description: 'Iranian MOIS-linked group active since 2020 conducting ransomware and wiper operations primarily targeting Israeli organizations for destructive effect rather than financial gain.', tactics: ['Initial Access', 'Execution', 'Defense Evasion', 'Impact'], targetSectors: ['Government', 'Finance', 'Healthcare', 'Technology'], active: true, }, { id: 'ajax_security', name: 'Ajax Security Team', aka: 'Operation Woolen-Goldfish / Rocket Kitten / Flying Kitten', sponsor: 'Iran', lat: 35.6, lon: 51.2, mitreId: 'G0130', mitreUrl: 'https://attack.mitre.org/groups/G0130/', description: 'Iranian group active since 2010, transitioning from website defacement to malware-based espionage targeting the US defense industrial base and Iranian anti-censorship technology users.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Defense', 'Government', 'Civil Society'], active: false, }, { id: 'cleaver', name: 'Cleaver', aka: 'Threat Group 2889 / TG-2889', sponsor: 'Iran', lat: 35.7, lon: 51.3, mitreId: 'G0003', mitreUrl: 'https://attack.mitre.org/groups/G0003/', description: 'Iranian actors responsible for Operation Cleaver targeting critical infrastructure across 16 countries, including aviation, energy, defense, and transportation.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Critical Infrastructure', 'Aviation', 'Energy', 'Defense', 'Transportation'], active: false, }, { id: 'copykittens', name: 'CopyKittens', aka: 'CopyKittens', sponsor: 'Iran', lat: 35.5, lon: 51.4, mitreId: 'G0052', mitreUrl: 'https://attack.mitre.org/groups/G0052/', description: 'Iranian cyber espionage group operating since at least 2013 responsible for Operation Wilted Tulip targeting Israel, Saudi Arabia, Turkey, the US, Jordan, and Germany.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Defense', 'Research', 'Technology'], active: false, }, { id: 'curium', name: 'CURIUM', aka: 'Crimson Sandstorm / TA456 / Tortoise Shell / Yellow Liderc', sponsor: 'Iran (IRGC)', lat: 35.4, lon: 51.2, mitreId: 'G1012', mitreUrl: 'https://attack.mitre.org/groups/G1012/', description: 'Iranian group investing months building social media relationships with targets before deploying malware. Targets IT service providers in the Middle East since at least 2018.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['IT Services', 'Government', 'Defense'], active: true, }, { id: 'cyberav3ngers', name: 'CyberAv3ngers', aka: 'Soldiers of Soloman', sponsor: 'Iran (IRGC)', lat: 35.7, lon: 51.6, mitreId: 'G1027', mitreUrl: 'https://attack.mitre.org/groups/G1027/', description: 'IRGC-affiliated group that globally targeted Unitronics PLCs in 2023, attacking water/wastewater facilities, energy, and healthcare sectors with defacement and disruption.', tactics: ['Initial Access', 'Execution', 'Impact'], targetSectors: ['Water', 'Energy', 'Healthcare', 'Manufacturing', 'ICS'], active: true, }, { id: 'ferocious_kitten', name: 'Ferocious Kitten', aka: 'Ferocious Kitten', sponsor: 'Iran', lat: 35.5, lon: 51.3, mitreId: 'G0137', mitreUrl: 'https://attack.mitre.org/groups/G0137/', description: 'Iranian threat group primarily targeting Persian-speaking individuals inside Iran with surveillance and monitoring capabilities since at least 2015.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Dissidents', 'Civil Society', 'Journalists'], active: true, }, { id: 'fox_kitten', name: 'Fox Kitten', aka: 'Pioneer Kitten / UNC757 / RUBIDIUM / Lemon Sandstorm', sponsor: 'Iran (suspected government nexus)', lat: 35.6, lon: 51.4, mitreId: 'G0117', mitreUrl: 'https://attack.mitre.org/groups/G0117/', description: 'Iranian-nexus group active since 2017 targeting oil & gas, government, defense, healthcare, and manufacturing in the Middle East, North Africa, Europe, Australia, and North America.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Oil & Gas', 'Government', 'Defense', 'Healthcare', 'Manufacturing'], active: true, }, { id: 'group5', name: 'Group5', aka: 'Group5', sponsor: 'Iran (suspected)', lat: 35.3, lon: 51.0, mitreId: 'G0043', mitreUrl: 'https://attack.mitre.org/groups/G0043/', description: 'Iranian-nexus group targeting Syrian opposition via spearphishing and watering holes, using Android RAT DroidJack and njRAT for surveillance.', tactics: ['Initial Access', 'Execution', 'Collection'], targetSectors: ['Civil Society', 'Political Opposition', 'Journalists'], active: false, }, { id: 'hexane', name: 'HEXANE', aka: 'Lyceum / Siamesekitten / Spirlin', sponsor: 'Iran', lat: 35.4, lon: 51.3, mitreId: 'G1001', mitreUrl: 'https://attack.mitre.org/groups/G1001/', description: 'Iranian cyber espionage group targeting oil & gas, telecoms, aviation, and ISPs in the Middle East and Africa since at least 2017.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Oil & Gas', 'Telecommunications', 'Aviation', 'ISP'], active: true, }, { id: 'leafminer', name: 'Leafminer', aka: 'Raspite', sponsor: 'Iran', lat: 35.2, lon: 51.2, mitreId: 'G0077', mitreUrl: 'https://attack.mitre.org/groups/G0077/', description: 'Iranian threat group targeting government organizations and businesses in the Middle East since early 2017 using custom malware and watering hole attacks.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Finance', 'Energy'], active: false, }, { id: 'moses_staff', name: 'Moses Staff', aka: 'DEV-0500 / Marigold Sandstorm', sponsor: 'Iran (politically motivated)', lat: 35.8, lon: 51.6, mitreId: 'G1009', mitreUrl: 'https://attack.mitre.org/groups/G1009/', description: 'Suspected Iranian group primarily targeting Israeli companies since 2021, leaking stolen data and encrypting networks without a ransom demand for purely destructive political effect.', tactics: ['Initial Access', 'Execution', 'Defense Evasion', 'Impact', 'Exfiltration'], targetSectors: ['Government', 'Finance', 'Energy', 'Manufacturing', 'Utilities'], active: true, }, { id: 'silent_librarian', name: 'Silent Librarian', aka: 'TA407 / COBALT DICKENS', sponsor: 'Iran (IRGC / Mabna Institute)', lat: 35.6, lon: 51.5, mitreId: 'G0122', mitreUrl: 'https://attack.mitre.org/groups/G0122/', description: 'Iranian group affiliated with the Mabna Institute conducting credential phishing against universities and research institutions worldwide on behalf of the IRGC.', tactics: ['Initial Access', 'Credential Access', 'Collection', 'Exfiltration'], targetSectors: ['Academia', 'Research', 'Government'], active: true, }, { id: 'polonium', name: 'POLONIUM', aka: 'Plaid Rain', sponsor: 'Lebanon (Iran-coordinated)', lat: 33.9, lon: 35.5, mitreId: 'G1005', mitreUrl: 'https://attack.mitre.org/groups/G1005/', description: 'Lebanon-based group primarily targeting Israeli organizations since 2022. Coordinates operations with Iranian MOIS based on victim overlap and shared techniques.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Manufacturing', 'IT', 'Defense', 'Healthcare', 'Finance'], active: true, }, // === MIDDLE EAST === { id: 'apt_c23', name: 'APT-C-23', aka: 'Mantis / Arid Viper / Desert Falcon / Two-tailed Scorpion', sponsor: 'Palestinian (Hamas-linked)', lat: 31.5, lon: 34.5, mitreId: 'G1028', mitreUrl: 'https://attack.mitre.org/groups/G1028/', description: 'Group active since 2014 primarily targeting Israeli military assets. Has developed Android and iOS mobile spyware since 2017 for surveillance of targets across the Middle East.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Military', 'Government', 'Defense', 'Civil Society'], active: true, }, { id: 'molerats', name: 'Molerats', aka: 'Operation Molerats / Gaza Cybergang', sponsor: 'Palestine (Hamas-linked)', lat: 31.5, lon: 34.4, mitreId: 'G0021', mitreUrl: 'https://attack.mitre.org/groups/G0021/', description: 'Arabic-speaking politically-motivated group operating since 2012, targeting Middle East, European, and US entities with politically themed lures.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Finance', 'Media', 'NGO'], active: true, }, { id: 'dark_caracal', name: 'Dark Caracal', aka: 'Dark Caracal', sponsor: 'Lebanon (GDGS)', lat: 33.9, lon: 35.5, mitreId: 'G0070', mitreUrl: 'https://attack.mitre.org/groups/G0070/', description: 'Threat group attributed to the Lebanese General Directorate of General Security conducting global mobile and desktop surveillance operations since at least 2012.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Military', 'Government', 'Finance', 'Manufacturing', 'Utilities'], active: true, }, { id: 'darkhydrus', name: 'DarkHydrus', aka: 'DarkHydrus', sponsor: 'Iran (suspected)', lat: 35.3, lon: 51.1, mitreId: 'G0079', mitreUrl: 'https://attack.mitre.org/groups/G0079/', description: 'Threat group targeting government agencies and educational institutions in the Middle East since 2016 using open-source tools and DNS tunneling for C2.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Command and Control'], targetSectors: ['Government', 'Education'], active: false, }, { id: 'blackoasis', name: 'BlackOasis', aka: 'BlackOasis', sponsor: 'Middle East (government customer)', lat: 25.2, lon: 55.3, mitreId: 'G0063', mitreUrl: 'https://attack.mitre.org/groups/G0063/', description: 'Middle Eastern group believed to be a customer of Gamma Group (FinSpy). Targets UN figures, opposition bloggers, activists, regional journalists, and think tanks.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['UN', 'Civil Society', 'Journalists', 'Think Tanks'], active: true, }, { id: 'bouncing_golf', name: 'Bouncing Golf', aka: 'Bouncing Golf', sponsor: 'Middle East (suspected)', lat: 25.0, lon: 45.0, mitreId: 'G0097', mitreUrl: 'https://attack.mitre.org/groups/G0097/', description: 'Cyberespionage campaign targeting Middle Eastern countries with Android malware capable of stealing sensitive data from mobile devices.', tactics: ['Initial Access', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Telecoms'], active: false, }, { id: 'stealth_falcon', name: 'Stealth Falcon', aka: 'Project Raven', sponsor: 'UAE (suspected government)', lat: 24.5, lon: 54.4, mitreId: 'G0038', mitreUrl: 'https://attack.mitre.org/groups/G0038/', description: 'UAE government-linked group conducting targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Journalists', 'Activists', 'Dissidents', 'Government'], active: true, }, { id: 'sea_turtle', name: 'Sea Turtle', aka: 'Teal Kurma / Marbled Dust / Cosmic Wolf / SILICON', sponsor: 'Turkey', lat: 39.9, lon: 32.9, mitreId: 'G1041', mitreUrl: 'https://attack.mitre.org/groups/G1041/', description: 'Turkey-linked group active since 2017 conducting DNS hijacking operations against registrars and DNS providers to intercept credentials for government and security targets.', tactics: ['Initial Access', 'Credential Access', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Telecoms', 'ISP', 'Defense', 'Media'], active: true, }, { id: 'promethium', name: 'PROMETHIUM', aka: 'StrongPity', sponsor: 'Turkey (suspected)', lat: 39.9, lon: 32.8, mitreId: 'G0056', mitreUrl: 'https://attack.mitre.org/groups/G0056/', description: 'Espionage group focused since 2012 on Turkish targets and their perceived enemies, using trojanized software installers delivered via ISP-level interception.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Military', 'Political Opposition'], active: true, }, { id: 'neodymium', name: 'NEODYMIUM', aka: 'NEODYMIUM', sponsor: 'Turkey (suspected)', lat: 39.9, lon: 32.7, mitreId: 'G0055', mitreUrl: 'https://attack.mitre.org/groups/G0055/', description: 'Activity group with a 2016 campaign heavily targeting Turkish victims. Closely associated with PROMETHIUM and reportedly linked to BlackOasis operations.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Military', 'Civil Society'], active: false, }, // === SOUTH/SOUTHEAST ASIA === { id: 'sidewinder', name: 'Sidewinder', aka: 'T-APT-04 / Rattlesnake', sponsor: 'India (suspected)', lat: 28.6, lon: 77.2, mitreId: 'G0121', mitreUrl: 'https://attack.mitre.org/groups/G0121/', description: 'Suspected Indian threat actor active since 2012, targeting government, military, and business entities primarily in Pakistan, China, Nepal, and Afghanistan.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Business', 'Police'], active: true, }, { id: 'patchwork', name: 'Patchwork', aka: 'Hangover Group / Dropping Elephant / MONSOON', sponsor: 'India (suspected)', lat: 28.6, lon: 77.3, mitreId: 'G0040', mitreUrl: 'https://attack.mitre.org/groups/G0040/', description: 'Suspected Indian group first observed in 2015. Targets diplomatic and government agencies globally. Notable for copy-pasting large amounts of code from online forums.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Diplomatic', 'Think Tanks', 'Military'], active: true, }, { id: 'confucius', name: 'Confucius', aka: 'Confucius APT', sponsor: 'South Asia (India suspected)', lat: 28.5, lon: 77.1, mitreId: 'G0142', mitreUrl: 'https://attack.mitre.org/groups/G0142/', description: 'Cyber espionage group primarily targeting military personnel, high-profile personalities, and government organizations in South Asia since 2013, with similarities to Patchwork.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Military', 'Government', 'Business'], active: true, }, { id: 'bitter', name: 'BITTER', aka: 'T-APT-17', sponsor: 'South Asia (suspected)', lat: 33.7, lon: 73.1, mitreId: 'G1002', mitreUrl: 'https://attack.mitre.org/groups/G1002/', description: 'Suspected South Asian group active since 2013 targeting government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Energy', 'Engineering'], active: true, }, { id: 'sidecopy', name: 'SideCopy', aka: 'SideCopy', sponsor: 'Pakistan (suspected)', lat: 33.7, lon: 73.0, mitreId: 'G1008', mitreUrl: 'https://attack.mitre.org/groups/G1008/', description: 'Pakistani group mimicking Sidewinder infection chains to target Indian and Afghan government personnel since 2019. Named for its deliberate copying of a rival group\'s techniques.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Defense', 'Military'], active: true, }, { id: 'gorgon_group', name: 'Gorgon Group', aka: 'Gorgon Group', sponsor: 'Pakistan (suspected)', lat: 33.7, lon: 73.2, mitreId: 'G0078', mitreUrl: 'https://attack.mitre.org/groups/G0078/', description: 'Pakistan-connected group mixing criminal and targeted operations against government organizations in the UK, Spain, Russia, and the US.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Exfiltration'], targetSectors: ['Government', 'Finance', 'Technology'], active: true, }, { id: 'platinum', name: 'PLATINUM', aka: 'PLATINUM', sponsor: 'Unknown (SE Asia focus)', lat: 13.7, lon: 100.5, mitreId: 'G0068', mitreUrl: 'https://attack.mitre.org/groups/G0068/', description: 'Activity group active since 2009 targeting governments and related organizations in South and Southeast Asia with sophisticated techniques including abuse of hotpatching.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Defense Evasion', 'Lateral Movement'], targetSectors: ['Government', 'Defense', 'Intelligence'], active: false, }, // === SOUTH KOREA === { id: 'darkhotel', name: 'Darkhotel', aka: 'DUBNIUM / Zigzag Hail', sponsor: 'South Korea (suspected)', lat: 37.5, lon: 127.0, mitreId: 'G0012', mitreUrl: 'https://attack.mitre.org/groups/G0012/', description: 'Suspected South Korean group targeting traveling executives via hotel Wi-Fi networks and spearphishing since at least 2004.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Business Executives', 'Defense', 'Electronics', 'Pharmaceutical', 'Automotive'], active: true, }, { id: 'higaisa', name: 'Higaisa', aka: 'Higaisa', sponsor: 'South Korea (suspected)', lat: 37.5, lon: 127.1, mitreId: 'G0126', mitreUrl: 'https://attack.mitre.org/groups/G0126/', description: 'Suspected South Korean origin group primarily targeting North Korea since 2009 but also operating in China, Japan, Russia, and Poland.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Political Organizations', 'NGO'], active: false, }, // === AFRICA === { id: 'silverterrier', name: 'SilverTerrier', aka: 'SilverTerrier', sponsor: 'Nigeria (Criminal)', lat: 9.1, lon: 7.4, mitreId: 'G0083', mitreUrl: 'https://attack.mitre.org/groups/G0083/', description: 'Nigerian business email compromise (BEC) group active since 2014 targeting high technology, higher education, and manufacturing organizations using commodity malware.', tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'], targetSectors: ['Technology', 'Education', 'Manufacturing'], active: true, }, // === EASTERN EUROPE / CRIMINAL === { id: 'fin7', name: 'FIN7', aka: 'GOLD NIAGARA / Carbon Spider / Sangria Tempest', sponsor: 'Criminal (Eastern Europe)', lat: 50.4, lon: 30.5, mitreId: 'G0046', mitreUrl: 'https://attack.mitre.org/groups/G0046/', description: 'Sophisticated criminal group responsible for over $3B in theft from 100+ US companies. Operated a fake cybersecurity company to recruit penetration testers. Now operates ransomware.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Retail', 'Restaurant', 'Hospitality', 'Finance', 'Healthcare'], active: true, }, { id: 'fin6', name: 'FIN6', aka: 'Skeleton Spider / ITG08 / TAAL / Camouflage Tempest', sponsor: 'Criminal', lat: 50.0, lon: 30.0, mitreId: 'G0037', mitreUrl: 'https://attack.mitre.org/groups/G0037/', description: 'Cybercrime group specializing in stealing and selling payment card data from point-of-sale systems in the hospitality and retail sectors. Pivoted to ransomware deployment.', tactics: ['Initial Access', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Hospitality', 'Retail', 'Finance'], active: true, }, { id: 'fin8', name: 'FIN8', aka: 'Syssphinx', sponsor: 'Criminal', lat: 50.0, lon: 36.0, mitreId: 'G0061', mitreUrl: 'https://attack.mitre.org/groups/G0061/', description: 'Financially motivated group targeting hospitality, retail, entertainment, insurance, and financial sectors since 2016. Switched to ransomware deployment in 2021.', tactics: ['Initial Access', 'Lateral Movement', 'Collection', 'Exfiltration', 'Impact'], targetSectors: ['Hospitality', 'Retail', 'Finance', 'Insurance'], active: true, }, { id: 'carbanak', name: 'Carbanak', aka: 'Anunak', sponsor: 'Criminal (Russia-linked)', lat: 55.0, lon: 37.0, mitreId: 'G0008', mitreUrl: 'https://attack.mitre.org/groups/G0008/', description: 'Cybercriminal group using Carbanak malware to target financial institutions since 2013. Responsible for over $1B in losses from banks via fraudulent wire transfers.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Banking', 'Finance'], active: true, }, { id: 'cobalt_group', name: 'Cobalt Group', aka: 'GOLD KINGSWOOD / Cobalt Spider', sponsor: 'Criminal', lat: 50.4, lon: 30.5, mitreId: 'G0080', mitreUrl: 'https://attack.mitre.org/groups/G0080/', description: 'Financially motivated group targeting financial institutions via ATM systems, card processing, payment systems, and SWIFT since 2016. Primarily targeting banks in Eastern Europe, Central Asia, and SE Asia.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Impact'], targetSectors: ['Banking', 'ATM', 'Payment Systems'], active: true, }, { id: 'ta505', name: 'TA505', aka: 'Hive0065 / Spandex Tempest / CHIMBORAZO', sponsor: 'Criminal (Russia-linked)', lat: 55.0, lon: 38.0, mitreId: 'G0092', mitreUrl: 'https://attack.mitre.org/groups/G0092/', description: 'Prolific criminal group known for massive email campaigns distributing Dridex and Clop ransomware. Responsible for some of the largest malware distribution campaigns ever recorded.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Command and Control', 'Exfiltration'], targetSectors: ['Finance', 'Retail', 'Healthcare', 'Manufacturing', 'Government'], active: true, }, { id: 'silence', name: 'Silence', aka: 'Whisper Spider', sponsor: 'Criminal (Russia)', lat: 55.7, lon: 37.9, mitreId: 'G0091', mitreUrl: 'https://attack.mitre.org/groups/G0091/', description: 'Financially motivated group targeting financial institutions since 2016. Has compromised Russian Central Bank automated systems, ATMs, and card processing infrastructure.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Impact'], targetSectors: ['Banking', 'ATM', 'Card Processing'], active: true, }, { id: 'indrik_spider2', name: 'Wizard Spider', aka: 'GOLD BLACKBURN / TEMP.MixMaster', sponsor: 'Criminal (Russia)', lat: 55.6, lon: 37.5, mitreId: 'G0102', mitreUrl: 'https://attack.mitre.org/groups/G0102/', description: 'Russian cybercriminal group operating TrickBot banking trojan and Ryuk/Conti ransomware. One of the most prolific ransomware operators targeting hospitals, schools, and businesses.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Impact'], targetSectors: ['Healthcare', 'Finance', 'Government', 'Manufacturing', 'Education'], active: true, }, { id: 'gold_southfield', name: 'GOLD SOUTHFIELD', aka: 'Pinchy Spider', sponsor: 'Criminal (Russia)', lat: 55.3, lon: 37.2, mitreId: 'G0115', mitreUrl: 'https://attack.mitre.org/groups/G0115/', description: 'Financially motivated group operating REvil Ransomware-as-a-Service since 2018, conducting high-value attacks including the Kaseya supply chain attack affecting 1,500 organizations.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'], targetSectors: ['Technology', 'Finance', 'Healthcare', 'Government'], active: false, }, { id: 'lapsus', name: 'LAPSUS$', aka: 'DEV-0537 / Strawberry Tempest', sponsor: 'Criminal (UK/Brazil)', lat: 51.5, lon: -0.1, mitreId: 'G1004', mitreUrl: 'https://attack.mitre.org/groups/G1004/', description: 'Young cybercriminal group specializing in social engineering and large-scale data extortion without ransomware. Compromised Microsoft, Okta, NVIDIA, Samsung, and Uber.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Technology', 'Telecommunications', 'Government', 'Healthcare'], active: false, }, { id: 'scattered_spider', name: 'Scattered Spider', aka: 'Roasted 0ktapus / Octo Tempest / UNC3944', sponsor: 'Criminal (US/UK)', lat: 37.8, lon: -122.4, mitreId: 'G1015', mitreUrl: 'https://attack.mitre.org/groups/G1015/', description: 'Native English-speaking group active since 2022 using advanced social engineering and help-desk impersonation to bypass MFA and compromise enterprise cloud environments. Hit MGM and Caesars.', tactics: ['Initial Access', 'Persistence', 'Privilege Escalation', 'Defense Evasion', 'Exfiltration'], targetSectors: ['Hospitality', 'Gaming', 'Retail', 'Telecommunications', 'Finance'], active: true, }, { id: 'darkvisnya', name: 'DarkVishnya', aka: 'DarkVishnya', sponsor: 'Criminal (Eastern Europe)', lat: 52.2, lon: 21.0, mitreId: 'G0105', mitreUrl: 'https://attack.mitre.org/groups/G0105/', description: 'Financially motivated group attacking Eastern European financial institutions in 2017-2018 by physically planting malicious hardware devices inside bank offices.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Banking', 'Finance'], active: false, }, { id: 'gcman', name: 'GCMAN', aka: 'GCMAN', sponsor: 'Criminal', lat: 55.0, lon: 37.5, mitreId: 'G0036', mitreUrl: 'https://attack.mitre.org/groups/G0036/', description: 'Threat group targeting banks with the purpose of transferring money to e-currency services using custom malware and legitimate sysadmin tools.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'], targetSectors: ['Banking', 'Finance'], active: false, }, { id: 'rtm', name: 'RTM', aka: 'RTM', sponsor: 'Criminal (Russia)', lat: 55.5, lon: 37.5, mitreId: 'G0048', mitreUrl: 'https://attack.mitre.org/groups/G0048/', description: 'Russian cybercriminal group primarily targeting users of remote banking systems in Russia and neighboring countries since at least 2015 using the RTM banking trojan.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Banking', 'Finance', 'Remote Banking'], active: true, }, { id: 'fin4', name: 'FIN4', aka: 'FIN4', sponsor: 'Criminal (financial insider trading)', lat: 40.7, lon: -74.0, mitreId: 'G0085', mitreUrl: 'https://attack.mitre.org/groups/G0085/', description: 'Financially motivated group targeting confidential information for insider trading in healthcare and pharmaceutical companies since 2013. Focused solely on credential harvesting via phishing.', tactics: ['Initial Access', 'Credential Access', 'Collection'], targetSectors: ['Healthcare', 'Pharmaceutical', 'Finance'], active: false, }, { id: 'fin5', name: 'FIN5', aka: 'FIN5', sponsor: 'Criminal (Russia-linked)', lat: 50.0, lon: 36.0, mitreId: 'G0053', mitreUrl: 'https://attack.mitre.org/groups/G0053/', description: 'Financially motivated group targeting PII and payment card data in restaurant, gaming, and hotel industries since at least 2008.', tactics: ['Initial Access', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Restaurant', 'Gaming', 'Hospitality'], active: false, }, { id: 'fin10', name: 'FIN10', aka: 'FIN10', sponsor: 'Criminal', lat: 49.0, lon: -98.0, mitreId: 'G0051', mitreUrl: 'https://attack.mitre.org/groups/G0051/', description: 'Financially motivated group targeting North American organizations since 2013 via extortion using stolen data rather than ransomware.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Gaming', 'Mining', 'Natural Resources', 'Finance'], active: false, }, { id: 'fin13', name: 'FIN13', aka: 'Elephant Beetle', sponsor: 'Criminal (Latin America)', lat: -14.2, lon: -51.9, mitreId: 'G1016', mitreUrl: 'https://attack.mitre.org/groups/G1016/', description: 'Financially motivated group targeting financial, retail, and hospitality industries in Mexico and Latin America since 2016 using custom tooling for fraud operations.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'], targetSectors: ['Finance', 'Retail', 'Hospitality'], active: true, }, { id: 'akira', name: 'Akira', aka: 'GOLD SAHARA / Howling Scorpius', sponsor: 'Criminal', lat: 50.0, lon: 18.0, mitreId: 'G1024', mitreUrl: 'https://attack.mitre.org/groups/G1024/', description: 'Ransomware group active since March 2023 using double extortion. Targets business, government, critical infrastructure, and healthcare with ESXi-capable variants overlapping with Conti.', tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact', 'Exfiltration'], targetSectors: ['Business', 'Government', 'Critical Infrastructure', 'Healthcare'], active: true, }, { id: 'blackbyte', name: 'BlackByte', aka: 'Hecamede', sponsor: 'Criminal', lat: 50.0, lon: 20.0, mitreId: 'G1043', mitreUrl: 'https://attack.mitre.org/groups/G1043/', description: 'Ransomware group active since 2021 targeting critical infrastructure entities in North America using double extortion. Initially had a universal decryptor due to a shared encryption key.', tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact'], targetSectors: ['Critical Infrastructure', 'Healthcare', 'Government'], active: true, }, { id: 'play', name: 'Play', aka: 'Play', sponsor: 'Criminal', lat: 50.0, lon: 22.0, mitreId: 'G1040', mitreUrl: 'https://attack.mitre.org/groups/G1040/', description: 'Ransomware group active since 2022 deploying Playcrypt ransomware against business, government, healthcare, and media in North America, South America, and Europe.', tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact', 'Exfiltration'], targetSectors: ['Business', 'Government', 'Healthcare', 'Media'], active: true, }, { id: 'inc_ransom', name: 'INC Ransom', aka: 'GOLD IONIC', sponsor: 'Criminal', lat: 50.0, lon: 24.0, mitreId: 'G1032', mitreUrl: 'https://attack.mitre.org/groups/G1032/', description: 'Ransomware and data extortion group active since July 2023 targeting industrial, healthcare, and education sectors in the US and Europe.', tactics: ['Initial Access', 'Lateral Movement', 'Impact', 'Exfiltration'], targetSectors: ['Industrial', 'Healthcare', 'Education'], active: true, }, { id: 'medusa_group', name: 'Medusa Group', aka: 'Spearwing', sponsor: 'Criminal', lat: 50.0, lon: 26.0, mitreId: 'G1051', mitreUrl: 'https://attack.mitre.org/groups/G1051/', description: 'RaaS operation active since 2021 employing living-off-the-land techniques and double extortion. Opportunistic targeting across all sectors globally.', tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact', 'Exfiltration'], targetSectors: ['Healthcare', 'Education', 'Government', 'Industrial'], active: true, }, { id: 'storm0501', name: 'Storm-0501', aka: 'Storm-0501', sponsor: 'Criminal', lat: 50.0, lon: 28.0, mitreId: 'G1053', mitreUrl: 'https://attack.mitre.org/groups/G1053/', description: 'Financially motivated criminal group active since 2021 conducting ransomware operations using multiple RaaS platforms including LockBit, BlackCat, and Embargo.', tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact'], targetSectors: ['Healthcare', 'Government', 'Manufacturing'], active: true, }, { id: 'storm1811', name: 'Storm-1811', aka: 'Storm-1811', sponsor: 'Criminal', lat: 50.0, lon: 30.0, mitreId: 'G1046', mitreUrl: 'https://attack.mitre.org/groups/G1046/', description: 'Criminal entity linked to Black Basta ransomware. Uses email overloading and fake IT help-desk calls to trick employees into installing remote access tools.', tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact'], targetSectors: ['Healthcare', 'Finance', 'Manufacturing', 'Government'], active: true, }, { id: 'exotic_lily', name: 'EXOTIC LILY', aka: 'EXOTIC LILY', sponsor: 'Criminal (Russia-linked)', lat: 55.2, lon: 37.6, mitreId: 'G1011', mitreUrl: 'https://attack.mitre.org/groups/G1011/', description: 'Initial access broker closely linked with Wizard Spider, deploying Conti and Diavol ransomware. Targets IT, cybersecurity, and healthcare sectors via spearphishing since 2021.', tactics: ['Initial Access', 'Execution'], targetSectors: ['IT', 'Cybersecurity', 'Healthcare'], active: true, }, { id: 'evilnum', name: 'Evilnum', aka: 'Evilnum', sponsor: 'Criminal', lat: 52.0, lon: 20.0, mitreId: 'G0120', mitreUrl: 'https://attack.mitre.org/groups/G0120/', description: 'Financially motivated group active since 2018 targeting financial technology companies, particularly those dealing with trading and investment platforms in Europe.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['FinTech', 'Finance', 'Investment'], active: true, }, { id: 'ta551', name: 'TA551', aka: 'GOLD CABIN / Shathak', sponsor: 'Criminal', lat: 54.0, lon: 18.0, mitreId: 'G0127', mitreUrl: 'https://attack.mitre.org/groups/G0127/', description: 'Financially motivated group active since 2018 distributing malware via email campaigns in English, German, Italian, and Japanese targeting organizations for ransomware deployment.', tactics: ['Initial Access', 'Execution', 'Persistence'], targetSectors: ['Finance', 'Healthcare', 'Manufacturing'], active: true, }, { id: 'teamtnt', name: 'TeamTNT', aka: 'TeamTNT', sponsor: 'Criminal', lat: 51.0, lon: 10.0, mitreId: 'G0139', mitreUrl: 'https://attack.mitre.org/groups/G0139/', description: 'Cloud and container-focused threat group active since 2019 targeting exposed Docker APIs and Kubernetes clusters to deploy cryptocurrency miners.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'], targetSectors: ['Cloud', 'Container Infrastructure', 'Technology'], active: true, }, { id: 'blue_mockingbird', name: 'Blue Mockingbird', aka: 'Blue Mockingbird', sponsor: 'Criminal (unknown)', lat: 40.0, lon: -100.0, mitreId: 'G0108', mitreUrl: 'https://attack.mitre.org/groups/G0108/', description: 'Cluster deploying Monero cryptocurrency-mining DLL payloads on Windows systems, exploiting MSSQL servers since December 2019.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'], targetSectors: ['Technology', 'General'], active: true, }, // === SOUTH AMERICA === { id: 'apt_c36', name: 'APT-C-36', aka: 'Blind Eagle', sponsor: 'South America (Colombia/Venezuela)', lat: 4.7, lon: -74.1, mitreId: 'G0099', mitreUrl: 'https://attack.mitre.org/groups/G0099/', description: 'Suspected South American espionage group active since 2018 targeting Colombian government, financial, petroleum, and manufacturing organizations.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Government', 'Finance', 'Petroleum', 'Manufacturing'], active: true, }, { id: 'machete', name: 'Machete', aka: 'APT-C-43 / El Machete', sponsor: 'South America (Venezuela suspected)', lat: 10.5, lon: -66.9, mitreId: 'G0095', mitreUrl: 'https://attack.mitre.org/groups/G0095/', description: 'Suspected Spanish-speaking group active since 2010 primarily targeting Latin American government and military intelligence services, with a focus on Venezuela.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Intelligence', 'Military', 'Utilities'], active: true, }, { id: 'malteiro', name: 'Malteiro', aka: 'Malteiro', sponsor: 'Brazil (Criminal)', lat: -15.8, lon: -47.9, mitreId: 'G1026', mitreUrl: 'https://attack.mitre.org/groups/G1026/', description: 'Brazil-based criminal group active since 2019 operating Mispadu banking trojan as Malware-as-a-Service, primarily targeting victims in Latin America and Europe.', tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'], targetSectors: ['Finance', 'Retail', 'General'], active: true, }, { id: 'poseidon_group', name: 'Poseidon Group', aka: 'Poseidon Group', sponsor: 'Brazil', lat: -15.8, lon: -47.8, mitreId: 'G0033', mitreUrl: 'https://attack.mitre.org/groups/G0033/', description: 'Portuguese-speaking group active since 2005 exfiltrating data and blackmailing victim companies into contracting them as a security firm.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Finance', 'Energy', 'Government', 'Manufacturing'], active: false, }, // === MISCELLANEOUS / UNKNOWN ORIGIN === { id: 'equation', name: 'Equation', aka: 'Equation Group', sponsor: 'USA (NSA/TAO suspected)', lat: 38.9, lon: -77.0, mitreId: 'G0020', mitreUrl: 'https://attack.mitre.org/groups/G0020/', description: 'Extremely sophisticated group employing multiple RATs and zero-days. Known for the ability to overwrite hard disk drive firmware — a capability beyond any known threat actor. Tools leaked by Shadow Brokers.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Telecoms', 'Finance', 'Energy'], active: false, }, { id: 'strider', name: 'Strider', aka: 'ProjectSauron', sponsor: 'Unknown (nation-state)', lat: 50.0, lon: 15.0, mitreId: 'G0041', mitreUrl: 'https://attack.mitre.org/groups/G0041/', description: 'Highly sophisticated group active since 2011 targeting Russia, China, Sweden, Belgium, Iran, and Rwanda. Uses custom modular malware platform tailored to each victim.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Military', 'Telecoms', 'Finance'], active: false, }, { id: 'orangeworm', name: 'Orangeworm', aka: 'Orangeworm', sponsor: 'Unknown', lat: 37.0, lon: -95.0, mitreId: 'G0071', mitreUrl: 'https://attack.mitre.org/groups/G0071/', description: 'Group targeting healthcare organizations in the US, Europe, and Asia since 2015 for corporate espionage, implanting Kwampirs backdoor in radiology and imaging software.', tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection'], targetSectors: ['Healthcare', 'Pharmaceutical', 'IT Services', 'Manufacturing'], active: false, }, { id: 'moustached_bouncer', name: 'MoustachedBouncer', aka: 'MoustachedBouncer', sponsor: 'Belarus (suspected)', lat: 53.9, lon: 27.6, mitreId: 'G1019', mitreUrl: 'https://attack.mitre.org/groups/G1019/', description: 'Cyberespionage group active since 2014 exclusively targeting foreign embassies in Belarus, leveraging ISP-level adversary-in-the-middle attacks.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Diplomatic', 'Embassies'], active: true, }, { id: 'metador', name: 'Metador', aka: 'Metador', sponsor: 'Unknown (nation-state suspected)', lat: 25.0, lon: 45.0, mitreId: 'G1013', mitreUrl: 'https://attack.mitre.org/groups/G1013/', description: 'Mysterious threat group first reported in 2022 targeting a limited number of telecoms, ISPs, and universities in the Middle East and Africa with advanced custom malware.', tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection'], targetSectors: ['Telecommunications', 'ISP', 'Academia'], active: true, }, { id: 'sowbug', name: 'Sowbug', aka: 'Sowbug', sponsor: 'Unknown (Asia-Pacific)', lat: -6.2, lon: 106.8, mitreId: 'G0054', mitreUrl: 'https://attack.mitre.org/groups/G0054/', description: 'Threat group conducting targeted attacks against government entities in South America and Southeast Asia since at least 2015 using the Felismus RAT.', tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'], targetSectors: ['Government', 'Diplomatic'], active: false, }, { id: 'lazykscripter', name: 'LazyScripter', aka: 'LazyScripter', sponsor: 'Unknown', lat: 30.0, lon: 31.0, mitreId: 'G0140', mitreUrl: 'https://attack.mitre.org/groups/G0140/', description: 'Threat group mainly targeting the airlines industry since at least 2018 using open-source toolsets and IATA-themed lures.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Airlines', 'Aviation'], active: true, }, { id: 'ta2541', name: 'TA2541', aka: 'TA2541', sponsor: 'Criminal', lat: 30.0, lon: 30.0, mitreId: 'G1018', mitreUrl: 'https://attack.mitre.org/groups/G1018/', description: 'Cybercriminal group targeting aviation, aerospace, transportation, manufacturing, and defense since 2017 with high-volume commodity RAT campaigns using aviation-themed lures.', tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'], targetSectors: ['Aviation', 'Aerospace', 'Defense', 'Transportation', 'Manufacturing'], active: true, }, { id: 'the_white_company', name: 'The White Company', aka: 'The White Company', sponsor: 'Unknown (state-sponsored suspected)', lat: 33.7, lon: 73.0, mitreId: 'G0089', mitreUrl: 'https://attack.mitre.org/groups/G0089/', description: 'Likely state-sponsored group conducting Operation Shaheen against Pakistani government and military organizations in 2017-2018 with custom evasion capabilities.', tactics: ['Initial Access', 'Execution', 'Defense Evasion', 'Collection'], targetSectors: ['Government', 'Military'], active: false, }, { id: 'inception', name: 'Inception', aka: 'Cloud Atlas / Inception Framework', sponsor: 'Unknown (Russia suspected)', lat: 55.0, lon: 37.0, mitreId: 'G0100', mitreUrl: 'https://attack.mitre.org/groups/G0100/', description: 'Cyber espionage group primarily targeting Russia, but also US, Europe, Middle East, and Africa. Uses cloud services like OneDrive for C2 to evade detection.', tactics: ['Initial Access', 'Persistence', 'Command and Control', 'Collection'], targetSectors: ['Government', 'Military', 'Finance', 'Energy'], active: true, }, ];