Threat Actor Profiles
Named threat actors in the dataset, their state nexus, attributed operations, and behavioural patterns.
Rule: a case gets a named profile when a state organ or group is named by an on-record government attribution, by authenticated documents, or by consistent reporting citing officials, whichever state it is. Each profile states that basis. Criminal groups with no established state nexus have their own profile. “Unattributed, contested or non-state” holds only cases where no state organ is named.
Sandworm Team (GRU Unit 74455)
Russia, GRU (Main Intelligence Directorate), assessed to be Unit 74455
Lazarus Group (RGB, North Korea)
North Korea, Reconnaissance General Bureau (RGB)
SVR / APT29 / Cozy Bear
Russia, SVR (Foreign Intelligence Service)
PRC Ministry of State Security (MSS) Groups
China, Ministry of State Security (MSS) and its contractors (Tianjin State Security Bureau for APT10; Sichuan Juxinhe Network Technology for Salt Typhoon)
People's Liberation Army Cyber Units (PLA Unit 61398 / 3PLA Successor)
China, People's Liberation Army (PLA), formerly Third Department of the General Staff Department (3PLA) including Unit 61398; reorganised under the PLA Strategic Support Force (SSF) in 2015 and subsequent restructurings
Scattered Spider
Non-state: loosely organized English-speaking individuals (US/UK)
Iranian State-Linked Actors (IRGC/MOIS)
Iran, Islamic Revolutionary Guard Corps (IRGC) and Ministry of Intelligence and Security (MOIS)
Unattributed, Contested or Non-State
No state organ named on the record: unattributed intrusions, contested or reciprocal attributions, and non-state armed groups
PRC State-Sponsored Actors (Organ Not Named)
China; governments attribute these operations to the PRC state without naming the responsible organ in public
UK Government Communications Headquarters (GCHQ)
United Kingdom, Government Communications Headquarters (GCHQ)
US–Israeli Operations (Reported, Never Officially Attributed)
United States and Israel, as reported; no government has attributed these operations on the record
Criminal Ransomware Groups (No State Nexus Established)
Non-state: Russian-speaking ransomware groups (DarkSide, Conti, ALPHV/BlackCat); public assessments do not establish state sponsorship