[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"threat-actors-index-1-":3,"gb-ta-view-1-":187,"gb-actor-az":333},{"success":4,"data":5,"meta":328},true,[6,36,85,129,147,182,198,225,258,279,288,306],{"Name":7,"Description":8,"TypeOfIncident":9,"SuspectedStateSponsor":11,"TargetCategory":12,"Country":15,"Synonyms":16,"technique_count":34,"slug":35},"APT29","A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of State, Pentagon, and the Joint Chiefs of Staff. The threat actor includes all of the Dukes tool sets, including MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke (aka MiniDionis), and HammerDuke (aka Hammertoss). '",[10],"Espionage","Russian Federation",[13,14],"Government","Private sector","RU",[17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"Group 100","COZY BEAR","The Dukes","Minidionis","SeaDuke","YTTRIUM","IRON HEMLOCK","Grizzly Steppe","G0016","ATK7","Cloaked Ursa","TA421","Blue Kitsune","ITG11","BlueBravo","Nobelium","UAC-0029",159,"apt29",{"Name":37,"Description":38,"TypeOfIncident":39,"SuspectedStateSponsor":40,"TargetCategory":41,"Country":42,"Synonyms":43,"technique_count":83,"slug":84},"Lazarus Group","Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.",[],"Korea (Democratic People's Republic of)",[13,14],"KP",[44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82],"Operation DarkSeoul","Dark Seoul","Hidden Cobra","Hastati Group","Andariel","Unit 121","Bureau 121","NewRomanic Cyber Army Team","Bluenoroff","Subgroup: Bluenoroff","Group 77","Labyrinth Chollima","Operation Troy","Operation GhostSecret","Operation AppleJeus","APT38","APT 38","Stardust Chollima","Whois Hacking Team","Zinc","Appleworm","Nickel Academy","APT-C-26","NICKEL GLADSTONE","COVELLITE","ATK3","G0032","ATK117","G0082","Citrine Sleet","DEV-0139","DEV-1222","Diamond Sleet","ZINC","Sapphire Sleet","COPERNICIUM","TA404","Lazarus group","BeagleBoyz",156,"lazarus-group",{"Name":86,"Description":87,"TypeOfIncident":88,"SuspectedStateSponsor":89,"TargetCategory":90,"Country":106,"Synonyms":107,"technique_count":127,"slug":128},"APT41","APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.",[],"People's Republic of China",[91,92,93,94,95,96,97,98,99,100,101,102,14,103,104,105],"Automotive","Business","Services","Cryptocurrency","Education","Energy","Financial","Healthcare","High-Tech","Intergovernmental","Media and Entertainment","Pharmaceuticals","Retail","Telecommunications","Travel","CN",[108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126],"G0096","TA415","Blackfly","Grayfly","LEAD","BARIUM","WICKED SPIDER","WICKED PANDA","BRONZE ATLAS","BRONZE EXPORT","Red Kelpie","G0044","Earth Baku","Amoeba","HOODOO","Brass Typhoon","Winnti","Double Dragon","TG-2633",141,"apt41",{"Name":130,"Description":131,"TypeOfIncident":132,"SuspectedStateSponsor":40,"TargetCategory":133,"Country":42,"Synonyms":134,"technique_count":145,"slug":146},"Kimsuky","This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.",[10],[13,14],[135,136,137,138,139,140,141,142,143,144],"Velvet Chollima","Black Banshee","Thallium","Operation Stolen Pencil","G0086","APT43","Emerald Sleet","THALLIUM","Springtail","Sparkling Pisces",128,"kimsuky",{"Name":148,"Description":149,"TypeOfIncident":150,"SuspectedStateSponsor":11,"TargetCategory":151,"Country":15,"Synonyms":153,"technique_count":180,"slug":181},"APT28","The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.",[10],[13,152],"Military",[154,155,156,157,158,159,160,161,162,163,164,24,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179],"Pawn Storm","FANCY BEAR","Sednit","SNAKEMACKEREL","Tsar Team","TG-4127","STRONTIUM","Swallowtail","IRON TWILIGHT","Group 74","SIG40","G0007","ATK5","Fighting Ursa","ITG05","Blue Athena","TA422","T-APT-12","APT-C-20","UAC-0028","FROZENLAKE","Sofacy","Forest Blizzard","BlueDelta","Fancy Bear","GruesomeLarch",122,"apt28",{"Name":183,"Description":184,"TypeOfIncident":185,"SuspectedStateSponsor":186,"TargetCategory":187,"Country":106,"Synonyms":188,"technique_count":196,"slug":197},"Volt Typhoon","[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.\n\n[Secureworks] BRONZE SILHOUETTE likely operates on behalf the PRC. The targeting of U.S. government and defense organizations for intelligence gain aligns with PRC requirements, and the tradecraft observed in these engagements overlap with other state-sponsored Chinese threat groups.",[],"",null,[189,190,191,192,193,194,195],"BRONZE SILHOUETTE","VANGUARD PANDA","UNC3236","Insidious Taurus","VOLTZITE","Dev-0391","Storm-0391",112,"volt-typhoon",{"Name":199,"Description":200,"TypeOfIncident":201,"SuspectedStateSponsor":202,"TargetCategory":203,"Country":205,"Synonyms":206,"technique_count":223,"slug":224},"APT32","Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.",[10],"Vietnam",[13,14,204],"Civil society","VN",[207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222],"OceanLotus Group","Ocean Lotus","OceanLotus","Cobalt Kitty","APT-C-00","SeaLotus","Sea Lotus","APT-32","APT 32","Ocean Buffalo","POND LOACH","TIN WOODLAWN","BISMUTH","ATK17","G0050","Canvas Cyclone",105,"apt32",{"Name":226,"Description":227,"TypeOfIncident":228,"SuspectedStateSponsor":11,"TargetCategory":229,"Country":15,"Synonyms":230,"technique_count":256,"slug":257},"Turla","A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'",[10],[13,152],[231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255],"Snake","VENOMOUS Bear","Group 88","Waterbug","WRAITH","Uroburos","Pfinet","TAG_0530","KRYPTON","Hippo Team","Pacifier APT","Popeye","SIG23","IRON HUNTER","MAKERSMARK","ATK13","G0010","ITG12","Blue Python","SUMMIT","UNC4210","Secret Blizzard","UAC-0144","UAC-0024","UAC-0003",91,"turla",{"Name":259,"Description":260,"TypeOfIncident":261,"SuspectedStateSponsor":262,"TargetCategory":263,"Country":264,"Synonyms":265,"technique_count":277,"slug":278},"MuddyWater","The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.",[10],"Iran (Islamic Republic of)",[13],"IR",[266,267,268,269,270,271,272,273,274,275,276],"TEMP.Zagros","Static Kitten","Seedworm","MERCURY","COBALT ULSTER","G0069","ATK51","Boggy Serpens","Mango Sandstorm","TA450","Earth Vetala",82,"muddywater",{"Name":280,"Description":281,"TypeOfIncident":282,"SuspectedStateSponsor":186,"TargetCategory":187,"Country":15,"Synonyms":283,"technique_count":286,"slug":287},"FIN13","Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term intrusions in Mexico with an activity timeframe stretching back as early as 2016. Although their operations continue through the present day, in many ways FIN13's intrusions are like a time capsule of traditional financial cybercrime from days past. Instead of today's prevalent smash-and-grab ransomware groups, FIN13 takes their time to gather information to perform fraudulent money transfers. Rather than relying heavily on attack frameworks such as Cobalt Strike, the majority of FIN13 intrusions involve heavy use of custom passive backdoors and tools to lurk in environments for the long haul.",[],[284,285],"TG2003","Elephant Beetle",75,"fin13",{"Name":289,"Description":290,"TypeOfIncident":291,"SuspectedStateSponsor":186,"TargetCategory":187,"Country":15,"Synonyms":292,"technique_count":286,"slug":305},"FIN7","Groups targeting financial organizations or people with significant financial assets.",[],[293,294,295,296,297,298,299,300,301,302,303,304],"CARBON SPIDER","GOLD NIAGARA","Calcium","ATK32","G0046","G0008","Coreid","Carbanak","Sangria Tempest","ELBRUS","Carbon Spider","JokerStash","fin7",{"Name":307,"Description":308,"TypeOfIncident":309,"SuspectedStateSponsor":262,"TargetCategory":310,"Country":264,"Synonyms":311,"technique_count":326,"slug":327},"OilRig","OilRig is an Iranian threat group operating primarily in the Middle East by targeting organizations in this region that are in a variety of different industries; however, this group has occasionally targeted organizations outside of the Middle East as well. It also appears OilRig carries out supply chain attacks, where the threat group leverages the trust relationship between organizations to attack their primary targets. \r\n\r\nOilRig is an active and organized threat group, which is evident based on their systematic targeting of specific organizations that appear to be carefully chosen for strategic purposes. Attacks attributed to this group primarily rely on social engineering to exploit the human rather than software vulnerabilities; however, on occasion this group has used recently patched vulnerabilities in the delivery phase of their attacks. The lack of software vulnerability exploitation does not necessarily suggest a lack of sophistication, as OilRig has shown maturity in other aspects of their operations. Such maturities involve:\r\n\r\n-Organized evasion testing used the during development of their tools.\r\n-Use of custom DNS Tunneling protocols for command and control (C2) and data exfiltration.\r\n-Custom web-shells and backdoors used to persistently access servers.\r\n\r\nOilRig relies on stolen account credentials for lateral movement. After OilRig gains access to a system, they use credential dumping tools, such as Mimikatz, to steal credentials to accounts logged into the compromised system. The group uses these credentials to access and to move laterally to other systems on the network. After obtaining credentials from a system, operators in this group prefer to use tools other than their backdoors to access the compromised systems, such as remote desktop and putty. OilRig also uses phishing sites to harvest credentials to individuals at targeted organizations to gain access to internet accessible resources, such as Outlook Web Access.\n\n\n\nSince at least 2014, an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran. The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries. Repeated targeting of Middle Eastern financial, energy and government organizations leads FireEye to assess that those sectors are a primary concern of APT34. The use of infrastructure tied to Iranian operations, timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government.",[10],[13,14,204],[312,313,314,315,316,317,318,319,320,321,322,323,324,325],"Twisted Kitten","Cobalt Gypsy","Crambus","Helix Kitten","APT 34","APT34","IRN2","ATK40","G0049","Evasive Serpens","Hazel Sandstorm","EUROPIUM","TA452","Earth Simnavaz",74,"oilrig",{"total":329,"page":330,"limit":331,"totalPages":332},862,1,12,72,[334,335,336,337,338,339,340,341,342,343,344,345,346,349,352,355,358,361,364,367,370,373,376,379,382,385,388,391,394,397,400,403,406,409,412,415,418,421,424,427,430,433,436,439,442,445,448,451,454,457,460,463,466,469,472,475,478,481,484,487,490,493,496,499,502,505,508,511,514,517,520,523,526,529,532,535,538,541,544,547,550,553,556,559,562,565,568,571,574,577,580,583,586,589,592,595,598,601,604,607,610,613,616,619,622,625,628,631,634,637,640,643,646,649,652,655,658,661,664,667,670,673,676,679,682,685,688,691,694,697,700,703,706,709,712,715,718,721,724,727,730,733,736,739,742,745,748,751,754,757,760,763,766,769,772,775,778,781,784,787,790,793,796,799,802,805,808,811,814,817,820,823,826,829,832,835,838,841,844,847,850,853,856,859,862,865,868,871,874,877,880,883,886,889,892,895,898,901,904,907,910,913,916,919,922,925,928,931,934,937,940,943,946,949,952,955,958,961,964,967,970,973,976,979,982,985,988,991,994,997,1000,1003,1006,1009,1012,1015,1018,1021,1024,1027,1030,1033,1036,1039,1042,1045,1048,1051,1054,1057,1060,1063,1066,1069,1072,1075,1078,1081,1084,1087,1090,1093,1096,1099,1102,1105,1108,1111,1113,1116,1119,1122,1125,1128,1131,1134,1137,1140,1143,1146,1149,1152,1155,1158,1161,1164,1167,1170,1173,1176,1179,1182,1185,1188,1191,1194,1197,1200,1203,1206,1209,1212,1215,1218,1221,1224,1227,1230,1233,1236,1239,1242,1245,1248,1251,1254,1257,1260,1263,1266,1269,1272,1275,1278,1281,1284,1287,1290,1293,1296,1299,1302,1305,1308,1311,1314,1317,1320,1323,1326,1329,1332,1335,1338,1341,1344,1347,1350,1353,1356,1359,1362,1365,1368,1371,1374,1377,1380,1383,1386,1389,1392,1395,1398,1401,1404,1407,1410,1413,1416,1419,1422,1425,1428,1431,1434,1437,1440,1443,1446,1449,1452,1455,1458,1461,1464,1467,1470,1473,1476,1479,1482,1485,1488,1491,1494,1497,1500,1503,1506,1509,1512,1515,1518,1521,1524,1527,1530,1533,1536,1539,1542,1545,1548,1551,1554,1557,1560,1563,1566,1569,1572,1575,1578,1581,1584,1587,1590,1593,1596,1599,1602,1605,1608,1611,1614,1617,1620,1623,1626,1629,1632,1635,1638,1641,1644,1647,1650,1653,1656,1659,1662,1665,1668,1671,1674,1677,1680,1683,1686,1689,1692,1695,1698,1701,1704,1707,1710,1713,1716,1719,1722,1725,1728,1731,1734,1737,1740,1743,1746,1749,1752,1755,1758,1761,1764,1767,1770,1773,1776,1779,1782,1785,1788,1791,1794,1797,1800,1803,1806,1809,1812,1815,1818,1821,1824,1827,1830,1833,1836,1839,1842,1845,1848,1851,1854,1857,1860,1863,1866,1869,1872,1875,1878,1881,1884,1887,1890,1893,1896,1899,1902,1905,1908,1911,1914,1917,1920,1923,1926,1929,1932,1935,1937,1940,1943,1946,1949,1952,1954,1957,1960,1963,1966,1969,1972,1975,1978,1981,1984,1987,1990,1993,1996,1999,2002,2005,2008,2011,2014,2017,2020,2023,2026,2029,2032,2035,2038,2041,2044,2047,2050,2053,2056,2059,2062,2065,2068,2071,2074,2077,2080,2083,2086,2089,2092,2095,2098,2101,2104,2107,2110,2113,2116,2119,2122,2125,2128,2131,2134,2137,2140,2143,2146,2149,2152,2155,2158,2161,2164,2167,2170,2173,2176,2179,2182,2185,2188,2191,2194,2197,2200,2203,2206,2209,2212,2215,2218,2221,2224,2227,2230,2233,2236,2239,2242,2245,2248,2251,2254,2257,2260,2263,2266,2269,2272,2275,2278,2281,2284,2287,2290,2293,2296,2299,2302,2305,2308,2311,2314,2317,2320,2323,2326,2329,2332,2335,2338,2341,2344,2347,2350,2353,2356,2359,2362,2365,2368,2371,2374,2377,2380,2383,2386,2389,2392,2395,2398,2401,2404,2407,2410,2413,2416,2419,2422,2425,2428,2431,2434,2437,2440,2443,2446,2449,2452,2455,2458,2461,2464,2467,2470,2473,2476,2479,2482,2485,2488,2491,2494,2497,2500,2503,2506,2509,2512,2515,2518,2521,2524,2527,2530,2533,2536,2539,2542,2545,2548,2551,2554,2557,2560,2563,2566,2569,2572,2575,2578,2581,2584,2587,2590,2593,2596,2599,2602,2605,2608,2611,2614,2617,2620,2623,2626,2629,2632,2635,2638,2641,2644,2647,2650,2653,2655,2658,2661,2664,2667,2670,2673,2676,2679,2682,2685,2688,2691,2694,2697,2700,2703,2706,2709,2712,2715,2718,2721,2724,2727,2730,2733,2736,2739,2742,2745,2748,2751,2754,2757,2760,2763,2766,2769,2772,2775,2778,2781,2784,2787,2790,2793,2796,2799,2802,2805,2808,2811,2814,2817,2820,2823,2826,2829,2832,2835,2838,2841,2844,2847,2850,2853,2856,2859,2862,2865,2868,2871,2874,2877,2880,2882,2885,2888],[7,35],[37,84],[86,128],[130,146],[148,181],[183,197],[199,224],[226,257],[259,278],[280,287],[289,305],[307,327],[347,348],"Gamaredon Group","gamaredon-group",[350,351],"Scattered Spider","scattered-spider",[353,354],"TeamTNT","teamtnt",[356,357],"APT39","apt39",[359,360],"APT3","apt3",[362,363],"Earth Lusca","earth-lusca",[365,366],"FIN6","fin6",[368,369],"FIN8","fin8",[371,372],"Fox Kitten","fox-kitten",[374,375],"TA505","ta505",[377,378],"Rocke","rocke",[380,381],"APT33","apt33",[383,384],"HAFNIUM","hafnium",[386,387],"GALLIUM","gallium",[389,390],"TA2541","ta2541",[392,393],"APT37","apt37",[395,396],"APT5","apt5",[398,399],"ToddyCat","toddycat",[401,402],"Higaisa","higaisa",[404,405],"APT1","apt1",[407,408],"Winter Vivern","winter-vivern",[410,411],"TEMP.Veles","temp-veles",[413,414],"APT19","apt19",[416,417],"Molerats","molerats",[419,420],"SideCopy","sidecopy",[422,423],"Tonto Team","tonto-team",[425,426],"Naikon","naikon",[428,429],"EXOTIC LILY","exotic-lily",[431,432],"BackdoorDiplomacy","backdoordiplomacy",[434,435],"Silent Librarian","silent-librarian",[437,438],"BlackTech","blacktech",[440,441],"Stealth Falcon","stealth-falcon",[443,444],"Malteiro","malteiro",[446,447],"PROMETHIUM","promethium",[449,450],"Dark Caracal","dark-caracal",[452,453],"APT18","apt18",[455,456],"WIRTE","wirte",[458,459],"Mustard Tempest","mustard-tempest",[461,462],"Evilnum","evilnum",[464,465],"FIN10","fin10",[467,468],"APT-C-36","apt-c-36",[470,471],"PLATINUM","platinum",[473,474],"Metador","metador",[476,477],"Whitefly","whitefly",[479,480],"FIN5","fin5",[482,483],"CopyKittens","copykittens",[485,486],"Aoqin Dragon","aoqin-dragon",[488,489],"Sowbug","sowbug",[491,492],"DarkVishnya","darkvishnya",[494,495],"RTM","rtm",[497,498],"DarkHydrus","darkhydrus",[500,501],"IndigoZebra","indigozebra",[503,504],"GOLD SOUTHFIELD","gold-southfield",[506,507],"MoustachedBouncer","moustachedbouncer",[509,510],"POLONIUM","polonium",[512,513],"TA577","ta577",[515,516],"Gallmaker","gallmaker",[518,519],"Poseidon Group","poseidon-group",[521,522],"Ferocious Kitten","ferocious-kitten",[524,525],"Cleaver","cleaver",[527,528],"APT12","apt12",[530,531],"Mofang","mofang",[533,534],"TA459","ta459",[536,537],"Thrip","thrip",[539,540],"TA578","ta578",[542,543],"Volatile Cedar","volatile-cedar",[545,546],"Group5","group5",[548,549],"SilverTerrier","silverterrier",[551,552],"APT30","apt30",[554,555],"Orangeworm","orangeworm",[557,558],"APT17","apt17",[560,561],"GCMAN","gcman",[563,564],"APT16","apt16",[566,567],"Scarlet Mimic","scarlet-mimic",[569,570],"BlackOasis","blackoasis",[572,573],"BRONZE VAPOR","bronze-vapor",[575,576],"TianWu","tianwu",[578,579],"GOBLIN PANDA","goblin-panda",[581,582],"SLIME29","slime29",[584,585],"QUILTED TIGER","quilted-tiger",[587,588],"APT4","apt4",[590,591],"SAMURAI PANDA","samurai-panda",[593,594],"APT-C-12","apt-c-12",[596,597],"Sandworm","sandworm",[599,600],"APT2","apt2",[602,603],"APT10","apt10",[605,606],"Longhorn","longhorn",[608,609],"ENERGETIC BEAR","energetic-bear",[611,612],"Attor","attor",[614,615],"Beijing Group","beijing-group",[617,618],"Tick","tick",[620,621],"DragonOK","dragonok",[623,624],"Operation BugDrop","operation-bugdrop",[626,627],"DarkHotel","darkhotel",[629,630],"CHRYSENE","chrysene",[632,633],"RansomHouse","ransomhouse",[635,636],"APT9","apt9",[638,639],"Unit 8200","unit-8200",[641,642],"LOTUS PANDA","lotus-panda",[644,645],"El Machete","el-machete",[647,648],"Blackatom","blackatom",[650,651],"Flying Kitten","flying-kitten",[653,654],"BRONZE SPRING","bronze-spring",[656,657],"Red Dev 17","red-dev-17",[659,660],"GOLD BURLAP","gold-burlap",[662,663],"Sandman APT","sandman-apt",[665,666],"TEMPER PANDA","temper-panda",[668,669],"Inception Framework","inception-framework",[671,672],"OnionDog","oniondog",[674,675],"Careto","careto",[677,678],"TeamSpy Crew","teamspy-crew",[680,681],"APT40","apt40",[683,684],"Madi","madi",[686,687],"Infy","infy",[689,690],"SNOWGLOBE","snowglobe",[692,693],"Blue Termite","blue-termite",[695,696],"White Bear","white-bear",[698,699],"APT27","apt27",[701,702],"TempTick","temptick",[704,705],"RAZOR TIGER","razor-tiger",[707,708],"Curious Gorge","curious-gorge",[710,711],"Equation Group","equation-group",[713,714],"Rocket Kitten","rocket-kitten",[716,717],"ProjectSauron","projectsauron",[719,720],"APT14","apt14",[722,723],"DAGGER PANDA","dagger-panda",[725,726],"Charming Kitten","charming-kitten",[728,729],"APT21","apt21",[731,732],"TA406","ta406",[734,735],"Evasive Panda","evasive-panda",[737,738],"BANISHED KITTEN","banished-kitten",[740,741],"Cotton Sandstorm","cotton-sandstorm",[743,744],"Worok","worok",[746,747],"LYCEUM","lyceum",[749,750],"Gelsemium","gelsemium",[752,753],"Red Menshen","red-menshen",[755,756],"Earth Wendigo","earth-wendigo",[758,759],"AridViper","aridviper",[761,762],"Operation Parliament","operation-parliament",[764,765]," Stealth Mango and Tangelo ","stealth-mango-and-tangelo",[767,768],"RANCOR","rancor",[770,771],"Hellsing","hellsing",[773,774],"APT15","apt15",[776,777],"Copy-Paste","copy-paste",[779,780],"Storm-0558","storm-0558",[782,783],"InvisiMole","invisimole",[785,786],"BladeHawk","bladehawk",[788,789],"Killnet","killnet",[791,792],"Ghostwriter","ghostwriter",[794,795],"Earth Berberoka","earth-berberoka",[797,798],"NoName057(16)","noname057-16",[800,801],"Antlion","antlion",[803,804],"APT42","apt42",[806,807],"Tortoiseshell","tortoiseshell",[809,810],"WIZARD SPIDER","wizard-spider",[812,813],"Predatory Sparrow","predatory-sparrow",[815,816],"ModifiedElephant","modifiedelephant",[818,819],"Operation C-Major","operation-c-major",[821,822],"Unnamed Actor","unnamed-actor",[824,825],"HenBox","henbox",[827,828],"MUSTANG PANDA","mustang-panda",[830,831],"Grayling","grayling",[833,834],"Chamelgang","chamelgang",[836,837],"RedGolf","redgolf",[839,840],"DEV-0586","dev-0586",[842,843],"Karakurt","karakurt",[845,846],"Scarab","scarab",[848,849],"UNC3524","unc3524",[851,852],"Cosmic Lynx","cosmic-lynx",[854,855],"ZooPark","zoopark",[857,858],"ZeroSevenGroup","zerosevengroup",[860,861],"Zarya","zarya",[863,864],"YoroTrooper","yorotrooper",[866,867],"Xiaoqiying","xiaoqiying",[869,870],"XakNet","xaknet",[872,873],"JINX-0126","jinx-0126",[875,876],"Water Curupira","water-curupira",[878,879],"Witchetty","witchetty",[881,882],"WIP19","wip19",[884,885],"WildPressure","wildpressure",[887,888],"WildCard","wildcard",[890,891],"UTA0178","uta0178",[893,894],"The Big Bang","the-big-bang",[896,897],"Snake Wine","snake-wine",[899,900],"Slingshot","slingshot",[902,903],"Scattered Canary","scattered-canary",[905,906],"Operation Poison Needles","operation-poison-needles",[908,909],"Urpage","urpage",[911,912],"APT20","apt20",[914,915],"WeRedEvils","weredevils",[917,918],"HURRICANE PANDA","hurricane-panda",[920,921],"WeedSec","weedsec",[923,924],"Operation WizardOpium","operation-wizardopium",[926,927],"Water Orthrus","water-orthrus",[929,930],"Water Makara","water-makara",[932,933],"Water Gamayun","water-gamayun",[935,936],"Water Barghest","water-barghest",[938,939],"Wassonite","wassonite",[941,942],"WageMole","wagemole",[944,945],"VulzSecTeam","vulzsecteam",[947,948],"Void Rabisu","void-rabisu",[950,951],"Void Manticore","void-manticore",[953,954],"Void Blizzard","void-blizzard",[956,957],"Void Banshee","void-banshee",[959,960],"Void Balaur","void-balaur",[962,963],"Void Arachne","void-arachne",[965,966],"VIKING SPIDER","viking-spider",[968,969],"VICE SPIDER","vice-spider",[971,972],"Vanilla Tempest","vanilla-tempest",[974,975],"VICEROY TIGER","viceroy-tiger",[977,978],"FishMedley","fishmedley",[980,981],"UAC-0020","uac-0020",[983,984],"VENOM SPIDER","venom-spider",[986,987],"Velvet Tempest","velvet-tempest",[989,990],"UTG-Q-010","utg-q-010",[992,993],"UTG-Q-008","utg-q-008",[995,996],"UTA0355","uta0355",[998,999],"UTA0352","uta0352",[1001,1002],"UTA0218","uta0218",[1004,1005],"UserSec","usersec",[1007,1008],"USDoD","usdod",[1010,1011],"UNK_RemoteRogue","unk-remoterogue",[1013,1014],"The Gorgon Group","the-gorgon-group",[1016,1017],"Unfading Sea Haze","unfading-sea-haze",[1019,1020],"UNC5820","unc5820",[1022,1023],"UNC5537","unc5537",[1025,1026],"UNC5337","unc5337",[1028,1029],"UNC5330","unc5330",[1031,1032],"UNC5325","unc5325",[1034,1035],"UNC5291","unc5291",[1037,1038],"UNC5174","unc5174",[1040,1041],"UNC4990","unc4990",[1043,1044],"UNC4841","unc4841",[1046,1047],"UNC4736","unc4736",[1049,1050],"UNC4540","unc4540",[1052,1053],"UNC4536","unc4536",[1055,1056],"UNC4393","unc4393",[1058,1059],"UNC4191","unc4191",[1061,1062],"UNC3973","unc3973",[1064,1065],"UNC3886","unc3886",[1067,1068],"UNC2970","unc2970",[1070,1071],"UNC2717","unc2717",[1073,1074],"UNC2659","unc2659",[1076,1077],"UNC2630","unc2630",[1079,1080],"UNC2565","unc2565",[1082,1083],"UNC2465","unc2465",[1085,1086],"UNC2447","unc2447",[1088,1089],"UNC215","unc215",[1091,1092],"LightBasin","lightbasin",[1094,1095],"UNC1878","unc1878",[1097,1098],"UNC1860","unc1860",[1100,1101],"UNC1549","unc1549",[1103,1104],"UAT-5918","uat-5918",[1106,1107],"UAT-5394","uat-5394",[1109,1110],"Storm-1849","storm-1849",[1112,1110],"STORM-1849",[1114,1115],"UAC-0226","uac-0226",[1117,1118],"UAC-0219","uac-0219",[1120,1121],"UAC-0215","uac-0215",[1123,1124],"UAC-0194","uac-0194",[1126,1127],"UAC-0185","uac-0185",[1129,1130],"UAC-0184","uac-0184",[1132,1133],"UAC-0154","uac-0154",[1135,1136],"UAC-0149","uac-0149",[1138,1139],"UAC-0102","uac-0102",[1141,1142],"UAC-0099","uac-0099",[1144,1145],"UAC-0063","uac-0063",[1147,1148],"UAC-0050","uac-0050",[1150,1151],"UAC-0006","uac-0006",[1153,1154],"TwoSail Junk","twosail-junk",[1156,1157],"Aslan Neferler Tim","aslan-neferler-tim",[1159,1160],"Tstark","tstark",[1162,1163],"TRIPLESTRENGTH","triplestrength",[1165,1166],"Earth Estries","earth-estries",[1168,1169],"Water Labbu","water-labbu",[1171,1172],"APT23","apt23",[1174,1175],"FASTCash","fastcash",[1177,1178],"TraderTraitor","tradertraitor",[1180,1181],"Tomiris","tomiris",[1183,1184],"TIDRONE","tidrone",[1186,1187],"Red Charon","red-charon",[1189,1190],"BOSS SPIDER","boss-spider",[1192,1193],"Fxmsp","fxmsp",[1195,1196],"Threatsec","threatsec",[1198,1199],"Dust Storm","dust-storm",[1201,1202],"Common Raven","common-raven",[1204,1205],"Threat Actor 888","threat-actor-888",[1207,1208],"Flash Kitten","flash-kitten",[1210,1211],"Rebel Jackal","rebel-jackal",[1213,1214],"Kinsing","kinsing",[1216,1217],"SHARK SPIDER","shark-spider",[1219,1220],"HummingBad","hummingbad",[1222,1223],"Sea Turtle","sea-turtle",[1225,1226],"TA800","ta800",[1228,1229],"Nazar","nazar",[1231,1232],"TA516","ta516",[1234,1235],"Watchdog","watchdog",[1237,1238],"Cyber Alliance","cyber-alliance",[1240,1241],"TunnelSnake","tunnelsnake",[1243,1244],"TOXCAR CYBER TEAM","toxcar-cyber-team",[1246,1247],"Keksec","keksec",[1249,1250],"Storm-0324","storm-0324",[1252,1253],"Operation Red Signature","operation-red-signature",[1255,1256],"Taidoor","taidoor",[1258,1259],"Deadeye Jackal","deadeye-jackal",[1261,1262],"Smishing Triad","smishing-triad",[1264,1265],"The Shadow Brokers","the-shadow-brokers",[1267,1268],"Nitro","nitro",[1270,1271],"APT24","apt24",[1273,1274],"PassCV","passcv",[1276,1277],"Operation Sharpshooter","operation-sharpshooter",[1279,1280],"Hacking Team","hacking-team",[1282,1283],"Kasablanka","kasablanka",[1285,1286],"Cyber Av3ngers","cyber-av3ngers",[1288,1289],"Gnosticplayers","gnosticplayers",[1291,1292],"Dalbit","dalbit",[1294,1295],"Avivore","avivore",[1297,1298],"APT6","apt6",[1300,1301],"TheDarkOverlord","thedarkoverlord",[1303,1304],"FusionCore","fusioncore",[1306,1307],"Cyber Partisans","cyber-partisans",[1309,1310],"Storm-0062","storm-0062",[1312,1313],"SmugX","smugx",[1315,1316],"Callisto","callisto",[1318,1319],"HAZY TIGER","hazy-tiger",[1321,1322],"Belsen Group","belsen-group",[1324,1325],"Water Sigbin","water-sigbin",[1327,1328],"TetrisPhantom","tetrisphantom",[1330,1331],"TEMP_Heretic","temp-heretic",[1333,1334],"Teleboyi","teleboyi",[1336,1337],"Team-Xecuter","team-xecuter",[1339,1340],"TaskMasters","taskmasters",[1342,1343],"TAG-56","tag-56",[1345,1346],"TAG-28","tag-28",[1348,1349],"TAG-124","tag-124",[1351,1352],"TAG-112","tag-112",[1354,1355],"Storm-2077","storm-2077",[1357,1358],"TA579","ta579",[1360,1361],"TA575","ta575",[1363,1364],"TA571","ta571",[1366,1367],"TA547","ta547",[1369,1370],"TA530","ta530",[1372,1373],"TA499","ta499",[1375,1376],"TA4903","ta4903",[1378,1379],"TA455","ta455",[1381,1382],"TA453","ta453",[1384,1385],"TA444","ta444",[1387,1388],"TA402","ta402",[1390,1391],"TA2725","ta2725",[1393,1394],"TA2722","ta2722",[1396,1397],"TA2536","ta2536",[1399,1400],"Cadelle","cadelle",[1402,1403],"Carderbee","carderbee",[1405,1406],"SYLHET GANG-SG","sylhet-gang-sg",[1408,1409],"APT22","apt22",[1411,1412],"StucxTeam","stucxteam",[1414,1415],"Storm Cloud","storm-cloud",[1417,1418],"Storm-2460","storm-2460",[1420,1421],"Storm-2372","storm-2372",[1423,1424],"Storm-2139","storm-2139",[1426,1427],"Storm-1977","storm-1977",[1429,1430],"Storm-1679","storm-1679",[1432,1433],"Storm-1674","storm-1674",[1435,1436],"Storm-1575","storm-1575",[1438,1439],"Storm-1567","storm-1567",[1441,1442],"Storm-1295","storm-1295",[1444,1445],"Storm-1286","storm-1286",[1447,1448],"Storm-1283","storm-1283",[1450,1451],"Storm-1167","storm-1167",[1453,1454],"Storm-1152","storm-1152",[1456,1457],"Storm-1113","storm-1113",[1459,1460],"Storm-1099","storm-1099",[1462,1463],"Storm-1084","storm-1084",[1465,1466],"Storm-1044","storm-1044",[1468,1469],"Storm-0940","storm-0940",[1471,1472],"Storm-0867","storm-0867",[1474,1475],"Storm-0826","storm-0826",[1477,1478],"Storm-0539","storm-0539",[1480,1481],"Storm-0506","storm-0506",[1483,1484],"Storm-0501","storm-0501",[1486,1487],"Storm-0494","storm-0494",[1489,1490],"Storm-0473","storm-0473",[1492,1493],"Storm-0381","storm-0381",[1495,1496],"Storm-0249","storm-0249",[1498,1499],"UAC-0094","uac-0094",[1501,1502],"Starry Addax","starry-addax",[1504,1505],"Stargazer Goblin","stargazer-goblin",[1507,1508],"STAC5143","stac5143",[1510,1511],"SPIKEDWINE","spikedwine",[1513,1514],"MONTY SPIDER","monty-spider",[1516,1517],"Webworm","webworm",[1519,1520],"SpaceBears","spacebears",[1522,1523],"Sp1d3r","sp1d3r",[1525,1526],"SongXY","songxy",[1528,1529],"Solntsepek","solntsepek",[1531,1532],"SOLAR SPIDER","solar-spider",[1534,1535],"SneakyChef","sneakychef",[1537,1538],"SloppyLemming","sloppylemming",[1540,1541],"SkidSec","skidsec",[1543,1544],"SingularityMD","singularitymd",[1546,1547],"ResumeLooters","resumelooters",[1549,1550],"TA554","ta554",[1552,1553],"Anonymous Sudan","anonymous-sudan",[1555,1556],"TA2552","ta2552",[1558,1559],"TA482","ta482",[1561,1562],"TA558","ta558",[1564,1565],"Sima","sima",[1567,1568],"SilverFish","silverfish",[1570,1571],"SilkSpecter","silkspecter",[1573,1574],"SILKFIN AGENCY","silkfin-agency",[1576,1577],"SilitNetwork","silitnetwork",[1579,1580],"SiegedSec","siegedsec",[1582,1583],"ShinyHunters","shinyhunters",[1585,1586],"SharpPanda","sharppanda",[1588,1589],"Shahid Hemmat","shahid-hemmat",[1591,1592],"ShaggyPanther","shaggypanther",[1594,1595],"ShadowSyndicate","shadowsyndicate",[1597,1598],"Shadow Network","shadow-network",[1600,1601],"SEXi","sexi",[1603,1604],"Swan Vector","swan-vector",[1606,1607],"HollowQuill","hollowquill",[1609,1610],"ScreamedJungle","screamedjungle",[1612,1613],"Scarred Manticore","scarred-manticore",[1615,1616],"SCARLETEEL","scarleteel",[1618,1619],"ScamClub","scamclub",[1621,1622],"SandCat","sandcat",[1624,1625],"SAMBASPIDER","sambaspider",[1627,1628],"Saad Tycoon","saad-tycoon",[1630,1631],"Ruthless Rabbit","ruthless-rabbit",[1633,1634],"Ruby Sleet","ruby-sleet",[1636,1637],"RUBYCARP","rubycarp",[1639,1640],"Lifting Zmiy","lifting-zmiy",[1642,1643],"RomCom","romcom",[1645,1646],"Yanbian Gang","yanbian-gang",[1648,1649],"RipperSec","rippersec",[1651,1652],"RGB-TEAM","rgb-team",[1654,1655],"RevengeHotels","revengehotels",[1657,1658],"Returned Libra","returned-libra",[1660,1661],"IRIDIUM","iridium",[1663,1664],"NOTROBIN","notrobin",[1666,1667],"UNC2452","unc2452",[1669,1670],"REF7707","ref7707",[1672,1673],"Red Nue","red-nue",[1675,1676],"Red-Lili","red-lili",[1678,1679],"RedJuliett","redjuliett",[1681,1682],"Redfly","redfly",[1684,1685],"RedEcho","redecho",[1687,1688],"RedAlpha","redalpha",[1690,1691],"Reckless Rabbit","reckless-rabbit",[1693,1694],"XDSpy","xdspy",[1696,1697],"RansomHub","ransomhub",[1699,1700],"RansomVC","ransomvc",[1702,1703],"RaHDit","rahdit",[1705,1706],"R00tK1T","r00tk1t",[1708,1709],"PurpleHaze","purplehaze",[1711,1712],"puNK-003","punk-003",[1714,1715],"ANTHROPOID SPIDER","anthropoid-spider",[1717,1718],"Pickaxe","pickaxe",[1720,1721],"Prophet Spider","prophet-spider",[1723,1724],"TA428","ta428",[1726,1727],"TA2101","ta2101",[1729,1730],"Prolific Puma","prolific-puma",[1732,1733],"DustSquad","dustsquad",[1735,1736],"ProCC","procc",[1738,1739],"PlushDaemon","plushdaemon",[1741,1742],"Phlox Tempest","phlox-tempest",[1744,1745],"PhantomCore","phantomcore",[1747,1748],"PhantomControl","phantomcontrol",[1750,1751],"PerSwaysion","perswaysion",[1753,1754],"Pearl Sleet","pearl-sleet",[1756,1757],"[Unnamed group]","unnamed-group",[1759,1760],"OVERLORD SPIDER","overlord-spider",[1762,1763],"OverFlame","overflame",[1765,1766],"OurMine","ourmine",[1768,1769],"CLOCKWORK SPIDER","clockwork-spider",[1771,1772],"Operation Wocao","operation-wocao",[1774,1775],"Operation Triangulation","operation-triangulation",[1777,1778],"Operation Shadow Force","operation-shadow-force",[1780,1781],"Operation Ghoul","operation-ghoul",[1783,1784],"Operation ForumTroll","operation-forumtroll",[1786,1787],"Operation Emmental","operation-emmental",[1789,1790],"Operation DRBControl","operation-drbcontrol",[1792,1793],"Operation Comando","operation-comando",[1795,1796],"GOLD NORTHFIELD","gold-northfield",[1798,1799],"STARDUST CHOLLIMA","stardust-chollima",[1801,1802],"OUTLAW SPIDER","outlaw-spider",[1804,1805],"Cutting Kitten","cutting-kitten",[1807,1808],"TA570","ta570",[1810,1811],"TiltedTemple","tiltedtemple",[1813,1814],"PARINACOTA","parinacota",[1816,1817],"ZOMBIE SPIDER","zombie-spider",[1819,1820],"OldGremlin","oldgremlin",[1822,1823],"OilAlpha","oilalpha",[1825,1826],"Storm-0829","storm-0829",[1828,1829],"Nullbulge","nullbulge",[1831,1832],"AtlasCross","atlascross",[1834,1835],"Nexus Zeta","nexus-zeta",[1837,1838],"NewsPenguin","newspenguin",[1840,1841],"Operation ShadowHammer","operation-shadowhammer",[1843,1844],"NB65","nb65",[1846,1847],"NEODYMIUM","neodymium",[1849,1850],"Natohub","natohub",[1852,1853],"NARWHAL SPIDER","narwhal-spider",[1855,1856],"Nam3L3ss","nam3l3ss",[1858,1859],"MurenShark","murenshark",[1861,1862],"MUMMY SPIDER","mummy-spider",[1864,1865],"Moshen Dragon","moshen-dragon",[1867,1868],"MORH4x","morh4x",[1870,1871],"Mora_001","mora-001",[1873,1874],"Molatori","molatori",[1876,1877],"Mogilevich","mogilevich",[1879,1880],"MirrorFace","mirrorface",[1882,1883],"MIMIC SPIDER","mimic-spider",[1885,1886],"DEV-0270","dev-0270",[1888,1889],"TERBIUM","terbium",[1891,1892],"DEV-1028","dev-1028",[1894,1895],"Raspberry Typhoon","raspberry-typhoon",[1897,1898],"BelialDemon","belialdemon",[1900,1901],"SMOKY SPIDER","smoky-spider",[1903,1904],"SCULLY SPIDER","scully-spider",[1906,1907],"NOCTURNAL SPIDER","nocturnal-spider",[1909,1910],"Honeybee","honeybee",[1912,1913],"Massgrave","massgrave",[1915,1916],"Markopolo","markopolo",[1918,1919],"UNC5266","unc5266",[1921,1922],"EvilTraffic","eviltraffic",[1924,1925],"PowerPool","powerpool",[1927,1928],"Malsmoke","malsmoke",[1930,1931],"MalKamak","malkamak",[1933,1934],"DangerousSavanna","dangeroussavanna",[1936,1936],"luoxk",[1938,1939],"Luna Moth","luna-moth",[1941,1942],"LulzSec Black","lulzsec-black",[1944,1945],"LofyGang","lofygang",[1947,1948],"LinkC Pub","linkc-pub",[1950,1951],"Liminal Panda","liminal-panda",[1953,1951],"LIMINAL PANDA",[1955,1956],"Lilac Typhoon","lilac-typhoon",[1958,1959],"LilacSquid","lilacsquid",[1961,1962],"RedDelta","reddelta",[1964,1965],"Libyan Scorpions","libyan-scorpions",[1967,1968],"Larva-24005","larva-24005",[1970,1971],"Larva-208","larva-208",[1973,1974],"Lancefly","lancefly",[1976,1977],"DEV-0950","dev-0950",[1979,1980],"LabHost","labhost",[1982,1983],"KromSec","kromsec",[1985,1986],"Opal Sleet","opal-sleet",[1988,1989],"KNOCKOUT SPIDER","knockout-spider",[1991,1992],"KelvinSecurity","kelvinsecurity",[1994,1995],"KAX17","kax17",[1997,1998],"BadRory","badrory",[2000,2001],"Karkadann","karkadann",[2003,2004],"Kairos","kairos",[2006,2007],"JuiceLedger","juiceledger",[2009,2010],"JavaGhost","javaghost",[2012,2013],"Jabaroot","jabaroot",[2015,2016],"HiddenArt","hiddenart",[2018,2019],"ItaDuke","itaduke",[2021,2022],"IronHusky","ironhusky",[2024,2025],"Iron Group","iron-group",[2027,2028],"IRLeaks","irleaks",[2030,2031],"NOMAD PANDA","nomad-panda",[2033,2034],"IntelBroker","intelbroker",[2036,2037],"Cold River","cold-river",[2039,2040],"ShroudedSnooper","shroudedsnooper",[2042,2043],"RedStinger","redstinger",[2045,2046],"ViceLeaker","viceleaker",[2048,2049],"N4ughtysecTU","n4ughtysectu",[2051,2052],"MoneyTaker","moneytaker",[2054,2055],"TA2719","ta2719",[2057,2058],"DOPPEL SPIDER","doppel-spider",[2060,2061],"RATPAK SPIDER","ratpak-spider",[2063,2064],"Camaro Dragon","camaro-dragon",[2066,2067],"Storm-1133","storm-1133",[2069,2070],"BRONZE EDGEWOOD","bronze-edgewood",[2072,2073],"INDRIK SPIDER","indrik-spider",[2075,2076],"INDOHAXSEC TEAM","indohaxsec-team",[2078,2079],"BRONZE SPIRAL","bronze-spiral",[2081,2082],"WindShift","windshift",[2084,2085],"TRACER KITTEN","tracer-kitten",[2087,2088],"Operation Soft Cell","operation-soft-cell",[2090,2091],"IcePeony","icepeony",[2093,2094],"GozNym","goznym",[2096,2097],"Hunt3r Kill3rs","hunt3r-kill3rs",[2099,2100],"HookAds","hookads",[2102,2103],"HomeLand Justice","homeland-justice",[2105,2106],"HIVE-0145","hive-0145",[2108,2109],"Hive0117","hive0117",[2111,2112],"HikkI-Chan","hikki-chan",[2114,2115],"Hezb","hezb",[2117,2118],"HellHounds","hellhounds",[2120,2121],"Head Mare","head-mare",[2123,2124],"Handala","handala",[2126,2127],"Hagga","hagga",[2129,2130],"Storm-0530","storm-0530",[2132,2133],"Guacamaya","guacamaya",[2135,2136],"Groundbait","groundbait",[2138,2139],"GRIM SPIDER","grim-spider",[2141,2142],"GREF","gref",[2144,2145],"GreenSpot","greenspot",[2147,2148],"Greenbug","greenbug",[2150,2151],"Gray Sandstorm","gray-sandstorm",[2153,2154],"Gorilla","gorilla",[2156,2157],"GOLD WINTER","gold-winter",[2159,2160],"GOLD WATERFALL","gold-waterfall",[2162,2163],"GOLD SYMPHONY","gold-symphony",[2165,2166],"GOLD SKYLINE","gold-skyline",[2168,2169],"GOLD RIVERVIEW","gold-riverview",[2171,2172],"GOLD REBELLION","gold-rebellion",[2174,2175],"GOLD PRELUDE","gold-prelude",[2177,2178],"GOLD MANSARD","gold-mansard",[2180,2181],"GOLD GARDEN","gold-garden",[2183,2184],"GOLD GALLEON","gold-galleon",[2186,2187],"GOLD FLANDERS","gold-flanders",[2189,2190],"GOLD FAIRFAX","gold-fairfax",[2192,2193],"GoldFactory","goldfactory",[2195,2196],"GOLD EVERGREEN","gold-evergreen",[2198,2199],"GoldenJackal","goldenjackal",[2201,2202],"GOLD DUPONT","gold-dupont",[2204,2205],"GOLD CABIN","gold-cabin",[2207,2208],"GOFFEE","goffee",[2210,2211],"Gitloker","gitloker",[2213,2214],"GhostSec","ghostsec",[2216,2217],"GhostR","ghostr",[2219,2220],"GhostEmperor","ghostemperor",[2222,2223],"GambleForce","gambleforce",[2225,2226],"GamaCopy","gamacopy",[2228,2229],"FunkSec","funksec",[2231,2232],"FrostyNeighbor","frostyneighbor",[2234,2235],"UAC-0118","uac-0118",[2237,2238],"GC01","gc01",[2240,2241],"GC02","gc02",[2243,2244],"TurkHackTeam","turkhackteam",[2246,2247],"Calypso","calypso",[2249,2250],"FlyingYeti","flyingyeti",[2252,2253],"Flax Typhoon","flax-typhoon",[2255,2256],"Fishing Elephant","fishing-elephant",[2258,2259],"PINCHY SPIDER","pinchy-spider",[2261,2262],"Boulder Bear","boulder-bear",[2264,2265],"Siesta","siesta",[2267,2268],"APT35","apt35",[2270,2271],"FIN1","fin1",[2273,2274],"APT31","apt31",[2276,2277],"WOLF SPIDER","wolf-spider",[2279,2280],"FIN11","fin11",[2282,2283],"Fail0verflow","fail0verflow",[2285,2286],"ExCobalt","excobalt",[2288,2289],"EvilWeb","evilweb",[2291,2292],"Evil Corp","evil-corp",[2294,2295],"Evilbyte","evilbyte",[2297,2298],"GreyEnergy","greyenergy",[2300,2301],"SparklingGoblin","sparklinggoblin",[2303,2304],"ELUSIVE COMET","elusive-comet",[2306,2307],"REF5961","ref5961",[2309,2310],"Edalat-e Ali","edalat-e-ali",[2312,2313],"EC2 Grouper","ec2-grouper",[2315,2316],"Earth Yako","earth-yako",[2318,2319],"Earth Longzhi","earth-longzhi",[2321,2322],"Earth Kurma","earth-kurma",[2324,2325],"Earth Krahang","earth-krahang",[2327,2328],"Earth Kitsune","earth-kitsune",[2330,2331],"Earth Kapre","earth-kapre",[2333,2334],"Earth Freybug","earth-freybug",[2336,2337],"Earth Baxia","earth-baxia",[2339,2340],"Earth Alux","earth-alux",[2342,2343],"TA410","ta410",[2345,2346],"GURU SPIDER","guru-spider",[2348,2349],"Magic Kitten","magic-kitten",[2351,2352],"DUNGEON SPIDER","dungeon-spider",[2354,2355],"DriftingCloud","driftingcloud",[2357,2358],"RASPITE","raspite",[2360,2361],"DragonSpark","dragonspark",[2363,2364],"DragonRank","dragonrank",[2366,2367],"DragonForce","dragonforce",[2369,2370],"Dragonbridge","dragonbridge",[2372,2373],"MageCart","magecart",[2375,2376],"DieNet","dienet",[2378,2379],"DiceyF","diceyf",[2381,2382],"Storm-1101","storm-1101",[2384,2385],"DEV-0928","dev-0928",[2387,2388],"Sunglow Blizzard","sunglow-blizzard",[2390,2391],"DEV-0569","dev-0569",[2393,2394],"DEV-0147","dev-0147",[2396,2397],"Desorden Group","desorden-group",[2399,2400],"Denim Tsunami","denim-tsunami",[2402,2403],"DefrayX","defrayx",[2405,2406],"DarkRaaS","darkraas",[2408,2409],"DarkCasino","darkcasino",[2411,2412],"Dark Basin","dark-basin",[2414,2415],"Dancing Salome","dancing-salome",[2417,2418],"Daixin Team","daixin-team",[2420,2421],"Cyber Toufan","cyber-toufan",[2423,2424],"CyberNiggers","cyberniggers",[2426,2427],"GhostNet","ghostnet",[2429,2430],"MosesStaff","mosesstaff",[2432,2433],"Storm-0835","storm-0835",[2435,2436],"Cyber.Anarchy.Squad","cyber-anarchy-squad",[2438,2439],"Ukrainian Cyber Alliance","ukrainian-cyber-alliance",[2441,2442],"Cuboid Sandstorm","cuboid-sandstorm",[2444,2445],"CRYSTALRAY","crystalray",[2447,2448],"BAMBOO SPIDER","bamboo-spider",[2450,2451],"TRAVELING SPIDER","traveling-spider",[2453,2454],"MALLARD SPIDER","mallard-spider",[2456,2457],"Kiss-a-Dog","kiss-a-dog",[2459,2460],"CoughingDown","coughingdown",[2462,2463],"CostaRicto","costaricto",[2465,2466],"CosmicBeetle","cosmicbeetle",[2468,2469],"CoralRaider","coralraider",[2471,2472],"Confucious","confucious",[2474,2475],"Codefinger","codefinger",[2477,2478],"COBALT KATANA","cobalt-katana",[2480,2481],"COBALT JUNO","cobalt-juno",[2483,2484],"CL-STA-0043","cl-sta-0043",[2486,2487],"CloudSorcerer","cloudsorcerer",[2489,2490],"Xcatze","xcatze",[2492,2493],"SWEED","sweed",[2495,2496],"DNSpionage","dnspionage",[2498,2499],"CiberInteligenciaSV","ciberinteligenciasv",[2501,2502],"UNC3569","unc3569",[2504,2505],"Chernovite","chernovite",[2507,2508],"Vicious Panda","vicious-panda",[2510,2511],"Chaya_004","chaya-004",[2513,2514],"CeranaKeeper","ceranakeeper",[2516,2517],"Carmine Tsunami","carmine-tsunami",[2519,2520],"CardinalLizard","cardinallizard",[2522,2523],"Caramel Tsunami","caramel-tsunami",[2525,2526],"Caracal Kitten","caracal-kitten",[2528,2529],"Caliente Bandits","caliente-bandits",[2531,2532],"BuhTrap","buhtrap",[2534,2535],"BRONZE STARLIGHT","bronze-starlight",[2537,2538],"BRONZE HIGHLAND","bronze-highland",[2540,2541],"BrazenBamboo","brazenbamboo",[2543,2544],"BOSON SPIDER","boson-spider",[2546,2547],"Boolka","boolka",[2549,2550],"Bondnet","bondnet",[2552,2553],"Bohrium","bohrium",[2555,2556],"Blue Tsunami","blue-tsunami",[2558,2559],"BlueHornet","bluehornet",[2561,2562],"BlueBottle","bluebottle",[2564,2565],"Blackwood","blackwood",[2567,2568],"Blacktail","blacktail",[2570,2571],"Blackmeta","blackmeta",[2573,2574],"BlackJack","blackjack",[2576,2577],"Blackgear","blackgear",[2579,2580],"BITWISE SPIDER","bitwise-spider",[2582,2583],"Bignosa","bignosa",[2585,2586],"POISON CARP","poison-carp",[2588,2589],"Hive0137","hive0137",[2591,2592],"TA555","ta555",[2594,2595],"SALTY SPIDER","salty-spider",[2597,2598],"BazarCall","bazarcall",[2600,2601],"Budminer","budminer",[2603,2604],"Bahamut","bahamut",[2606,2607],"AzzaSec","azzasec",[2609,2610],"Ayyıldız Tim","ayy-ld-z-tim",[2612,2613],"Awaken Likho","awaken-likho",[2615,2616],"Sath-ı Müdafaa","sath-m-dafaa",[2618,2619],"Packrat","packrat",[2621,2622],"APT-C-27","apt-c-27",[2624,2625],"UNC3890","unc3890",[2627,2628],"APT-C-34","apt-c-34",[2630,2631],"Asnarök","asnar-k",[2633,2634],"Lucky Cat","lucky-cat",[2636,2637],"TAG-53","tag-53",[2639,2640],"Silence group","silence-group",[2642,2643],"ArcaneDoor","arcanedoor",[2645,2646],"APT-C-60","apt-c-60",[2648,2649],"APT73","apt73",[2651,2652],"APT45","apt45",[140,2654],"apt43",[2656,2657],"BiBiGun","bibigun",[2659,2660],"AppMilad","appmilad",[2662,2663],"[Vault 7\u002F8]","vault-7-8",[2665,2666],"Pacha Group","pacha-group",[2668,2669],"Anonymous KSA","anonymous-ksa",[2671,2672],"Anonymous64","anonymous64",[2674,2675],"Angry Likho","angry-likho",[2677,2678],"Domestic Kitten","domestic-kitten",[2680,2681],"Silent Chollima","silent-chollima",[2683,2684],"LAPSUS","lapsus",[2686,2687],"Altoufan Team","altoufan-team",[2689,2690],"ALTDOS","altdos",[2692,2693],"Altahrea Team","altahrea-team",[2695,2696],"Alpha Spider","alpha-spider",[2698,2699],"SaintBear","saintbear",[2701,2702],"TOXIC PANDA","toxic-panda",[2704,2705],"REF2924","ref2924",[2707,2708],"Pink Sandstorm","pink-sandstorm",[2710,2711],"Aggressive Inventory Zombies","aggressive-inventory-zombies",[2713,2714],"AeroBlade","aeroblade",[2716,2717],"UNION SPIDER","union-spider",[2719,2720],"FOXY PANDA","foxy-panda",[2722,2723],"ALLANITE","allanite",[2725,2726],"Adrastea","adrastea",[2728,2729],"Actor240524","actor240524",[2731,2732],"Cobalt","cobalt",[2734,2735],"WildNeutron","wildneutron",[2737,2738],"TA866","ta866",[2740,2741],"Roaming Mantis","roaming-mantis",[2743,2744],"TINY SPIDER","tiny-spider",[2746,2747],"LUNAR SPIDER","lunar-spider",[2749,2750],"CIRCUS SPIDER","circus-spider",[2752,2753],"RIDDLE SPIDER","riddle-spider",[2755,2756],"HOUND SPIDER","hound-spider",[2758,2759],"1937CN","1937cn",[2761,2762],"ANDROMEDA SPIDER","andromeda-spider",[2764,2765],"APT26","apt26",[2767,2768],"APT.3102","apt-3102",[2770,2771],"BIG PANDA","big-panda",[2773,2774],"Clever Kitten","clever-kitten",[2776,2777],"Corsair Jackal","corsair-jackal",[2779,2780],"Cyber Army of Russia Reborn","cyber-army-of-russia-reborn",[2782,2783],"Cyber Berkut","cyber-berkut",[2785,2786],"Cyber Caliphate Army","cyber-caliphate-army",[2788,2789],"Cyber fighters of Izz Ad-Din Al Qassam","cyber-fighters-of-izz-ad-din-al-qassam",[2791,2792],"Danti","danti",[2794,2795],"DEXTOROUS SPIDER","dextorous-spider",[2797,2798],"DIZZY PANDA","dizzy-panda",[2800,2801],"ELECTRIC PANDA","electric-panda",[2803,2804],"ELOQUENT PANDA","eloquent-panda",[2806,2807],"EvilPost","evilpost",[2809,2810],"Ghost Jackal","ghost-jackal",[2812,2813],"GIBBERISH PANDA","gibberish-panda",[2815,2816],"IMPERSONATING PANDA","impersonating-panda",[2818,2819],"MAGNETIC SPIDER","magnetic-spider",[2821,2822],"Mana Team","mana-team",[2824,2825],"Mirage Tiger","mirage-tiger",[2827,2828],"Moskalvzapoe","moskalvzapoe",[2830,2831],"Night Dragon","night-dragon",[2833,2834],"Operation Cobalt Whisper","operation-cobalt-whisper",[2836,2837],"Operation Kabar Cobra","operation-kabar-cobra",[2839,2840],"PALE PANDA","pale-panda",[2842,2843],"People's Cyber Army of Russia","people-s-cyber-army-of-russia",[2845,2846],"PIZZO SPIDER","pizzo-spider",[2848,2849],"POISONUS PANDA","poisonus-panda",[2851,2852],"PREDATOR PANDA","predator-panda",[2854,2855],"RADIO PANDA","radio-panda",[2857,2858],"Roaming Tiger","roaming-tiger",[2860,2861],"SABRE PANDA","sabre-panda",[2863,2864],"Sands Casino","sands-casino",[2866,2867],"SINGING SPIDER","singing-spider",[2869,2870],"SPICY PANDA","spicy-panda",[2872,2873],"TeamXRat","teamxrat",[2875,2876],"TEMP.Hermit","temp-hermit",[2878,2879],"TEST PANDA","test-panda",[191,2881],"unc3236",[2883,2884],"UNION PANDA","union-panda",[2886,2887],"Viking Jackal","viking-jackal",[2889,2890],"WET PANDA","wet-panda"]