Sign inStart freeBook a demo

Know who is behind the attacks.

This is a free directory of more than 850 criminal and state-backed hacking groups. Each profile explains who the group is, where it is thought to operate from, which sectors and countries it targets and the techniques it uses. It is written for business owners, IT teams and security analysts alike.

Free to readNo account neededBuilt from public reporting

On this pageRanked by how much public reporting documents each group's attack techniques
  1. 01SideCopy
  2. 02Tonto Team
  3. 03Naikon
  4. 04EXOTIC LILY
  5. 05BackdoorDiplomacy
All groups

Every group, most documented first.

Showing 37 to 48 of 862

A to Z

Know the name? Find it here.

Every one of the 862 profiles, in alphabetical order. Groups often have several names, so if one is missing, try the search above with another.

Show all 862 groups from A to Z
How to read a profile

What does a profile tell you?

Five things. Enough to decide whether a group matters to you, and where to look next.

  1. 01

    Who they are

    The group’s main name and every other name security companies use for it, so you can match news stories to the same group.

  2. 02

    Where they are thought to be from

    The country they are thought to operate from, and any government suspected of backing them.

  3. 03

    Who they go after

    The sectors and countries named in public reporting about the group.

  4. 04

    How they work

    Their known attack techniques, laid out stage by stage, from researching a target to causing damage.

  5. 05

    Where it comes from

    Links to the public reports behind the profile, so you can check every detail for yourself.

By industry

Who is targeting your industry?

Start from the work you do. Each industry page lists the threat groups public reporting links to that sector, and where they are thought to operate from.

Free account

Is it a risk to your business?

A public profile tells you who a group is. Your account tells you whether it matters to you: we match the software you run to the flaws threat groups use, and we keep watching, so you hear about anything that affects you as soon as we know.

  • Over 900 group profiles in the app, every claim backed by a quote and a source link.
  • Your sector at a glance: which threat groups and ransomware gangs are hitting it.
  • Flaws in the software you run, ranked 0 to 100, with threat group activity counted in.
  • A PDF dossier on any group, ready to send to your board or your IT provider.
Start free →Book a demo
FAQ

Threat groups, explained.

Something else? Talk to the team →

A threat group is a team of attackers that security researchers have tracked across many attacks. Some are criminals after money, such as ransomware gangs. Others are thought to work for governments, collecting intelligence or causing disruption.

APT stands for advanced persistent threat: a well-resourced group, often state-backed, that gets into a network and tries to stay unnoticed for a long time. Many of the groups in this directory are APTs.

Researchers link attacks to a group by the tools, servers, techniques and targets they share. Different security companies often give the same group different names, which is why each profile lists its other names.

No. Every profile in this directory is open to read without an account.

Profiles of over 900 groups with a quote and a source behind every claim, a view of who is targeting your sector, PDF dossiers to share, and the software you run matched against known flaws, ranked from 0 to 100.

Get started

Know who is coming, and what to fix first.

Create a free account and tell us the software you run. We match the software you run against flaws threat groups use, rank them 0 to 100 and keep watching, so you hear about it as soon as we know.

Start free →Book a demo

No card neededNothing to installIntelligence and alerts free