{"meta":{"status":200,"terms-of-use":"All data returned by this API is confidential and proprietary information of Tidal Cyber Inc. ('Tidal Cyber'). Use of the data returned by this API is governed by the Tidal Cyber Terms of Use, available at https://www.tidalcyber.com/terms-of-use, or, if applicable, the agreement between Tidal Cyber and the organization on behalf of which you are using this API and the information returned by this API."},"data":[{"id":"00b45c13-d165-44d0-ad6b-99787d2a7ce3","name":"8Base Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3014","created":"2024-06-13T20:11:21.098291Z","modified":"2024-06-13T20:11:21.098295Z","tidal_id":"f71856b7-657e-5bc1-851c-025b7ab41986","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"78372fe7-47ca-4c0f-908f-c266b122e4d8","tag":"1d06c2ad-3f16-44e4-908c-d6a3191aa29c"},{"id":"4050ce86-cee1-4dd0-ab3f-ebefe3d5a2ab","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"fa9d7845-bfc8-40ad-991e-72b462928705","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"e1ac15a0-845b-43d5-9438-65fd561b86f3","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"721e09b6-f55f-42dc-ad85-e21c41d01438","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"b81cb47b-0e8d-4ce8-bc2a-047c020ef3b1","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"8567136b-f84a-45ed-8cce-46324c7da60e","name":"admin@338","source":"MITRE","group_attack_id":"G0018","created":"2017-05-31T21:31:53.579000Z","modified":"2020-03-18T19:54:59.120000Z","tidal_id":"d67d2f56-eb61-5586-a526-b4096957b434","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"36c70cf2-c7d5-5926-8155-5d3a63e3e55a","name":"Agrius","source":"MITRE","group_attack_id":"G1030","created":"2024-10-31T16:28:11.153309Z","modified":"2024-10-31T16:28:11.153311Z","tidal_id":"36c70cf2-c7d5-5926-8155-5d3a63e3e55a","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"}],"observed_sector":[],"associated_groups":[{"id":"9518b72c-ba6b-5f8c-8787-314d79d01f00","name":"Pink Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"d0de43a8-daca-5aff-939c-3a6b0df860a4","owner_id":null,"owner_name":null},{"id":"0148f228-b244-56cf-a3bc-0ad845a7f9f1","name":"AMERICIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"d8025092-064d-5234-b723-be1aacd11977","owner_id":null,"owner_name":null},{"id":"e0d0f0ff-048d-5342-b5b3-1ff120649ec6","name":"Agonizing Serpens","description":"<sup>[[Unit42 Agrius 2023](https://app.tidalcyber.com/references/70fb43bd-f8e1-56a5-a0e9-884e85f16b10)]</sup>","source":"MITRE","associated_group_id":"72183fe8-69c2-59a7-b44b-f08562bf92cc","owner_id":null,"owner_name":null},{"id":"04c6128d-ea70-5ae0-97d6-7b20dc73bc3e","name":"BlackShadow","description":"<sup>[[CheckPoint Agrius 2023](https://app.tidalcyber.com/references/b3034b5d-1fe5-5677-a2e8-9329141875d4)]</sup>","source":"MITRE","associated_group_id":"6a08a7a0-aade-579d-9baa-9728e68c8f9c","owner_id":null,"owner_name":null}],"tags":[{"id":"60befc62-30e4-43fe-bea4-16ee569e4c9d","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"3968e084-45b6-48a1-9f19-3d9152cd7053","name":"Aisuru botnet operators","source":"Tidal Cyber","group_attack_id":"G3150","created":"2025-11-19T17:45:10.882300Z","modified":"2025-11-19T17:45:10.882302Z","tidal_id":"8f9b70aa-0781-59f0-ae84-07bb24b2950f","country":[],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"69dd3e9b-a2bb-4afc-bd54-3154343e266c","name":"Video Games"}],"associated_groups":[{"id":"eee475bb-6b57-4fa5-ba0d-f84c9fb1289a","name":"Aisuru group","description":"<sup>[[None December 10 2025](/references/8dcd43e9-e28f-4536-93d3-9823aa064cdb)]</sup>","source":"USER","associated_group_id":"b9f3512b-a15b-4f9a-836d-895a2285d41c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d9a5fdf2-8a4e-48a0-8ec0-792fce0e5be8","name":"AISURU team","description":"<sup>[[None December 10 2025](/references/8dcd43e9-e28f-4536-93d3-9823aa064cdb)]</sup>","source":"USER","associated_group_id":"324e20bf-68ca-4e94-a6dd-8ce261868ee1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"5e041d87-53d8-4e15-8334-ec50aebbd9a6","tag":"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a"},{"id":"d9f310f8-cb62-477e-9b1d-692649572094","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"ee2b8807-2306-493d-9b2a-7dc89e19dcd0","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"9d932675-d08b-4b8d-993e-98697ffa1c51","tag":"fe984a01-910d-4e39-9c49-179aa03f75ab"},{"id":"817200e6-66e7-43a5-82eb-27b06689d902","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"544202ee-6f7b-446f-8369-dd4929892844","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"e38bcb42-12c1-4202-a794-ec26cd830caa","name":"Ajax Security Team","source":"MITRE","group_attack_id":"G0130","created":"2021-04-14T13:17:43.941000Z","modified":"2022-05-11T14:00:00.188000Z","tidal_id":"f7b5ab96-7180-55f9-ac25-88742f9e6cf1","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"b14e52c9-267e-484b-b3af-14844e5634f5","name":"AjaxTM","description":"<sup>[[FireEye Operation Saffron Rose 2013](https://app.tidalcyber.com/references/2f4c0941-d14e-4eb8-828c-f1d9a1e14a95)]</sup>","source":"MITRE","associated_group_id":"81051e64-7fde-44c5-816e-a85b25a02e11","owner_id":null,"owner_name":null},{"id":"c63555ae-395f-49dd-b279-b6b85c33e41f","name":"Operation Woolen-Goldfish","description":"Analysis of infrastructure, tools, and modes of operation revealed a potential relationship between [Ajax Security Team](https://app.tidalcyber.com/groups/e38bcb42-12c1-4202-a794-ec26cd830caa) and the campaign Operation Woolen-Goldfish.<sup>[[Check Point Rocket Kitten](https://app.tidalcyber.com/references/71da7d4c-f1f8-4f5c-a609-78a414851baf)]</sup><sup>[[TrendMicro Operation Woolen Goldfish March 2015](https://app.tidalcyber.com/references/0f077c93-aeda-4c95-9996-c52812a31267)]</sup>","source":"MITRE","associated_group_id":"9585b539-c040-40a6-a94c-fcf8afa786e2","owner_id":null,"owner_name":null},{"id":"59646b90-8877-4904-b72d-7b73ee8af863","name":"Rocket Kitten","description":"Analysis of infrastructure, tools, and modes of operation revealed a potential relationship between [Ajax Security Team](https://app.tidalcyber.com/groups/e38bcb42-12c1-4202-a794-ec26cd830caa) and Rocket Kitten.<sup>[[Check Point Rocket Kitten](https://app.tidalcyber.com/references/71da7d4c-f1f8-4f5c-a609-78a414851baf)]</sup><sup>[[IranThreats Kittens Dec 2017](https://app.tidalcyber.com/references/8338ad75-89f2-47d8-b85b-7cbf331bd7cd)]</sup>","source":"MITRE","associated_group_id":"ed2a8933-1662-460c-b400-db7a03921659","owner_id":null,"owner_name":null},{"id":"930c273b-0f2f-4398-b016-3623a384e681","name":"Flying Kitten","description":"<sup>[[CrowdStrike Flying Kitten ](https://app.tidalcyber.com/references/ab669ded-e659-4313-b5ab-8c5362562f39)]</sup>","source":"MITRE","associated_group_id":"aea21266-a894-40a3-a8cd-2eb2136859d8","owner_id":null,"owner_name":null},{"id":"b62221c3-4173-4748-9f3c-c1bc57ca2ef3","name":"Operation Saffron Rose","description":"<sup>[[FireEye Operation Saffron Rose 2013](https://app.tidalcyber.com/references/2f4c0941-d14e-4eb8-828c-f1d9a1e14a95)]</sup>","source":"MITRE","associated_group_id":"c7e17231-5a22-49f8-a174-b15d5143b169","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"923f478c-7ad1-516f-986d-61f96b9c553e","name":"Akira","source":"MITRE","group_attack_id":"G1024","created":"2024-04-25T13:28:24.118084Z","modified":"2024-04-25T13:28:24.118086Z","tidal_id":"b17fd648-53f6-5d1e-a23a-80303327a6d8","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"8c04cdb9-d766-412c-b041-782c879f51c6","name":"Latvia","country_name":"Latvia","country_code":"LV"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"125b9f74-e1c0-4256-af53-7ac8c7bdf2e9","name":"Nicaragua","country_name":"Nicaragua","country_code":"NI"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"ff6c7702-0a73-5408-bbf9-f11f2592a1d2","name":"PUNK SPIDER","description":"<sup>[[CrowdStrike PUNK SPIDER](https://app.tidalcyber.com/references/a16f89a4-5142-559b-acfa-f69ad9410bd2)]</sup>","source":"MITRE","associated_group_id":"1b85746d-0b75-59c2-80e8-683576553e54","owner_id":null,"owner_name":null},{"id":"ca5b363c-9ff2-4b15-9012-21f207e69b2a","name":"Akira ransomware operators","description":"<sup>[[Huntress September 15 2025](/references/14473272-5941-4ebb-8ea7-5521f6a9a283)]</sup>","source":"USER","associated_group_id":"ff49a5e0-b238-47e1-83e0-649b9d1e5d25","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"57cc080a-9186-42db-839f-4e436a0ad107","name":"Akira Ransomware Group","description":"<sup>[[Sophos News December 07 2025](/references/d74c88c0-25fe-419a-bf69-1603d1b3a597)]</sup>","source":"USER","associated_group_id":"4f8219b4-acad-4bac-9b6d-07ee86672958","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"04a3fd84-5199-4ad8-ba1d-7e9c883058d7","name":"Storm-1567","description":"<sup>[[BlackBerry Akira July 11 2024](/references/59a1bd0f-a907-4918-90e1-d163bf84f927)]</sup>","source":"Tidal Cyber","associated_group_id":"9ceb2517-f743-4845-80d1-6887fdbca9b1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"f4116e8c-e328-4529-9ef1-7c08766bc19c","name":"Howling Scorpius","description":"<sup>[[Unit 42 December 2 2024](/references/3d0c4862-a67e-4f8e-8045-05596854f14b)]</sup>","source":"Tidal Cyber","associated_group_id":"7a381cef-e5a0-431b-bf74-9e9252652a2c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1d72e7e0-3c9e-5ac1-a534-42b4866521ad","name":"Howling Scorpius","description":"<sup>[[Palo Alto Howling Scorpius DEC 2024](https://app.tidalcyber.com/references/26d3e738-8921-51bc-a71c-7e74278a6a78)]</sup>","source":"MITRE","associated_group_id":"cb58456b-06ab-4bec-a71f-bdd3e9688fbc","owner_id":null,"owner_name":null},{"id":"57fd3db7-ff37-5aaf-88ea-d01627623e42","name":"GOLD SAHARA","description":"<sup>[[Secureworks GOLD SAHARA](https://app.tidalcyber.com/references/3abb7995-4a62-56a6-9492-942965edf0a0)]</sup>","source":"MITRE","associated_group_id":"2afdf2f1-1eed-5ade-b0a2-4714f9bbdc09","owner_id":null,"owner_name":null}],"tags":[{"id":"01b2e76f-918c-47e7-828d-ae16e58f9c3f","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"3d79402d-4c3e-4fdd-974f-85c0e1bdd247","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"3328ed40-3373-47a5-90b5-3a2465262b1e","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"14305bca-ad79-497c-ab7a-20c616098652","tag":"47365c8b-5db8-4d3a-9eb9-d49c8df1a90e"},{"id":"afa19d68-767e-4913-a451-61a6a68e46e5","tag":"8046a757-48f0-4787-81ab-9dc8c1eb77cd"},{"id":"6e50866d-b6f7-44b4-bc43-111fab699b20","tag":"33d22eff-59a1-47e0-b9eb-615dee314595"},{"id":"4062ef5d-7ef4-4447-92cb-88eafa21d06f","tag":"5bb8b429-aab3-4c2a-b2e1-5eab5e2cb732"},{"id":"e30c9a17-ff2f-4e1e-a372-d08abd227578","tag":"656086ec-8663-4b44-8f02-b927fccbc2de"},{"id":"db6d0294-5bd5-42c3-8c97-ed10ba93b2c3","tag":"91a95724-7c53-4397-859a-1aebe1704ca9"},{"id":"19255cb1-f0c5-478d-bd8a-c211ae9cdedf","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"121373a5-8fa7-420b-b9c4-7757e30521c1","tag":"0580d361-b60b-4664-9b2e-6d737e495cc1"},{"id":"2f350cff-b15d-4e49-a2b7-b7dc24ce4501","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"587da763-cb06-4766-8920-85f7cf1d7250","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"7b813ea0-7e2e-4be7-928a-63f947754ad6","tag":"c5a258ce-9045-48d9-b254-ec2bf6437bb5"},{"id":"0ebb3beb-1d40-45d1-bd18-8bc6e01fac82","tag":"cc4ea215-87ce-4351-9579-cf527caf5992"},{"id":"bbfb504e-d913-4eb7-a976-b220e945f7a3","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"46f56134-b0ea-49ca-aee5-f855ebf78492","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"110c88b7-88e1-43be-831a-85e42a4b5446","tag":"c79f7ba7-a2f2-43ff-8c78-521807ef6c92"},{"id":"16a18cec-71e4-4e25-b427-632ffa3e471c","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"7d2a0252-8c85-4efe-b268-0782ed5629a9","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"66ff806f-f69b-4128-9a73-50589cb8dbfa","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"}],"owner_name":null},{"id":"92c6218e-b260-510f-85bd-2228c589771b","name":"ALLANITE","source":"ICS","group_attack_id":"G1000","created":"2026-01-28T13:08:18.109435Z","modified":"2026-01-28T13:08:18.109439Z","tidal_id":"92c6218e-b260-510f-85bd-2228c589771b","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"53c365c8-6a9b-4703-a9c1-1752566c2fda","name":"Palmetto Fusion","description":"","source":"ICS","associated_group_id":"652e73fb-2ab3-5c09-812f-6fc9713d0962","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"2cc997b5-5076-4eef-9974-f54387614f46","name":"Andariel","source":"MITRE","group_attack_id":"G0138","created":"2021-09-29T15:10:19.236000Z","modified":"2022-05-24T16:27:11.471000Z","tidal_id":"7ed786cb-36c1-57b2-a8de-0de9e73a2159","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"924615bb-935a-568a-92da-b15fac86a315","name":"PLUTONIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"51748245-05c7-50ee-bef2-84457539dfc3","owner_id":null,"owner_name":null},{"id":"90f7d68b-a3c3-4fe2-9bd3-fad0e4b56afd","name":"APT45","description":"<sup>[[Mandiant APT45 July 25 2024](/references/a9673491-7493-4b85-b5fc-595e91bc7fdc)]</sup>","source":"Tidal Cyber","associated_group_id":"304838a0-8ed7-4558-9fab-e42fa12362fd","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d4fd7a33-9444-4987-bf25-1247b5029461","name":"Stonefly","description":"<sup>[[Symantec Stonefly April 27 2022](/references/64d72689-0c7a-480a-a295-6321fc0d82fc)]</sup>","source":"Tidal Cyber","associated_group_id":"a68713cc-c251-4f04-ad46-0396c320a1bb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8f90a9f3-849e-4cd8-b276-42498b6968e2","name":"Silent Chollima","description":"<sup>[[CrowdStrike Silent Chollima Adversary September 2021](https://app.tidalcyber.com/references/835283b5-af3b-4baf-805e-da8ebbe8b5d2)]</sup>","source":"MITRE","associated_group_id":"045b431e-ca2a-4b1b-a6fa-758127ce2b4e","owner_id":null,"owner_name":null},{"id":"b2afcb59-0cdd-5b46-8871-704b45c2fdca","name":"Onyx Sleet","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"4cb90519-c054-5b0a-91a7-add9f608e00f","owner_id":null,"owner_name":null},{"id":"e921c8b5-cea3-414c-805c-748495340b3b","name":"Jumpy Pisces","description":"<sup>[[Unit42 Jumpy Pisces October 30 2024](/references/2da2d3c6-cf19-49c8-8a82-2119b14d4e03)]</sup>","source":"Tidal Cyber","associated_group_id":"2ba485a7-56be-4015-b6fa-6a184ca923cd","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"3bec16e3-65af-4e18-89e5-f9f5533b5622","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"},{"id":"39a403b9-2117-4c96-8275-a8e1630d741b","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"9fc71baa-5d95-4f96-a445-a8775a87bfaf","tag":"27a117ce-bb19-4f79-9bc2-a851b69c5c50"},{"id":"5fb69b91-1718-478a-8d65-175daf47d482","tag":"6070668f-1cbd-4878-8066-c636d1d8659c"},{"id":"b85c26ad-427f-48d5-ae9d-4203946d4712","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"8b8a94b6-2693-4408-bc2b-9bb78cc6c9cc","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"0f943818-86a2-43ab-8527-42d0a398df1c","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"20a6596d-fd71-4aa8-a014-b2e71ad3ed1d","tag":"4f4744b0-8401-423c-9ed0-3cb2985d9fd3"},{"id":"0c1d49e2-1a2a-443f-9a4a-7949cb1f1504","tag":"ddfaecd0-bd3e-41ac-85c7-ca2156684343"},{"id":"931ab4c8-f981-4c09-81be-dcd405456f26","tag":"0dbed83d-af67-4ce0-a1ee-16f1165fdc0f"},{"id":"54f7ac6c-4755-46da-9c6e-4b5b94501762","tag":"6422a882-7606-4aa3-b994-f917f53c2ada"},{"id":"fd76c8ff-ab2a-41fc-a942-4a8d98dfde30","tag":"c1b123d2-ce58-4345-8482-d1da27b3c053"},{"id":"9fcca261-76b3-4592-9f0b-f37cf48c9281","tag":"f166e59e-9877-4102-a39b-fae38df4b790"},{"id":"1657eb08-a362-4d95-b2dc-fc947e1dcd9b","tag":"6a82d685-3f77-498d-91c3-a759292ec2da"},{"id":"5fe5361b-ab59-4f2a-8b4a-a37a095214a9","tag":"a32a757a-9d6b-43ca-ac4b-5f695dd0f110"},{"id":"da71737e-ae1d-4bf1-8d7e-dbc3846b0008","tag":"ac70560d-c3e7-4b40-a4d6-a3287e3d952b"},{"id":"7e5ce990-da8f-4c35-801b-1a9fa485a56a","tag":"75f62312-a7ee-4534-8c8a-e3b7366a3a4b"},{"id":"3bcc80a3-a311-4f90-ab57-115db007be5e","tag":"887d1cfe-d0c5-431c-8dce-0e1b9a2505aa"},{"id":"dade6f0d-f2d1-4188-bb38-e452441d076e","tag":"96eec53f-355c-406c-87ba-18c3be4c69a1"},{"id":"d6b8c4e5-e173-49d3-a85a-3ce862429630","tag":"54fafdbe-1ea0-4f48-99ad-757c8fe50df2"},{"id":"4c140d05-42a3-4b6f-b864-9a5e3ab58581","tag":"35b334ec-4169-4898-ab90-487eea7feb69"},{"id":"80130e05-6be8-4cab-bc4c-03cbf65e7fe2","tag":"4ac4e1b9-2192-47ac-a4d1-3a31aa0f2140"},{"id":"9ca3b861-8899-4fca-ac7c-1238349397eb","tag":"936a56f5-a4f1-42d8-83b7-c44399ead661"},{"id":"092428a5-7d12-44f8-96df-6333f8d0a3ac","tag":"0d19ceed-28f6-4258-b365-f6e6f296121d"},{"id":"4abd1f41-f889-4553-b616-883ee1a4b258","tag":"037cc75c-9683-49db-aaa8-c8142763bb87"},{"id":"314810b8-ced8-4d6b-9d26-fdfdc95c3630","tag":"ff71ed89-8355-4abc-9da4-eb4768a38c9c"},{"id":"ee1dcef3-3028-4643-8a25-a7d9b161ae63","tag":"6fade0a3-0c26-4a11-b81e-25d20e38bdd3"},{"id":"8001023f-817d-402b-b0f3-63b10976757b","tag":"3b54d8a5-580f-43bf-a12d-8e011f953bad"},{"id":"1ff54975-fa18-4a4a-ae9a-8da71060a3da","tag":"0f6e72e1-ba8f-4d1d-920d-d8945a4fee59"},{"id":"b8935b12-1381-4d40-96dc-44e5afe9f2e1","tag":"7bbc5366-897a-4505-bc68-3a18e3d4cf44"},{"id":"2d93ab6b-7d07-4d19-9254-f5f2c1227bcc","tag":"4cd85398-c33a-4374-9a76-2bbf297cca63"},{"id":"62d69e76-3c0c-449a-acb8-84f7ab464a31","tag":"5ec8231e-70e9-4675-b922-368bcb9e914a"},{"id":"30c1872d-27f6-466c-a9bf-c2a315a4a320","tag":"21c64d34-e52a-42ba-a8c7-85aa82dc0b3f"},{"id":"d8166d31-9054-4afd-bd23-9634a47aa139","tag":"cd9ab9e7-248f-4097-b120-a42834ce0f89"},{"id":"4f10d563-9530-4a7c-b3eb-1ac9d29d764b","tag":"91ddbeac-b587-4978-a80d-543a5d96cb77"},{"id":"b7293157-b035-462d-bf8c-74dbb681afa5","tag":"b8448700-7ed0-48b8-85f5-ed23e0d9ab97"},{"id":"533b22a1-d40c-42ba-bc34-f2f2e215468b","tag":"12b074b9-6748-4ad7-880f-836cb80587e1"},{"id":"799d1947-be08-43f3-baad-758953c9d0f5","tag":"45f92502-0775-4fc6-8fcd-97b325ea49a9"},{"id":"64646ec5-65d9-4eab-bd7a-02a003e50b2c","tag":"cddb4563-fe90-4c72-be81-6256d175a698"},{"id":"5d9743de-bf12-432d-a448-6a9e4cf7a19f","tag":"69f278d7-194f-42d0-8f83-11de9f861264"},{"id":"458ce445-c472-4831-bfbb-a46d0691337d","tag":"f0c58aa3-5d21-4ade-95a0-b775dde7e8a3"},{"id":"f0728844-35fd-41a9-bd76-80c7922605de","tag":"5f9b1c23-81f8-4aa3-8d97-235302e77eec"},{"id":"26d85d71-2877-40f8-8975-1cb0c98ccb2b","tag":"d842c7ff-e3d3-4534-9ed7-283752f4bbe2"},{"id":"33de9390-82f7-4140-8ea9-215571550744","tag":"ecd84106-2a5b-4d25-854e-b8d1f57f6b75"},{"id":"7e5521c4-d3b8-4d0e-8a89-1dce5b667f28","tag":"7e6ef160-8e4f-4132-bdc4-9991f01c472e"},{"id":"318798a6-d582-42bf-8ba3-4901a15e7b29","tag":"532b7819-d407-41e9-9733-0d716b69eb17"},{"id":"a1b7750d-0fbb-49b0-bd39-1ed7e9bf2ee7","tag":"e401022a-36ac-486d-8503-dd531410a927"},{"id":"e897c9ed-0d03-4968-80c3-466bb87d2c43","tag":"173e1480-8d9b-49c5-854d-594dde9740d6"},{"id":"524ed25f-945e-4734-9563-2fade5988663","tag":"7551097a-dfdd-426f-aaa2-a2916dd9b873"},{"id":"f0f5202e-9ce8-405c-b518-8e353861222e","tag":"c475ad68-3fdc-4725-8abc-784c56125e96"},{"id":"b37cbcb6-12e5-4de0-8d8c-8c7da46a5b14","tag":"08809fa0-61b6-4394-b103-1c4d19a5be16"},{"id":"f63305c5-fd3b-4705-a046-725dc7a2b1e1","tag":"4ac8dcde-2665-4066-9ad9-b5572d5f0d28"},{"id":"d1133ddb-c85e-4371-95e2-14dac918dd0f","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"675bf052-a516-4f31-a261-7a4bccce1472","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"67e02e39-1db8-4842-b0b1-d250ea9a22c3","name":"AnonGhost","source":"Tidal Cyber","group_attack_id":"G3024","created":"2023-10-10T20:48:48.858617Z","modified":"2023-10-10T20:48:48.858621Z","tidal_id":"464895b3-7448-5bc8-978a-116a95eaa19d","country":[],"observed_motivation":[],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[],"owner_name":"TidalCyberIan"},{"id":"e70517cf-9c3c-4e94-b63a-af72e6c1fc82","name":"Anonymous (Collective)","source":"Tidal Cyber","group_attack_id":"G3097","created":"2025-04-11T15:33:37.769017Z","modified":"2025-04-11T15:33:37.769020Z","tidal_id":"3708aa42-d949-54cf-b807-5e25124db598","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"bf63f004-3350-4ed7-b7cb-5d855975add7","name":"Anonymous","description":"<sup>[[Check Point Blog August 13 2024](/references/72134c73-bdd5-4cd1-9046-1ea01c75faf3)]</sup>","source":"USER","associated_group_id":"aaee0b93-bebb-4522-aac7-fed492778aff","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c6c8f72a-8112-45bd-bcd3-376be18f2850","name":"Anonymous collective","description":"<sup>[[Check Point Blog August 13 2024](/references/72134c73-bdd5-4cd1-9046-1ea01c75faf3)]</sup>","source":"USER","associated_group_id":"8e5ad5ba-3738-4bb7-ad7e-023092183501","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e1dac594-c886-44d9-9bc4-5403f8914184","name":"AnonHuntersLatam","description":"<sup>[[Check Point Blog August 13 2024](/references/72134c73-bdd5-4cd1-9046-1ea01c75faf3)]</sup>","source":"USER","associated_group_id":"947f2db4-500a-485b-a5d6-48b80092b7d1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"4a8e8b6d-28f3-488c-9fd5-2b4c2ebbae6d","tag":"62bde669-3020-4682-be68-36c83b2588a4"},{"id":"999c1142-05a9-4120-b3f6-92a5d84fa69a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"ee6c781a-e805-4229-be16-6cc0caa6281f","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"132feaeb-a9a1-4ecc-b7e9-86c008c15218","name":"Anonymous Sudan","source":"Tidal Cyber","group_attack_id":"G3023","created":"2023-10-10T20:48:48.549192Z","modified":"2023-10-10T20:48:48.549197Z","tidal_id":"1826c3b9-2c69-5483-acf7-94847c5c8a11","country":[],"observed_motivation":[],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"8c04cdb9-d766-412c-b041-782c879f51c6","name":"Latvia","country_name":"Latvia","country_code":"LV"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"84d7b5cd-a34d-4365-bdbf-cba51ef26fa9","name":"Storm-1359","description":"<sup>[[Microsoft DDoS Attacks Response June 2023](/references/d64e941e-785b-4b23-a7d0-04f12024b033)]</sup>","source":"Tidal Cyber","associated_group_id":"8a3ffc59-378f-447a-bd67-129659941a20","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"743fb69e-34c5-4cb1-9b34-ba427dacf85b","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"0816722a-4a54-46de-80ab-2d372bdf1eca","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"0fde0dbd-eb3a-4aa6-95ed-27c2e4c8cc5d","tag":"c7bd6fa4-288f-4da1-986e-e0fd9a4a3c97"},{"id":"c1e4ea0a-2edd-406e-90a9-4d00d90f7735","tag":"62bde669-3020-4682-be68-36c83b2588a4"}],"owner_name":"TidalCyberIan"},{"id":"17d8f642-dafb-41cc-9849-097d871944e0","name":"Anonymous Venezuela","source":"Tidal Cyber","group_attack_id":"G3191","created":"2026-01-06T18:04:02.258978Z","modified":"2026-01-06T18:04:02.258981Z","tidal_id":"171fc187-3f3f-58c2-8d9a-c94cd11fc108","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"5e764a51-5c08-4b6c-ae68-d98a9ed4fb9f","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"24ff93f4-9fb8-49fb-b843-6b875c535195","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5a7121d1-1699-4878-afe3-b643b639fdf2","name":"Antique Typhoon","source":"Tidal Cyber","group_attack_id":"G3064","created":"2024-11-15T17:29:05.167198Z","modified":"2024-11-15T17:29:05.167202Z","tidal_id":"0a5e97e6-900a-56ea-878e-91e1d475cdac","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[{"id":"102b99c0-2abd-4126-87e0-bf43881353ab","name":"Storm-0558","description":"<sup>[[Microsoft Security Blog July 14 2023](/references/a9cf756b-8157-4cc4-bdab-b10f320487df)]</sup>","source":"Tidal Cyber","associated_group_id":"6c6d7808-487f-4ca2-a66b-3b614f9df022","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"e2884439-8c79-469d-acc7-b4eeef5fc1a3","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"b3187a7b-8ac3-495d-8a93-76e21d20dbfb","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"485d58ac-c5f2-4dfd-9d0f-f8755db8a898","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"8a280bdd-d14c-43ca-b5cb-bd68e1fda44a","name":"Anubis Ransomware Group","source":"Tidal Cyber","group_attack_id":"G3111","created":"2025-06-23T13:53:42.297639Z","modified":"2025-06-23T13:53:42.297643Z","tidal_id":"99e0c2aa-440a-5b1d-b6cb-e1f04fc71f43","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"}],"associated_groups":[],"tags":[{"id":"dfc0af97-9273-4f67-8b33-db36dbb18ceb","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"b7a0d851-d952-438d-9695-3ce45624898f","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"ee2afbc6-76fb-4b9d-bf74-1299f38ffff8","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"1a88e9f9-12ea-4d90-a30a-6b44e486364d","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"73055fec-f5c4-4805-9418-8fd5c21bbe4d","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"454402a3-0503-45bf-b2e0-177fa2e2d412","name":"Aoqin Dragon","source":"MITRE","group_attack_id":"G1007","created":"2022-07-14T14:32:47.582000Z","modified":"2022-10-21T18:42:52.256000Z","tidal_id":"5e264b13-ed1a-5596-9562-ec843eacb449","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"e3f8e995-04b8-5158-945d-3d2f11a6d87c","name":"AppleJeus","source":"MITRE","group_attack_id":"G1049","created":"2025-10-29T21:08:48.108248Z","modified":"2025-10-29T21:08:48.108248Z","tidal_id":"e3f8e995-04b8-5158-945d-3d2f11a6d87c","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"2c3ef023-ef88-5a44-b9b0-19ea8eb07e6b","name":"UNC4736","description":"<sup>[[dtex DPRK 2025 structure ITworkers](https://app.tidalcyber.com/references/fd19ce93-66ea-59d2-b6da-880c7bc574f1)]</sup><sup>[[Mandiant 3cx UNC4736 2023](https://app.tidalcyber.com/references/40761128-2550-56fe-8960-2c6f6e5944b0)]</sup>","source":"MITRE","associated_group_id":"2eb80e46-ec97-5116-ae32-d587f817ec6d","owner_id":null,"owner_name":null},{"id":"c471e819-2606-50a4-bbdc-d4faf99e194f","name":"Gleaming Pisces","description":"<sup>[[Unit42 DPRK Threat Groups 2024](https://app.tidalcyber.com/references/e55dc11d-ccc0-5f89-8f42-0cd5f5e0f128)]</sup>","source":"MITRE","associated_group_id":"0bf80db7-5978-5cdb-af8b-3f2333156d23","owner_id":null,"owner_name":null},{"id":"aa6dd966-e1a7-5aa8-8b26-e63c92b08d61","name":"UNC1720","description":"<sup>[[JPCert Blog Laz Subgroups 2025](https://app.tidalcyber.com/references/7982b22d-0976-5f11-8cc6-b2408ed29af7)]</sup><sup>[[Mandiant DPRK Groups 2023](https://app.tidalcyber.com/references/d5b51af4-2091-55c7-a97f-c8b5ab871342)]</sup>","source":"MITRE","associated_group_id":"a488b8c3-8ce5-512f-a235-5f377aa139d3","owner_id":null,"owner_name":null},{"id":"f006c5da-1f8c-5ea0-8370-a507b7857c48","name":"Citrine Sleet","description":"<sup>[[Unit42 DPRK Threat Groups 2024](https://app.tidalcyber.com/references/e55dc11d-ccc0-5f89-8f42-0cd5f5e0f128)]</sup>","source":"MITRE","associated_group_id":"e8a2ad40-c983-59ef-bf9e-3b91bb887615","owner_id":null,"owner_name":null}],"tags":[{"id":"469b947f-4bce-48bf-ac49-54b5febaf320","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"}],"owner_name":null},{"id":"5307bba1-2674-4fbd-bfd5-1db1ae06fc5f","name":"APT1","source":"MITRE","group_attack_id":"G0006","created":"2017-05-31T21:31:47.955000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"efa8350c-5f75-5460-9d3d-e94e144d5ea6","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"0a756fb1-b308-407d-a819-4105f10cb203","name":"Luxembourg","country_name":"Luxembourg","country_code":"LU"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"af30fa7e-afcf-4da0-9771-9dfbe389f238","name":"Comment Group","description":"<sup>[[Mandiant APT1](https://app.tidalcyber.com/references/865eba93-cf6a-4e41-bc09-de9b0b3c2669)]</sup>","source":"MITRE","associated_group_id":"b618f5c9-c399-4b6e-a614-12a383ba363c","owner_id":null,"owner_name":null},{"id":"cc50c7a6-2dab-498f-992b-7cdda0c20b7e","name":"Comment Panda","description":"<sup>[[CrowdStrike Putter Panda](https://app.tidalcyber.com/references/413962d0-bd66-4000-a077-38c2677995d1)]</sup>","source":"MITRE","associated_group_id":"22829c72-7358-468d-b661-da019a020d6e","owner_id":null,"owner_name":null},{"id":"1c4be283-01e5-4fa8-b566-79bded25cab0","name":"Comment Crew","description":"<sup>[[Mandiant APT1](https://app.tidalcyber.com/references/865eba93-cf6a-4e41-bc09-de9b0b3c2669)]</sup>","source":"MITRE","associated_group_id":"88a50fe2-ab89-4dc3-8c47-0b0661f5c8e2","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"225314a7-8f40-48d4-9cff-3ec39b177762","name":"APT12","source":"MITRE","group_attack_id":"G0005","created":"2017-05-31T21:31:47.537000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"18dd1cf7-48ff-5761-9157-c3d0ff4d0a34","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"}],"associated_groups":[{"id":"894ed5d0-7eb7-4383-b06f-9cc82d4aa1a6","name":"Numbered Panda","description":"<sup>[[Meyers Numbered Panda](https://app.tidalcyber.com/references/988dfcfc-0c16-4129-9523-a77539291951)]</sup>","source":"MITRE","associated_group_id":"5142b9b1-ad6a-4d7b-b982-9b200169dfe5","owner_id":null,"owner_name":null},{"id":"1bc197b3-bd5f-4c3f-853d-56a8e37af86d","name":"IXESHE","description":"<sup>[[Meyers Numbered Panda](https://app.tidalcyber.com/references/988dfcfc-0c16-4129-9523-a77539291951)]</sup> <sup>[[Moran 2014](https://app.tidalcyber.com/references/15ef155b-7628-4b18-bc53-1d30be4eac5d)]</sup>","source":"MITRE","associated_group_id":"3a506347-4e45-4afe-a15a-3c5697ecf07b","owner_id":null,"owner_name":null},{"id":"539a41fe-6f8f-496b-9915-4302797d33ca","name":"DynCalc","description":"<sup>[[Meyers Numbered Panda](https://app.tidalcyber.com/references/988dfcfc-0c16-4129-9523-a77539291951)]</sup> <sup>[[Moran 2014](https://app.tidalcyber.com/references/15ef155b-7628-4b18-bc53-1d30be4eac5d)]</sup>","source":"MITRE","associated_group_id":"583a2f5d-33db-48b0-9809-5183f4d4dbec","owner_id":null,"owner_name":null},{"id":"11ad1ce8-e59f-48e8-8a52-f7012c9a0d4f","name":"DNSCALC","description":"<sup>[[Moran 2014](https://app.tidalcyber.com/references/15ef155b-7628-4b18-bc53-1d30be4eac5d)]</sup>","source":"MITRE","associated_group_id":"1f696314-a0e0-4bc2-8b82-26d7f98bb308","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"06a05175-0812-44f5-a529-30eba07d1762","name":"APT16","source":"MITRE","group_attack_id":"G0023","created":"2017-05-31T21:31:56.270000Z","modified":"2022-07-26T23:33:26.354000Z","tidal_id":"7dfa0eaa-635f-52d0-80a8-20eb589f3ae3","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"5f083251-f5dc-459a-abfc-47a1aa7f5094","name":"APT17","source":"MITRE","group_attack_id":"G0025","created":"2017-05-31T21:31:57.307000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"049c9d77-c956-5efc-95a5-1fa6e30c20a3","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"b357afb9-0349-4203-a083-5dd2f1f9ead0","name":"Deputy Dog","description":"<sup>[[FireEye APT17](https://app.tidalcyber.com/references/a303f97a-72dd-4833-bac7-a421addc3242)]</sup>","source":"MITRE","associated_group_id":"3df7e342-600a-4312-8e16-5496890302d5","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"a0c31021-b281-4c41-9855-436768299fe7","name":"APT18","source":"MITRE","group_attack_id":"G0026","created":"2017-05-31T21:31:57.733000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"9f8426f6-295c-5d03-b83e-78026f54192f","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"a13f9607-2ef4-43c7-8aa9-26b83c7b0967","name":"TG-0416","description":"<sup>[[ThreatStream Evasion Analysis](https://app.tidalcyber.com/references/de6bc044-6275-4cab-80a1-feefebd3c1f0)]</sup><sup>[[Anomali Evasive Maneuvers July 2015](https://app.tidalcyber.com/references/471ae30c-2753-468e-8e4d-6e7a3be599c9)]</sup>","source":"MITRE","associated_group_id":"5fdf8c44-69f3-4d9b-9258-0bb7758be2e9","owner_id":null,"owner_name":null},{"id":"bb6b1708-cf48-48c7-9f46-ef0a53885d9a","name":"Dynamite Panda","description":"<sup>[[ThreatStream Evasion Analysis](https://app.tidalcyber.com/references/de6bc044-6275-4cab-80a1-feefebd3c1f0)]</sup><sup>[[Anomali Evasive Maneuvers July 2015](https://app.tidalcyber.com/references/471ae30c-2753-468e-8e4d-6e7a3be599c9)]</sup>","source":"MITRE","associated_group_id":"637ac710-fc16-472c-a832-4cac678250f8","owner_id":null,"owner_name":null},{"id":"ffe44646-5353-49d5-8e26-410c1ce6df86","name":"Threat Group-0416","description":"<sup>[[ThreatStream Evasion Analysis](https://app.tidalcyber.com/references/de6bc044-6275-4cab-80a1-feefebd3c1f0)]</sup>","source":"MITRE","associated_group_id":"3a92b51b-3fb6-4792-99f3-dfd2e16f9d8b","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"713e2963-fbf4-406f-a8cf-6a4489d90439","name":"APT19","source":"MITRE","group_attack_id":"G0073","created":"2018-10-17T00:14:20.652000Z","modified":"2021-05-26T12:38:01.003000Z","tidal_id":"5c32b8b1-ae7e-5733-aa22-5c728790b957","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"04c4f789-2393-4714-ab28-06fc38039960","name":"Codoso","description":"<sup>[[Unit 42 C0d0so0 Jan 2016](https://app.tidalcyber.com/references/c740fc1c-093e-4389-890e-1fd88a824df4)]</sup>","source":"MITRE","associated_group_id":"6d83a49f-9211-4cba-ac43-e00ac72377db","owner_id":null,"owner_name":null},{"id":"4addd000-b8b9-4c93-ba5b-378c14c46ae7","name":"C0d0so0","description":"<sup>[[Unit 42 C0d0so0 Jan 2016](https://app.tidalcyber.com/references/c740fc1c-093e-4389-890e-1fd88a824df4)]</sup>","source":"MITRE","associated_group_id":"89f839e7-602e-4862-9f93-1092acec19e7","owner_id":null,"owner_name":null},{"id":"ace4b025-4fd3-4ddd-af6f-673dea88aa9f","name":"Codoso Team","description":"<sup>[[FireEye APT Groups](https://app.tidalcyber.com/references/5b6b909d-870a-4d14-85ec-6aa14e598740)]</sup>","source":"MITRE","associated_group_id":"e5363e5c-073d-4bb4-9c68-9944251ff7a8","owner_id":null,"owner_name":null},{"id":"eb91a5a0-73b5-4552-87a7-2100812fc442","name":"Sunshop Group","description":"<sup>[[Dark Reading Codoso Feb 2015](https://app.tidalcyber.com/references/c24035b1-2021-44ae-b01e-651e44526737)]</sup>","source":"MITRE","associated_group_id":"1447143d-e8bf-448d-92df-67f19ac2e850","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"4173c301-0307-458d-89dd-2583e94247ec","name":"APT20","source":"Tidal Cyber","group_attack_id":"G3020","created":"2023-09-14T20:18:03.449582Z","modified":"2023-09-14T20:18:03.449586Z","tidal_id":"dce07191-7cad-5634-8d8e-6fd4fac9384a","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"7446e519-930c-416c-bcf9-55a8819a2630","name":"VIOLIN PANDA","description":"","source":"Tidal Cyber","associated_group_id":"9d19037b-5996-473a-9c75-1896ba436adc","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"84038ade-9caf-40f8-9660-cd0459f65d81","name":"TH3Bug","description":"","source":"Tidal Cyber","associated_group_id":"f233d85e-9274-4e5d-9eb8-57fa3dc6bebf","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1fe02736-3a38-4a71-b117-63c5386f15fb","name":"Crawling Taurus","description":"<sup>[[Unit 42 ATOM Crawling Taurus](/references/75098b2c-4928-4e3f-9bcc-b4f6b8de96f8)]</sup>","source":"Tidal Cyber","associated_group_id":"c8c1b25e-4066-44c1-bb17-f561c86d8202","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4812c101-e6cf-48c1-a1cd-640a1131ff22","name":"Twivy","description":"<sup>[[Mandiant APT Groups List](/references/c984fcfc-1bfd-4b1e-9034-a6ff3e6ebf97)]</sup>","source":"Tidal Cyber","associated_group_id":"276fd84a-14fa-4040-9a98-f5eb09a24f3f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[],"owner_name":"TidalCyberIan"},{"id":"5b1a5b9e-4722-41fc-a15d-196a549e3ac5","name":"APT28","source":"MITRE","group_attack_id":"G0007","created":"2017-05-31T21:31:48.664000Z","modified":"2022-03-16T18:08:13.958000Z","tidal_id":"a3dbd077-107b-53d3-b32f-4f2409e1cb90","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"b23d13af-1445-4219-a1b9-a559d1873102","name":"Armenia","country_name":"Armenia","country_code":"AM"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"8af7cb07-edaa-4b5c-a1f0-bc171151e6b4","name":"Croatia","country_name":"Croatia","country_code":"HR"},{"id":"7ffb715f-01a7-49b4-a641-66f13647cef5","name":"Cyprus","country_name":"Cyprus","country_code":"CY"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"07578934-334f-4a04-b0c0-7157b1257617","name":"Greece","country_name":"Greece","country_code":"GR"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"f0106493-e44f-43d5-b12b-0971842d81de","name":"Kyrgyzstan","country_name":"Kyrgyzstan","country_code":"KG"},{"id":"8c04cdb9-d766-412c-b041-782c879f51c6","name":"Latvia","country_name":"Latvia","country_code":"LV"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"57795c9b-f344-44fb-99fa-85379126bb0b","name":"Moldova, Republic of","country_name":"Moldova","country_code":"MD"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"b3b49312-69e9-426b-b18e-268bbf39f129","name":"Montenegro","country_name":"Montenegro","country_code":"ME"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"3720daef-8d9a-49ba-b95c-d374c52ba355","name":"North Macedonia","country_name":"North Macedonia","country_code":"MK"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"1cdaf0b5-6ad2-4321-8145-7fccb5bbd59f","name":"Slovakia","country_name":"Slovakia","country_code":"SK"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"74026dba-423a-49c5-afea-4f18bc021a6a","name":"Tajikistan","country_name":"Tajikistan","country_code":"TJ"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"b02938ca-9762-4fa5-88da-da9700e3eef3","name":"Uganda","country_name":"Uganda","country_code":"UG"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"7b2468c3-ef9b-422b-8700-f2d9230115c9","name":"STRONTIUM","description":"<sup>[[Kaspersky Sofacy](https://app.tidalcyber.com/references/46226f98-c762-48e3-9bcd-19ff14184bb5)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Microsoft STRONTIUM Aug 2019](https://app.tidalcyber.com/references/7efd3c8d-5e69-4b6f-8edb-9186abdf0e1a)]</sup><sup>[[Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020](https://app.tidalcyber.com/references/0a65008c-acdd-40fa-af1a-3d9941af8eac)]</sup><sup>[[TrendMicro Pawn Storm Dec 2020](https://app.tidalcyber.com/references/3bc249cd-f29a-4a74-a179-a6860e43683f)]</sup><sup>[[Cybersecurity Advisory GRU Brute Force Campaign July 2021](https://app.tidalcyber.com/references/e70f0742-5f3e-4701-a46b-4a58c0281537)]</sup>","source":"MITRE","associated_group_id":"f7c8de7a-3322-48b4-917c-e2ffd433890b","owner_id":null,"owner_name":null},{"id":"7003a53f-b1ba-44d0-8a04-bd1766e4865c","name":"Tsar Team","description":"<sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup>","source":"MITRE","associated_group_id":"afa355ce-eb36-498d-b9e4-e0d6bce1573f","owner_id":null,"owner_name":null},{"id":"fbb85fd4-09a6-5bc8-90ea-701ac9f84bd6","name":"FROZENLAKE","description":"<sup>[[Leonard TAG 2023](https://app.tidalcyber.com/references/95c6ad1d-df16-5dd3-a6ef-75c1247ec5e0)]</sup>","source":"MITRE","associated_group_id":"140d057b-3b9e-52f9-a159-614c7e4add67","owner_id":null,"owner_name":null},{"id":"4ff67067-30fa-5cec-a4d7-70de1640a5e1","name":"Forest Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"ff159646-8737-4733-9ae7-c59c077feb21","owner_id":null,"owner_name":null},{"id":"75a22116-0f97-4563-b49e-73ede9f679a0","name":"SNAKEMACKEREL","description":"<sup>[[Accenture SNAKEMACKEREL Nov 2018](https://app.tidalcyber.com/references/c38d021c-d84c-4aa7-b7a5-be47e18df1d8)]</sup>","source":"MITRE","associated_group_id":"7f58eb05-a22c-4df9-a8ad-6e3dfa97e511","owner_id":null,"owner_name":null},{"id":"687436e6-ae66-4a38-a6ad-e51579474d1f","name":"BlueDelta","description":"<sup>[[Www.recordedfuture.com January 09 2026](/references/fb8ee1dd-bf96-4d28-9d9f-807cc351190b)]</sup>","source":"USER","associated_group_id":"b7f7d39a-d3c1-4e8b-a9f6-9f4bc638d09c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6a42e6dd-3e4e-475f-8293-59d9af80e394","name":"IRON TWILIGHT","description":"<sup>[[Secureworks IRON TWILIGHT Profile](https://app.tidalcyber.com/references/2fc5b9dc-3745-4760-b116-5cc5abb9101d)]</sup><sup>[[Secureworks IRON TWILIGHT Active Measures March 2017](https://app.tidalcyber.com/references/0d28c882-5175-4bcf-9c82-e6c4394326b6)]</sup>","source":"MITRE","associated_group_id":"fc8d868d-e3df-486d-8efb-eed4d3554abe","owner_id":null,"owner_name":null},{"id":"ebcc547a-c3b7-4673-801f-4409511f6dd2","name":"Fancy Bear","description":"<sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup><sup>[[Kaspersky Sofacy](https://app.tidalcyber.com/references/46226f98-c762-48e3-9bcd-19ff14184bb5)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Ars Technica GRU indictment Jul 2018](https://app.tidalcyber.com/references/a1192cb3-4536-4900-93c7-a127ca06c690)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup><sup>[[Symantec APT28 Oct 2018](https://app.tidalcyber.com/references/777bc94a-6c21-4f8c-9efa-a1cf52ececc0)]</sup><sup>[[Securelist Sofacy Feb 2018](https://app.tidalcyber.com/references/3a043bba-2451-4765-946b-c1f3bf4aea36)]</sup><sup>[[Cybersecurity Advisory GRU Brute Force Campaign July 2021](https://app.tidalcyber.com/references/e70f0742-5f3e-4701-a46b-4a58c0281537)]</sup>","source":"MITRE","associated_group_id":"78894876-29d5-4feb-9afa-d7ab2955b81b","owner_id":null,"owner_name":null},{"id":"56f38218-30ad-4c58-8943-9b68103d91fa","name":"Sednit","description":"This designation has been used in reporting both to refer to the threat group and its associated malware [JHUHUGIT](https://app.tidalcyber.com/software/d50ef3fc-7d1c-4a82-b1cf-2319d83da3ae).<sup>[[FireEye APT28 January 2017](https://app.tidalcyber.com/references/61d80b8f-5bdb-41e6-b59a-d2d996392873)]</sup><sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup><sup>[[Kaspersky Sofacy](https://app.tidalcyber.com/references/46226f98-c762-48e3-9bcd-19ff14184bb5)]</sup><sup>[[Ars Technica GRU indictment Jul 2018](https://app.tidalcyber.com/references/a1192cb3-4536-4900-93c7-a127ca06c690)]</sup>","source":"MITRE","associated_group_id":"78e2b73c-4042-4c78-af27-c289450e9db1","owner_id":null,"owner_name":null},{"id":"faedc5a2-750e-4f7e-b219-caa2867c4cb6","name":"Pawn Storm","description":"<sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[TrendMicro Pawn Storm Dec 2020](https://app.tidalcyber.com/references/3bc249cd-f29a-4a74-a179-a6860e43683f)]</sup> ","source":"MITRE","associated_group_id":"c9b8f211-b713-4e51-8442-e494c4c56e8b","owner_id":null,"owner_name":null},{"id":"5ee64dd4-4eec-4830-b897-9a167fc4c0d1","name":"Pawn Storm","description":"<sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[TrendMicro Pawn Storm Dec 2020](https://app.tidalcyber.com/references/3bc249cd-f29a-4a74-a179-a6860e43683f)]</sup>","source":"Mobile","associated_group_id":"c9b8f211-b713-4e51-8442-e494c4c56e8b","owner_id":null,"owner_name":null},{"id":"4dda10af-64d7-4d4c-bb37-a9ecc3dede33","name":"STRONTIUM","description":"<sup>[[Kaspersky Sofacy](https://app.tidalcyber.com/references/46226f98-c762-48e3-9bcd-19ff14184bb5)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Microsoft STRONTIUM Aug 2019](https://app.tidalcyber.com/references/7efd3c8d-5e69-4b6f-8edb-9186abdf0e1a)]</sup><sup>[[Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020](https://app.tidalcyber.com/references/0a65008c-acdd-40fa-af1a-3d9941af8eac)]</sup><sup>[[TrendMicro Pawn Storm Dec 2020](https://app.tidalcyber.com/references/3bc249cd-f29a-4a74-a179-a6860e43683f)]</sup><sup>[[Cybersecurity Advisory GRU Brute Force Campaign July 2021](https://app.tidalcyber.com/references/e70f0742-5f3e-4701-a46b-4a58c0281537)]</sup>","source":"Mobile","associated_group_id":"f7c8de7a-3322-48b4-917c-e2ffd433890b","owner_id":null,"owner_name":null},{"id":"ecfdc2e7-d896-40dc-8247-e542dde02ab3","name":"Tsar Team","description":"<sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup>","source":"Mobile","associated_group_id":"afa355ce-eb36-498d-b9e4-e0d6bce1573f","owner_id":null,"owner_name":null},{"id":"ebb27272-18c0-4cdb-89f1-6e8e66f6c0eb","name":"Sofacy","description":"This designation has been used in reporting both to refer to the threat group and its associated malware.<sup>[[FireEye APT28](https://app.tidalcyber.com/references/c423b2b2-25a3-4a8d-b89a-83ab07c0cd20)]</sup><sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup><sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Ars Technica GRU indictment Jul 2018](https://app.tidalcyber.com/references/a1192cb3-4536-4900-93c7-a127ca06c690)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup>","source":"MITRE","associated_group_id":"8983bc4c-26f9-4d1b-a32d-5b198f90cc24","owner_id":null,"owner_name":null},{"id":"918a1911-1e70-4c88-96b1-025f07c570eb","name":"GruesomeLarch","description":"<sup>[[Nearest Neighbor Volexity](https://app.tidalcyber.com/references/25b312ea-0d7a-5f05-9db1-14bbab909317)]</sup>","source":"Mobile","associated_group_id":"b3d9c55e-e627-5ef5-8235-2380a9f2fa14","owner_id":null,"owner_name":null},{"id":"9e03a6df-6398-48c9-acae-cdadb68ed5ae","name":"Swallowtail","description":"<sup>[[Symantec APT28 Oct 2018](https://app.tidalcyber.com/references/777bc94a-6c21-4f8c-9efa-a1cf52ececc0)]</sup>","source":"MITRE","associated_group_id":"7f1b55a8-6645-4262-ba7f-8f3e9d372f10","owner_id":null,"owner_name":null},{"id":"2d20b321-5edf-4bc7-915b-98eadcbf90a5","name":"Group 74","description":"<sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup>","source":"MITRE","associated_group_id":"cf66714e-7dc7-44dc-b594-c7ee99610bc2","owner_id":null,"owner_name":null},{"id":"b8651331-b87b-4ea6-934b-f170c3dc7303","name":"Threat Group-4127","description":"<sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup>","source":"MITRE","associated_group_id":"f31dcaf0-e808-4073-9b57-88030e5842bb","owner_id":null,"owner_name":null},{"id":"55adb620-5d68-4583-87db-f1d920d5d875","name":"TG-4127","description":"<sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup>","source":"MITRE","associated_group_id":"8d33359e-a3fc-4423-a84a-82081e99fb82","owner_id":null,"owner_name":null},{"id":"6523da3d-411f-5cb6-8a76-4583bc211cd0","name":"GruesomeLarch","description":"<sup>[[Nearest Neighbor Volexity](https://app.tidalcyber.com/references/25b312ea-0d7a-5f05-9db1-14bbab909317)]</sup>","source":"MITRE","associated_group_id":"b3d9c55e-e627-5ef5-8235-2380a9f2fa14","owner_id":null,"owner_name":null},{"id":"d462b4e5-b823-470a-b4c0-c5b135f9ed37","name":"TA422","description":"<sup>[[Proofpoint TA422 December 5 2023](/references/4c69ce41-2094-478f-8b51-26c1704a042d)]</sup>","source":"Tidal Cyber","associated_group_id":"f80ba1c4-b890-4b26-a61e-aaa5e7a7dc3d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9fe69ea1-4c35-4322-8029-b5ce381f8d94","name":"Forest Blizzard","description":"<sup>[[U.S. Federal Bureau of Investigation 2 27 2024](/references/962fb031-dfd1-43a7-8202-3a2231b0472b)]</sup>","source":"Tidal Cyber","associated_group_id":"5ef741d0-4089-4ca7-aed9-da91b36b75c9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1f703bf9-e266-4244-b423-15b4d12030ee","name":"IRON TWILIGHT","description":"<sup>[[Secureworks IRON TWILIGHT Profile](https://app.tidalcyber.com/references/2fc5b9dc-3745-4760-b116-5cc5abb9101d)]</sup><sup>[[Secureworks IRON TWILIGHT Active Measures March 2017](https://app.tidalcyber.com/references/0d28c882-5175-4bcf-9c82-e6c4394326b6)]</sup>","source":"Mobile","associated_group_id":"fc8d868d-e3df-486d-8efb-eed4d3554abe","owner_id":null,"owner_name":null},{"id":"c93347b9-0721-4bb4-87f2-e0932031f3eb","name":"SNAKEMACKEREL","description":"<sup>[[Accenture SNAKEMACKEREL Nov 2018](https://app.tidalcyber.com/references/c38d021c-d84c-4aa7-b7a5-be47e18df1d8)]</sup>","source":"Mobile","associated_group_id":"7f58eb05-a22c-4df9-a8ad-6e3dfa97e511","owner_id":null,"owner_name":null},{"id":"91d3bc69-dc90-48ae-b98a-0f1ba2681893","name":"Swallowtail","description":"<sup>[[Symantec APT28 Oct 2018](https://app.tidalcyber.com/references/777bc94a-6c21-4f8c-9efa-a1cf52ececc0)]</sup>","source":"Mobile","associated_group_id":"7f1b55a8-6645-4262-ba7f-8f3e9d372f10","owner_id":null,"owner_name":null},{"id":"05253f71-e799-4306-a354-c26997c760ca","name":"Group 74","description":"<sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup>","source":"Mobile","associated_group_id":"cf66714e-7dc7-44dc-b594-c7ee99610bc2","owner_id":null,"owner_name":null},{"id":"7b90065e-a27b-4e02-a532-39b8d0dfa66a","name":"Sednit","description":"This designation has been used in reporting both to refer to the threat group and its associated malware [JHUHUGIT](https://app.tidalcyber.com/software/d50ef3fc-7d1c-4a82-b1cf-2319d83da3ae).<sup>[[FireEye APT28 January 2017](https://app.tidalcyber.com/references/61d80b8f-5bdb-41e6-b59a-d2d996392873)]</sup><sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup><sup>[[Kaspersky Sofacy](https://app.tidalcyber.com/references/46226f98-c762-48e3-9bcd-19ff14184bb5)]</sup><sup>[[Ars Technica GRU indictment Jul 2018](https://app.tidalcyber.com/references/a1192cb3-4536-4900-93c7-a127ca06c690)]</sup>","source":"Mobile","associated_group_id":"78e2b73c-4042-4c78-af27-c289450e9db1","owner_id":null,"owner_name":null},{"id":"439e9e87-8d93-47b7-bc59-e28942878bf7","name":"Sofacy","description":"This designation has been used in reporting both to refer to the threat group and its associated malware.<sup>[[FireEye APT28](https://app.tidalcyber.com/references/c423b2b2-25a3-4a8d-b89a-83ab07c0cd20)]</sup><sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup><sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Ars Technica GRU indictment Jul 2018](https://app.tidalcyber.com/references/a1192cb3-4536-4900-93c7-a127ca06c690)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup>","source":"Mobile","associated_group_id":"8983bc4c-26f9-4d1b-a32d-5b198f90cc24","owner_id":null,"owner_name":null},{"id":"95c71ee1-53ab-4de6-9d96-02cd17d3d6e9","name":"Fancy Bear","description":"<sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup><sup>[[Kaspersky Sofacy](https://app.tidalcyber.com/references/46226f98-c762-48e3-9bcd-19ff14184bb5)]</sup><sup>[[ESET Sednit Part 3](https://app.tidalcyber.com/references/7c2be444-a947-49bc-b5f6-8f6bec870c6a)]</sup><sup>[[Ars Technica GRU indictment Jul 2018](https://app.tidalcyber.com/references/a1192cb3-4536-4900-93c7-a127ca06c690)]</sup><sup>[[Talos Seduploader Oct 2017](https://app.tidalcyber.com/references/2db77619-72df-461f-84bf-2d1c3499a5c0)]</sup><sup>[[Symantec APT28 Oct 2018](https://app.tidalcyber.com/references/777bc94a-6c21-4f8c-9efa-a1cf52ececc0)]</sup><sup>[[Securelist Sofacy Feb 2018](https://app.tidalcyber.com/references/3a043bba-2451-4765-946b-c1f3bf4aea36)]</sup><sup>[[Cybersecurity Advisory GRU Brute Force Campaign July 2021](https://app.tidalcyber.com/references/e70f0742-5f3e-4701-a46b-4a58c0281537)]</sup>","source":"Mobile","associated_group_id":"78894876-29d5-4feb-9afa-d7ab2955b81b","owner_id":null,"owner_name":null},{"id":"b872f796-afaf-43d4-9fe6-9de3b56f61b0","name":"Threat Group-4127","description":"<sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup>","source":"Mobile","associated_group_id":"f31dcaf0-e808-4073-9b57-88030e5842bb","owner_id":null,"owner_name":null},{"id":"cbdef38d-c23b-4602-ac3e-1e8f900e5be5","name":"TG-4127","description":"<sup>[[SecureWorks TG-4127](https://app.tidalcyber.com/references/5f401c82-4e16-43a1-b234-48918fe7df9f)]</sup>","source":"Mobile","associated_group_id":"8d33359e-a3fc-4423-a84a-82081e99fb82","owner_id":null,"owner_name":null},{"id":"fa2f3a8a-ad76-4151-bcd2-29cb8c8abd84","name":"Forest Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"ff159646-8737-4733-9ae7-c59c077feb21","owner_id":null,"owner_name":null},{"id":"a1445443-edc7-4199-ad2a-8a5b75835888","name":"FROZENLAKE","description":"<sup>[[Leonard TAG 2023](https://app.tidalcyber.com/references/95c6ad1d-df16-5dd3-a6ef-75c1247ec5e0)]</sup>","source":"Mobile","associated_group_id":"140d057b-3b9e-52f9-a159-614c7e4add67","owner_id":null,"owner_name":null}],"tags":[{"id":"8c756269-d570-4c85-bf6a-588b65359ecd","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"0e1df4dd-0c31-4f89-ac57-20e8de4b28de","tag":"efa33611-88a5-40ba-9bc4-3d85c6c8819b"},{"id":"3026d4aa-43e8-4a55-8795-0da153bf3562","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"5d1c9c61-939a-47f3-b308-f61b6b29177d","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"c3d56a96-8924-40a6-a686-2e9ea7ef152f","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"9fb928d2-7620-4196-a634-ab75de246c51","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"57463738-9a48-42e6-ad00-7a128bd90e75","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"1404e515-ada3-446f-a779-9f2e2f13ba53","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"d5d98fdc-7fe3-49c3-813e-bceb2d9c60c1","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"673987b9-0185-4625-bf3e-76d1e70aec16","tag":"98dc51bc-b8e1-4e77-8cda-72698b2768be"},{"id":"b2f2e8e5-ce71-4a0a-ad4c-e996d0c8ef49","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"3cf67106-2d7d-42c6-ad47-d71b2355d119","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"2883757b-7807-4f39-8fa0-1cb5d1f4d2a0","tag":"2185ed93-7e1c-4553-9452-c8411b5dca93"},{"id":"b26eb296-499f-409f-9e1a-f35cddb460f4","tag":"c146ec54-a59e-4e2c-87d9-bef2181c896a"},{"id":"96bb5802-2911-4c1b-a89d-d36d9f0f3afc","tag":"62996ab2-7293-4d4b-a699-30e5bbd137df"},{"id":"10516096-1bb7-4c79-be02-296c4690be4c","tag":"77c45e5f-7ac2-4ec2-8962-cdb843b9087c"},{"id":"76e9739d-2732-4b2a-95b1-e4e7b252f720","tag":"b62ad173-2fd9-49e7-8d4c-b8e3579ce46c"},{"id":"4fc9457b-e2ef-4aac-b93a-692584fc3ac8","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"2239a84c-63a9-4a75-80ff-da0004d7041c","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"83fa9094-8355-40ee-ac1d-f60dd1b58d7b","tag":"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a"},{"id":"0f618548-270e-45dc-bc70-59b04b90094a","tag":"74afe12f-2bde-486e-983f-97e223bbfb6f"},{"id":"41268161-f69a-43d0-8cca-47668dd09b75","tag":"62bde669-3020-4682-be68-36c83b2588a4"},{"id":"214ec027-112b-44e8-b873-3f9bf5e14e13","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"67747ff9-ce64-4ffa-91ec-6329cd8aaf6b","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"136be77a-1950-4ebb-901a-0ec6f90c62e3","tag":"6070668f-1cbd-4878-8066-c636d1d8659c"},{"id":"29ca4a51-b429-45b1-9e05-256fe53bbafd","tag":"d8f7e071-fbfd-46f8-b431-e241bb1513ac"},{"id":"5629a2a8-fabe-48eb-ac05-263861b741c1","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"546c28a0-0364-4375-bac2-b1c3560b649e","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"3008f970-f191-48a0-9ba9-1ab1e275c9cc","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"4930898c-094f-49b7-8b6d-96c2c2a57b12","tag":"916ea1e8-d117-45a4-8564-0597a02b06e4"},{"id":"c7460040-65f2-48a0-a62b-8d80e99beae0","tag":"904ad11a-20ca-479c-ad72-74bd5d9dc7e4"},{"id":"635b65cd-db6f-47ae-8915-a78597a14642","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"77b63876-6685-4680-be75-c400a9a7b398","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"5db73563-a3f1-4641-bcf1-e86e9332e326","tag":"f01290d9-7160-44cb-949f-ee4947d04b6f"},{"id":"715a7a36-28ec-4f57-9c68-373423b974b1","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"}],"owner_name":null},{"id":"4c3e48b9-4426-4271-a7af-c3dfad79f447","name":"APT29","source":"MITRE","group_attack_id":"G0016","created":"2017-05-31T21:31:52.748000Z","modified":"2022-07-11T20:34:55.717000Z","tidal_id":"686596a3-c2e7-5179-a47e-2ce4d17aa638","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7ffb715f-01a7-49b4-a641-66f13647cef5","name":"Cyprus","country_name":"Cyprus","country_code":"CY"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"f0106493-e44f-43d5-b12b-0971842d81de","name":"Kyrgyzstan","country_name":"Kyrgyzstan","country_code":"KG"},{"id":"8c04cdb9-d766-412c-b041-782c879f51c6","name":"Latvia","country_name":"Latvia","country_code":"LV"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"0a756fb1-b308-407d-a819-4105f10cb203","name":"Luxembourg","country_name":"Luxembourg","country_code":"LU"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"b3b49312-69e9-426b-b18e-268bbf39f129","name":"Montenegro","country_name":"Montenegro","country_code":"ME"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"1cdaf0b5-6ad2-4321-8145-7fccb5bbd59f","name":"Slovakia","country_name":"Slovakia","country_code":"SK"},{"id":"178dd2d0-cacf-404b-a3da-8f812fc38338","name":"Slovenia","country_name":"Slovenia","country_code":"SI"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"b02938ca-9762-4fa5-88da-da9700e3eef3","name":"Uganda","country_name":"Uganda","country_code":"UG"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"},{"id":"69dd3e9b-a2bb-4afc-bd54-3154343e266c","name":"Video Games"}],"associated_groups":[{"id":"530f67f9-ace5-4ac2-8b37-bd2a3865d690","name":"The Dukes","description":"<sup>[[F-Secure The Dukes](https://app.tidalcyber.com/references/cc0dc623-ceb5-4ac6-bfbb-4f8514d45a27)]</sup><sup>[[ESET Dukes October 2019](https://app.tidalcyber.com/references/fbc77b85-cc5a-4c65-956d-b8556974b4ef)]</sup><sup>[[NCSC APT29 July 2020](https://app.tidalcyber.com/references/28da86a6-4ca1-4bb4-a401-d4aa469c0034)]</sup><sup>[[Cybersecurity Advisory SVR TTP May 2021](https://app.tidalcyber.com/references/e18c1b56-f29d-4ea9-a425-a6af8ac6a347)]</sup>","source":"MITRE","associated_group_id":"b9af22de-f6b0-4b07-9182-1d43179e1d31","owner_id":null,"owner_name":null},{"id":"59d76b12-0ee2-5427-aee0-8f4fda583f25","name":"Blue Kitsune","description":"<sup>[[PWC WellMess July 2020](https://app.tidalcyber.com/references/22794e37-3c55-444a-b659-e5a1a6bc2da0)]</sup><sup>[[PWC WellMess C2 August 2020](https://app.tidalcyber.com/references/3afca6f1-680a-46ae-8cea-10b6b870d5e7)]</sup>","source":"MITRE","associated_group_id":"e6294fb3-cd59-57de-a0a6-d19f4d2a1560","owner_id":null,"owner_name":null},{"id":"8d921cec-57e9-4a0e-95c8-0f220bf75771","name":"CozyDuke","description":"<sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup>","source":"MITRE","associated_group_id":"c71bf5f1-a297-4b10-8d66-3f61bd0b2a25","owner_id":null,"owner_name":null},{"id":"e574f72a-e781-4170-9917-a417bd72e79e","name":"NOBELIUM","description":"<sup>[[MSTIC NOBELIUM Mar 2021](https://app.tidalcyber.com/references/8688a0a9-d644-4b96-81bb-031f1f898652)]</sup><sup>[[MSTIC NOBELIUM May 2021](https://app.tidalcyber.com/references/047ec63f-1f4b-4b57-9ab5-8a5cfcc11f4d)]</sup><sup>[[MSTIC Nobelium Toolset May 2021](https://app.tidalcyber.com/references/52464e69-ff9e-4101-9596-dd0c6404bf76)]</sup><sup>[[MSRC Nobelium June 2021](https://app.tidalcyber.com/references/1588799f-a5d2-46bc-978d-f10ed7ceb15c)]</sup>","source":"MITRE","associated_group_id":"a51f4654-cba5-4052-8d79-a8671339eb9e","owner_id":null,"owner_name":null},{"id":"5f3029c0-da2e-45ee-bda4-5afe70c098fa","name":"UNC2452","description":"<sup>[[FireEye SUNBURST Backdoor December 2020](https://app.tidalcyber.com/references/d006ed03-a8af-4887-9356-3481d81d43e4)]</sup>","source":"MITRE","associated_group_id":"b9ef525d-16a2-4896-8205-6da397b37245","owner_id":null,"owner_name":null},{"id":"1c164198-c984-4371-b0ab-54f0e7d8c6fd","name":"YTTRIUM","description":"<sup>[[Microsoft Unidentified Dec 2018](https://app.tidalcyber.com/references/896c88f9-8765-4b60-b679-667b338757e3)]</sup>","source":"MITRE","associated_group_id":"f60a21a2-2a87-4e54-99df-f78ab1a7fd26","owner_id":null,"owner_name":null},{"id":"3f6b0598-3a33-4726-aaed-a81e323f08b6","name":"IRON RITUAL","description":"<sup>[[Secureworks IRON RITUAL Profile](https://app.tidalcyber.com/references/c1ff66d6-3ea3-4347-8a8b-447cd8b48dab)]</sup>","source":"MITRE","associated_group_id":"f26c70ba-7879-4083-bfd0-ec34bdb80416","owner_id":null,"owner_name":null},{"id":"44087a77-831c-4dc4-af9d-8a6aa4ef4fc8","name":"Cozy Bear","description":"<sup>[[Crowdstrike DNC June 2016](https://app.tidalcyber.com/references/7f4edc06-ac67-4d71-b39c-5df9ce521bbb)]</sup><sup>[[ESET Dukes October 2019](https://app.tidalcyber.com/references/fbc77b85-cc5a-4c65-956d-b8556974b4ef)]</sup><sup>[[NCSC APT29 July 2020](https://app.tidalcyber.com/references/28da86a6-4ca1-4bb4-a401-d4aa469c0034)]</sup><sup>[[Cybersecurity Advisory SVR TTP May 2021](https://app.tidalcyber.com/references/e18c1b56-f29d-4ea9-a425-a6af8ac6a347)]</sup><sup>[[CrowdStrike StellarParticle January 2022](https://app.tidalcyber.com/references/149c1446-d6a1-4a63-9420-def9272d6cb9)]</sup>","source":"MITRE","associated_group_id":"0742ac72-9dc7-40ba-b568-1185187d93a8","owner_id":null,"owner_name":null},{"id":"82c24d84-98b7-4ea9-af12-e863506a0b62","name":"NobleBaron","description":"<sup>[[SentinelOne NobleBaron June 2021](https://app.tidalcyber.com/references/98cf2bb0-f36c-45af-8d47-bf26aca3bb09)]</sup>","source":"MITRE","associated_group_id":"7a8aa751-21a3-4fdc-b19b-2810ffb4f44f","owner_id":null,"owner_name":null},{"id":"d23fdc45-3325-519e-85e8-55353eec7d71","name":"SolarStorm","description":"<sup>[[Unit 42 SolarStorm December 2020](https://app.tidalcyber.com/references/ecbb602a-2427-5eba-8c2b-25d90c95f166)]</sup>","source":"MITRE","associated_group_id":"7a10ed9e-6744-5657-bc4f-dfea05a89105","owner_id":null,"owner_name":null},{"id":"3ccd8900-e251-540a-8206-4ebd1eec00c8","name":"UNC3524","description":"<sup>[[Mandiant APT29 Eye Spy Email Nov 22](https://app.tidalcyber.com/references/452ca091-42b1-5bef-8a01-921c1f46bbee)]</sup>","source":"MITRE","associated_group_id":"d381c0b3-36d6-5619-9111-e392345eb22d","owner_id":null,"owner_name":null},{"id":"3cb3858f-3e99-4ab0-ab04-6a2ff3e7d5cc","name":"IRON HEMLOCK","description":"<sup>[[Secureworks IRON HEMLOCK Profile](https://app.tidalcyber.com/references/36191a48-4661-42ea-b194-2915c9b184f3)]</sup>","source":"MITRE","associated_group_id":"1e5b89db-5d7c-40f0-86a2-ab7affabd6c3","owner_id":null,"owner_name":null},{"id":"72249657-2665-4406-8486-35016b132f8a","name":"Dark Halo","description":"<sup>[[Volexity SolarWinds](https://app.tidalcyber.com/references/355cecf8-ef3e-4a6e-a652-3bf26fe46d88)]</sup>","source":"MITRE","associated_group_id":"c0b8d1d5-4412-44b7-ba21-d2f0c96be941","owner_id":null,"owner_name":null},{"id":"a43165a4-9907-5cc6-9977-f65121bbc24f","name":"Midnight Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"059625b3-ec2f-4d00-85a5-a964795f83a4","owner_id":null,"owner_name":null},{"id":"05b6f671-7e22-4422-99b6-7438b6fc654b","name":"Midnight Blizzard","description":"<sup>[[Microsoft Midnight Blizzard January 19 2024](/references/91b48ddd-9e3f-4d36-a262-3b52145b3db2)]</sup>","source":"Tidal Cyber","associated_group_id":"4f1c2576-e3bb-4cd0-8d9f-df4cde4db79d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8823f6a6-96f8-44d9-be9d-42f86aea309a","name":"ICECAP","description":"<sup>[[Google Cybercrime Report February 11 2025](/references/17685d5c-4255-445e-a546-e0dfb92378c2)]</sup>","source":"Tidal Cyber","associated_group_id":"fa747c20-6645-4456-a96a-b530267a4030","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"4d4a0c95-309d-44b9-9422-3c9b9fdb31a8","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"25ab700c-c2d8-49b8-b390-bd245a66e974","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"903d6fca-b4a2-42a7-9774-a27a2a8d2c48","tag":"154bd6f0-9276-4ea5-946c-d35769d3ae4b"},{"id":"999f8814-25ad-4fb3-ad3f-02d2cd93b038","tag":"1ee3e55f-8f28-43c4-9f01-8a1bad68bd56"},{"id":"8086e400-6c31-4e78-aee6-bfb553b6ff57","tag":"082b6886-9f4a-4237-82e4-827f6bab704e"},{"id":"851b1b4f-eb51-4c2c-bd9e-58ebbf1a8f58","tag":"7d158419-2d50-4688-aa4f-3b68a4d30870"},{"id":"d954ce07-86d5-4938-8ece-3b03e45df39e","tag":"5c7a911d-9f28-4f13-a6aa-c7a2e2b3ca55"},{"id":"2b85f1fc-e932-4e3d-9d59-2a6344c6bfe2","tag":"46404b24-e38a-4fea-981b-cac3d3020c8b"},{"id":"33f0fd39-9db1-4c6a-a57a-405ba71b5f39","tag":"9a0df3c4-2bbf-4192-a08a-ec27d9a4c5f1"},{"id":"68e0bfa3-b124-4c25-af61-ca79b616139c","tag":"e676e31d-d1d4-4a83-afa9-acf58be4f92a"},{"id":"87c72668-ec9a-4098-8843-08539fd9c2c7","tag":"49478e42-38e9-417c-9cf9-7f2c5d41bfa8"},{"id":"f3c012e3-4a89-482c-bad7-982e775aefcb","tag":"b7ad8591-fbff-46ec-8f4a-33f569cce2f9"},{"id":"8d7c9a3a-d38c-4d82-912c-960fa3d13814","tag":"5ef89937-dd06-4407-91d2-61db30c75934"},{"id":"5f3dc93f-10fa-4147-b80e-512952cd08d6","tag":"72d3fa15-265b-4f4c-ba77-635d8531fe69"},{"id":"b26ea1a2-4a9f-480b-b0d7-13e9d74b9561","tag":"5bd6e9f7-78e3-4a8b-8734-c8c45b61a76d"},{"id":"e758d797-e7c4-4ee0-ba00-0b4cb132513f","tag":"b3665c87-5cb3-414e-8910-d4ffe53371c2"},{"id":"b9de3f2e-d838-436b-95cb-4f74f120e0d4","tag":"d1596bb2-b947-419a-b1f0-8f38e28eae09"},{"id":"2b25c711-f4ce-419e-9aa0-ef040380cdf2","tag":"49a674f7-c117-422e-8057-67bdfab2de9c"},{"id":"c46f8a19-6611-4522-9e62-28e70f2ba7d1","tag":"a4240ea5-b7d4-40a0-afbd-76fcf2e4ebbc"},{"id":"03c62148-f3d2-44dd-8a62-20be4b748253","tag":"f97e406e-0d4b-4927-af03-8113a720417f"},{"id":"fd3b5707-991a-4b0b-a04e-b80286d6b9eb","tag":"1b0321d7-4d9a-4977-bd2a-092c2693b328"},{"id":"acd6f2b0-6339-40ad-a701-26d321a71153","tag":"cccb02c5-9791-4cb4-8fe8-0c5a6aea7dcf"},{"id":"18b4faee-ff5f-48f3-8f17-b11cdd34c192","tag":"15b77e5c-2285-434d-9719-73c14beba8bd"},{"id":"24a4f728-58d0-42bc-8ecd-70b712a76f85","tag":"7551097a-dfdd-426f-aaa2-a2916dd9b873"},{"id":"5f004843-deb7-449f-b369-ed184f65d357","tag":"a32a757a-9d6b-43ca-ac4b-5f695dd0f110"},{"id":"b8db2c4d-316e-4849-8733-a8bb692185e0","tag":"1b98f09a-7d93-4abb-8f3e-1eacdb9f9871"},{"id":"a4ec10d6-ad56-4a98-8faf-622ee347f076","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"1832983a-75c8-4312-a9d8-0d0934869763","tag":"08809fa0-61b6-4394-b103-1c4d19a5be16"},{"id":"ba9f85f1-9ed4-4c6d-a73c-92bd471c7fcd","tag":"4a457eb3-e404-47e5-b349-8b1f743dc657"},{"id":"b68bdc7e-0520-41d4-b61a-5a9f4a5ec002","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"b8adfb93-a8e9-4f51-92f7-ac3b4764ba8b","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"},{"id":"908462e7-c0be-4469-96b6-dd9c15a29e8e","tag":"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a"},{"id":"03c471a7-80f3-4f59-a68e-1a042aedff9d","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"}],"owner_name":null},{"id":"9da726e6-af02-49b8-8ebe-7ea4235513c9","name":"APT3","source":"MITRE","group_attack_id":"G0022","created":"2017-05-31T21:31:55.853000Z","modified":"2021-10-01T19:09:20.817000Z","tidal_id":"16ae6eca-11f7-5fb2-965a-f32285541415","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"0a756fb1-b308-407d-a819-4105f10cb203","name":"Luxembourg","country_name":"Luxembourg","country_code":"LU"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[],"associated_groups":[{"id":"04676dcd-f1cb-4333-8be5-430590252412","name":"Threat Group-0110","description":"<sup>[[Recorded Future APT3 May 2017](https://app.tidalcyber.com/references/a894d79f-5977-4ef9-9aa5-7bfec795ceb2)]</sup> <sup>[[Symantec Buckeye](https://app.tidalcyber.com/references/dbf3ce3e-bcf2-4e47-ad42-839e51967395)]</sup>","source":"MITRE","associated_group_id":"9eac64b2-f6ac-4a34-98c9-b159337fbea8","owner_id":null,"owner_name":null},{"id":"be611484-9a2e-4588-b8fa-c0508d5b6664","name":"Gothic Panda","description":"<sup>[[PWC Pirpi Scanbox](https://app.tidalcyber.com/references/4904261a-a3a9-4c3e-b6a7-079890026ee2)]</sup> <sup>[[Recorded Future APT3 May 2017](https://app.tidalcyber.com/references/a894d79f-5977-4ef9-9aa5-7bfec795ceb2)]</sup> <sup>[[Symantec Buckeye](https://app.tidalcyber.com/references/dbf3ce3e-bcf2-4e47-ad42-839e51967395)]</sup>","source":"MITRE","associated_group_id":"d447bfdc-0a5c-4651-9070-2b3b87ac2128","owner_id":null,"owner_name":null},{"id":"6d48e081-6e08-46c1-9540-4040930dcb84","name":"Pirpi","description":"<sup>[[PWC Pirpi Scanbox](https://app.tidalcyber.com/references/4904261a-a3a9-4c3e-b6a7-079890026ee2)]</sup>","source":"MITRE","associated_group_id":"feff078c-cd96-4e56-90a7-4310ae8e48cb","owner_id":null,"owner_name":null},{"id":"12d12339-8efc-4730-8987-71c5a15de637","name":"UPS Team","description":"<sup>[[FireEye Clandestine Wolf](https://app.tidalcyber.com/references/dbb779c4-4d75-4fb4-ad3a-7d1f0f74e26f)]</sup> <sup>[[Recorded Future APT3 May 2017](https://app.tidalcyber.com/references/a894d79f-5977-4ef9-9aa5-7bfec795ceb2)]</sup> <sup>[[Symantec Buckeye](https://app.tidalcyber.com/references/dbf3ce3e-bcf2-4e47-ad42-839e51967395)]</sup>","source":"MITRE","associated_group_id":"bceffa47-b63a-4ebf-bded-33cb633c5ea7","owner_id":null,"owner_name":null},{"id":"bd9c167a-8dc3-4476-a119-d919c905cd26","name":"Buckeye","description":"<sup>[[Symantec Buckeye](https://app.tidalcyber.com/references/dbf3ce3e-bcf2-4e47-ad42-839e51967395)]</sup>","source":"MITRE","associated_group_id":"4149bb91-e34b-4d22-80f1-e8adfab0d17f","owner_id":null,"owner_name":null},{"id":"daf15744-3090-430a-86b5-573037ff5654","name":"TG-0110","description":"<sup>[[Recorded Future APT3 May 2017](https://app.tidalcyber.com/references/a894d79f-5977-4ef9-9aa5-7bfec795ceb2)]</sup> <sup>[[Symantec Buckeye](https://app.tidalcyber.com/references/dbf3ce3e-bcf2-4e47-ad42-839e51967395)]</sup>","source":"MITRE","associated_group_id":"a62a6f94-d301-4cf8-b67e-662fd7f91d73","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"be45ff95-6c74-4000-bc39-63044673d82f","name":"APT30","source":"MITRE","group_attack_id":"G0013","created":"2017-05-31T21:31:51.026000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"5dbb5961-2294-5302-87ce-2774a58e15f4","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"5ab9467f-4a34-4883-8e8f-2d3b2b3404d1","name":"Bhutan","country_name":"Bhutan","country_code":"BT"},{"id":"50877c20-18c5-48d0-936a-a6bc462810f5","name":"Brunei Darussalam","country_name":"Brunei Darussalam","country_code":"BN"},{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"e8f8da13-386b-4027-8fe0-f4e3e341ae07","name":"Lao People's Democratic Republic","country_name":"Lao People's Democratic Republic","country_code":"LA"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"c0fe9859-e8de-4ce1-bc3c-b489e914a145","name":"APT32","source":"MITRE","group_attack_id":"G0050","created":"2017-12-14T16:46:06.044000Z","modified":"2021-10-14T16:39:50.790000Z","tidal_id":"71fcf59e-fc31-570e-af4c-75f59730cef7","country":[{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_motivation":[],"observed_country":[{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"e8f8da13-386b-4027-8fe0-f4e3e341ae07","name":"Lao People's Democratic Republic","country_name":"Lao People's Democratic Republic","country_code":"LA"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"44190852-882a-4342-a5c8-f02ca889a229","name":"OceanLotus","description":"<sup>[[FireEye APT32 May 2017](https://app.tidalcyber.com/references/b72d017b-a70f-4003-b3d9-90d79aca812d)]</sup><sup>[[Volexity OceanLotus Nov 2017](https://app.tidalcyber.com/references/ed9f5545-377f-4a12-92e4-c0439cc5b037)]</sup><sup>[[Cybereason Oceanlotus May 2017](https://app.tidalcyber.com/references/1ef3025b-d4a9-49aa-b744-2dbea10a0abf)]</sup><sup>[[ESET OceanLotus Mar 2019](https://app.tidalcyber.com/references/b2745f5c-a181-48e1-b1cf-37a1ffe1fdf0)]</sup><sup>[[Amnesty Intl. Ocean Lotus February 2021](https://app.tidalcyber.com/references/a54a2f68-8406-43ab-8758-07edd49dfb83)]</sup>","source":"MITRE","associated_group_id":"60ed0464-1075-4f6d-b72d-4aaa2892d2c9","owner_id":null,"owner_name":null},{"id":"3666201a-e438-4c28-b130-b4dfe67854c2","name":"SeaLotus","description":"<sup>[[Cybereason Oceanlotus May 2017](https://app.tidalcyber.com/references/1ef3025b-d4a9-49aa-b744-2dbea10a0abf)]</sup>","source":"MITRE","associated_group_id":"510b8ec4-efad-41e0-8f0b-68c70a3d92e0","owner_id":null,"owner_name":null},{"id":"9a219fab-e9e1-4f04-98ef-baeb7710139d","name":"APT-C-00","description":"<sup>[[ESET OceanLotus](https://app.tidalcyber.com/references/a7bcbaca-10c1-403a-9eb5-f111af1cbf6a)]</sup><sup>[[Cybereason Oceanlotus May 2017](https://app.tidalcyber.com/references/1ef3025b-d4a9-49aa-b744-2dbea10a0abf)]</sup><sup>[[ESET OceanLotus Mar 2019](https://app.tidalcyber.com/references/b2745f5c-a181-48e1-b1cf-37a1ffe1fdf0)]</sup><sup>[[Amnesty Intl. Ocean Lotus February 2021](https://app.tidalcyber.com/references/a54a2f68-8406-43ab-8758-07edd49dfb83)]</sup>","source":"MITRE","associated_group_id":"6be3ad40-e776-4127-81d2-c24a7e2b6778","owner_id":null,"owner_name":null},{"id":"ecaa6e5c-677a-5749-a53d-3cc21441689c","name":"Canvas Cyclone","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"2675acd9-3744-560c-8d3d-5629643bcadf","owner_id":null,"owner_name":null},{"id":"2e005665-ab4c-582a-a447-220c9bea0fbe","name":"BISMUTH","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"7f2c17d9-8a42-5df6-b6ca-5ba3f15eb893","owner_id":null,"owner_name":null}],"tags":[{"id":"4db87ee4-433a-49df-a1c7-296f58881620","tag":"115113f0-5876-4aa5-b731-5ad46f60c069"}],"owner_name":null},{"id":"99bbbe25-45af-492f-a7ff-7cbc57828bac","name":"APT33","source":"MITRE","group_attack_id":"G0064","created":"2018-04-18T17:59:24.739000Z","modified":"2022-05-23T21:22:08.170000Z","tidal_id":"316554b6-1ac5-5dde-8d31-0be0e6306f10","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"5b0a8eda-4736-4489-8058-be0e929e49b3","name":"HOLMIUM","description":"<sup>[[Microsoft Holmium June 2020](https://app.tidalcyber.com/references/c249bfcf-25c4-4502-b5a4-17783d581163)]</sup>","source":"ICS","associated_group_id":"51ec6111-08b2-4294-a3a6-6d3f04161b62","owner_id":null,"owner_name":null},{"id":"6384c096-3397-442e-b00e-7443e28c6b99","name":"Elfin","description":"<sup>[[Symantec Elfin Mar 2019](https://app.tidalcyber.com/references/55671ede-f309-4924-a1b4-3d597517b27e)]</sup>","source":"ICS","associated_group_id":"b757d8cd-0b22-4604-81a6-1cd3dd53084c","owner_id":null,"owner_name":null},{"id":"46e16650-4bf8-4805-af63-f726d7cdf99a","name":"Peach Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"be83d2ba-f87a-4ba6-a0e8-9121adfbbfb4","owner_id":null,"owner_name":null},{"id":"4526a53c-a0c4-4554-8d6c-c30f1a5db7a0","name":"Peach Sandstorm","description":"<sup>[[Microsoft Peach Sandstorm September 14 2023](/references/98a631f4-4b95-4159-b311-dee1216ec208)]</sup>","source":"Tidal Cyber","associated_group_id":"5d178cb0-a072-4b2f-9c28-13642fb30c03","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a7af6a75-ed87-42d6-a011-92ab54eb977c","name":"HOLMIUM","description":"<sup>[[Microsoft Holmium June 2020](https://app.tidalcyber.com/references/c249bfcf-25c4-4502-b5a4-17783d581163)]</sup>","source":"MITRE","associated_group_id":"51ec6111-08b2-4294-a3a6-6d3f04161b62","owner_id":null,"owner_name":null},{"id":"36a6c829-fbff-4c14-bb51-749cb5850af8","name":"Elfin","description":"<sup>[[Symantec Elfin Mar 2019](https://app.tidalcyber.com/references/55671ede-f309-4924-a1b4-3d597517b27e)]</sup>","source":"MITRE","associated_group_id":"b757d8cd-0b22-4604-81a6-1cd3dd53084c","owner_id":null,"owner_name":null},{"id":"dcc94987-7080-525a-a0d6-52cc62caca33","name":"Peach Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"be83d2ba-f87a-4ba6-a0e8-9121adfbbfb4","owner_id":null,"owner_name":null}],"tags":[{"id":"3d42c8c6-1bbc-4d40-b4f9-543ba23a6d9f","tag":"cb5803f0-8ab4-4ada-8540-7758dfc126e2"},{"id":"6c388ade-6185-49ab-b038-35847953b2e7","tag":"0f1b7cb0-c4de-485e-8ff5-fe12ffccd738"},{"id":"4b5c583f-4f8b-471d-9231-42a34fed3ec7","tag":"dd24557e-a8e8-4202-872d-c2f411974cad"},{"id":"0ecff0a8-1d5d-4509-85dc-330d0d361e10","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"159f387c-c553-4a61-978b-5fc4ed52d31d","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"}],"owner_name":null},{"id":"013fdfdc-aa32-4779-8f6e-7920615cbf66","name":"APT37","source":"MITRE","group_attack_id":"G0067","created":"2018-04-18T17:59:24.739000Z","modified":"2021-10-15T16:54:01.193000Z","tidal_id":"bfdcb5d0-9406-5d98-8a9a-1fa46a1c88f8","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[{"id":"03c73305-1b06-4c25-9ccf-79882636896a","name":"Reaper","description":"<sup>[[FireEye APT37 Feb 2018](https://app.tidalcyber.com/references/4d575c1a-4ff9-49ce-97cd-f9d0637c2271)]</sup>","source":"MITRE","associated_group_id":"0e5a5a21-ca65-4b92-91d8-c6ffe8d39dd8","owner_id":null,"owner_name":null},{"id":"e8f786f6-7d73-5703-923b-e35d928b9b63","name":"Ricochet Chollima","description":"<sup>[[CrowdStrike Richochet Chollima September 2021](https://app.tidalcyber.com/references/69a23467-c55c-43a3-951d-c208e6ead6f7)]</sup>","source":"MITRE","associated_group_id":"62533eef-3762-5920-b3da-392fcd2d4d02","owner_id":null,"owner_name":null},{"id":"97656f0d-503e-4c1a-b13d-e3234bc03039","name":"ScarCruft","description":"<sup>[[Securelist ScarCruft Jun 2016](https://app.tidalcyber.com/references/04961952-9bac-48f3-adc7-40a3a2bcee84)]</sup><sup>[[FireEye APT37 Feb 2018](https://app.tidalcyber.com/references/4d575c1a-4ff9-49ce-97cd-f9d0637c2271)]</sup><sup>[[Securelist ScarCruft May 2019](https://app.tidalcyber.com/references/2dd5b872-a4ab-4b77-8457-a3d947298fc0)]</sup>","source":"MITRE","associated_group_id":"83962063-25d5-498b-8d40-168df6e8e85a","owner_id":null,"owner_name":null},{"id":"871d5dfc-2a15-4e75-8530-84c27ab5f71a","name":"TA-RedAnt","description":"<sup>[[The Hacker News October 16 2024](/references/1b531975-c7b4-441c-b169-5e586a78feac)]</sup>","source":"Tidal Cyber","associated_group_id":"8fbc8c1f-ed80-493a-88bd-935ad471ecdc","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"04d9498f-aa30-4b2e-8de8-60fe4f96c8dc","name":"RedEyes","description":"<sup>[[The Hacker News October 16 2024](/references/1b531975-c7b4-441c-b169-5e586a78feac)]</sup>","source":"Tidal Cyber","associated_group_id":"eb5f78a3-1fa3-4fae-b369-01da535fbdc7","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"254122d6-138a-4a88-ac3e-529ecdc3903e","name":"Group123","description":"<sup>[[FireEye APT37 Feb 2018](https://app.tidalcyber.com/references/4d575c1a-4ff9-49ce-97cd-f9d0637c2271)]</sup>","source":"MITRE","associated_group_id":"1cbfa64f-c394-402f-9c1f-d66e33b2b2f7","owner_id":null,"owner_name":null},{"id":"95339824-c45f-45f9-9cc7-ee155ee0adff","name":"InkySquid","description":"<sup>[[Volexity InkySquid BLUELIGHT August 2021](https://app.tidalcyber.com/references/7e394434-364f-4e50-9a96-3e75dacc9866)]</sup>","source":"MITRE","associated_group_id":"81c1b801-4fc4-4602-89c0-91f59afd3f67","owner_id":null,"owner_name":null},{"id":"3e47382e-8271-42c3-ae3e-cf1cd3e2a158","name":"TEMP.Reaper","description":"<sup>[[FireEye APT37 Feb 2018](https://app.tidalcyber.com/references/4d575c1a-4ff9-49ce-97cd-f9d0637c2271)]</sup>","source":"MITRE","associated_group_id":"66d651c2-e379-45a4-a7eb-4e838f8b2819","owner_id":null,"owner_name":null}],"tags":[{"id":"fb02ade5-813a-411f-a3d3-bddec2fed179","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"be70aba8-a9b5-4cbf-8691-7f8e032b4c21","tag":"19e8c417-a31d-417d-8266-f2430fa4cc02"},{"id":"18a371f7-220f-4dbf-b388-b6a5c4d506d5","tag":"c32847ad-5a61-4456-b108-fe63aa58d2b5"},{"id":"3bdcb5b5-4c50-46a9-8d11-83104ddc2297","tag":"808d2196-2950-4331-a7e0-6ed73e8f333a"},{"id":"ccdfcecc-98d0-485a-9bf2-7fc1dc1bcf30","tag":"ae9bc1d7-9466-4a7e-a3df-05564440e384"},{"id":"eb78c8f5-f785-477e-9ba5-9ba3c8461b1e","tag":"a98d7a43-f227-478e-81de-e7299639a355"}],"owner_name":null},{"id":"dfbce236-735c-436d-b433-933bd6eae17b","name":"APT38","source":"MITRE","group_attack_id":"G0082","created":"2019-01-29T21:27:24.793000Z","modified":"2022-05-11T14:00:00.188000Z","tidal_id":"8687d839-8ac9-5baf-99a4-9d91356b29b1","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"},{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"445023e4-5031-43b9-b6bf-c9d0909a46fa","name":"Bosnia and Herzegovina","country_name":"Bosnia and Herzegovina","country_code":"BA"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"284bedec-2fd7-47c2-83aa-cd937c829bf5","name":"Costa Rica","country_name":"Costa Rica","country_code":"CR"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"005b5c57-ecff-4cfb-8011-cd2a38a4ebbd","name":"Ghana","country_name":"Ghana","country_code":"GH"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"9ffef8c5-edb1-4c22-ba82-e54f7eb04a05","name":"Malta","country_name":"Malta","country_code":"MT"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"65ee8bd3-cae5-4276-8ab1-de639ff0a6c8","name":"Mozambique","country_name":"Mozambique","country_code":"MZ"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"125b9f74-e1c0-4256-af53-7ac8c7bdf2e9","name":"Nicaragua","country_name":"Nicaragua","country_code":"NI"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"c43cd6e5-932a-41c4-a1c6-c517fda79660","name":"Panama","country_name":"Panama","country_code":"PA"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"ebdfbff8-04eb-47fd-8e5f-ccbc4c6a3876","name":"Tanzania, United Republic of","country_name":"Tanzania","country_code":"TZ"},{"id":"007cc23c-fb39-48cb-88de-97276d551dce","name":"Togo","country_name":"Togo","country_code":"TG"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"b02938ca-9762-4fa5-88da-da9700e3eef3","name":"Uganda","country_name":"Uganda","country_code":"UG"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"77fb02d9-8844-4e95-9c18-99375c9de3c1","name":"Uruguay","country_name":"Uruguay","country_code":"UY"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"},{"id":"acd19876-f1a5-4100-8d73-b863cbcc1706","name":"Zambia","country_name":"Zambia","country_code":"ZM"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"aee3e01d-a962-4821-b0b9-0050277303e8","name":"Credit Unions"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"936a2a9f-3abf-4698-84e7-86a3a9241836","name":"Alluring Pisces","description":"<sup>[[Securelist October 28 2025](/references/cb5511fe-e8c0-4878-b986-a5b5aaa902d8)]</sup>","source":"USER","associated_group_id":"59ab89f4-d4a1-4bc4-97c8-510e19f97e69","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"49e6f170-6913-4d94-88eb-c972bb42fc00","name":"TA444","description":"<sup>[[Securelist October 28 2025](/references/cb5511fe-e8c0-4878-b986-a5b5aaa902d8)]</sup>","source":"USER","associated_group_id":"52a7aa49-15b1-496a-86ba-618bd5633792","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"50e4936f-cded-54f7-9ec4-69da0b73e3cc","name":"COPERNICIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"ddaf5d32-4936-5579-aac9-60b196fb528f","owner_id":null,"owner_name":null},{"id":"de75ab36-f304-5181-b2d9-735c512b37d4","name":"Sapphire Sleet","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"bf676ffc-e9a4-5a72-9f91-6c5f5116be42","owner_id":null,"owner_name":null},{"id":"9ebcd096-5e63-48f1-9a67-d80859a8fcc5","name":"Stardust Chollima","description":"<sup>[[CrowdStrike Stardust Chollima Profile April 2018](https://app.tidalcyber.com/references/a0119ad4-ceea-4dba-bc08-a682085a9b27)]</sup><sup>[[CrowdStrike GTR 2021 June 2021](https://app.tidalcyber.com/references/ec58e524-6de5-4cbb-a5d3-984b9b652f26)]</sup>","source":"MITRE","associated_group_id":"dd64bbe7-4d35-4622-a92f-23255765c525","owner_id":null,"owner_name":null},{"id":"df049954-1069-4ccc-8491-19c279452c1d","name":"NICKEL GLADSTONE","description":"<sup>[[SecureWorks NICKEL GLADSTONE profile Sept 2021](https://app.tidalcyber.com/references/c78a8379-04a4-4558-820d-831ad4f267fd)]</sup>","source":"MITRE","associated_group_id":"25b6512f-c60e-480f-81a0-c2ec4ba31ac8","owner_id":null,"owner_name":null},{"id":"ba2dea9a-8870-4c63-a164-1fb2cc270edf","name":"BeagleBoyz","description":"<sup>[[CISA AA20-239A BeagleBoyz August 2020](https://app.tidalcyber.com/references/a8a2e3f2-3967-4e82-a36a-2436c654fb3f)]</sup>","source":"MITRE","associated_group_id":"b8b8afb0-04b2-41b3-b756-d652b65c530d","owner_id":null,"owner_name":null},{"id":"4e2a5cca-f160-4ca7-a9bf-e2232436aef1","name":"Bluenoroff","description":"<sup>[[Kaspersky Lazarus Under The Hood Blog 2017](https://app.tidalcyber.com/references/a1e1ab6a-8db0-4593-95ec-78784607dfa0)]</sup>","source":"MITRE","associated_group_id":"cf196249-7d25-4d5a-b2c9-2b34f045feba","owner_id":null,"owner_name":null},{"id":"d81848af-aeea-4b22-879b-688e5bf17b4d","name":"NICKEL GLADSTONE","description":"<sup>[[SecureWorks NICKEL GLADSTONE profile Sept 2021](https://app.tidalcyber.com/references/c78a8379-04a4-4558-820d-831ad4f267fd)]</sup>","source":"ICS","associated_group_id":"25b6512f-c60e-480f-81a0-c2ec4ba31ac8","owner_id":null,"owner_name":null},{"id":"3cf8c203-9172-46e3-99b5-4b0dd4ea13c5","name":"BeagleBoyz","description":"<sup>[[CISA AA20-239A BeagleBoyz August 2020](https://app.tidalcyber.com/references/a8a2e3f2-3967-4e82-a36a-2436c654fb3f)]</sup>","source":"ICS","associated_group_id":"b8b8afb0-04b2-41b3-b756-d652b65c530d","owner_id":null,"owner_name":null},{"id":"59e8c178-b588-4e94-bfc5-69f3e35c7b5d","name":"Bluenoroff","description":"<sup>[[Kaspersky Lazarus Under The Hood Blog 2017](https://app.tidalcyber.com/references/a1e1ab6a-8db0-4593-95ec-78784607dfa0)]</sup>","source":"ICS","associated_group_id":"cf196249-7d25-4d5a-b2c9-2b34f045feba","owner_id":null,"owner_name":null},{"id":"e5dc0a9a-6f89-4b20-985b-8ce092e258e6","name":"Stardust Chollima","description":"<sup>[[CrowdStrike Stardust Chollima Profile April 2018](https://app.tidalcyber.com/references/a0119ad4-ceea-4dba-bc08-a682085a9b27)]</sup><sup>[[CrowdStrike GTR 2021 June 2021](https://app.tidalcyber.com/references/ec58e524-6de5-4cbb-a5d3-984b9b652f26)]</sup>","source":"ICS","associated_group_id":"dd64bbe7-4d35-4622-a92f-23255765c525","owner_id":null,"owner_name":null},{"id":"823ed331-f256-4e78-a691-f22fe5f223c1","name":"Sapphire Sleet","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"bf676ffc-e9a4-5a72-9f91-6c5f5116be42","owner_id":null,"owner_name":null},{"id":"7d83ef67-21e7-4636-88d2-335fb9bbbabf","name":"COPERNICIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"ddaf5d32-4936-5579-aac9-60b196fb528f","owner_id":null,"owner_name":null}],"tags":[{"id":"60243052-7249-4651-9853-8ea7c5032ad8","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"0c94e135-dc02-44bc-809c-23017c226c88","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"42ae9c0b-ea2a-4d69-af42-c9c2d633e541","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"50088fc4-2948-4b79-b3bd-d23193e0eb75","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"9e8692c5-cd6b-4fe7-ab61-3789a5c00803","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"b0dd478f-c0f0-462c-98a5-8a7360c015ec","tag":"4a457eb3-e404-47e5-b349-8b1f743dc657"},{"id":"1f230b77-5704-4fbc-90d4-9fc1cb5bada5","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"90d10330-f780-4e3f-9fcf-5f84e6cd9808","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"2bd7bf49-276f-4b62-934e-9c0129e25ecf","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"},{"id":"b237c471-1d20-476e-8f07-f3f6bbae13b4","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":null},{"id":"a57b52c7-9f64-4ffe-a7c3-0de738fb2af1","name":"APT39","source":"MITRE","group_attack_id":"G0087","created":"2019-02-19T16:01:38.585000Z","modified":"2022-09-02T18:03:29.024000Z","tidal_id":"baf7cf85-62b5-5727-b314-1a92090864c1","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"}],"associated_groups":[{"id":"0d240614-12ee-43dd-bebb-81e485f62c6b","name":"ITG07","description":"<sup>[[FBI FLASH APT39 September 2020](https://app.tidalcyber.com/references/76869199-e9fa-41b4-b045-41015e6daaec)]</sup><sup>[[Dept. of Treasury Iran Sanctions September 2020](https://app.tidalcyber.com/references/0c8ff80a-6b1d-4212-aa40-99aeef04ce05)]</sup><sup>[[DOJ Iran Indictments September 2020](https://app.tidalcyber.com/references/f30a77dd-d1d0-41b8-b82a-461dd6cd126f)]</sup>","source":"MITRE","associated_group_id":"6ca4e51d-aa35-4a77-b3ba-7eb8634808f7","owner_id":null,"owner_name":null},{"id":"704993e6-2034-4ca1-bba0-53bd8dbd174c","name":"Chafer","description":"Activities associated with APT39 largely align with a group publicly referred to as Chafer.<sup>[[FireEye APT39 Jan 2019](https://app.tidalcyber.com/references/ba366cfc-cc04-41a5-903b-a7bb73136bc3)]</sup><sup>[[Symantec Chafer Dec 2015](https://app.tidalcyber.com/references/0a6166a3-5649-4117-97f4-7b8b5b559929)]</sup><sup>[[Dark Reading APT39 JAN 2019](https://app.tidalcyber.com/references/b310dfa4-f4ee-4a0c-82af-b0fdef1a1f58)]</sup><sup>[[FBI FLASH APT39 September 2020](https://app.tidalcyber.com/references/76869199-e9fa-41b4-b045-41015e6daaec)]</sup><sup>[[Dept. of Treasury Iran Sanctions September 2020](https://app.tidalcyber.com/references/0c8ff80a-6b1d-4212-aa40-99aeef04ce05)]</sup><sup>[[DOJ Iran Indictments September 2020](https://app.tidalcyber.com/references/f30a77dd-d1d0-41b8-b82a-461dd6cd126f)]</sup>","source":"MITRE","associated_group_id":"d9944d22-b092-4f28-a27d-328d77ad7790","owner_id":null,"owner_name":null},{"id":"502e332b-f839-45bc-a2e1-9832af325c42","name":"Remix Kitten","description":"<sup>[[Crowdstrike GTR2020 Mar 2020](https://app.tidalcyber.com/references/a2325ace-e5a1-458d-80c1-5037bd7fa727)]</sup>","source":"MITRE","associated_group_id":"94ad9c24-d673-4f4c-8d3d-eb57a3d6aa6a","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"502223ee-8947-42f8-a532-a3b3da12b7d9","name":"APT41","source":"MITRE","group_attack_id":"G0096","created":"2019-09-23T13:43:36.945000Z","modified":"2022-06-02T20:09:29.475000Z","tidal_id":"903ca1dc-815b-5f1b-97ca-b5bc78483bd3","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"a0bfbad9-4a8d-451b-9401-df2db3b2da4c","name":"Bahrain","country_name":"Bahrain","country_code":"BH"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"6195ab08-5020-439d-a89f-783a35013ceb","name":"Finland","country_name":"Finland","country_code":"FI"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"},{"id":"69dd3e9b-a2bb-4afc-bd54-3154343e266c","name":"Video Games"}],"associated_groups":[{"id":"152c96c0-7f83-4104-9f5f-b73487734fad","name":"Wicked Panda","description":"<sup>[[Crowdstrike GTR2020 Mar 2020](https://app.tidalcyber.com/references/a2325ace-e5a1-458d-80c1-5037bd7fa727)]</sup>","source":"MITRE","associated_group_id":"160cc195-b382-4bb1-807c-2e1592fbe105","owner_id":null,"owner_name":null},{"id":"e0b083a4-7dfa-43d6-9046-bb0ec9ee1d26","name":"HOODOO","description":"<sup>[[Google Cloud May 28 2025](/references/def3e3dd-8136-4714-a58f-ffbd00066dc0)]</sup>","source":"Tidal Cyber","associated_group_id":"fc68a353-a37c-4afa-8e82-43c27ff7a46b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"eb616d56-5f8c-412c-b772-210e82306100","name":"Wicked Panda","description":"<sup>[[Crowdstrike GTR2020 Mar 2020](https://app.tidalcyber.com/references/a2325ace-e5a1-458d-80c1-5037bd7fa727)]</sup>","source":"Mobile","associated_group_id":"160cc195-b382-4bb1-807c-2e1592fbe105","owner_id":null,"owner_name":null},{"id":"8fc43bc6-0a24-4860-ad39-37d23567f008","name":"Earth Baku","description":"<sup>[[Trend Micro Earth Baku August 9 2024](/references/fad563ac-c7b2-4611-8924-e56c65aee309)]</sup>","source":"Tidal Cyber","associated_group_id":"d56befc3-31f4-4ec1-b2e9-cd4175cdc532","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4d3bb29a-a19e-572f-873b-8afa7777edf3","name":"Brass Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"aa60c45c-4dbd-53d0-ae1b-5f76c292a993","owner_id":null,"owner_name":null},{"id":"1309075d-64d0-5840-a2e2-28cd6bad69e3","name":"BARIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"051a3897-2613-576f-8c46-47d39eb4bf1c","owner_id":null,"owner_name":null},{"id":"c596e931-96df-4abc-992f-c6c275a7c760","name":"Brass Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"aa60c45c-4dbd-53d0-ae1b-5f76c292a993","owner_id":null,"owner_name":null},{"id":"52532583-e96d-4e90-b7f6-400ed7da7244","name":"BARIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"051a3897-2613-576f-8c46-47d39eb4bf1c","owner_id":null,"owner_name":null}],"tags":[{"id":"6a516f19-28f6-46c8-8479-26f27686df35","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"12769a22-a1d7-4bb4-a754-8c72faf6fa43","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"aac338c3-0fd4-4a27-a343-8ba83ffd43a1","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"945651b4-f350-4b99-a217-a2c2406c98c6","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"},{"id":"8a2f4e57-883e-4045-b88f-79ddca2b1324","tag":"a98d7a43-f227-478e-81de-e7299639a355"}],"owner_name":null},{"id":"c4336f3a-1902-5eb1-8ad1-204da1267dcc","name":"APT42","source":"MITRE","group_attack_id":"G1044","created":"2025-04-22T20:47:04.440311Z","modified":"2025-04-22T20:47:04.440314Z","tidal_id":"c4336f3a-1902-5eb1-8ad1-204da1267dcc","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"}],"associated_groups":[{"id":"93ff8290-ec27-419d-9640-939cd1bcc2b4","name":"SpearSpecter","description":"<sup>[[National-Digital-Agency November 14 2025](/references/16bfc78d-3c16-4eb9-997d-1ada2e9d9aee)]</sup>","source":"USER","associated_group_id":"52a631fe-dc91-41b2-90ae-881f2957f86d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d2862751-9938-4c6a-8f63-71577af0c320","name":"CharmingCypress","description":"<sup>[[National-Digital-Agency November 14 2025](/references/16bfc78d-3c16-4eb9-997d-1ada2e9d9aee)]</sup>","source":"USER","associated_group_id":"ab62598d-512d-4403-aa54-9a55a6027e0c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"603af03c-86ae-4b74-b455-de424451c516","name":"Educated Manticore","description":"<sup>[[National-Digital-Agency November 14 2025](/references/16bfc78d-3c16-4eb9-997d-1ada2e9d9aee)]</sup>","source":"USER","associated_group_id":"9b3f37ae-39f0-4e71-a2a2-a27242ebb029","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ef02ca46-cdc4-47a5-a8e8-855e1c7635af","name":"TA453","description":"<sup>[[SOCRadar APT42 December 12 2022](/references/6077faed-b162-4850-969a-2abedc842198)]</sup><sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"69d9316e-daa7-4fe4-86e0-c79c4ab27c5e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e6a91ed0-9a2c-4c61-b5c3-223bab418e1b","name":"ITG-018","description":"<sup>[[SOCRadar APT42 December 12 2022](/references/6077faed-b162-4850-969a-2abedc842198)]</sup>","source":"Tidal Cyber","associated_group_id":"fc5a7885-d14e-4eac-911e-2048e276df2e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"fad832f0-178c-4ccc-8875-c5313c9a0b0a","name":"Yellow Garuda","description":"<sup>[[SOCRadar APT42 December 12 2022](/references/6077faed-b162-4850-969a-2abedc842198)]</sup>","source":"Tidal Cyber","associated_group_id":"f7ac3bdb-a3bf-4d57-a45f-05cd2499d941","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ac4439aa-f71e-405f-9430-5bef3c4d63e5","name":"CALANQUE","description":"<sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"da6bb644-a0e9-45c2-973b-02257cd49daf","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c174dcb2-dc45-4a84-93de-d21b85dfa402","name":"Charming Kitten","description":"<sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"2a379f9c-0c8b-4066-8131-dfc6aad03b30","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ebaf494c-29c4-4368-8ac3-2e429c8ebed8","name":"Mint Sandstorm","description":"<sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"33be4e56-0a55-519d-b783-d6b2bdfe4e7f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"3b577536-a4d3-4b57-b246-d26dda3070b8","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"aa817a3c-ffb8-4e63-8b2f-507cc5cee850","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"f64e8106-e344-47ff-9e9d-76b462c44a3d","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"a1c0a8e1-5673-4cb9-87b5-6859a8d40310","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"}],"owner_name":null},{"id":"ce126445-6984-45bb-9737-35448f06f27b","name":"APT42 (Deprecated)","source":"Tidal Cyber","group_attack_id":"G3050","created":"2024-08-30T18:12:45.635874Z","modified":"2024-08-30T18:12:45.635878Z","tidal_id":"62b04a1a-0541-5b40-92a7-27b28cc46444","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"}],"associated_groups":[{"id":"039e1e9c-89a6-48b5-ba03-f730d3c7700e","name":"Yellow Garuda","description":"<sup>[[SOCRadar APT42 December 12 2022](/references/6077faed-b162-4850-969a-2abedc842198)]</sup>","source":"Tidal Cyber","associated_group_id":"f7ac3bdb-a3bf-4d57-a45f-05cd2499d941","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a1149197-7b8e-45b2-b6e0-feeabcc16b33","name":"CALANQUE","description":"<sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"da6bb644-a0e9-45c2-973b-02257cd49daf","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2d713c0d-e6a7-4eac-b7ed-83e78568d3cd","name":"CHARMING KITTEN","description":"<sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"cfb751d4-fbeb-4ba9-8bf2-129dbe83a21b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"cbcfd382-0efa-4430-94b2-119bcec315e0","name":"Mint Sandstorm","description":"<sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"33be4e56-0a55-519d-b783-d6b2bdfe4e7f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7ac6f311-4fca-4552-9cd9-2ed55b28f39f","name":"TA453","description":"<sup>[[SOCRadar APT42 December 12 2022](/references/6077faed-b162-4850-969a-2abedc842198)]</sup><sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"69d9316e-daa7-4fe4-86e0-c79c4ab27c5e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e6b63c21-ee48-4e98-b31f-edf9f9d7bb0b","name":"ITG-018","description":"<sup>[[SOCRadar APT42 December 12 2022](/references/6077faed-b162-4850-969a-2abedc842198)]</sup>","source":"Tidal Cyber","associated_group_id":"fc5a7885-d14e-4eac-911e-2048e276df2e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9cbdb393-b6af-4115-a46e-35fadb9776ab","name":"Charming Kitten","description":"<sup>[[Google Israel-Hamas War February 14 2024](/references/55290507-e007-4366-9116-bbad364c14f3)]</sup>","source":"Tidal Cyber","associated_group_id":"2a379f9c-0c8b-4066-8131-dfc6aad03b30","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"e14eb8ea-d37a-4ab3-9e7e-778177cd219e","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"261fdfa5-c1c9-4fe9-8813-c06339b142e2","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"31f337a0-88f2-4ece-afad-0c10e7820cee","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"1065c829-bb2e-4137-b512-065599f92928","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f46d6ee9-9d1d-586a-9f2d-6bff8fb92910","name":"APT5","source":"MITRE","group_attack_id":"G1023","created":"2024-04-25T13:28:24.610202Z","modified":"2024-04-25T13:28:24.610205Z","tidal_id":"fe120881-69ff-590e-86b5-90833521952a","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"9df68579-d955-580a-9923-8999eeb3d23e","name":"Keyhole Panda","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[Secureworks BRONZE FLEETWOOD Profile](https://app.tidalcyber.com/references/4fbb113c-94b4-56fd-b292-1ccf84e1c8f3)]</sup>","source":"MITRE","associated_group_id":"52df2643-f787-52f6-aab4-faadb047ed30","owner_id":null,"owner_name":null},{"id":"3781627a-4daf-4135-bc2f-ebcf58409024","name":"TABCTENG","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"f48bd325-047e-431b-986a-fd77cf78e33d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"79a8bec5-486e-577c-a8f0-756e9726f8a9","name":"Mulberry Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[Microsoft East Asia Threats September 2023](https://app.tidalcyber.com/references/31f2c61e-cefe-5df7-9c2b-780bf03c88ec)]</sup>","source":"MITRE","associated_group_id":"984afa34-aa0b-558d-942a-2dec31cf4ea0","owner_id":null,"owner_name":null},{"id":"8260f27b-e7d9-5ba5-855e-0abfd3d1b37c","name":"MANGANESE","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[NSA APT5 Citrix Threat Hunting December 2022](https://app.tidalcyber.com/references/916e2137-46e6-53c2-a917-5b5b5c4bae3a)]</sup>","source":"MITRE","associated_group_id":"de24ca90-b169-5865-8174-70efe5c862cd","owner_id":null,"owner_name":null},{"id":"0087d249-fc58-5d42-af95-d408e2941c8e","name":"BRONZE FLEETWOOD","description":"<sup>[[Secureworks BRONZE FLEETWOOD Profile](https://app.tidalcyber.com/references/4fbb113c-94b4-56fd-b292-1ccf84e1c8f3)]</sup>","source":"MITRE","associated_group_id":"02651bff-3c58-5ac8-b577-0576fd12c4ab","owner_id":null,"owner_name":null},{"id":"3d2c8492-05f5-500c-b187-b066af049f95","name":"UNC2630","description":"<sup>[[NSA APT5 Citrix Threat Hunting December 2022](https://app.tidalcyber.com/references/916e2137-46e6-53c2-a917-5b5b5c4bae3a)]</sup>","source":"MITRE","associated_group_id":"51a70420-ba27-59be-a2a7-fea92df06c24","owner_id":null,"owner_name":null}],"tags":[{"id":"fdb64fde-e0d3-4f18-9fd6-7198843271e6","tag":"77de8096-7e36-481a-9a35-149fada04c57"},{"id":"a8c1cc8b-dbba-437f-9994-1f4530b183cf","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"a64f3b2b-f609-4105-a6c4-becffc58bf53","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"2b2b9353-c093-4e35-8e96-3d6eb2f0bebd","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"9b8782fc-a563-4248-b56f-de50d2e36cef","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"}],"owner_name":null},{"id":"6d92a936-42f6-408c-a8e8-238ccb159f48","name":"APT73","source":"Tidal Cyber","group_attack_id":"G3066","created":"2024-11-25T18:01:03.441470Z","modified":"2024-11-25T18:01:03.441475Z","tidal_id":"8ef4d5f0-fb14-55a1-9efa-74b5a2d9f5e4","country":[],"observed_motivation":[],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"d24413a4-21a4-49dd-bb93-70be649b3636","name":"ERALEIG","description":"<sup>[[Medium April 20 2024](/references/428333d6-8b04-415c-877c-36cf5a3e5967)]</sup>","source":"Tidal Cyber","associated_group_id":"c7080125-83b1-4b39-b7d0-c02e89e514d2","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7b8e46a5-90e6-4ad7-b4f4-e6370bf41d6e","name":"BASHE","description":"<sup>[[Medium April 20 2024](/references/428333d6-8b04-415c-877c-36cf5a3e5967)]</sup>","source":"Tidal Cyber","associated_group_id":"9b452841-52dd-4543-83c7-54c4aeb8626d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"a7620a2f-60ae-4468-8318-cf560181acab","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"25b61c7a-a9b2-4841-8226-281506071c30","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"9006ba5f-d675-4d52-a982-3e9bcf2f31dd","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"0fcdf614-1f0b-49cd-9fca-a995e0144221","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"e3c5164e-49cf-5bb1-955d-6775585abb14","name":"APT-C-23","source":"MITRE","group_attack_id":"G1028","created":"2024-04-25T13:28:24.364402Z","modified":"2024-04-25T13:28:24.364404Z","tidal_id":"03e1ea71-02dd-592f-8b5b-5d9c3936a3cc","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"5cfbf5c3-aa5c-4de0-84e9-52e961c65d95","name":"Algeria","country_name":"Algeria","country_code":"DZ"},{"id":"a0bfbad9-4a8d-451b-9401-df2db3b2da4c","name":"Bahrain","country_name":"Bahrain","country_code":"BH"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"5237c9b3-b0d1-4979-98d9-8ff0decd3d16","name":"Palestine, State of","country_name":"Palestine","country_code":"PS"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"}],"associated_groups":[{"id":"aa560746-8f2a-5b45-bc81-6715cff1accc","name":"TAG-63","description":"","source":"MITRE","associated_group_id":"34edf0c8-e639-50b2-ae11-96fa61f58bb4","owner_id":null,"owner_name":null},{"id":"53accbe5-0efc-4dac-82bd-be296d8301f8","name":"AridViper","description":"<sup>[[Sekoia.io AridViper](/references/963a97b9-71b2-46e7-8315-1d7ef76d832c)]</sup>","source":"Tidal Cyber","associated_group_id":"8c5e072f-9b49-4bcc-aaee-828b617c9420","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"fd8adda4-f031-4cc9-a95a-d448b7f084a4","name":"TAG-63","description":"","source":"Mobile","associated_group_id":"34edf0c8-e639-50b2-ae11-96fa61f58bb4","owner_id":null,"owner_name":null},{"id":"a24656b2-81b9-485f-a473-c41ecde8fd30","name":"Mantis","description":"<sup>[[symantec_mantis](https://app.tidalcyber.com/references/76a792b5-f3cd-566e-a87b-9fae844ce07d)]</sup><sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup>","source":"Mobile","associated_group_id":"dbd663c8-f0b2-5e78-8eec-e2c345bb8a41","owner_id":null,"owner_name":null},{"id":"8d19b41b-44a7-45b2-93d1-c9d8c1007d44","name":"Desert Falcon","description":"<sup>[[welivesecurity_apt-c-23](https://app.tidalcyber.com/references/7196226e-7d0d-5e14-a4e3-9b6322537039)]</sup><sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup><sup>[[fb_arid_viper](https://app.tidalcyber.com/references/1dca5e73-0b6e-51cd-867c-927d081f228d)]</sup>","source":"Mobile","associated_group_id":"fcb7e2c8-54fa-5754-85c4-f50897e55a70","owner_id":null,"owner_name":null},{"id":"1aae1136-8f8c-48f1-8fc8-f0b2ce37a273","name":"Grey Karkadann","description":"<sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup>","source":"Mobile","associated_group_id":"f7536e2e-54ba-52bb-b0ba-f1a3cbb13321","owner_id":null,"owner_name":null},{"id":"3fb91fe3-8a04-4cae-8b5a-c0e94463fbc9","name":"Two-tailed Scorpion","description":"<sup>[[welivesecurity_apt-c-23](https://app.tidalcyber.com/references/7196226e-7d0d-5e14-a4e3-9b6322537039)]</sup>","source":"Mobile","associated_group_id":"b5071d2f-e21b-51e5-b578-2d896c7219e0","owner_id":null,"owner_name":null},{"id":"bfe90a91-e486-58f1-827f-2e1d6c47b050","name":"Grey Karkadann","description":"<sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup>","source":"MITRE","associated_group_id":"f7536e2e-54ba-52bb-b0ba-f1a3cbb13321","owner_id":null,"owner_name":null},{"id":"1a9ab2e9-a1be-565d-995c-c44d1f405aa9","name":"Mantis","description":"<sup>[[symantec_mantis](https://app.tidalcyber.com/references/76a792b5-f3cd-566e-a87b-9fae844ce07d)]</sup><sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup>","source":"MITRE","associated_group_id":"dbd663c8-f0b2-5e78-8eec-e2c345bb8a41","owner_id":null,"owner_name":null},{"id":"e0c34598-7a3f-50a3-ac7d-da77fb13695a","name":"Arid Viper","description":"<sup>[[welivesecurity_apt-c-23](https://app.tidalcyber.com/references/7196226e-7d0d-5e14-a4e3-9b6322537039)]</sup><sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup><sup>[[fb_arid_viper](https://app.tidalcyber.com/references/1dca5e73-0b6e-51cd-867c-927d081f228d)]</sup>","source":"MITRE","associated_group_id":"275239f6-6304-5a10-abed-0c94cc4c85f3","owner_id":null,"owner_name":null},{"id":"253638fb-d05c-5e04-aed7-fc8a75166440","name":"Desert Falcon","description":"<sup>[[welivesecurity_apt-c-23](https://app.tidalcyber.com/references/7196226e-7d0d-5e14-a4e3-9b6322537039)]</sup><sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup><sup>[[fb_arid_viper](https://app.tidalcyber.com/references/1dca5e73-0b6e-51cd-867c-927d081f228d)]</sup>","source":"MITRE","associated_group_id":"fcb7e2c8-54fa-5754-85c4-f50897e55a70","owner_id":null,"owner_name":null},{"id":"e2fd72b8-a52c-50e5-bd38-a0617536fc16","name":"Big Bang APT","description":"<sup>[[checkpoint_interactive_map_apt-c-23](https://app.tidalcyber.com/references/24dd2641-839b-5a0e-b5ca-ea121ea70992)]</sup> ","source":"MITRE","associated_group_id":"27db951c-b5c1-5953-95a8-c24e6dc3fc13","owner_id":null,"owner_name":null},{"id":"7786aa5a-5e3f-58fa-92b9-5946483c0592","name":"Two-tailed Scorpion","description":"<sup>[[welivesecurity_apt-c-23](https://app.tidalcyber.com/references/7196226e-7d0d-5e14-a4e3-9b6322537039)]</sup>","source":"MITRE","associated_group_id":"b5071d2f-e21b-51e5-b578-2d896c7219e0","owner_id":null,"owner_name":null},{"id":"d90ad76e-cfe3-41ce-a057-2d9ceb3aa494","name":"Arid Viper","description":"<sup>[[welivesecurity_apt-c-23](https://app.tidalcyber.com/references/7196226e-7d0d-5e14-a4e3-9b6322537039)]</sup><sup>[[sentinelone_israel_hamas_war](https://app.tidalcyber.com/references/8fa21bad-0186-5181-b52e-32f7f116695c)]</sup><sup>[[fb_arid_viper](https://app.tidalcyber.com/references/1dca5e73-0b6e-51cd-867c-927d081f228d)]</sup>","source":"Mobile","associated_group_id":"275239f6-6304-5a10-abed-0c94cc4c85f3","owner_id":null,"owner_name":null},{"id":"5e052b63-9d5e-4a01-bcca-ea9993d501ea","name":"Big Bang APT","description":"<sup>[[checkpoint_interactive_map_apt-c-23](https://app.tidalcyber.com/references/24dd2641-839b-5a0e-b5ca-ea121ea70992)]</sup>","source":"Mobile","associated_group_id":"27db951c-b5c1-5953-95a8-c24e6dc3fc13","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"153c14a6-31b7-44f2-892e-6d9fdc152267","name":"APT-C-36","source":"MITRE","group_attack_id":"G0099","created":"2020-05-05T18:53:08.166000Z","modified":"2021-05-26T20:17:53.085000Z","tidal_id":"313a559e-3caf-552d-bd7e-7c67d37b1bd6","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[{"id":"d05bd826-f2f5-4cbf-bd89-f34858b044d9","name":"BlindEagle","description":"<sup>[[None December 16 2025](/references/77a0f06e-b16f-4d3d-998e-0af3e1789624)]</sup>","source":"USER","associated_group_id":"5abd6007-c71f-4fe1-9693-672c0750c0d0","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"0f882166-9c8e-4f29-9a60-d6e39b1639d3","name":"APT-C-36 (Blind Eagle)","description":"<sup>[[None December 16 2025](/references/77a0f06e-b16f-4d3d-998e-0af3e1789624)]</sup>","source":"USER","associated_group_id":"46ff51a1-e64f-49b2-aee2-4218f30fadd2","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"5aafaa4c-ae95-463c-9557-87708d537a69","name":"Hive0131","description":"<sup>[[None December 16 2025](/references/77a0f06e-b16f-4d3d-998e-0af3e1789624)]</sup>","source":"USER","associated_group_id":"60057984-0853-4b09-8f15-dcf229b5f491","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c42ea733-327b-447b-b530-b5eb87fb98d5","name":"Blind Eagle","description":"<sup>[[QiAnXin APT-C-36 Feb2019](https://app.tidalcyber.com/references/cae075ea-42cb-4695-ac66-9187241393d1)]</sup>","source":"MITRE","associated_group_id":"3a48eb6e-2b44-4004-af10-459f5ee4352a","owner_id":null,"owner_name":null}],"tags":[{"id":"9e779683-a410-4fd9-b333-c9259116e746","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"aa2c3aad-2995-4a85-bf5b-0a2e1d35942b","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"}],"owner_name":null},{"id":"b8a349a6-cde1-4d95-b20f-44c62bbfc786","name":"Aquatic Panda","source":"MITRE","group_attack_id":"G0143","created":"2022-01-18T14:49:29.505000Z","modified":"2022-06-29T20:28:29.913000Z","tidal_id":"86b8a9d8-5fcc-5483-9d7d-0ae76d912f4e","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"9921b373-8791-4e35-9324-bc0c55cdeb58","name":"CHROMIUM","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"4c302b2d-679a-53bc-820c-95e27a90faf4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9f385fd4-4579-450f-807f-3ab9418a4ed7","name":"Charcoal Typhoon","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"34f00eb2-bd44-5b8f-8c7d-bae2c3ab241a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"66a0675c-fdfe-4835-a453-a2b113731df2","name":"ControlX","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"68300981-5bc3-5eea-8013-1fd745e906e4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"012e1235-9106-4f70-ba52-3c65293130f1","name":"RedHotel","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"95776d29-68d0-47fd-beb4-ca28fa6a2911","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"bc022a3f-94de-4ac0-9df3-57f4f5c296c2","name":"Bronze University","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"c725df43-d582-44dd-ae17-c7e39fd96e3f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7dd47e05-3a64-49d0-8d6d-316861361c3f","name":"Chromium","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"398a03a9-ffc4-4128-b8ac-120a1698997b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3ad902ad-82b0-49f9-a68a-fb1ecaef51dd","name":"Red Scully","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"7a33c511-088c-44f4-b2eb-0e2e6644bb50","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c6765946-dc7d-44ac-b39d-9a2a0a5fe8b9","name":"i-Soon","description":"<sup>[[FBI i-Soon PSA March 5 2025](/references/7f549454-a535-4453-8586-5c4603089cc4)]</sup>","source":"Tidal Cyber","associated_group_id":"e3f2f26e-7e4a-4614-892a-4231e1d98219","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7ad2dac9-6406-4b1b-a31e-e14132401fe2","name":"RedAlpha","description":"<sup>[[FBI i-Soon PSA March 5 2025](/references/7f549454-a535-4453-8586-5c4603089cc4)]</sup>","source":"Tidal Cyber","associated_group_id":"d526c35d-756a-494a-8dea-bf585f038b62","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8e596aa7-cb1c-4cda-add3-27aef42b94dc","name":"Red Scylla","description":"<sup>[[FBI i-Soon PSA March 5 2025](/references/7f549454-a535-4453-8586-5c4603089cc4)]</sup>","source":"Tidal Cyber","associated_group_id":"68f8bf23-9d5f-45d1-a3cd-0c0e69ab40a9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6515e3f6-7eae-4ef1-abaf-0499df6cb6f7","name":"Hassium","description":"<sup>[[FBI i-Soon PSA March 5 2025](/references/7f549454-a535-4453-8586-5c4603089cc4)]</sup>","source":"Tidal Cyber","associated_group_id":"f84ea83a-929f-4fb0-954f-fd7241adb7b4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2b003758-c9c7-4978-a023-7eba8c914623","name":"TAG-22","description":"<sup>[[FBI i-Soon PSA March 5 2025](/references/7f549454-a535-4453-8586-5c4603089cc4)]</sup>","source":"Tidal Cyber","associated_group_id":"f52f1ae7-3df5-479c-b487-b214c2946fe3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"4181b0d0-9e1a-4586-8990-1a4cea7d88e8","tag":"c16092ee-468a-4935-8ee1-18bd423ecc52"},{"id":"64f5936e-2dbe-43ba-b405-edc9ea161710","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":null},{"id":"f0de217f-3520-43ab-a9e1-f1cffd1d3963","name":"Astaroth Operators","source":"Tidal Cyber","group_attack_id":"G3202","created":"2026-01-14T13:30:29.585351Z","modified":"2026-01-14T13:30:29.585355Z","tidal_id":"5ebd5fec-6c40-52fc-9359-891799c17509","country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[],"tags":[{"id":"745a99fd-8139-475c-834b-71656ee0ef10","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"883bf081-a951-4fe7-80a3-27b47ff5ce51","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"87978c5a-e705-4316-bff5-745dd536ccfb","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5e12e91a-8a8a-4966-8b56-83a152091094","name":"Automated Libra","source":"Trellix TIG","group_attack_id":"G3004","created":"2025-04-11T15:06:30.590572Z","modified":"2025-04-11T15:06:30.590575Z","tidal_id":"9aa71935-2767-5b07-90ec-0cc100c8e831","country":[{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"1410c563-f125-4d1e-b208-e5180b8c6471","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"}],"owner_name":"TidalCyberIan"},{"id":"3be36063-6383-42b5-ad7e-f41abf84f1ae","name":"Autumn Dragon","source":"Tidal Cyber","group_attack_id":"G3178","created":"2025-12-24T14:56:39.397060Z","modified":"2025-12-24T14:56:39.397064Z","tidal_id":"8a5b646b-68b3-5dfb-a124-f2b73b3304fd","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"e8f8da13-386b-4027-8fe0-f4e3e341ae07","name":"Lao People's Democratic Republic","country_name":"Lao People's Democratic Republic","country_code":"LA"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"}],"associated_groups":[],"tags":[{"id":"1578cb08-93a3-49f8-80d5-0747c0530f3c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"cdd609d1-ea32-4bea-8eb8-f6fa017ce5f8","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"90f4d3f9-3fe3-4a64-8dc1-172c6d037dca","name":"Axiom","source":"MITRE","group_attack_id":"G0001","created":"2017-05-31T21:31:45.629000Z","modified":"2022-05-11T14:00:00.188000Z","tidal_id":"7435fe52-6ba5-598a-a2b5-898141e68cee","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"61037820-7b66-46bf-8bfd-06cdb81e9b52","name":"Group 72","description":"<sup>[[Cisco Group 72](https://app.tidalcyber.com/references/b9201737-ef72-46d4-8e86-89fee5b98aa8)]</sup>","source":"MITRE","associated_group_id":"a975effb-1b65-4dd5-85ba-b0d12d94b7a8","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"e5b0da2b-12bc-4113-9459-9c51329c9ae0","name":"BackdoorDiplomacy","source":"MITRE","group_attack_id":"G0135","created":"2021-09-21T14:52:49.596000Z","modified":"2021-10-18T19:47:11.389000Z","tidal_id":"b2c6b892-5723-5439-bb32-88598ebfe51c","country":[],"observed_motivation":[],"observed_country":[{"id":"c6c2025a-b24b-49a3-aa9d-c3c5fe9029d7","name":"Albania","country_name":"Albania","country_code":"AL"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"8af7cb07-edaa-4b5c-a1f0-bc171151e6b4","name":"Croatia","country_name":"Croatia","country_code":"HR"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"005b5c57-ecff-4cfb-8011-cd2a38a4ebbd","name":"Ghana","country_name":"Ghana","country_code":"GH"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"d1aa288d-a353-4ca4-aacf-1a4192e5dc83","name":"Libya","country_name":"Libya","country_code":"LY"},{"id":"affc791d-eba9-4975-b3e1-792f56db9ae8","name":"Namibia","country_name":"Namibia","country_code":"NA"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"b3005b16-e25f-4f4c-b7d6-c125dea0ea60","name":"Beast Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3119","created":"2025-08-14T15:16:15.158930Z","modified":"2025-08-14T15:16:15.158933Z","tidal_id":"7cb4553e-cd4e-52de-a7f3-548a82cb459e","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"5ab9467f-4a34-4883-8e8f-2d3b2b3404d1","name":"Bhutan","country_name":"Bhutan","country_code":"BT"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[],"tags":[{"id":"ff3c6e44-159f-475c-974d-9f0d16721c98","tag":"70dc52b0-f317-4134-8a42-71aea1443707"},{"id":"0dc77ede-c82e-4385-83da-8e65303e6e6d","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"4f67c708-baa6-4b03-80ce-f5b7b530d93d","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"b8e826b0-8911-488f-bf1e-108417564d7b","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"38bf930b-ae69-4b99-b7cf-27cb71934b04","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"d7d9e2df-2089-4580-98d7-302f824002e9","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"04eb37f7-6cae-4ec7-b2d8-01faddc54f0c","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a2add2a0-2b54-4623-a380-a9ad91f1f2dd","name":"BianLian Ransomware Group","source":"Tidal Cyber","group_attack_id":"G3002","created":"2023-07-14T12:56:35.605119Z","modified":"2023-07-14T12:56:35.605124Z","tidal_id":"09cc8265-9edd-591f-a3ec-6f4827c15c77","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"ff7c70e6-e6b4-4c1c-ab1d-2ba7ca3b460d","tag":"0094c0cb-29f2-4d61-a62a-fb3b3ef3d9a0"},{"id":"5c95cc82-c025-470f-adae-e7c006f50f3e","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"bb2744c1-452e-4c12-a251-dcc105a0f6ba","tag":"b396ec0b-13bd-4c7c-82e5-038110fe3aae"},{"id":"59554b73-dfd6-4725-bc91-4bd18db6d316","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"65badb9b-dfb5-4e49-ad95-c5c35724c6f7","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"95d4f0ab-4623-40e6-bbef-4469e300d801","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"9daeee59-7e2b-42e5-99a5-44f0e716d901","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"c6f9392b-3bf9-4216-946c-d3623220e298","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"b7166918-6fc9-4119-a260-4e97e0a6a146","tag":"d713747c-2d53-487e-9dac-259230f04460"},{"id":"876d9b6c-24f5-4217-b36e-6b15bf55db70","tag":"964c2590-4b52-48c6-afff-9a6d72e68908"},{"id":"38eb30b2-a283-41a6-98e0-2b3545ee3510","tag":"fde4c246-7d2d-4d53-938b-44651cf273f1"},{"id":"313b45b4-189b-429a-bca0-a8330a07c171","tag":"2743d495-7728-4a75-9e5f-b64854039792"},{"id":"0417e26e-bd0b-44e5-a213-5be33692abe0","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"15abab10-35eb-4033-bb3c-0fcc3fb8b623","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"3a02aa1b-851a-43e1-b83b-58037f3c7025","name":"BITTER","source":"MITRE","group_attack_id":"G1002","created":"2022-06-01T20:26:53.880000Z","modified":"2022-06-01T21:20:18.113000Z","tidal_id":"b43ce37d-71e5-52ce-a984-9cd6d143f16c","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"0d37e4d0-c59c-4973-bd22-f401032a4412","name":"APT-C-08","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"31b88a22-40bb-477b-ba43-761e93b4a674","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"80126642-ae2a-4ba4-8240-1740965ae49f","name":"Aramanberry","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"e8fb3832-256f-4c31-8993-6c303befc409","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e1c7dbc2-d7ea-4c66-b365-1070a482ba5a","name":"T-APT-17","description":"<sup>[[Cisco Talos Bitter Bangladesh May 2022](https://app.tidalcyber.com/references/097583ed-03b0-41cd-bf85-66d473f46439)]</sup>","source":"Mobile","associated_group_id":"fd4b4e28-6f0c-43a5-b42d-6d2488d1ff93","owner_id":null,"owner_name":null},{"id":"f4e52f24-5321-41c6-b198-c118b9c7abd6","name":"T-APT-17","description":"<sup>[[Cisco Talos Bitter Bangladesh May 2022](https://app.tidalcyber.com/references/097583ed-03b0-41cd-bf85-66d473f46439)]</sup>","source":"MITRE","associated_group_id":"fd4b4e28-6f0c-43a5-b42d-6d2488d1ff93","owner_id":null,"owner_name":null}],"tags":[{"id":"a5d0e9d7-d3a2-4112-9eb9-da6422458bbd","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":null},{"id":"904e9735-74f6-4fac-b498-91fddd49fe64","name":"Bjorka","source":"Tidal Cyber","group_attack_id":"G3076","created":"2025-02-18T15:18:14.060676Z","modified":"2025-02-18T15:18:14.060680Z","tidal_id":"3c43a6f6-a119-543a-829d-ae6f3f3a7985","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"c945f7ba-806b-47f0-9315-59a734cd786d","name":"El Salvador","country_name":"El Salvador","country_code":"SV"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"b3b49312-69e9-426b-b18e-268bbf39f129","name":"Montenegro","country_name":"Montenegro","country_code":"ME"},{"id":"3720daef-8d9a-49ba-b95c-d374c52ba355","name":"North Macedonia","country_name":"North Macedonia","country_code":"MK"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"1cdaf0b5-6ad2-4321-8145-7fccb5bbd59f","name":"Slovakia","country_name":"Slovakia","country_code":"SK"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"},{"id":"acd19876-f1a5-4100-8d73-b863cbcc1706","name":"Zambia","country_name":"Zambia","country_code":"ZM"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"74a9e741-5f38-429d-bb71-fd2f773da1d6","name":"Bjorkanism","description":"","source":"Tidal Cyber","associated_group_id":"ed9bd821-d753-4c4a-a1f8-ba5ffaf4e62b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"066967f0-a332-4862-857d-fff1ae79484c","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"32e92ca6-9ffa-4687-96ac-0f87b77b6ac4","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"c8f5fc6d-b361-4e55-b54b-4a677816d503","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"4c4c4731-15bd-4407-8cb0-94cf8502c3a8","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"393da13e-016c-41a3-9d89-b33173adecbf","name":"Bl00dy Ransomware Gang","source":"Tidal Cyber","group_attack_id":"G3010","created":"2023-08-04T16:40:34.467084Z","modified":"2023-08-04T16:40:34.467091Z","tidal_id":"151edf0f-41f2-59b7-867e-0d5a8e83df62","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"8a667e2c-202d-4064-aa05-81c51a634cad","tag":"fdd53e62-5bf1-41f1-8bd6-b970a866c39d"},{"id":"01deefe5-70bf-4c4f-b04e-62996689efac","tag":"d431939f-2dc0-410b-83f7-86c458125444"},{"id":"fcc53086-818e-44ec-8913-2198c27aa3b2","tag":"1b5da77a-bf84-4fba-a6d7-8b3b8f7699e0"},{"id":"32408029-62ee-4ad1-9010-34dba3d0859f","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"ff42f3eb-17ea-4a07-a8cb-bace865b7e62","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"ad21f7b3-39b2-485f-899e-71fd5ea4adde","tag":"992bdd33-4a47-495d-883a-58010a2f0efb"},{"id":"df526219-985d-446a-abca-e3a6d205021b","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"1100b3a7-f203-4fec-acc5-5c036100a096","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"7f52cadb-7a12-4b9d-9290-1ef02123fbe4","name":"Black Basta Affiliates","source":"Tidal Cyber","group_attack_id":"G3037","created":"2024-05-14T19:30:00.579431Z","modified":"2024-05-14T19:30:00.579435Z","tidal_id":"cb990021-64da-515b-a69d-d31b0a0928ff","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"9ed53522-6480-4357-a103-d9e15a33b3a2","name":"Storm-1811","description":"<sup>[[Microsoft Security Blog 5 15 2024](/references/0876de6e-ea0c-4717-89a4-9c7baed53b6f)]</sup>","source":"Tidal Cyber","associated_group_id":"55f92f85-24b7-4a78-b33e-d870185cc54c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"a3eb61ff-4556-46e7-92c7-bfb3b2703624","tag":"224a7921-60a2-4417-8059-eee765c88b46"},{"id":"7269890a-3e2f-48b3-b4a4-258040744b38","tag":"5187cea7-601f-4829-8b41-306044200b64"},{"id":"46b03c93-cbc8-45cb-a681-aeef7c9cb7c5","tag":"a6e50ad7-5f65-43f1-90b3-943045a57289"},{"id":"fa44c776-6597-4509-b0d9-59ab4b23ca4a","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"32da1bbd-3471-4d5b-9ec1-3162b6082d81","tag":"47365c8b-5db8-4d3a-9eb9-d49c8df1a90e"},{"id":"e18d97a4-8d42-4529-82fe-8a311c6a7a3d","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"1f63b326-c504-459f-9b5f-0e8bdc30fd0d","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"a4715afe-701d-4d6f-8ba7-2cfcab6ba3f7","tag":"d903e38b-600d-4736-9e3b-cf1a6e436481"},{"id":"5936c210-5f08-48b7-a63e-ea80fba4f94d","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"2a7a85e6-698c-4bd1-9c5d-e3478d0611b4","tag":"d819ae1a-e385-49fd-88d5-f66660729ecb"},{"id":"a925c69a-32ba-4218-a6c4-bf61c60c442a","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"55cedf48-1ecc-4e5f-a3a2-0c6807752586","tag":"c40971d6-ad75-4b2d-be6c-5353c96a232d"},{"id":"9a2bb8b0-36e0-4aed-ab89-956ad3853a91","tag":"3adcb409-166d-4465-ba1f-ddaecaff8282"},{"id":"80877370-8741-4b69-b0ac-ccf37cbce88f","tag":"dea4388a-b1f2-4f2a-9df9-108631d0d078"},{"id":"b2e59392-5702-4542-b7e0-9e2486468d37","tag":"2743d495-7728-4a75-9e5f-b64854039792"},{"id":"ecbab653-e477-4983-bcd7-ec7d4cdfad1e","tag":"d431939f-2dc0-410b-83f7-86c458125444"},{"id":"621279d7-6914-4c84-86ea-88b5bcb016a2","tag":"fdd53e62-5bf1-41f1-8bd6-b970a866c39d"},{"id":"0104d286-248e-45d8-b55d-0fa2d7d89b0d","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"1ba39e20-6d1b-4c4d-9009-86c2a9949945","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"ba5ef033-b01a-4d52-b511-fc5cd7e94fb8","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"}],"owner_name":"TidalCyberIan"},{"id":"94f5c644-d36a-59b0-b7e2-7a1d3413443d","name":"BlackByte","source":"MITRE","group_attack_id":"G1043","created":"2025-04-22T20:47:03.452438Z","modified":"2025-04-22T20:47:03.452442Z","tidal_id":"94f5c644-d36a-59b0-b7e2-7a1d3413443d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"fb77353c-5d42-536b-acb7-aad28c929c6a","name":"Hecamede","description":"<sup>[[Symantec BlackByte 2022](https://app.tidalcyber.com/references/965503f6-e5f9-5c98-b0c4-1211e44346d9)]</sup>","source":"MITRE","associated_group_id":"5e0001f2-8212-5692-9fd0-6ce17cad7db2","owner_id":null,"owner_name":null}],"tags":[{"id":"ef12b2bf-de82-4beb-a846-06435aebb47d","tag":"21ecb1dc-84db-4d74-a634-331c24c48a6c"},{"id":"f0411df8-8296-43e6-9acd-5875e5ef08f9","tag":"47365c8b-5db8-4d3a-9eb9-d49c8df1a90e"},{"id":"36e03842-33d5-419a-a776-c9648571ca40","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"761f63c8-2ede-4613-b111-b840aba4ad98","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"49c84d14-dc68-46cd-9fb4-e61f459ef202","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"61829f80-3a8f-43ad-9963-dafa2b056b08","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"a62c779d-de32-49bd-9134-334c8102ffcc","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"8fe556d2-f66c-4a5d-a880-f2fe9dbab848","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"42574287-5c66-49f8-b005-986d55cc500d","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"9ffc82fa-a737-4a46-8c47-abf07b6318fa","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"33159d02-a1ce-49ec-a381-60b069db66f7","name":"BlackCat Ransomware Actors & Affiliates","source":"Tidal Cyber","group_attack_id":"G3019","created":"2023-09-14T20:18:03.118640Z","modified":"2023-09-14T20:18:03.118645Z","tidal_id":"af6bc837-0487-5a7d-ae12-8d18e0420653","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"21002808-4882-4bcf-9cf2-aa2d5a8e4abe","name":"Bolivia, Plurinational State of","country_name":"Bolivia","country_code":"BO"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"07578934-334f-4a04-b0c0-7157b1257617","name":"Greece","country_name":"Greece","country_code":"GR"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"43a5a379-e1ee-4ec4-ae63-7d556e25f120","name":"Jamaica","country_name":"Jamaica","country_code":"JM"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"0a756fb1-b308-407d-a819-4105f10cb203","name":"Luxembourg","country_name":"Luxembourg","country_code":"LU"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"c43cd6e5-932a-41c4-a1c6-c517fda79660","name":"Panama","country_name":"Panama","country_code":"PA"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"53e1210a-b379-4569-aba4-9e7f6916f24e","name":"Tunisia","country_name":"Tunisia","country_code":"TN"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"7618729a-b75f-4320-926c-da4319dc2b37","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"9f9ae43d-6ec4-4a1d-a65d-6a6181399a7c","tag":"c475ad68-3fdc-4725-8abc-784c56125e96"},{"id":"1678f9d1-ee1c-4085-af12-e79f0799e799","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"93087b24-ffeb-4beb-a044-a23fac839478","tag":"e499005b-adba-45bb-85e3-07043fd9edf9"},{"id":"217124b7-0fc5-405d-bb5e-2abab4f680e8","tag":"8b1cb0dc-dd3e-44ba-828c-55c040e93b93"},{"id":"2cb69505-c355-4a0d-8534-7bb1b6934093","tag":"5f5e40cd-0732-4eb4-a083-06940623c3f9"},{"id":"79c8a7a9-3aec-4ab5-9dc1-3c8def4908c7","tag":"915e7ac2-b266-45d7-945c-cb04327d6246"},{"id":"1ee81121-a2fc-460e-bc36-a480fda71d63","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"c46d60a1-bc1e-4888-a110-462b781f9851","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"c397a2b8-163e-406d-b13e-09d50e8b1e02","tag":"7140a6ea-2c03-4028-9da9-21d6157fdb13"},{"id":"17b14745-0b03-4309-ada7-b6f5d2cbf86a","tag":"963e4802-3d3f-4e4b-b258-0b36020997b9"},{"id":"d7c353f5-9d15-47de-8ffe-faab82205dd1","tag":"a58fbc12-8068-4eba-89f0-64c9d5a7aaf8"},{"id":"f198d549-0779-4591-98c4-2875a97fd354","tag":"b0098999-7465-42a0-ac7d-a55001c4e79f"},{"id":"6b2f0bec-dc67-402d-8c92-55bfe088f122","tag":"33d22eff-59a1-47e0-b9eb-615dee314595"},{"id":"fbd6943d-4d58-472b-9535-867a2b5e37f4","tag":"fe3eb26d-6daa-4f82-b0dd-fc1e2fffbc2b"},{"id":"6ee6531e-49b7-40a1-871b-4a6a8312412b","tag":"e401022a-36ac-486d-8503-dd531410a927"},{"id":"82cdca09-4289-454b-abe0-15ca87bf8cdf","tag":"c8ce7130-e134-492c-a98a-ed1d25b57e4c"},{"id":"2f35ac91-2fad-4548-9ac2-c51bc924c930","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"4863bf4f-612d-4a76-8f8e-682eb41e89ed","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"fea2db0e-e6a6-44f1-9b5a-2d00744c388b","name":"BlackLock Ransomware Operators","source":"Tidal Cyber","group_attack_id":"G3109","created":"2025-06-17T14:41:02.975955Z","modified":"2025-06-17T14:41:02.975959Z","tidal_id":"c79976a7-fc1c-5951-956f-6f7ee0e11fd5","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"d08a2d3e-3e10-49c5-b678-8371adf015a1","name":"Aruba","country_name":"Aruba","country_code":"AW"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"0ee7a498-654f-4a33-a713-c032aa205072","name":"Congo, The Democratic Republic of the","country_name":"The Democratic Republic of the Congo","country_code":"CD"},{"id":"8af7cb07-edaa-4b5c-a1f0-bc171151e6b4","name":"Croatia","country_name":"Croatia","country_code":"HR"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"48dcb70e-5db1-46f6-9bd5-33ed646872e4","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"319760d9-782a-4391-828f-c88b468bf3c6","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"d318d498-fcde-4870-a208-629338e2bc0e","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"03aa8e3e-af18-469a-9499-775868e8450e","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"990a0efa-e2a3-4793-87f9-6be17a3a9f59","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f879703f-0f5b-4e5a-8c4e-b398163c9a84","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"428dc121-a593-4981-9127-f958ae0a0fdd","name":"BlackOasis","source":"MITRE","group_attack_id":"G0063","created":"2018-04-18T17:59:24.739000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"4348feef-b06a-5fba-a5e2-b3d97fb69a39","country":[],"observed_motivation":[],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"82996d62-5083-4687-afb7-ee2ef56cc2ee","name":"Angola","country_name":"Angola","country_code":"AO"},{"id":"a0bfbad9-4a8d-451b-9401-df2db3b2da4c","name":"Bahrain","country_name":"Bahrain","country_code":"BH"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"d1aa288d-a353-4ca4-aacf-1a4192e5dc83","name":"Libya","country_name":"Libya","country_code":"LY"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"53e1210a-b379-4569-aba4-9e7f6916f24e","name":"Tunisia","country_name":"Tunisia","country_code":"TN"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"1d751794-ce94-4936-bf45-4ab86d0e3b6e","name":"BlackSuit Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3047","created":"2024-08-09T14:52:32.053693Z","modified":"2024-08-09T14:52:32.053697Z","tidal_id":"f84cdadd-8094-5a8e-8015-c0a8c7810ba7","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"43a5a379-e1ee-4ec4-ae63-7d556e25f120","name":"Jamaica","country_name":"Jamaica","country_code":"JM"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"1b6d80b5-4815-406d-ab3d-4db73af99723","name":"Ignoble Scorpius","description":"<sup>[[Unit42 BlackSuit October 14 2025](/references/5edcf0bf-1cd2-4f22-9d3c-be8eb1befda0)]</sup>","source":"USER","associated_group_id":"ac8eecf9-dc69-4b76-bfa1-c6a010963a29","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9ed9b8c8-5a52-4956-bfc4-8998c2eaabbc","name":"BlackSuit","description":"<sup>[[Red Canary December 09 2025](/references/6d71e655-029e-49b0-8285-30e036e63140)]</sup>","source":"USER","associated_group_id":"114d496e-2b4e-4a8f-b91e-04d0371cb86f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"966de3e9-ffb0-44d4-8a13-5036272d2aec","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"7f5febe1-41c7-441d-b7b3-fc40a653065b","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"ef2d8531-828d-4bb3-ab74-3c843841d718","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"2f527233-3664-40e4-a21a-ca4f98fc6f9d","tag":"d602ade5-148e-4f57-a202-87845bab308b"},{"id":"dc67951f-b373-4ced-b12d-63a8d76f9333","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"d6480cb6-a693-4280-82d7-badad1e07df5","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"7bd48986-c1a6-4347-9566-698fbb39cbf0","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"38878657-717b-4488-972e-125272d850b3","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"5467110a-5fd4-4cbe-bfc8-747827f4aa48","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"528ab2ea-b8f1-44d8-8831-2a89fefd97cb","name":"BlackTech","source":"MITRE","group_attack_id":"G0098","created":"2020-05-05T18:36:45.970000Z","modified":"2022-04-06T13:14:27.477000Z","tidal_id":"95a87482-a6cd-59a2-85c6-15b0557bf075","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"f0d645a2-10c4-47ba-93c5-25113f1da1c6","name":"Palmerworm","description":"<sup>[[Symantec Palmerworm Sep 2020](https://app.tidalcyber.com/references/84ecd475-8d3f-4e7c-afa8-2dff6078bed5)]</sup><sup>[[IronNet BlackTech Oct 2021](https://app.tidalcyber.com/references/98b2d114-4246-409d-934a-238682fd5ae6)]</sup>","source":"MITRE","associated_group_id":"25cec21f-c276-4d0c-adef-6313bd752e07","owner_id":null,"owner_name":null},{"id":"0fd0a5c0-8fe5-40b0-aaba-c3407636b6cf","name":"Temp.Overboard","description":"<sup>[[U.S. CISA BlackTech September 27 2023](/references/309bfb48-76d1-4ae9-9c6a-30b54658133c)]</sup>","source":"Tidal Cyber","associated_group_id":"e3baf8a3-d4bb-4ef0-add7-39bc238b0c12","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a8a9cd0f-96d4-4157-9e52-6d169c2a2f24","name":"Circuit Panda","description":"<sup>[[U.S. CISA BlackTech September 27 2023](/references/309bfb48-76d1-4ae9-9c6a-30b54658133c)]</sup>","source":"Tidal Cyber","associated_group_id":"c1769626-608d-42b4-b0dc-67520181e8a6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"0bac0bf4-1488-4b4c-b949-aa2703a1ac95","name":"Radio Panda","description":"<sup>[[U.S. CISA BlackTech September 27 2023](/references/309bfb48-76d1-4ae9-9c6a-30b54658133c)]</sup>","source":"Tidal Cyber","associated_group_id":"4e472ebd-7685-409e-a41d-b9034d04583f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"6f9f1f22-8ea1-4c4e-8998-887012376078","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"fc0cb508-a698-45d0-a896-c77f74968610","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"36d6158f-fadd-4ac0-ae55-443a5b51bd55","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"930901b1-fd43-4fa3-b447-3ae3d994cb81","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"}],"owner_name":null},{"id":"b600c071-855e-49e4-b35a-816751732973","name":"BLOCKADE SPIDER","source":"Tidal Cyber","group_attack_id":"G3154","created":"2025-12-10T14:14:11.816315Z","modified":"2025-12-10T14:14:11.816317Z","tidal_id":"093979dc-4372-5ad5-b8fe-9b78b1b9ca80","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"835dcb17-4ed7-4a14-abec-f4dc99b74b57","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"55655314-850c-4d98-aad7-b0ab83b1f8cf","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"9700a3aa-44af-4a96-8b12-8fbab06f946a","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"6201b8c4-ef70-4836-bf08-cf92f9de694d","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"593e2adc-4344-4e31-bab8-87f00d4e59a3","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"44151174-83b4-4ae3-bc2f-2124850b87de","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"bfccf607-80ba-4b52-b8db-6932749460ee","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"b82c6ed1-c74a-4128-8b4d-18d1e17e1134","name":"Blue Mockingbird","source":"MITRE","group_attack_id":"G0108","created":"2020-05-26T20:09:39.139000Z","modified":"2021-10-12T21:46:13.007000Z","tidal_id":"0c98d54f-d41f-50c4-a122-656458bc246d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"72e921d4-4c9f-5893-8d45-aa9d90bf9851","name":"Bouncing Golf","source":"Mobile","group_attack_id":"G0097","created":"2026-01-28T13:08:09.923750Z","modified":"2026-01-28T13:08:09.923754Z","tidal_id":"72e921d4-4c9f-5893-8d45-aa9d90bf9851","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"5825a840-5577-4ffc-a08d-3f48d64395cb","name":"BRONZE BUTLER","source":"MITRE","group_attack_id":"G0060","created":"2018-01-16T16:13:52.465000Z","modified":"2021-10-12T19:42:16.869000Z","tidal_id":"d03031a3-c79a-5d9f-9583-ccf943acbfe3","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[{"id":"9e7fe94c-5b33-4fa6-9e42-46b416ff370b","name":"Tick","description":"<sup>[[Trend Micro Daserf Nov 2017](https://app.tidalcyber.com/references/4ca0e6a9-8c20-49a0-957a-7108083a8a29)]</sup><sup>[[Symantec Tick Apr 2016](https://app.tidalcyber.com/references/3e29cacc-2c05-4f35-8dd1-948f8aee6713)]</sup><sup>[[Trend Micro Tick November 2019](https://app.tidalcyber.com/references/93adbf0d-5f5e-498e-aca1-ed3eb11561e7)]</sup>","source":"MITRE","associated_group_id":"19c5a727-c2a1-411d-ad3c-b96b62dd72ea","owner_id":null,"owner_name":null},{"id":"dbaaf996-8ef8-4463-9953-4ce480d051cf","name":"REDBALDKNIGHT","description":"<sup>[[Trend Micro Daserf Nov 2017](https://app.tidalcyber.com/references/4ca0e6a9-8c20-49a0-957a-7108083a8a29)]</sup><sup>[[Trend Micro Tick November 2019](https://app.tidalcyber.com/references/93adbf0d-5f5e-498e-aca1-ed3eb11561e7)]</sup>","source":"MITRE","associated_group_id":"84db787e-f59b-4318-be71-17bf3c55effa","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"fac6fbf1-935f-4106-ad8b-c8fd8389dd38","name":"CACTUS Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3030","created":"2024-06-13T20:11:51.952095Z","modified":"2024-06-13T20:11:51.952098Z","tidal_id":"7cf1f99f-248c-5a1d-a985-da227aa0d369","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"598853da-53a4-434c-a091-bc06c0307798","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"d4563f9e-5c3d-48ae-a2c9-cf36f91b5998","tag":"0bcc4824-7e68-4aac-b883-935e62b5be39"},{"id":"0839703a-ba9b-4b57-aa34-440897514956","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"358a8e47-c76a-4eb1-af7f-151684104f69","tag":"3b615816-3403-46a4-bd7e-f7a723fc56da"},{"id":"5b850ec3-dd42-4de5-a55a-e9ee68fec96e","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"29fc31b6-b6bb-4c81-b3a4-2b25a912ddef","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"19aeb037-831b-4c0d-a6ec-5a7ac58aa7dc","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"c95d4b13-de9d-4274-836e-404ff0254593","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"72d9bea7-9ca1-43e6-8702-2fb7fb1355de","name":"Carbanak","source":"MITRE","group_attack_id":"G0008","created":"2017-05-31T21:31:49.021000Z","modified":"2021-10-18T21:02:30.899000Z","tidal_id":"6b9a6e55-8c68-5c39-8e7d-0133b523ea43","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"445023e4-5031-43b9-b6bf-c9d0909a46fa","name":"Bosnia and Herzegovina","country_name":"Bosnia and Herzegovina","country_code":"BA"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"afc9c975-e2cc-48dd-be7f-be3540ce7f2e","name":"Iceland","country_name":"Iceland","country_code":"IS"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"5764e464-46b8-4946-b78c-73226ac1c64b","name":"Senegal","country_name":"Senegal","country_code":"SN"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[{"id":"37ca20a9-b364-4370-8da1-7544e1b2a779","name":"Anunak","description":"<sup>[[Fox-It Anunak Feb 2015](https://app.tidalcyber.com/references/d74a8d0b-887a-40b9-bd43-366764157990)]</sup>","source":"MITRE","associated_group_id":"060c0532-780d-4e42-9023-2ac385f369d7","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"3bdc748e-88e4-43bb-bcac-90e382775fa4","name":"Cat Scientist Actor","source":"Tidal Cyber","group_attack_id":"G3093","created":"2025-04-11T15:33:36.927768Z","modified":"2025-04-11T15:33:36.927771Z","tidal_id":"e34a876a-5f64-5e23-a12e-e783594157cc","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"}],"observed_sector":[],"associated_groups":[],"tags":[{"id":"b16f8618-f20b-4d92-9b1b-6c1cec026f94","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"75b1a4d2-6e3e-4dc0-97ba-69ee0615d931","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"4f797580-fff2-4f5c-a5d2-bffeaced17e4","name":"Cephalus Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3125","created":"2025-09-15T19:13:39.528345Z","modified":"2025-09-15T19:13:39.528350Z","tidal_id":"c04f4145-9388-5b57-949b-e5e249ef93cd","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"e834418c-e18a-4469-9e1c-2c12d6e875e3","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"082e0fe0-714a-44b8-95ce-15714674ec41","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"58cdf9cf-a167-4eac-8be9-e9e93e4e3b9c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"27c3279d-1691-40d7-93e1-ddc55bf12297","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"b8d85288-faf3-4db5-924e-34e37c96eb68","name":"Chaos","source":"Tidal Cyber","group_attack_id":"G3129","created":"2025-10-07T14:07:13.075777Z","modified":"2025-10-07T14:07:13.075779Z","tidal_id":"5d720587-8163-5a6c-b581-fb4ef535d7c9","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"7c040372-4519-4b64-ae58-997989d955c2","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"74e538a4-2968-4ff5-a6d9-fc8ef3a438ad","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"2e0372e7-ae74-4def-b7ba-e76e7f2f0ca9","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"450fd499-6ce0-43d8-8855-3d77acb1e4ef","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6d23e83f-fd4f-4802-bd01-daff7348741d","name":"Charcoal Stork","source":"Tidal Cyber","group_attack_id":"G3055","created":"2024-09-27T17:01:29.444980Z","modified":"2024-09-27T17:01:29.444985Z","tidal_id":"2aacbd6f-d8d6-5d41-bd59-23a5df725aa7","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[],"tags":[{"id":"a5cef270-b6e6-4180-8c25-03840235c7a6","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"e218bc7e-b630-44d4-b0df-f38863b26c4d","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"99c648f7-be33-42d0-af39-231b1e0951ee","name":"CHATTY SPIDER","source":"Tidal Cyber","group_attack_id":"G3082","created":"2025-03-04T15:55:07.006451Z","modified":"2025-03-04T15:55:07.006455Z","tidal_id":"ade3cca8-4f37-5dba-89f1-34e60ff99894","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[{"id":"5bccecd8-93da-4ec3-8ae7-7ff3c96a578c","name":"Luna Moth","description":"<sup>[[FBI Silent Ransom Group PIN May 23 2025](/references/9112728f-e507-4752-b4c7-3b03a719a983)]</sup>","source":"Tidal Cyber","associated_group_id":"410f34ce-2aaf-4518-8bb5-86d0bd05d17a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ecba4b6a-4fa3-485d-968c-aa98dea7a380","name":"Silent Ransom Group","description":"<sup>[[FBI Ransomware Tools November 7 2023](/references/e096e1f4-6b62-4756-8811-f263cf1dcecc)]</sup>","source":"Tidal Cyber","associated_group_id":"678ed710-4a55-48c1-b62f-eccc5ab7b6f5","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"da46d16c-fcba-4636-91e0-b685a799a5bd","name":"SRG","description":"<sup>[[FBI Ransomware Tools November 7 2023](/references/e096e1f4-6b62-4756-8811-f263cf1dcecc)]</sup>","source":"Tidal Cyber","associated_group_id":"fa2ca2fd-ef98-452d-ad7d-f69c63e07e76","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1ff3435a-0933-4c2b-89d0-1ec5d5830488","name":"TG2729","description":"<sup>[[Sygnia Luna Moth July 1 2022](/references/115590b2-ab57-432c-900e-000627464a11)]</sup>","source":"Tidal Cyber","associated_group_id":"e1c3dc08-ac6e-44ff-b4b7-640fa3e2ee26","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"f7384afb-4781-4be9-baab-043b4bafb344","name":"UNC3753","description":"<sup>[[FBI Silent Ransom Group PIN May 23 2025](/references/9112728f-e507-4752-b4c7-3b03a719a983)]</sup>","source":"Tidal Cyber","associated_group_id":"a28f1a99-1a8e-4e37-8e8e-709baf924b29","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"fdfedb90-e05f-4862-8ec9-17b1fc810cce","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f4055afa-95ef-4465-a489-c5b495dfa542","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"ca93af75-0ffa-4df4-b86a-92d4d50e496e","name":"Chimera","source":"MITRE","group_attack_id":"G0114","created":"2020-08-24T17:01:55.842000Z","modified":"2022-05-11T14:00:00.188000Z","tidal_id":"a2ad473d-134c-5ce9-9b5a-d26f57036f4f","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"}],"observed_sector":[{"id":"4684465c-9860-40a6-bd7a-632b74f768c3","name":"Semi Conductors"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"}],"associated_groups":[],"tags":[{"id":"923074e8-c622-4600-89c6-1906ea77fd62","tag":"ff873c9d-468f-46c4-a6ee-c8c707df0be7"}],"owner_name":null},{"id":"7a28cff6-80df-49e1-8457-a0305e736897","name":"Cicada3301 Ransomware Group","source":"Tidal Cyber","group_attack_id":"G3051","created":"2024-09-06T15:14:25.837711Z","modified":"2024-09-06T15:14:25.837714Z","tidal_id":"a0148ce5-d728-5eaa-a06a-5429718367b8","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[],"tags":[{"id":"5ee4fed8-d1f0-40aa-bbb2-ac315d81846c","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"459f51a5-56eb-4768-bee5-44a7a8d2f08d","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"ca292ede-fb51-4e34-a601-40132ad23801","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"f04a6fb2-e846-403a-b01d-d83c08273096","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"76f4db2e-b503-448f-9845-fbf6813773ca","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"fd7a2bce-b246-489d-9050-5b71777c1071","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"8e059c6b-d278-5454-a234-a8ad69feb66c","name":"Cinnamon Tempest","source":"MITRE","group_attack_id":"G1021","created":"2024-04-25T13:28:24.422638Z","modified":"2024-04-25T13:28:24.422640Z","tidal_id":"7d790013-c7ca-5147-acb1-10f36208e85f","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"a19668ca-e826-5301-8171-a1721c7ef9be","name":"Emperor Dragonfly","description":"<sup>[[Sygnia Emperor Dragonfly October 2022](https://app.tidalcyber.com/references/f9e40a71-c963-53de-9266-13f9f326c5bf)]</sup>","source":"MITRE","associated_group_id":"9d3998dc-bb46-57ba-b797-0d1baf258812","owner_id":null,"owner_name":null},{"id":"5c707e23-37bc-59dd-ae41-87fe5a3db15e","name":"BRONZE STARLIGHT","description":"<sup>[[Dell SecureWorks BRONZE STARLIGHT Profile](https://app.tidalcyber.com/references/d2e8cd95-fcd5-58e4-859a-c4724ec94ab4)]</sup>","source":"MITRE","associated_group_id":"eb1e9aae-f405-5abf-9ed5-6500ba587025","owner_id":null,"owner_name":null},{"id":"e67b254d-b882-5f18-9d88-2d19b2dffbbf","name":"DEV-0401","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"e1f2796b-985b-5502-a5c5-4b41655c710d","owner_id":null,"owner_name":null}],"tags":[{"id":"f8322ba1-73ce-4d2e-b0b7-a53c2ef6d0c1","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"}],"owner_name":null},{"id":"c8cc6ce8-d421-42e6-a6eb-2ea9d2d9ab07","name":"Cleaver","source":"MITRE","group_attack_id":"G0003","created":"2017-05-31T21:31:46.390000Z","modified":"2022-07-22T18:37:22.178000Z","tidal_id":"9f33a611-7bc3-5687-8842-3cda09518529","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"eeee1c2a-3bb5-40cf-93b6-98b1043ec89c","name":"TG-2889","description":"<sup>[[Dell Threat Group 2889](https://app.tidalcyber.com/references/de7003cb-5127-4fd7-9475-d69e0d7f5cc8)]</sup>","source":"MITRE","associated_group_id":"18e47f6e-b3e3-40e9-8cc1-589f3b8dca36","owner_id":null,"owner_name":null},{"id":"a307544f-424d-42a3-bb60-af98da937af7","name":"Threat Group 2889","description":"<sup>[[Dell Threat Group 2889](https://app.tidalcyber.com/references/de7003cb-5127-4fd7-9475-d69e0d7f5cc8)]</sup>","source":"MITRE","associated_group_id":"91b42715-7646-497a-a146-50bdffad8f71","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"41d6d175-2f69-45e6-9663-9ff0cf8649e3","name":"Cloak","source":"Tidal Cyber","group_attack_id":"G3211","created":"2026-01-23T20:30:07.517669Z","modified":"2026-01-23T20:30:07.517673Z","tidal_id":"f64ee065-33c1-5329-afac-22bc86f3640d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"e1db18cd-001b-4b3f-9fd5-03c423b52fd0","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"c2ec9046-bb9a-48b3-8334-2342827bde31","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"e8bb2f0e-259e-4091-9e91-496dbd8d6de4","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"603ab1c4-35c0-43da-a9c7-cec8159a2f45","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"58db02e6-d908-47c2-bc82-ed58ada61331","name":"Cobalt Group","source":"MITRE","group_attack_id":"G0080","created":"2018-10-17T00:14:20.652000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"09af617b-6040-5b08-8fbe-8b558cbde156","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"f0106493-e44f-43d5-b12b-0971842d81de","name":"Kyrgyzstan","country_name":"Kyrgyzstan","country_code":"KG"},{"id":"57795c9b-f344-44fb-99fa-85379126bb0b","name":"Moldova, Republic of","country_name":"Moldova","country_code":"MD"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"74026dba-423a-49c5-afea-4f18bc021a6a","name":"Tajikistan","country_name":"Tajikistan","country_code":"TJ"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[{"id":"4a04ccc8-b838-4e29-bdf3-258a2cf04ff1","name":"GOLD KINGSWOOD","description":"<sup>[[Secureworks GOLD KINGSWOOD September 2018](https://app.tidalcyber.com/references/cda529b2-e152-4ff0-a6b3-d0305b09fef9)]</sup>","source":"MITRE","associated_group_id":"14e60fe8-a70e-4b49-9e0c-d0417e2a8a2e","owner_id":null,"owner_name":null},{"id":"6b90d9bd-8c90-4afe-8fb3-feda0ca1b5dc","name":"Cobalt Gang","description":"<sup>[[Talos Cobalt Group July 2018](https://app.tidalcyber.com/references/7cdfd0d1-f7e6-4625-91ff-f87f46f95864)]</sup> <sup>[[Crowdstrike Global Threat Report Feb 2018](https://app.tidalcyber.com/references/6c1ace5b-66b2-4c56-9301-822aad2c3c16)]</sup><sup>[[Morphisec Cobalt Gang Oct 2018](https://app.tidalcyber.com/references/0a0bdd4b-a680-4a38-967d-3ad92f04d619)]</sup>","source":"MITRE","associated_group_id":"497264f0-60ec-4515-b123-4d17701d4bd8","owner_id":null,"owner_name":null},{"id":"13e2fb7f-2628-4461-a391-b966890b30c7","name":"Cobalt Spider","description":"<sup>[[Crowdstrike Global Threat Report Feb 2018](https://app.tidalcyber.com/references/6c1ace5b-66b2-4c56-9301-822aad2c3c16)]</sup>","source":"MITRE","associated_group_id":"5d356315-296c-4c79-b2e4-d4dcdcf59551","owner_id":null,"owner_name":null}],"tags":[{"id":"b48b4220-620c-489f-81ac-81548dcad673","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"},{"id":"705a91ea-09be-489b-8fc5-da9ba42499c0","tag":"57859162-d54e-4f4a-a89c-3ae374f09516"}],"owner_name":null},{"id":"d0f29889-7a9c-44d8-abdc-480b371f7b2b","name":"Confucius","source":"MITRE","group_attack_id":"G0142","created":"2021-12-26T23:11:39.442000Z","modified":"2022-06-30T20:15:32.697000Z","tidal_id":"112f0a7c-a964-531b-9936-6c3238b3a0e3","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"6d0045e9-37fd-4d43-8306-09da90621953","name":"Confucius APT","description":"","source":"MITRE","associated_group_id":"f223d10c-171d-4aa7-ab2c-7ff2acaf88f1","owner_id":null,"owner_name":null},{"id":"e015f5db-42ce-4265-93da-290bc47b5053","name":"Confucius APT","description":"","source":"Mobile","associated_group_id":"f223d10c-171d-4aa7-ab2c-7ff2acaf88f1","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"b436d32f-2667-5e00-a3d8-f58d2d5666d4","name":"Contagious Interview","source":"MITRE","group_attack_id":"G1052","created":"2025-10-29T21:08:48.108229Z","modified":"2025-10-29T21:08:48.108229Z","tidal_id":"b436d32f-2667-5e00-a3d8-f58d2d5666d4","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"f7098fd6-96c0-5a64-ae7d-4b7bd92fd157","name":"DeceptiveDevelopment","description":"<sup>[[ESET Contagious Interview BeaverTail InvisibleFerret February 2025](https://app.tidalcyber.com/references/c6626322-dce8-5de9-aa92-5b29a09a6203)]</sup>","source":"MITRE","associated_group_id":"279cfebc-fcd3-5aa1-b498-3247b40c9af1","owner_id":null,"owner_name":null},{"id":"7d7ef50f-c17f-51aa-b245-00e418de5ad1","name":"PurpleBravo","description":"<sup>[[Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025](https://app.tidalcyber.com/references/7f53d9e4-f460-5d94-bc65-1ee7dacaa251)]</sup>","source":"MITRE","associated_group_id":"684f4567-f17c-585c-9919-6ed25059e6e4","owner_id":null,"owner_name":null},{"id":"898088b8-a4ee-5f64-8b4f-3a89834a450c","name":"Gwisin Gang","description":"<sup>[[Sentinel One Contagious Interview ClickFix September 2025](https://app.tidalcyber.com/references/a34fe621-79ff-5ef9-9bfc-db067dcf9033)]</sup><sup>[[dtex DPRK 2025 structure ITworkers](https://app.tidalcyber.com/references/fd19ce93-66ea-59d2-b6da-880c7bc574f1)]</sup>","source":"MITRE","associated_group_id":"a74a2f34-22a8-57ac-85d0-66bacf93eef9","owner_id":null,"owner_name":null},{"id":"b92ae0d8-4988-5403-9ec1-6e24e71c992f","name":"Tenacious Pungsan","description":"<sup>[[Datadog Contagious Interview Tenacious Pungsan October 2024](https://app.tidalcyber.com/references/bc385280-c918-5fd1-81eb-f813426a5a49)]</sup>","source":"MITRE","associated_group_id":"821a0b35-7d07-5e3e-a727-9523f4b934b9","owner_id":null,"owner_name":null},{"id":"44868bb4-bddf-5741-8265-7451cee67f60","name":"DEV#POPPER","description":"<sup>[[Securonix Contagious Interview DEVPOPPER April 2024](https://app.tidalcyber.com/references/355802a7-58dc-590e-8b9a-6437bff71e44)]</sup>","source":"MITRE","associated_group_id":"74c7bf3d-5faf-53b4-9afb-6a2bc966e30c","owner_id":null,"owner_name":null},{"id":"81d9ee3e-a99c-5ea4-8df5-6cd837513fb9","name":"TAG-121","description":"<sup>[[Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025](https://app.tidalcyber.com/references/7f53d9e4-f460-5d94-bc65-1ee7dacaa251)]</sup>","source":"MITRE","associated_group_id":"01c6ef64-049e-5ef6-9786-d07490d477ff","owner_id":null,"owner_name":null}],"tags":[{"id":"5a78c0c5-0374-4f4a-b3fc-df8c04bf0720","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"}],"owner_name":null},{"id":"6a8f5eca-8ecc-4bff-9c5f-5380e044ed5b","name":"CopyKittens","source":"MITRE","group_attack_id":"G0052","created":"2018-01-16T16:13:52.465000Z","modified":"2022-08-08T21:29:36.462000Z","tidal_id":"22a05929-46b0-5d73-aacf-91b26f370716","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"838595da-c006-4ebd-83f3-6d34b341ed0b","name":"DEV-0588","description":"<sup>[[Microsoft POLONIUM June 2022](/references/689ff1ab-9fed-4aa2-8e5e-78dac31e6fbd)]</sup>","source":"Tidal Cyber","associated_group_id":"ab64163d-7ccd-4faa-8775-511c9d7a3663","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[],"owner_name":null},{"id":"04b73cf2-33f4-4206-be9e-c80c4c9b54e8","name":"CosmicBeetle","source":"Tidal Cyber","group_attack_id":"G3053","created":"2024-09-13T19:21:14.883560Z","modified":"2024-09-13T19:21:14.883566Z","tidal_id":"7a8fe1ed-4d56-5f17-b439-9dac4bebae42","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"83ed4573-54ed-4a3f-80c8-9ac5acd7024c","name":"French Guiana","country_name":"French Guiana","country_code":"GF"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"640088a5-d548-4bab-bf41-29c46ed813f6","name":"Guatemala","country_name":"Guatemala","country_code":"GT"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"afcfad29-4907-4cad-aed9-5111c79b63ab","name":"NoName Ransomware Gang","description":"<sup>[[BleepingComputer NoName September 10 2024](/references/79752048-f2fd-4357-9e0a-15b9a2927852)]</sup>","source":"Tidal Cyber","associated_group_id":"13637afd-a85e-4b1d-88a6-f2db57bf9bd4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"894aa23d-ba03-4e96-b404-5505e65592fb","tag":"55ba9d29-7185-40eb-ba10-874cb3997a0f"},{"id":"3794b471-4ae4-4417-a951-066949526394","tag":"793f4441-3916-4b3d-a3fd-686a59dc3de2"},{"id":"acdb351d-83d6-4d1a-adfa-e378accc5179","tag":"c40971d6-ad75-4b2d-be6c-5353c96a232d"},{"id":"dbebca53-5abd-4148-917c-fc6f367ab132","tag":"3adcb409-166d-4465-ba1f-ddaecaff8282"},{"id":"0e77be92-4ebe-492d-9538-17ce7c8c8ad9","tag":"33d22eff-59a1-47e0-b9eb-615dee314595"},{"id":"81e0065e-bed4-4bd0-958f-7390c2059bff","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"ad0b3df1-4651-4b56-af43-3b8b8b446856","tag":"09de661e-60c4-43fb-bfef-df017215d1d8"},{"id":"b47e95ad-63fd-4a59-9e3b-28252eee892f","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"ac3ee8ff-ad6a-47f7-a69a-92301712834a","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"00ec30ca-8a87-4334-b394-32ea0d94f884","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"b0bbd4b5-7a52-433b-9203-455d9359dc26","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f90163a0-b0a3-4b58-9367-27df79585b20","name":"CrazyHunter Team","source":"Tidal Cyber","group_attack_id":"G3196","created":"2026-01-14T13:30:28.456157Z","modified":"2026-01-14T13:30:28.456163Z","tidal_id":"bd19dea0-1ee1-5f86-8a67-c05cd2c2c02e","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"}],"observed_sector":[{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"}],"associated_groups":[],"tags":[{"id":"6a7daae6-cfe2-4dfa-acc9-115ef4c76f83","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"8d48a188-074e-4416-bbc7-60a18148fed8","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d49b5a8e-4312-4e5c-b92b-a6ded9ae486c","name":"Crimson Collective","source":"Tidal Cyber","group_attack_id":"G3135","created":"2025-10-07T14:07:13.993161Z","modified":"2025-10-07T14:07:13.993163Z","tidal_id":"b3ad11c5-1740-5ae2-a83d-fdde16132a42","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"69dd3e9b-a2bb-4afc-bd54-3154343e266c","name":"Video Games"}],"associated_groups":[],"tags":[{"id":"7d5536e6-77dd-4fb9-8a71-9799f094f4c9","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"2309c53a-87d8-444a-97db-81887ece751c","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"fd4dcc5c-f345-48e2-8323-25e1be3d50f0","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a6f7e897-aeba-44d1-a24c-21e236d22145","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5216ac81-da4c-4b87-86ce-b90a651f1048","name":"Cuba Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3008","created":"2024-06-13T20:11:13.914459Z","modified":"2024-06-13T20:11:13.914463Z","tidal_id":"6d56147e-2b8d-5678-855e-d355b2169aa2","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"2cb74834-3a9c-4a0d-8ac5-f4a317ad7a63","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"6eac57bb-a194-4aa0-9f25-11829842e88b","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"d264d910-45b5-44b7-85c3-b8c0c04a6484","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"b1ab2aa0-8350-4494-b43f-9808b8fea0a1","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"82f64600-f309-4028-aef0-102ea82fe5f8","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"ab15a328-c41e-5701-993f-3cab29ac4544","name":"CURIUM","source":"MITRE","group_attack_id":"G1012","created":"2023-05-26T01:20:56.479655Z","modified":"2023-05-26T01:20:56.479659Z","tidal_id":"275dbba3-6af3-5d82-8f7f-cfaaf71bee83","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"70d2465d-0b5c-5d14-9380-dd67afbfa0a2","name":"Crimson Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"df168351-73eb-5274-b27e-c0b00b6e62d1","owner_id":null,"owner_name":null},{"id":"7892da11-b087-44ad-af2b-dee008446512","name":"Imperial Kitten","description":"<sup>[[PwC Yellow Liderc October 25 2023](/references/cbeaf9b5-865f-44a1-a913-9eec28d7a5ff)]</sup>","source":"Tidal Cyber","associated_group_id":"4a36bf44-b585-4249-901a-763dd3761fa4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b1132daa-ef8c-4226-95dc-5bfa8f554f06","name":"Tortoiseshell","description":"<sup>[[PwC Yellow Liderc October 25 2023](/references/cbeaf9b5-865f-44a1-a913-9eec28d7a5ff)]</sup>","source":"Tidal Cyber","associated_group_id":"61b33fb8-d429-4acd-8566-8e49d5f727d1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9eecd745-e766-5aa4-b4ac-2e30c08e27de","name":"TA456","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[Proofpoint TA456 Defense Contractor July 2021](https://app.tidalcyber.com/references/0cc015d9-96d0-534e-a34a-221267250f90)]</sup>","source":"MITRE","associated_group_id":"18c5e336-eb18-5103-956a-8c80303b1c14","owner_id":null,"owner_name":null},{"id":"f64557c8-c9c6-50ab-bb14-7f1bc2603be6","name":"Tortoise Shell","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"29bc396f-6cf7-5c52-a499-a9fc9e5c99b1","owner_id":null,"owner_name":null},{"id":"ec9f3892-2cbc-5956-ae49-6cb672f4df05","name":"Yellow Liderc","description":"<sup>[[PWC Yellow Liderc 2023](https://app.tidalcyber.com/references/e473a371-2f34-5391-8888-42082b0a1904)]</sup>","source":"MITRE","associated_group_id":"81dafbff-4407-5027-9a50-231725475499","owner_id":null,"owner_name":null}],"tags":[{"id":"9cd171ce-b352-4356-b2a9-73916eba2776","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":null},{"id":"a1a03a84-1d75-40a3-916e-d3e0d1068d11","name":"CURLY SPIDER","source":"Tidal Cyber","group_attack_id":"G3081","created":"2025-03-04T15:55:06.837525Z","modified":"2025-03-04T15:55:06.837528Z","tidal_id":"01ddad6b-bd8b-5521-b62c-f643eb79bbaf","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"7d217660-070d-422f-bd56-e5921771d5e0","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"99cc3af1-dc90-449c-943d-63701c070e3a","tag":"62bde669-3020-4682-be68-36c83b2588a4"},{"id":"65e73a58-698c-441b-934d-c27b3aecb1b1","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a05db149-c8d8-4638-807a-940f741347a5","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"411e005e-95a4-4805-8296-0accf902d08d","name":"Cyber Army of Russia","source":"Tidal Cyber","group_attack_id":"G3035","created":"2024-06-13T20:12:20.384708Z","modified":"2024-06-13T20:12:20.384711Z","tidal_id":"aab5e2d2-8355-5336-adea-6320a7a8ee1e","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"b6f2b35c-9ce7-43cb-ade8-bfa9d4651c92","name":"CyberArmy of Russia","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"e4b35cbd-37c1-467b-bdf6-fd73436d504d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8e9183f8-b8fb-4981-a58c-db7881b83298","name":"Народная CyberАрмия (НКА)","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"64676c17-4b3e-4b15-b728-df8bdae3f879","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"23196920-903e-4668-8f22-7b60cc05cf28","name":"People’s CyberArmy of Russia (PCA)","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"1c2d8fce-0b39-4a24-9ffa-d7a645873b06","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8beeac6d-2e27-4e92-b052-468832853a5d","name":"Russian CyberArmy Team (RCAT)","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"24306970-32fb-4196-809a-f2569256e0d6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"82bf4215-44dc-4103-9318-9de238c49c04","name":"CyberArmyofRussia_Reborn","description":"<sup>[[Mandiant APT44 April 17 2024](/references/a64f689e-2bb4-4253-86cd-545e7f633a7e)]</sup>","source":"Tidal Cyber","associated_group_id":"e4b09e72-af72-42aa-b113-db076a83ccd4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b5d19b7f-42f3-42da-b9d6-69a560f6450f","name":"Cyber Army of Russia Reborn","description":"<sup>[[Wired Cyber Army of Russia April 17 2024](/references/53583baf-4e09-4d19-9348-6110206b88be)]</sup>","source":"Tidal Cyber","associated_group_id":"7dc6e149-850e-4b9f-8330-05fd76f070fb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c9330967-3fc0-4a22-882a-ca25878b69f9","name":"CARR","description":"<sup>[[Wired Cyber Army of Russia April 17 2024](/references/53583baf-4e09-4d19-9348-6110206b88be)]</sup>","source":"Tidal Cyber","associated_group_id":"134e6082-7694-457f-83bd-1d0e53f64a3b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"66cde6fa-0c69-4c4e-8940-c20555db647c","name":"People’s Cyber Army","description":"<sup>[[PJ Cyber Army of Russia 2023](/references/3e42ff96-fc7e-418e-8d8b-076a1a47981e)]</sup>","source":"Tidal Cyber","associated_group_id":"3ead76ff-8d90-477a-8f3f-299cc7ace59a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"14c53e6b-1fb2-4483-ba84-d5b475aeb384","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"ea4c6228-f0a2-4a56-b838-2f758236886a","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"eb7156ac-d658-4c31-9e26-a273b1c5af04","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"f97c9c55-1592-4f05-8f5f-42fa4ab37d07","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"0fcefd6a-54fe-4ed5-ba3b-a024ff1b30b5","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"c54971ad-187e-4d6d-8f7a-a2a24d58e091","tag":"2185ed93-7e1c-4553-9452-c8411b5dca93"},{"id":"2c3e3361-4c93-4387-8801-53d40490e49e","tag":"cc4ea215-87ce-4351-9579-cf527caf5992"},{"id":"4dbcd19a-3c90-41fd-b1b9-ed29adfbc74d","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"0be10b7f-960a-44d6-b8da-db74c6941a0c","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"3054d216-9636-4acd-a65d-808672c3fd4c","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"f41d026b-33d3-471e-aece-74be149ac148","tag":"62bde669-3020-4682-be68-36c83b2588a4"},{"id":"a8af7120-d269-40b7-ac2c-547bee217369","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"4aaef09f-0c3f-4131-88c8-494951558120","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"2578d40f-5ccc-40d6-84c9-5351b9576bf6","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"488fe989-6223-5562-9f4f-58459b0d9e23","name":"CyberAv3ngers","source":"ICS","group_attack_id":"G1027","created":"2026-01-28T13:08:18.109459Z","modified":"2026-01-28T13:08:18.109460Z","tidal_id":"488fe989-6223-5562-9f4f-58459b0d9e23","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"8be29bbf-3a99-4a6a-8343-a4e9a5849905","name":"Soldiers of Soloman","description":"CyberAv3ngers reportedly has connections to the IRGC-linked group Soldiers of Solomon.<sup>[[CISA AA23-335A IRGC-Affiliated December 2023](https://app.tidalcyber.com/references/d4e229ab-daa5-56cf-a752-b26f67c7f866)]</sup>","source":"ICS","associated_group_id":"90dda9ad-dd5c-52b8-b099-ffac967b48b4","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"44a9c8ac-c287-45d2-9ebc-2c8a7d0a1f57","name":"CyberAv3ngers","source":"Tidal Cyber","group_attack_id":"G3028","created":"2023-12-06T16:45:20.361025Z","modified":"2023-12-06T16:45:20.361029Z","tidal_id":"88371f03-e0e6-57b7-a118-6e93bf2684c0","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[],"tags":[{"id":"3a7cea4e-13ca-4e4b-8378-b73baec178b4","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"dd387b13-2ddf-4bb2-80ab-e23c2a393ca6","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"166b1b9f-fdd7-4191-b26f-2122804a0816","tag":"841ce707-a678-4bcf-86ff-7feeacd37e55"},{"id":"147f0c73-518e-418f-9a1c-656679b1ce6c","tag":"15787198-6c8b-4f79-bf50-258d55072fee"}],"owner_name":"TidalCyberIan"},{"id":"453114ba-40e5-476e-be79-1ceae7d41a63","name":"Cyber Hunters","source":"Tidal Cyber","group_attack_id":"G3192","created":"2026-01-06T18:04:02.471583Z","modified":"2026-01-06T18:04:02.471587Z","tidal_id":"c8136b71-c0a4-50bb-81da-84aeccb9352c","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"580586ad-bb21-40f8-8819-fe0e85db2674","name":"Skull Hunters","description":"<sup>[[Check Point Blog August 13 2024](/references/72134c73-bdd5-4cd1-9046-1ea01c75faf3)]</sup>","source":"USER","associated_group_id":"cf33deec-8ecd-46c1-9b2c-39a47a1dd762","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a59b1fbc-9294-4c4d-9f79-81301707ffd7","name":"MS BOTNET Cyberhunter","description":"<sup>[[Check Point Blog August 13 2024](/references/72134c73-bdd5-4cd1-9046-1ea01c75faf3)]</sup>","source":"USER","associated_group_id":"c9e8299d-e51c-4d31-912a-e4abed00a516","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9ef9f003-b53a-4b6a-985f-7d6509b038b6","name":"White Hunters","description":"<sup>[[Check Point Blog August 13 2024](/references/72134c73-bdd5-4cd1-9046-1ea01c75faf3)]</sup>","source":"USER","associated_group_id":"a7041d4a-eae9-41de-b7e0-e24ba81ecf0b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"5f0bfbd1-d326-40cb-aa7f-744baf385b24","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3263e8b0-b963-4dab-a564-d1b402e76fd6","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"42a7c134-c574-430b-8105-bf7a00e742ae","name":"Cyber Toufan","source":"Tidal Cyber","group_attack_id":"G3048","created":"2024-08-09T14:52:32.525681Z","modified":"2024-08-09T14:52:32.525686Z","tidal_id":"5dda92b9-eb9d-53c9-b3d4-6a87bd6903c7","country":[],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"90849fdd-2afb-49a3-a3e6-514df31a5288","name":"Cyber Toufan Al-aqsa","description":"","source":"Tidal Cyber","associated_group_id":"3f12e6ed-455f-465d-af7e-af48827cbc1c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[],"owner_name":"TidalCyberIan"},{"id":"82fc3514-e812-47f8-8e76-8bc5a8e3121c","name":"CyberVolk","source":"Tidal Cyber","group_attack_id":"G3096","created":"2025-04-11T15:33:37.572427Z","modified":"2025-04-11T15:33:37.572430Z","tidal_id":"12fdac12-9fa7-539d-81f0-9e046ee73ff0","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"7bef062a-1e7e-4153-b1ec-4a1ff6c57fd2","name":"GLORIAMIST India","description":"<sup>[[Rapid7 Blog October 3 2024](/references/47ec4fef-5558-4ba2-9f71-392152b12fd1)]</sup>","source":"Tidal Cyber","associated_group_id":"4b9575f6-89d3-45ad-a312-db5ccf3f26fa","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"19756a7f-db41-40f0-ade2-4c0c40c259d8","name":"Solntsevskaya Bratva","description":"<sup>[[Rapid7 Blog October 3 2024](/references/47ec4fef-5558-4ba2-9f71-392152b12fd1)]</sup>","source":"Tidal Cyber","associated_group_id":"4c45e307-6d45-41c5-a1b6-eb1fdce9700b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7dfcf228-132d-43dd-942e-b0d76cf01ba4","name":"GLORIAMIST","description":"<sup>[[SentinelOne November 25 2024](/references/71c8e60c-a72a-4bff-aae3-f3f155fa22ee)]</sup>","source":"Tidal Cyber","associated_group_id":"2ae7782d-0e21-4954-ae8d-4aa7c9a7c489","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"2f774dab-54f4-48ca-b49d-ca9ca483f520","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"97d2eb83-89a7-4f04-b634-d007d3efcd39","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"d5dfa5d1-ccee-43a0-ae59-29984193af66","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"f2f65621-a6d4-4a42-b292-c2e45c97e78a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"62d9586e-9d37-4206-a95d-d0dfacbd9d57","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"37d204f7-cc48-42d9-a085-de290504d6cf","name":"D4RK4RMY","source":"Tidal Cyber","group_attack_id":"G3130","created":"2025-10-07T14:07:13.232973Z","modified":"2025-10-07T14:07:13.232976Z","tidal_id":"6fe5c539-a3a2-5126-8835-a4dfcf33219f","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"d790ebae-cdb9-437c-8992-5cc39c84825f","name":"Communist Ransomware Party","description":"<sup>[[CYFIRMA 08 08 2025](/references/2987f12f-0050-4982-b14b-811361b534a0)]</sup>","source":"USER","associated_group_id":"2b357eda-cf77-4823-b6b2-4b978373955e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"b08f4bff-b736-4be9-9e33-07b19d7dd6ac","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"33d77b06-7e3f-48f6-b96d-e93482287f7e","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f0dab388-1641-50aa-b0b2-6bdb816e0490","name":"Daggerfly","source":"MITRE","group_attack_id":"G1034","created":"2024-10-31T16:28:11.501893Z","modified":"2024-10-31T16:28:11.501895Z","tidal_id":"f0dab388-1641-50aa-b0b2-6bdb816e0490","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"f3b3ddc5-621d-5f8e-8cb9-02ac132865ad","name":"Evasive Panda","description":"<sup>[[Symantec Daggerfly 2023](https://app.tidalcyber.com/references/cb0a51f5-fe5b-5dd0-8f55-4e7536cb61a4)]</sup><sup>[[ESET EvasivePanda 2024](https://app.tidalcyber.com/references/07e6b866-7119-50ad-8a6e-80c4e0d594bf)]</sup>","source":"MITRE","associated_group_id":"3c97b9a2-2849-5c8d-928f-96268d29d375","owner_id":null,"owner_name":null},{"id":"80351009-9754-483d-9967-b531c9f2123d","name":"StormBamboo","description":"<sup>[[BleepingComputer StormBamboo August 3 2024](/references/d25a3639-74d4-42fc-9006-58e5181147b9)]</sup>","source":"Tidal Cyber","associated_group_id":"4f1c8ceb-41d8-48c3-8dfe-1a36609cef8c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"fb0b2cf5-cc3d-4b18-b782-e91f5702bd96","name":"StormCloud","description":"<sup>[[BleepingComputer StormBamboo August 3 2024](/references/d25a3639-74d4-42fc-9006-58e5181147b9)]</sup>","source":"Tidal Cyber","associated_group_id":"ec4e41d2-c34a-4e62-a6c0-7027c49c1343","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"fd7ce749-9991-5325-a8a3-faf510a7646c","name":"BRONZE HIGHLAND","description":"<sup>[[Symantec Daggerfly 2023](https://app.tidalcyber.com/references/cb0a51f5-fe5b-5dd0-8f55-4e7536cb61a4)]</sup><sup>[[ESET EvasivePanda 2024](https://app.tidalcyber.com/references/07e6b866-7119-50ad-8a6e-80c4e0d594bf)]</sup>","source":"MITRE","associated_group_id":"67b4d021-37a5-5bed-9756-694d774e2218","owner_id":null,"owner_name":null}],"tags":[{"id":"d8767d18-72b2-44e3-a8c8-5d80232064bc","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"b9c4ab3a-2278-41c3-a8a5-a327625d2aa4","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"5e4bb7b2-0a6e-40b6-b8b4-0417c6488120","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"e50a06ac-221e-47cf-8b8e-cfeb24fae895","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"f800badd-6b30-4e9c-85bb-2c948cc242a3","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"}],"owner_name":null},{"id":"07bdadce-905e-4337-898a-13e88cfb5a61","name":"Daixin Team","source":"Tidal Cyber","group_attack_id":"G3007","created":"2023-12-01T14:42:16.270043Z","modified":"2023-12-01T14:42:16.270048Z","tidal_id":"0f34ea6b-864f-5fd4-bec5-216793967046","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[],"tags":[{"id":"574e4495-8c1b-4509-8c4b-bcbc6aab71d2","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"935665f5-0b8f-4284-995c-06646887833d","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"79df3d0b-6e89-4e2f-acd9-f2d5ed1f0939","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"ee245a71-a4c7-4f14-9e19-ba48f129d3ad","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"7ad94dbf-9909-42dd-8b62-a435481bdb14","name":"Dark Caracal","source":"MITRE","group_attack_id":"G0070","created":"2018-10-17T00:14:20.652000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"08c50423-5f7b-592d-a93e-78f274a7df60","country":[{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"2a528093-177d-468f-a83b-e270ca22f0ab","name":"Syrian Arab Republic","country_name":"Syrian Arab Republic","country_code":"SY"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"efa1d922-8f48-43a6-89fe-237e1f3812c8","name":"Darkhotel","source":"MITRE","group_attack_id":"G0012","created":"2017-05-31T21:31:50.624000Z","modified":"2022-10-19T22:07:30.243000Z","tidal_id":"4fd06b9f-f77e-53be-88f9-e1ec4036a785","country":[],"observed_motivation":[],"observed_country":[{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"65ee8bd3-cae5-4276-8ab1-de639ff0a6c8","name":"Mozambique","country_name":"Mozambique","country_code":"MZ"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"}],"associated_groups":[{"id":"c99d9d77-250e-5b57-8506-bc52d69450cf","name":"Zigzag Hail","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"61f2b793-3eae-5a00-8aaa-f8850c7e5b78","owner_id":null,"owner_name":null},{"id":"ecad4acb-5585-4ff1-9ada-3c187672f17b","name":"DUBNIUM","description":"<sup>[[Microsoft Digital Defense FY20 Sept 2020](https://app.tidalcyber.com/references/cdf74af5-ed71-4dfd-bc49-0ccfa40b65ea)]</sup><sup>[[Microsoft DUBNIUM June 2016](https://app.tidalcyber.com/references/ae28afad-e2d6-4c3c-a309-ee7c44a3e586)]</sup><sup>[[Microsoft DUBNIUM Flash June 2016](https://app.tidalcyber.com/references/999a471e-6373-463b-a77b-d3020b4a8702)]</sup><sup>[[Microsoft DUBNIUM July 2016](https://app.tidalcyber.com/references/e1bd8fb3-e0b4-4659-85a1-d37e1c3d167f)]</sup>","source":"MITRE","associated_group_id":"c110892f-9eae-4ffe-bf16-55437d814f3a","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"f2b31240-0b4a-4fa4-82a4-6bb00e146e75","name":"DarkHydrus","source":"MITRE","group_attack_id":"G0079","created":"2018-10-17T00:14:20.652000Z","modified":"2021-10-12T19:52:22.454000Z","tidal_id":"2beda691-2042-52e8-987d-d003b262ca71","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"d2ed88a2-5514-4336-bda7-770dbe4fd451","name":"DarkSpectre","source":"Tidal Cyber","group_attack_id":"G3190","created":"2026-01-06T18:04:02.045493Z","modified":"2026-01-06T18:04:02.045496Z","tidal_id":"1257c6ec-885a-590f-b25e-6add9adf1687","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"b4aeba67-76cc-4dbe-8a57-6996c7633840","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"20ac1c28-1bb3-4710-b883-df45977f63f9","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"be315444-81c5-43bc-917c-b492c3ee0810","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6c4f5f01-7afd-40ba-9d73-fbb33b385050","name":"DarkVault","source":"Tidal Cyber","group_attack_id":"G3205","created":"2026-01-23T20:30:06.481251Z","modified":"2026-01-23T20:30:06.481256Z","tidal_id":"c5ee1ebe-22b7-5493-b4ba-8eedaa922c08","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"c23bf37c-20e9-4eb3-8501-6b363be5cf3d","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"011a3200-cfc4-43fd-a1c2-f0c81c2d8f11","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"86098c56-1d8c-46ad-b10b-987e12b0cadf","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d428f9be-6faf-4d57-b677-4a927fea5f7e","name":"DarkVishnya","source":"MITRE","group_attack_id":"G0105","created":"2020-05-15T13:07:26.651000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"c26b116e-4981-52f4-bb54-b4f592e1fb46","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"43f826a1-e8c8-47b8-9b00-38e1b3e4293b","name":"Deep Panda","source":"MITRE","group_attack_id":"G0009","created":"2017-05-31T21:31:49.412000Z","modified":"2022-07-20T20:10:29.593000Z","tidal_id":"812ae263-24f1-5778-a6d7-f4f6779b4b5f","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"62b1680d-0ef6-474c-be65-6297564095d2","name":"WebMasters","description":"<sup>[[RSA Shell Crew](https://app.tidalcyber.com/references/6872a6d3-c4ab-40cf-82b7-5c5c8e077189)]</sup>","source":"MITRE","associated_group_id":"cf629343-dce6-40db-b07e-e9667c7fe3a1","owner_id":null,"owner_name":null},{"id":"7417fef0-7078-4023-aba0-d60274f30c80","name":"Shell Crew","description":"<sup>[[RSA Shell Crew](https://app.tidalcyber.com/references/6872a6d3-c4ab-40cf-82b7-5c5c8e077189)]</sup>","source":"MITRE","associated_group_id":"d2cec0e9-74c2-4095-a6d5-9996d8ad24a0","owner_id":null,"owner_name":null},{"id":"a3a4a987-f3b4-413b-a51e-75e7cb66f716","name":"Black Vine","description":"<sup>[[Symantec Black Vine](https://app.tidalcyber.com/references/0b7745ce-04c0-41d9-a440-df9084a45d09)]</sup>","source":"MITRE","associated_group_id":"55740e18-3c5e-4481-95ec-e2cc8810d3ee","owner_id":null,"owner_name":null},{"id":"37fb329c-eda8-4f9e-9bbe-89eab6780749","name":"PinkPanther","description":"<sup>[[RSA Shell Crew](https://app.tidalcyber.com/references/6872a6d3-c4ab-40cf-82b7-5c5c8e077189)]</sup>","source":"MITRE","associated_group_id":"07485906-ee31-42d3-aa65-60f8c8715978","owner_id":null,"owner_name":null},{"id":"47bbdec2-9f63-4388-a4cb-2f1124ecb3b4","name":"KungFu Kittens","description":"<sup>[[RSA Shell Crew](https://app.tidalcyber.com/references/6872a6d3-c4ab-40cf-82b7-5c5c8e077189)]</sup>","source":"MITRE","associated_group_id":"b7f392bf-d2bb-4074-bcfd-68a459d04a7a","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"b7b61ba1-7b0c-4568-a5ee-8b6634ed5b60","name":"Devman Ransomware Group","source":"Tidal Cyber","group_attack_id":"G3110","created":"2025-06-17T14:41:03.683162Z","modified":"2025-06-17T14:41:03.683167Z","tidal_id":"f63444a1-a6bf-5f71-97a2-425ee97fb1ef","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"}],"associated_groups":[],"tags":[{"id":"d0bb838d-79c0-4b72-bd68-c82c253c3ef7","tag":"88cd6603-5b4e-4d0c-9097-051d3a90cb80"},{"id":"5a3177b3-9eae-46da-8fa1-d151031cb014","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"72b20366-01dd-4526-b740-d57fe8a745a8","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"c5b8f8ed-2ec3-4e38-aefb-60572643568b","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f99bbc8c-425d-4e90-b739-06268bca3560","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"8e192f9d-b465-437e-a60f-0769d7691720","name":"Dire Wolf","source":"Tidal Cyber","group_attack_id":"G3131","created":"2025-10-07T14:07:13.384376Z","modified":"2025-10-07T14:07:13.384378Z","tidal_id":"3de50ff1-e324-5fd7-a2d3-cafbf909b06e","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"1c4f5bcf-a513-455b-b8ac-6a3f1ed0a1b8","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"df1896ea-3fb6-4697-b182-05a7b590c5ac","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"abc6d74d-e425-4181-93ed-bb16f911871b","name":"Donot Team","source":"Tidal Cyber","group_attack_id":"G3210","created":"2026-01-23T20:30:07.353131Z","modified":"2026-01-23T20:30:07.353133Z","tidal_id":"0300f690-e899-5063-85fe-b089ab5a756d","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"410100a2-6a0b-4706-858d-edd296348ef8","name":"SectorE02","description":"<sup>[[www.welivesecurity.com January 18 2022](/references/e6d5b908-3837-4f7e-93c8-378d4006db58)]</sup>","source":"USER","associated_group_id":"0ff7d9d0-503a-4a3d-b10c-89aaae17da14","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"0a5bad29-5f44-466e-a56b-a88219626fb1","name":"APT-C-35","description":"<sup>[[www.welivesecurity.com January 18 2022](/references/e6d5b908-3837-4f7e-93c8-378d4006db58)]</sup>","source":"USER","associated_group_id":"a1dccfcb-9854-47c2-ae35-03a9810a8081","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"88338bee-279d-4e1a-abb8-90c41358d06d","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"25d86149-e74e-4771-9ff4-252db128d11f","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"472080b0-e3d4-4546-9272-c4359fe856e1","name":"Dragonfly","source":"MITRE","group_attack_id":"G0035","created":"2017-05-31T21:32:05.217000Z","modified":"2022-10-19T22:09:02.443000Z","tidal_id":"ace49f7f-7a7b-5fcc-b5c4-632bad8be834","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"07578934-334f-4a04-b0c0-7157b1257617","name":"Greece","country_name":"Greece","country_code":"GR"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"da9f06f0-a7bf-4951-9127-e192ab66b5c3","name":"Serbia","country_name":"Serbia","country_code":"RS"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"}],"associated_groups":[{"id":"3d9d0d2d-ee9d-4367-bdf2-d690574f024d","name":"Crouching Yeti","description":"<sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup><sup>[[DOJ Russia Targeting Critical Infrastructure March 2022](https://app.tidalcyber.com/references/768a0ec6-b767-4044-acad-82834508640f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"MITRE","associated_group_id":"8e8f69f2-0bc1-4090-965b-1ee0e1e3cca9","owner_id":null,"owner_name":null},{"id":"949d3580-ee7a-4867-8875-323a417e689c","name":"TEMP.Isotope","description":"<sup>[[Mandiant Ukraine Cyber Threats January 2022](https://app.tidalcyber.com/references/6f53117f-2e94-4981-be61-c3da4b783ce2)]</sup><sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup>","source":"MITRE","associated_group_id":"2e1aa161-b0c0-431a-b974-735bb781c05a","owner_id":null,"owner_name":null},{"id":"e668617b-973b-4869-ad59-f34975d77cfe","name":"Energetic Bear","description":"<sup>[[Symantec Dragonfly](https://app.tidalcyber.com/references/9514c5cd-2ed6-4dbf-aa9e-1c425e969226)]</sup><sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[Secureworks MCMD July 2019](https://app.tidalcyber.com/references/f7364cfc-5a3b-4538-80d0-cae65f3c6592)]</sup><sup>[[Secureworks Karagany July 2019](https://app.tidalcyber.com/references/61c05edf-24aa-4399-8cdf-01d27f6595a1)]</sup><sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup><sup>[[DOJ Russia Targeting Critical Infrastructure March 2022](https://app.tidalcyber.com/references/768a0ec6-b767-4044-acad-82834508640f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"MITRE","associated_group_id":"acc95a06-1553-4f73-a582-f40dc1187b58","owner_id":null,"owner_name":null},{"id":"606860a6-d7f2-44ec-b728-5bf509e302db","name":"Berserk Bear","description":"<sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup><sup>[[DOJ Russia Targeting Critical Infrastructure March 2022](https://app.tidalcyber.com/references/768a0ec6-b767-4044-acad-82834508640f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"MITRE","associated_group_id":"3209f44c-6706-4886-aee8-91f2ab14b10d","owner_id":null,"owner_name":null},{"id":"5bac4d4f-82e4-452c-9552-a65131d02d00","name":"TG-4192","description":"<sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"MITRE","associated_group_id":"5d23fa1e-ece1-4111-a5e3-7d9eb3a8c214","owner_id":null,"owner_name":null},{"id":"f28310cb-19c5-41a1-8021-9bd81bc2919d","name":"IRON LIBERTY","description":"<sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[Secureworks MCMD July 2019](https://app.tidalcyber.com/references/f7364cfc-5a3b-4538-80d0-cae65f3c6592)]</sup><sup>[[Secureworks Karagany July 2019](https://app.tidalcyber.com/references/61c05edf-24aa-4399-8cdf-01d27f6595a1)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"MITRE","associated_group_id":"8e252d57-69fb-4e48-a094-838e24fe620e","owner_id":null,"owner_name":null},{"id":"a9b77537-7af4-573d-bbd0-7cf3ce4028c1","name":"Ghost Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"61e1ab6c-9bbe-52ff-b391-b61df037f43a","owner_id":null,"owner_name":null},{"id":"6230561a-b920-545e-a23d-0af5783f0702","name":"BROMINE","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"893d94fa-a0ff-58ec-ba99-c26274c7e09b","owner_id":null,"owner_name":null},{"id":"b59b1051-2d8d-4b44-8b89-36fce85042cd","name":"DYMALLOY","description":"<sup>[[Dragos DYMALLOY ](https://app.tidalcyber.com/references/d2785c6e-e0d1-4e90-a2d5-2c302176d5d3)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"MITRE","associated_group_id":"a9bba2d1-7fc8-43a0-8442-a12cde99329e","owner_id":null,"owner_name":null},{"id":"0af61d4c-2d19-45f9-afdf-57578e24cd53","name":"TEMP.Isotope","description":"<sup>[[Mandiant Ukraine Cyber Threats January 2022](https://app.tidalcyber.com/references/6f53117f-2e94-4981-be61-c3da4b783ce2)]</sup><sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup>","source":"ICS","associated_group_id":"2e1aa161-b0c0-431a-b974-735bb781c05a","owner_id":null,"owner_name":null},{"id":"b0669db6-523a-4448-a16c-9ec8c99a9406","name":"DYMALLOY","description":"<sup>[[Dragos DYMALLOY ](https://app.tidalcyber.com/references/d2785c6e-e0d1-4e90-a2d5-2c302176d5d3)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"ICS","associated_group_id":"a9bba2d1-7fc8-43a0-8442-a12cde99329e","owner_id":null,"owner_name":null},{"id":"874b1d29-718b-42ba-a009-6364aa1a25e3","name":"TG-4192","description":"<sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"ICS","associated_group_id":"5d23fa1e-ece1-4111-a5e3-7d9eb3a8c214","owner_id":null,"owner_name":null},{"id":"a97f185e-3556-4099-b84e-d3949aad4c33","name":"IRON LIBERTY","description":"<sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[Secureworks MCMD July 2019](https://app.tidalcyber.com/references/f7364cfc-5a3b-4538-80d0-cae65f3c6592)]</sup><sup>[[Secureworks Karagany July 2019](https://app.tidalcyber.com/references/61c05edf-24aa-4399-8cdf-01d27f6595a1)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"ICS","associated_group_id":"8e252d57-69fb-4e48-a094-838e24fe620e","owner_id":null,"owner_name":null},{"id":"889d8028-cc83-4324-abfa-d8b99aa354fc","name":"Ghost Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"61e1ab6c-9bbe-52ff-b391-b61df037f43a","owner_id":null,"owner_name":null},{"id":"a59fa46f-f6f9-403c-bcc5-f55276a75069","name":"BROMINE","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"893d94fa-a0ff-58ec-ba99-c26274c7e09b","owner_id":null,"owner_name":null},{"id":"3eb0fa57-6328-42cc-9a2f-60479cc81326","name":"Berserk Bear","description":"<sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup><sup>[[DOJ Russia Targeting Critical Infrastructure March 2022](https://app.tidalcyber.com/references/768a0ec6-b767-4044-acad-82834508640f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"ICS","associated_group_id":"3209f44c-6706-4886-aee8-91f2ab14b10d","owner_id":null,"owner_name":null},{"id":"ae43fab0-6c4f-4a3f-a10e-6f2ae9c70202","name":"Crouching Yeti","description":"<sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup><sup>[[DOJ Russia Targeting Critical Infrastructure March 2022](https://app.tidalcyber.com/references/768a0ec6-b767-4044-acad-82834508640f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"ICS","associated_group_id":"8e8f69f2-0bc1-4090-965b-1ee0e1e3cca9","owner_id":null,"owner_name":null},{"id":"d1b3ef04-0fa0-4f7b-a6eb-326b284f9b43","name":"Energetic Bear","description":"<sup>[[Symantec Dragonfly](https://app.tidalcyber.com/references/9514c5cd-2ed6-4dbf-aa9e-1c425e969226)]</sup><sup>[[Secureworks IRON LIBERTY July 2019](https://app.tidalcyber.com/references/c666200d-5392-43f2-9ad0-1268d7b2e86f)]</sup><sup>[[Secureworks MCMD July 2019](https://app.tidalcyber.com/references/f7364cfc-5a3b-4538-80d0-cae65f3c6592)]</sup><sup>[[Secureworks Karagany July 2019](https://app.tidalcyber.com/references/61c05edf-24aa-4399-8cdf-01d27f6595a1)]</sup><sup>[[Gigamon Berserk Bear October 2021](https://app.tidalcyber.com/references/06b6cbe3-8e35-4594-b36f-76b503c11520)]</sup><sup>[[DOJ Russia Targeting Critical Infrastructure March 2022](https://app.tidalcyber.com/references/768a0ec6-b767-4044-acad-82834508640f)]</sup><sup>[[UK GOV FSB Factsheet April 2022](https://app.tidalcyber.com/references/27e7d347-9d85-4897-9e04-33f58acc5687)]</sup>","source":"ICS","associated_group_id":"acc95a06-1553-4f73-a582-f40dc1187b58","owner_id":null,"owner_name":null}],"tags":[{"id":"3e4a37c8-5ba8-4ed2-af3d-42271299b715","tag":"3019470b-4c46-40f5-9633-4d054a28fc46"},{"id":"0115d097-d2a3-435a-8a41-cccbaab0e183","tag":"67c2c863-b87c-4809-8ec5-21375dcf1f2f"},{"id":"9142d6f3-6504-4dab-8a83-1e6e7be7188a","tag":"9ed63cc4-ed9d-4e8f-8297-4a5b6bd66858"},{"id":"d2326254-2893-49bf-944b-d6ec5581fdd1","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"a4509b1b-e541-4f00-bc6d-934bc9e9e343","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"d3f4e972-5639-40d6-95af-31204ddb6eca","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"}],"owner_name":null},{"id":"a58f147b-1f02-427d-a375-c4246335cb20","name":"DragonForce Ransomware Group","source":"Trellix TIG","group_attack_id":"G3008","created":"2025-04-11T15:06:31.379479Z","modified":"2025-04-11T15:06:31.379483Z","tidal_id":"f107bd3b-39bd-510a-8939-a5383a2a26a0","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"bf3b8216-3c9d-4752-ba10-5e09be892838","name":"Curaçao","country_name":"Curaçao","country_code":"CW"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"9130688b-bebf-4c36-9bd0-e0bd11852a8b","name":"Palau","country_name":"Palau","country_code":"PW"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"fec81bf6-334a-45df-b122-1a99fd1654e2","name":"DragonForce","description":"<sup>[[None October 29 2025](/references/3dacc043-780d-46fc-b61b-4be1d1dbdbad)]</sup>","source":"USER","associated_group_id":"6c7fdcf1-c534-455b-aff4-dd18717e2be3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"55cfc271-2c9f-4074-acb1-ca0910935be9","name":"DragonForce Ransomware Cartel","description":"<sup>[[None October 29 2025](/references/3dacc043-780d-46fc-b61b-4be1d1dbdbad)]</sup>","source":"USER","associated_group_id":"dffcb269-b0c4-4f48-9c74-9c17f67d9537","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"69d2b280-ffbe-467a-88bd-9f4dd6667f8e","name":"Water Tambanakua","description":"<sup>[[None October 29 2025](/references/3dacc043-780d-46fc-b61b-4be1d1dbdbad)]</sup>","source":"USER","associated_group_id":"e27a3cc2-d032-45e7-969f-8ab18ee00e17","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"62807fe3-e8e8-4943-9403-202e66542dbb","tag":"e316d257-7351-4868-bae2-579f71282cc2"},{"id":"37e96d30-2159-4772-883b-80a3a6ae31c0","tag":"bce27095-6b06-4746-a8df-136ad13c7833"},{"id":"2c4ea2f5-6706-4c2b-9951-4a5929cef4c4","tag":"27eaae77-7e2d-4ab3-8349-a24134c5f6a9"},{"id":"6cff7871-6a37-46c8-b747-be37548ddca5","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"2d0fea48-ee5d-4391-8ee5-5a7f664e5fa1","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"b7679b6b-8bd6-4562-816c-48ea9a6a36bc","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"8eb9a637-2525-4d8c-a63e-51dfaf91ab44","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"f2c2db08-624c-46b9-b7ed-b22c21b81813","name":"DragonOK","source":"MITRE","group_attack_id":"G0017","created":"2017-05-31T21:31:53.197000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"5ab1501a-44d5-52d7-a4b4-4ec66ec6f005","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"}],"observed_sector":[{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"2ee8f401-679c-455e-bc19-511bacdbffff","name":"DragonRank","source":"Tidal Cyber","group_attack_id":"G3075","created":"2025-02-11T18:20:19.532700Z","modified":"2025-02-11T18:20:19.532704Z","tidal_id":"8fa4341c-8fa3-5a41-a232-020de17adcad","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"79747b2b-179c-4245-bc62-dd6dc188008a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"1849d25a-229f-4e9a-b2cc-8164543eac45","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"4c125417-fe95-4c5b-b57a-41610301d4db","name":"Dr.MwNs","source":"Tidal Cyber","group_attack_id":"G3206","created":"2026-01-23T20:30:06.690232Z","modified":"2026-01-23T20:30:06.690235Z","tidal_id":"e088904f-d56f-5ede-ba40-903d11c36de6","country":[],"observed_motivation":[{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"5ab9467f-4a34-4883-8e8f-2d3b2b3404d1","name":"Bhutan","country_name":"Bhutan","country_code":"BT"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"b22c23ca-eeee-4b78-affa-a91c56b26028","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f1092979-0c15-462e-a06a-e0e875b92d42","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"1313da23-bbc5-4724-a278-fd6ca5e561f0","name":"Earth Lamia","source":"Tidal Cyber","group_attack_id":"G3160","created":"2025-12-10T14:14:12.866112Z","modified":"2025-12-10T14:14:12.866116Z","tidal_id":"97e74f9f-2847-5b6b-83a1-f2fe856fc54d","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"e0be9ec3-e743-4a4c-b16f-8397a41ad6d7","name":"UNC5454","description":"<sup>[[Google Cloud Blog December 12 2025](/references/10558220-d2be-4189-8608-b7bfeccf37e7)]</sup>","source":"USER","associated_group_id":"2d82bd96-b9c7-4f7a-816d-3182aeb1e80d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"c2029189-0bb7-4f1d-bc20-64f809d67ff4","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"140413c4-75d2-4443-920f-2aa0c31e61a8","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"b9268e56-a953-4e6b-850b-c07f442e1e34","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"646e35d2-75de-4c1d-8ad3-616d3e155c5e","name":"Earth Lusca","source":"MITRE","group_attack_id":"G1006","created":"2022-07-01T20:12:30.184000Z","modified":"2022-10-17T19:51:56.531000Z","tidal_id":"ac903157-86db-585e-bd0f-9a8ae56199cd","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"e6b6aa2b-5da1-4cbf-9622-8d38a8b4433d","name":"TAG-22","description":"<sup>[[Recorded Future TAG-22 July 2021](https://app.tidalcyber.com/references/258433e7-f829-4365-adbb-c5690159070f)]</sup>","source":"MITRE","associated_group_id":"f52f1ae7-3df5-479c-b487-b214c2946fe3","owner_id":null,"owner_name":null},{"id":"d9cdee92-5559-41d2-a324-a71a910e7fb4","name":"Charcoal Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"34f00eb2-bd44-5b8f-8c7d-bae2c3ab241a","owner_id":null,"owner_name":null},{"id":"1237b4ee-122e-549f-aa96-3522794e45dd","name":"ControlX","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"68300981-5bc3-5eea-8013-1fd745e906e4","owner_id":null,"owner_name":null},{"id":"c1d3e399-8959-57ed-beb0-db3ccb6aed8a","name":"Charcoal Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"34f00eb2-bd44-5b8f-8c7d-bae2c3ab241a","owner_id":null,"owner_name":null},{"id":"3ba0cbd9-3d93-5f94-bcb9-feb3cfe1c5f9","name":"CHROMIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup> <sup>[[Recorded Future RedHotel August 2023](https://app.tidalcyber.com/references/006715e1-9354-51aa-812b-21a33a37ebb4)]</sup>","source":"MITRE","associated_group_id":"4c302b2d-679a-53bc-820c-95e27a90faf4","owner_id":null,"owner_name":null},{"id":"1b0769f5-658e-4858-a867-900646e20c97","name":"TAG-22","description":"<sup>[[Recorded Future TAG-22 July 2021](https://app.tidalcyber.com/references/258433e7-f829-4365-adbb-c5690159070f)]</sup>","source":"Mobile","associated_group_id":"f52f1ae7-3df5-479c-b487-b214c2946fe3","owner_id":null,"owner_name":null},{"id":"7434e442-2b16-4188-8a6b-0a1b45a28b8d","name":"CHROMIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup> <sup>[[Recorded Future RedHotel August 2023](https://app.tidalcyber.com/references/006715e1-9354-51aa-812b-21a33a37ebb4)]</sup>","source":"Mobile","associated_group_id":"4c302b2d-679a-53bc-820c-95e27a90faf4","owner_id":null,"owner_name":null},{"id":"a2c3e214-4681-445b-a7a5-d3a41ffaabed","name":"ControlX","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"68300981-5bc3-5eea-8013-1fd745e906e4","owner_id":null,"owner_name":null}],"tags":[{"id":"dc345df7-9cc8-446b-9617-fc358f48a890","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"}],"owner_name":null},{"id":"016314dc-9707-4e9d-85a0-37b6c95a131f","name":"EC2 Grouper","source":"Tidal Cyber","group_attack_id":"G3120","created":"2025-08-28T19:35:28.467664Z","modified":"2025-08-28T19:35:28.467668Z","tidal_id":"1f6edbc5-7ee3-5e9a-bd51-033722c7345d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"ec3427bd-8a59-4fc1-bef6-a0a56e2b3aef","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"51cba7e2-2b36-4d40-a1bf-463b8494a062","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"fb44234c-bde4-4462-9370-4c04233e55ed","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"51146bb6-7478-44a3-8f08-19adcdceffca","name":"Elderwood","source":"MITRE","group_attack_id":"G0066","created":"2018-04-18T17:59:24.739000Z","modified":"2021-03-02T22:40:11.097000Z","tidal_id":"76fe0b0c-539c-5207-8c6a-666e805125ee","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"8c302bb7-2c76-43dc-a048-7fbc713ca7e7","name":"Beijing Group","description":"<sup>[[CSM Elderwood Sept 2012](https://app.tidalcyber.com/references/6b79006d-f6de-489c-82fa-8c3c28d652ef)]</sup>","source":"MITRE","associated_group_id":"a34e5489-2c79-4363-8cbb-2073f310cadc","owner_id":null,"owner_name":null},{"id":"54f3da5e-7868-4b0b-892a-86ee9356e5a5","name":"Elderwood Gang","description":"<sup>[[Symantec Elderwood Sept 2012](https://app.tidalcyber.com/references/5e908748-d260-42f1-a599-ac38b4e22559)]</sup> <sup>[[CSM Elderwood Sept 2012](https://app.tidalcyber.com/references/6b79006d-f6de-489c-82fa-8c3c28d652ef)]</sup>","source":"MITRE","associated_group_id":"512f83c6-b369-4d53-82b6-5b27f60e970e","owner_id":null,"owner_name":null},{"id":"cd3eeeed-e0ef-49f7-9eb9-df6a53a43256","name":"Sneaky Panda","description":"<sup>[[CSM Elderwood Sept 2012](https://app.tidalcyber.com/references/6b79006d-f6de-489c-82fa-8c3c28d652ef)]</sup>","source":"MITRE","associated_group_id":"54369a73-2715-48b3-8897-26380a48683e","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"26e1c52e-0c48-4cd0-bdc5-9cf981a6e714","name":"Eldorado Ransomware Operators","source":"Tidal Cyber","group_attack_id":"G3045","created":"2024-07-19T15:48:15.190911Z","modified":"2024-07-19T15:48:15.190916Z","tidal_id":"557fc96e-9443-5678-af50-7f874a5af66c","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"}],"associated_groups":[],"tags":[{"id":"bbeeb47f-3d4e-44d9-b5c0-481c4bf9d51c","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"997441de-02c4-45a1-9ab4-6029f6fc7386","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"343d414f-1a02-45ca-bded-c90c0a865b0f","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"f232ad29-8e0e-413a-90b4-388771d47cff","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"5b65e21a-4e52-4aee-bc09-389814c267a9","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"9844b5bb-0beb-41ee-885f-a05a6541f0aa","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"bde55a6d-ebee-420a-8529-81068f7ab053","name":"ELUSIVE COMET","source":"Tidal Cyber","group_attack_id":"G3099","created":"2025-05-06T16:28:55.388556Z","modified":"2025-05-06T16:28:55.388560Z","tidal_id":"bb7dc648-5dbb-5658-ae08-2282c5aa1d5f","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"910d593b-2e78-422a-adaf-9ea64cc10a24","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"},{"id":"fa443dd1-caed-486e-a640-371c205c9b24","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f0bc2fa2-1916-422e-9004-7c5d1a750b71","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"407274be-1820-4a84-939e-629313f4de1d","name":"Ember Bear","source":"MITRE","group_attack_id":"G1003","created":"2022-06-09T14:49:57.704000Z","modified":"2022-10-14T15:03:19.292000Z","tidal_id":"2a5f2684-bd0c-55ed-a53f-e24eb1c01d5a","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"b8798ba6-d539-4478-afea-f31a15a4682e","name":"GRU Unit 29155","description":"<sup>[[Arctic Wolf November 25 2025](/references/24a1832e-ffc5-4504-8e47-32ba0be97b0c)]</sup>","source":"USER","associated_group_id":"c37fdc4c-7e89-4792-b95b-7a5a84a3a902","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4a7db661-c335-5e39-8360-49e95fca489e","name":"Frozenvista","description":"<sup>[[CISA GRU29155 2024](https://app.tidalcyber.com/references/c4dba764-d864-59bf-a80d-f1263bc904e4)]</sup>","source":"MITRE","associated_group_id":"c83a2878-2609-57c0-8c7f-ca6656603235","owner_id":null,"owner_name":null},{"id":"ccd6ab1f-5b71-4764-8f66-541a4ea33caf","name":"GRU 161st Specialist Training Center","description":"<sup>[[Arctic Wolf November 25 2025](/references/24a1832e-ffc5-4504-8e47-32ba0be97b0c)]</sup>","source":"USER","associated_group_id":"7afc191d-c960-4722-853f-2fa10df3ec8e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"cef9334a-c8c2-4e6f-9d1f-69885568a767","name":"Bleeding Bear","description":"<sup>[[CrowdStrike Ember Bear Profile March 2022](https://app.tidalcyber.com/references/0639c340-b495-4d91-8418-3069f3fe0df1)]</sup>","source":"MITRE","associated_group_id":"097d6980-041e-42b0-b1b0-219f70381167","owner_id":null,"owner_name":null},{"id":"4f5d4021-268c-4677-9063-0a06648c3851","name":"UAC-0056","description":"<sup>[[CISA GRU29155 2024](https://app.tidalcyber.com/references/c4dba764-d864-59bf-a80d-f1263bc904e4)]</sup>","source":"MITRE","associated_group_id":"00c980c7-47ad-409d-bb62-374e5a078de8","owner_id":null,"owner_name":null},{"id":"03cc70c2-3404-59b8-9f90-729180205b82","name":"Cadet Blizzard","description":"<sup>[[Cadet Blizzard emerges as novel threat actor](https://app.tidalcyber.com/references/7180c6a7-e6ea-54bf-bcd7-c5238bbc5f5b)]</sup>","source":"MITRE","associated_group_id":"d0e5ff3f-386f-5cd9-809e-392e36836e5c","owner_id":null,"owner_name":null},{"id":"ec701dbc-762d-5832-9312-0ad1b141d1b0","name":"DEV-0586","description":"<sup>[[Cadet Blizzard emerges as novel threat actor](https://app.tidalcyber.com/references/7180c6a7-e6ea-54bf-bcd7-c5238bbc5f5b)]</sup>","source":"MITRE","associated_group_id":"13dc501f-1380-5772-976b-6114651ac6a8","owner_id":null,"owner_name":null},{"id":"9fba3deb-1539-42b6-b10a-b12309cf0726","name":"UNC2589","description":"<sup>[[Mandiant UNC2589 March 2022](https://app.tidalcyber.com/references/63d89139-9dd4-4ed6-bf6e-8cd872c5d034)]</sup>","source":"MITRE","associated_group_id":"d3f83fae-e133-4e00-a53b-f881f0a1f6e0","owner_id":null,"owner_name":null}],"tags":[{"id":"f98ec55b-3a80-444a-99bd-d9bff529c531","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"526ff5c9-606d-4f4f-91a9-885d8fff8b02","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"7fa8992b-e08f-4ea0-8352-6b47fb85b9b5","tag":"d8f7e071-fbfd-46f8-b431-e241bb1513ac"},{"id":"bb8e8062-3de6-4ed3-a6cd-863f228d98c8","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"9bbc2078-6fac-405d-ad04-ebefd048d9b8","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"26c4ad77-3d9c-4086-9a49-39dfdd306201","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"801107fd-a2a9-4f14-9569-4f10eb28011e","tag":"5b8371c5-1173-4496-82c7-5f0433987e77"},{"id":"b50ff58c-1a08-44ba-9a1e-32d5445408e7","tag":"f18e6c1d-d2ee-4eda-8172-67dcbc4e59ed"},{"id":"365c2b81-5ef2-456e-853c-0c43fb722a50","tag":"9e4936f0-e3b7-4721-a638-58b2d093b2f2"},{"id":"820f438a-a3ae-4f1f-bd07-461afe23fadb","tag":"1281067e-4a7e-4003-acf8-e436105bf395"},{"id":"5d3a3780-57e2-4348-9f9a-6f617d9ff2f7","tag":"7c67d99a-fc8a-4463-8f46-45e9a39fe6b0"},{"id":"072c27f1-796c-419d-aafa-86e74f755523","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"b277240a-1481-4994-bc4d-ce42fc368455","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"}],"owner_name":null},{"id":"ff71ddce-9e70-4aeb-b7df-9d1637be72bc","name":"ENVOY PANDA","source":"Tidal Cyber","group_attack_id":"G3086","created":"2025-03-04T15:55:08.162307Z","modified":"2025-03-04T15:55:08.162311Z","tidal_id":"559a5c0b-f4b3-5828-a97c-79dbb5eb526f","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"d7051307-aac2-4755-9fa9-0e8450adab06","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"34c0bb6d-5be1-4926-a30e-1186bb87ed95","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a4704485-65b5-49ec-bebe-5cc932362dd2","name":"Equation","source":"MITRE","group_attack_id":"G0020","created":"2017-05-31T21:31:54.697000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"a66300f9-c5ce-51c8-93c9-a44fea6d0b2d","country":[],"observed_motivation":[],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"d1aa288d-a353-4ca4-aacf-1a4192e5dc83","name":"Libya","country_name":"Libya","country_code":"LY"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"8faae3de-c64e-4d6f-a226-669f773e4341","name":"Mali","country_name":"Mali","country_code":"ML"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"5237c9b3-b0d1-4979-98d9-8ff0decd3d16","name":"Palestine, State of","country_name":"Palestine","country_code":"PS"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"e668b258-9408-499a-9eb9-5c81e6380ab7","name":"Somalia","country_name":"Somalia","country_code":"SO"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"3d817851-539b-44a3-8585-44b897d22941","name":"Sudan","country_name":"Sudan","country_code":"SD"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"2a528093-177d-468f-a83b-e270ca22f0ab","name":"Syrian Arab Republic","country_name":"Syrian Arab Republic","country_code":"SY"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"856c10c6-a475-4bbf-8f1d-1e06ccff8f2e","name":"Yemen","country_name":"Yemen","country_code":"YE"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"e22186de-4882-4813-9ea8-2eac4b6e6370","tag":"a98d7a43-f227-478e-81de-e7299639a355"}],"owner_name":null},{"id":"6636ab8d-871f-4353-a1a5-81c8d7cacca4","name":"Everest Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3106","created":"2025-06-10T15:50:37.008124Z","modified":"2025-06-10T15:50:37.008126Z","tidal_id":"ec6994cc-3e14-5103-a206-5a3f75b76770","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"a1cd0bde-6c95-4e9b-8bc9-a4c9dfd629ae","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"edb04234-63b3-4778-9a5a-0f78318a8937","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"84c41059-ff78-4375-bd40-41ad7b008656","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"2e210559-dcf8-4de3-b989-0125a422256e","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3731c13a-67d4-4ac4-841d-9623a5e0b303","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"4bdc62c9-af6a-4377-8431-58a6f39235dd","name":"Evilnum","source":"MITRE","group_attack_id":"G0120","created":"2021-01-22T16:46:17.790000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"c761466c-30aa-51ab-8ee7-d8d4f11947f1","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"396a4361-3e84-47bc-9544-58e287c05799","name":"EXOTIC LILY","source":"MITRE","group_attack_id":"G1011","created":"2022-08-18T15:25:59.689000Z","modified":"2022-10-13T17:54:09.402000Z","tidal_id":"4fc453ab-c644-5cda-9e8d-16a913d3e8cb","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"b4b389ad-6761-4153-9c01-22ec67b96e80","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"856b0de4-89c7-4db9-8a77-8dc469743222","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"73001b5e-fcc5-4902-8c98-a1d5a0e3c2c2","name":"Famous Chollima","source":"Tidal Cyber","group_attack_id":"G3102","created":"2025-06-03T14:14:27.800267Z","modified":"2025-06-03T14:14:27.800271Z","tidal_id":"dd910cc0-9feb-5038-a0b9-783cd5cd551a","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"c07491c5-107b-4e32-b948-54968505e8f0","name":"NICKEL TAPESTRY","description":"<sup>[[The Hacker News Nickel Tapestry October 20 2024](/references/43a8823e-e213-49a2-a3a3-80a9cc534706)]</sup>","source":"Tidal Cyber","associated_group_id":"7ae9a89b-0332-4f4e-961a-dd6c49151532","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9995eeaf-9a8a-40e2-ae9e-bec90aee0c1c","name":"Contagious Interview Actors","description":"<sup>[[NVISO Labs November 13 2025](/references/f298523a-6f0e-4699-8dd2-cd1d6b48297c)]</sup>","source":"USER","associated_group_id":"4b390cd7-9e7b-4af4-9803-14e6f43e19dc","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6a7a0f0e-e3e1-4c78-b1ea-8f37e089bfab","name":"North Korean Threat Actors","description":"<sup>[[NVISO Labs November 13 2025](/references/f298523a-6f0e-4699-8dd2-cd1d6b48297c)]</sup>","source":"USER","associated_group_id":"7d866712-df5b-425a-ab4b-17c13e712172","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"10742d99-e189-4eed-8dab-bc2e053a723d","name":"DPRK Job Lure","description":"<sup>[[NVISO Labs November 13 2025](/references/f298523a-6f0e-4699-8dd2-cd1d6b48297c)]</sup>","source":"USER","associated_group_id":"057f7bb8-ec9a-4ad5-a582-06ef46771782","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8d4650e6-64b5-44ed-9934-fe70f9560b2d","name":"Storm-0287","description":"<sup>[[Secureworks NICKEL TAPESTRY](/references/fc16e509-fb76-4f56-9ad0-2031629c5ca4)]</sup>","source":"Tidal Cyber","associated_group_id":"59e08e34-e34e-434e-80d9-6af7e40600b1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8e813edf-670e-426e-abde-6540fe85017b","name":"CL-STA-0241","description":"<sup>[[Unit 42 November 21 2023](/references/930228c3-a93b-4664-ab7d-65af212211fc)]</sup>","source":"Tidal Cyber","associated_group_id":"0dc2690f-4a3b-4c2d-8404-c696e4d18b46","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"24060b72-93c7-4c09-ae2a-ed5c6930475a","name":"Contagious Interview","description":"<sup>[[Silent Push Contagious Interview April 24 2025](/references/7062304e-91e9-45bf-84b4-c42bdad99e23)]</sup>","source":"Tidal Cyber","associated_group_id":"5162e66c-f383-4bd5-885a-cc58e90d6297","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ed55cf27-e400-49a5-a963-83be74813936","name":"BlockNovas LLC","description":"<sup>[[Silent Push Contagious Interview April 24 2025](/references/7062304e-91e9-45bf-84b4-c42bdad99e23)]</sup>","source":"Tidal Cyber","associated_group_id":"99d30b8e-1785-4bc4-a4ec-4594cafebfe3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"148f503c-6d43-44ff-a24f-f67e3e295da8","name":"Angeloper Agency","description":"<sup>[[Silent Push Contagious Interview April 24 2025](/references/7062304e-91e9-45bf-84b4-c42bdad99e23)]</sup>","source":"Tidal Cyber","associated_group_id":"7e8fa849-4609-410e-8b39-e9d053303ee3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4bc99e9f-27cf-4ebf-95a4-edb7c9e6ea9c","name":"SoftGlide LLC","description":"<sup>[[Silent Push Contagious Interview April 24 2025](/references/7062304e-91e9-45bf-84b4-c42bdad99e23)]</sup>","source":"Tidal Cyber","associated_group_id":"3c7ec3d8-f6b3-448d-a4db-fd091b13b329","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"10d3e396-5e1b-4fda-b55b-273d70fd4df5","name":"CL-STA-0240","description":"<sup>[[The Hacker News Contagious Interview April 25 2025](/references/68d9fec5-40b0-414a-9d39-21b5f36a013b)]</sup>","source":"Tidal Cyber","associated_group_id":"79f4d13e-72f6-417c-85b5-0b967a9fc3de","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1801f15d-1777-457d-a13e-9e84afb922f6","name":"DeceptiveDevelopment","description":"<sup>[[The Hacker News Contagious Interview April 25 2025](/references/68d9fec5-40b0-414a-9d39-21b5f36a013b)]</sup>","source":"Tidal Cyber","associated_group_id":"ff18e82f-ce0f-403e-ad1d-57a37a76a313","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6d296b22-7a74-4d99-bff1-336a75610ded","name":"DEV#POPPER","description":"<sup>[[The Hacker News Contagious Interview April 25 2025](/references/68d9fec5-40b0-414a-9d39-21b5f36a013b)]</sup>","source":"Tidal Cyber","associated_group_id":"16538454-1322-4c14-90fa-57d2a9f8b9aa","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"81c0812e-e53d-4509-bfc6-d60d1c48fced","name":"UNC5342","description":"<sup>[[The Hacker News Contagious Interview April 25 2025](/references/68d9fec5-40b0-414a-9d39-21b5f36a013b)]</sup>","source":"Tidal Cyber","associated_group_id":"8c0c098b-ea06-4840-b13b-cfd5ac421755","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3a81a01b-4ac1-411b-90ea-dcd9daf952f7","name":"Void Dokkaebi","description":"<sup>[[The Hacker News Contagious Interview April 25 2025](/references/68d9fec5-40b0-414a-9d39-21b5f36a013b)]</sup>","source":"Tidal Cyber","associated_group_id":"198ff57a-5697-4344-9f2c-78fde3fe6c37","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6a52e0c8-726c-42e2-ab3c-aed302d29de6","name":"WaterPlum","description":"<sup>[[NTT Security Holdings May 8 2025](/references/e42d25ec-c31d-41e4-8d86-d46a7bccd0c8)]</sup>","source":"Tidal Cyber","associated_group_id":"72518fb1-8054-412e-afe3-71fa941d73e1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1cbfca9a-7636-431e-8a3b-14198656fe20","name":"PurpleBravo","description":"<sup>[[Recorded Future PurpleBravo February 13 2025](/references/8a00f5cc-04ee-4999-a455-f26675921457)]</sup>","source":"Tidal Cyber","associated_group_id":"7ca97a08-1065-421a-9d2b-132eabfa76ac","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c90c1927-aa05-4f73-831a-4cbc4c1893d1","name":"TAG-120","description":"<sup>[[Recorded Future PurpleBravo February 13 2025](/references/8a00f5cc-04ee-4999-a455-f26675921457)]</sup>","source":"Tidal Cyber","associated_group_id":"8b5986cf-2547-44a3-aafd-8ccd297cc532","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e2e23d79-0a80-483b-a285-7b3232609c5d","name":"Tenacious Pungsan","description":"<sup>[[The Hacker News Hidden Risk November 7 2024](/references/0d575ac7-fa23-4c92-a567-494eeadb4259)]</sup>","source":"Tidal Cyber","associated_group_id":"4446cfe9-dc23-49fb-87b8-9a18dfe46441","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a8dd7c08-41c2-4487-8a7f-4dc200fa0a2c","name":"Wagemole","description":"<sup>[[The Hacker News Hidden Risk November 7 2024](/references/0d575ac7-fa23-4c92-a567-494eeadb4259)]</sup>","source":"Tidal Cyber","associated_group_id":"46685cdc-52d7-4227-a364-c99f4983d929","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ff7d6803-6bc5-4cf3-857b-2d1e441ef61e","name":"UNC5267","description":"<sup>[[The Hacker News Hidden Risk November 7 2024](/references/0d575ac7-fa23-4c92-a567-494eeadb4259)]</sup>","source":"Tidal Cyber","associated_group_id":"b7a6e681-9d2f-4cd0-815c-f657ea21caf3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"59885a60-3ed4-4288-8605-5ae22d8ea572","name":"Jasper Sleet","description":"Alias: Secureworks lists Storm-0287 as an alias of the entity they track as NICKEL TAPESTRY (another alias of which is Famous Chollima).<sup>[[Microsoft Security Blog June 30 2025](/references/3300c819-e236-40a2-a886-ce460876a2ca)]</sup> Microsoft indicates that Jasper Sleet is the current name for the entity previously tracked as Storm-0287.<sup>[[Secureworks NICKEL TAPESTRY](/references/fc16e509-fb76-4f56-9ad0-2031629c5ca4)]</sup>","source":"Tidal Cyber","associated_group_id":"48562967-1c0e-4728-a025-3ec8d515115a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"67f3d7f7-0244-4396-8de8-42a35337ff27","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"9924ad3e-6e80-47bb-8042-deaaf25896bb","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"},{"id":"a3c29839-e352-4c08-a26a-377faf4f9d7e","tag":"dae3e667-b5db-4063-aaae-8e8e0b8127a0"},{"id":"4a825e6b-a9f5-427a-9d3e-471eb974e2f9","tag":"c16092ee-468a-4935-8ee1-18bd423ecc52"},{"id":"482772d7-bb97-4fe2-ae8b-524538c3ea79","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"fa84fd22-f831-4322-9017-2a851c59dd74","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"155dac3e-27fc-43bd-812b-9f4c00b7e3d3","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"ffdb73e8-ba24-4981-b0df-3d3d9d61a5b8","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"275ca7b0-3b21-4c3a-8b6f-57b6f0ffb6fb","name":"Ferocious Kitten","source":"MITRE","group_attack_id":"G0137","created":"2021-09-28T17:41:12.950000Z","modified":"2021-10-25T14:28:10.337000Z","tidal_id":"96e4a04f-e04b-5609-9709-467298772b07","country":[],"observed_motivation":[],"observed_country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"345e553a-164d-4c9d-8bf9-19fcf8a51533","name":"FIN10","source":"MITRE","group_attack_id":"G0051","created":"2017-12-14T16:46:06.044000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"b4f2a7a2-2efa-53f0-a1ed-01aae4bd5849","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"ecdbd431-d62b-4b30-8663-b1ecb4304ec0","name":"FIN11","source":"Tidal Cyber","group_attack_id":"G3011","created":"2024-06-13T20:11:16.010363Z","modified":"2024-06-13T20:11:16.010366Z","tidal_id":"2babed57-a7f7-55b1-a768-402f6ea08c97","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[{"id":"fb557c05-b55a-4e3b-9945-d42337bd62f7","name":"UNC4857","description":"<sup>[[Mandiant MOVEit Transfer June 2 2023](/references/232c7555-0483-4a57-88cb-71a990f7d683)]</sup>","source":"Tidal Cyber","associated_group_id":"42b51e3b-334b-47ed-a4c7-077513842d17","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"01df3f5a-397b-4cc7-9056-322de7771d11","name":"Lace Tempest","description":"<sup>[[The DFIR Report Truebot June 12 2023](/references/a6311a66-bb36-4cad-a98f-2b0b89aafa3d)]</sup><sup>[[Microsoft Threat Intelligence Tweet April 26 2023](/references/3b5a2349-e10c-422b-91e3-20e9033fdb60)]</sup>","source":"Tidal Cyber","associated_group_id":"34515c47-85d2-457b-9ecd-4b3c7270dda3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"94652414-ac82-4ad5-a563-40c15166304f","name":"DEV-0950","description":"<sup>[[Microsoft Threat Intelligence Tweet April 26 2023](/references/3b5a2349-e10c-422b-91e3-20e9033fdb60)]</sup>","source":"Tidal Cyber","associated_group_id":"c1171e19-e023-429f-9b88-76755857b891","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"cf2f54c4-ca55-4859-9a61-0b7a2ab29df4","tag":"b18b5401-d88d-4f28-8f50-a884a5e58349"},{"id":"0a08e7c2-00ee-489a-aac9-592162f1512a","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"6ef057f5-fc2d-4a2c-b336-121b444c947b","tag":"f513f863-5910-4e32-ab1c-c7b118cb5f41"},{"id":"e2378638-b872-49cb-8570-c35f8d9f054b","tag":"d9c05db7-e2eb-45da-b468-17d8c5fb6394"},{"id":"1fe7d477-85d9-434f-9d13-1ed325a956ed","tag":"241d20a1-bda4-469b-854a-10113e64387d"},{"id":"10677723-a5c0-45f3-afc1-3612912ec0d8","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a9a860db-4e2d-4019-b093-42371a4d33c4","tag":"173e1480-8d9b-49c5-854d-594dde9740d6"},{"id":"8e2fd005-cad1-468a-934c-fc99fe64736c","tag":"1b5da77a-bf84-4fba-a6d7-8b3b8f7699e0"},{"id":"a515e8b7-c1a7-4c68-86bb-bab00d133c1c","tag":"992bdd33-4a47-495d-883a-58010a2f0efb"},{"id":"c028009e-42f6-40ea-a299-e0fd780906e9","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"b01a599a-0180-4b98-9934-684df22799ca","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"dbc7d070-4762-4693-bbc6-acc1451be2db","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6d6ed42c-760c-4964-a81e-1d4df06a8800","name":"FIN12","source":"Tidal Cyber","group_attack_id":"G3005","created":"2023-09-22T15:01:31.058611Z","modified":"2023-09-22T15:01:31.058618Z","tidal_id":"76be2dd0-0ea7-5a2a-b851-efe78f59f6e7","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"ec5a430a-ab92-42f4-bf3d-6298ceaf3a3e","name":"Papua New Guinea","country_name":"Papua New Guinea","country_code":"PG"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"57ff5c34-56d3-4499-a0ba-05a8bee6e810","name":"Pistachio Tempest","description":"<sup>[[CERTFR-2023-CTI-007](/references/0f4a03c5-79b3-418e-a77d-305d5a32caca)]</sup>","source":"Tidal Cyber","associated_group_id":"4a4dfd05-0243-4a4d-a4f5-043a8098034d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"78f3efbd-e45d-4a97-b088-bbb3dded5e87","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"820d499a-7092-46ea-bcef-eed3809a64da","tag":"2743d495-7728-4a75-9e5f-b64854039792"},{"id":"8f10686a-206b-4334-af73-869d7e825bd9","tag":"ecd84106-2a5b-4d25-854e-b8d1f57f6b75"},{"id":"5a633a2c-c016-4a63-b9ed-8faecb892b71","tag":"a6ba64e1-4b4a-4bbd-a26d-ce35c22b2530"},{"id":"c9d2a4dd-114c-4056-b198-0ca8386263e2","tag":"4bc9ab8f-7f57-4b1a-8857-ffaa7e5cc930"},{"id":"ff77c9de-05b8-4a45-bba9-04e011c7e7c9","tag":"d385b541-4033-48df-93cd-237ca6e46f36"}],"owner_name":"TidalCyberIan"},{"id":"570198e3-b59c-5772-b1ee-15d7ea14d48a","name":"FIN13","source":"MITRE","group_attack_id":"G1016","created":"2023-11-07T00:35:52.916490Z","modified":"2023-11-07T00:35:52.916493Z","tidal_id":"fafee2f0-5939-51e6-8f41-7e28ffcdace4","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"}],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[{"id":"f6570076-cfe5-5979-8e8a-ff8a17ca18b7","name":"Elephant Beetle","description":"<sup>[[Sygnia Elephant Beetle Jan 2022](https://app.tidalcyber.com/references/932897a6-0fa4-5be3-bf0b-20d6ddad238e)]</sup>","source":"MITRE","associated_group_id":"0bf8168b-e8b6-547b-ba47-a500a4f64a5b","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"4b6531dc-5b29-4577-8b54-fa99229ab0ca","name":"FIN4","source":"MITRE","group_attack_id":"G0085","created":"2019-01-31T02:01:45.129000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"8693aaca-88eb-577a-a11d-50dd8b748cde","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"7902f5cc-d6a5-4a57-8d54-4c75e0c58b83","name":"FIN5","source":"MITRE","group_attack_id":"G0053","created":"2018-01-16T16:13:52.465000Z","modified":"2021-10-16T19:48:37.809000Z","tidal_id":"0e366648-40a7-5b7d-b918-562fa98121d6","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"fcaadc12-7c17-4946-a9dc-976ed610854c","name":"FIN6","source":"MITRE","group_attack_id":"G0037","created":"2017-05-31T21:32:06.015000Z","modified":"2022-06-02T20:11:01.957000Z","tidal_id":"e2ab496d-2ed7-5ec4-9d6a-fbb854de4068","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"},{"id":"6c81c742-07a2-4540-8873-7b2fac9ec47e","name":"Organizational Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[{"id":"9f03f902-385c-4206-84f9-8b400d46f8c6","name":"Skeleton Spider","description":"<sup>[[Crowdstrike Global Threat Report Feb 2018](https://app.tidalcyber.com/references/6c1ace5b-66b2-4c56-9301-822aad2c3c16)]</sup>","source":"MITRE","associated_group_id":"b7091e08-25be-44de-a445-d81ca9fdc073","owner_id":null,"owner_name":null},{"id":"49613f19-cdb5-4063-a2b3-df60c9750723","name":"Magecart Group 6","description":"<sup>[[Security Intelligence ITG08 April 2020](https://app.tidalcyber.com/references/32569f59-14fb-4581-8a42-3bf49fb189e9)]</sup>","source":"MITRE","associated_group_id":"5b35e532-aaed-4e3b-bb9f-452e3c7fa8bb","owner_id":null,"owner_name":null},{"id":"81937cf7-c508-4b03-a184-2ed3bf2b153d","name":"ITG08","description":"<sup>[[Security Intelligence More Eggs Aug 2019](https://app.tidalcyber.com/references/f0a0286f-adb9-4a6e-85b5-5b0f45e6fbf3)]</sup>","source":"MITRE","associated_group_id":"6e65d12f-a1d8-4f49-9e47-c6a58f950e7f","owner_id":null,"owner_name":null},{"id":"58511006-653c-5504-841d-518bbbef9a00","name":"Camouflage Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"3ca6e70e-a7d0-53f5-a1cf-44241f62d775","owner_id":null,"owner_name":null},{"id":"49506e98-b9b4-50ce-a410-cf1b9a09cded","name":"TAAL","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"9285d6dc-883b-5c51-b5a6-8de9ba14c2b3","owner_id":null,"owner_name":null},{"id":"5f1587a2-1cb3-426b-bdf8-a4df90da16f6","name":"Magecart Group 6","description":"<sup>[[Security Intelligence ITG08 April 2020](https://app.tidalcyber.com/references/32569f59-14fb-4581-8a42-3bf49fb189e9)]</sup>","source":"ICS","associated_group_id":"5b35e532-aaed-4e3b-bb9f-452e3c7fa8bb","owner_id":null,"owner_name":null},{"id":"9b4d7cc0-fd9e-4bd4-8490-9c83c618063e","name":"ITG08","description":"<sup>[[Security Intelligence More Eggs Aug 2019](https://app.tidalcyber.com/references/f0a0286f-adb9-4a6e-85b5-5b0f45e6fbf3)]</sup>","source":"ICS","associated_group_id":"6e65d12f-a1d8-4f49-9e47-c6a58f950e7f","owner_id":null,"owner_name":null},{"id":"7c47a058-aa44-4fab-b1b6-8a14d2ccdf25","name":"Skeleton Spider","description":"<sup>[[Crowdstrike Global Threat Report Feb 2018](https://app.tidalcyber.com/references/6c1ace5b-66b2-4c56-9301-822aad2c3c16)]</sup>","source":"ICS","associated_group_id":"b7091e08-25be-44de-a445-d81ca9fdc073","owner_id":null,"owner_name":null},{"id":"f13b5cce-8a07-4ac1-b87c-4e60e89e8664","name":"TAAL","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"9285d6dc-883b-5c51-b5a6-8de9ba14c2b3","owner_id":null,"owner_name":null},{"id":"089938a2-072e-4587-8450-65069849a438","name":"Camouflage Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"3ca6e70e-a7d0-53f5-a1cf-44241f62d775","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"4348c510-50fc-4448-ab8d-c8cededd19ff","name":"FIN7","source":"MITRE","group_attack_id":"G0046","created":"2017-05-31T21:32:09.460000Z","modified":"2022-07-20T20:06:44.706000Z","tidal_id":"5519b851-8985-50d5-b352-961b9621c32d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"},{"id":"6c81c742-07a2-4540-8873-7b2fac9ec47e","name":"Organizational Gain"}],"observed_country":[{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"856c10c6-a475-4bbf-8f1d-1e06ccff8f2e","name":"Yemen","country_name":"Yemen","country_code":"YE"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"35eb1977-d260-4526-8248-289aa4a8a67a","name":"GOLD NIAGARA","description":"<sup>[[Secureworks GOLD NIAGARA Threat Profile](https://app.tidalcyber.com/references/b11276cb-f6dd-4e91-90cd-9c287fb3e6b1)]</sup>","source":"MITRE","associated_group_id":"89f19c2d-3449-4c67-9f1b-710217bc2a6f","owner_id":null,"owner_name":null},{"id":"02638e6a-1ed5-4ada-88f8-fd5cea55c5c1","name":"Carbon Spider","description":"<sup>[[CrowdStrike Carbon Spider August 2021](https://app.tidalcyber.com/references/36f0ddb0-94af-494c-ad10-9d3f75d1d810)]</sup>","source":"MITRE","associated_group_id":"7bdc9be3-109a-42e5-88ff-6260c6407478","owner_id":null,"owner_name":null},{"id":"54936570-d1d3-5078-9e5c-c38be5e18f3a","name":"ELBRUS","description":"<sup>[[Microsoft Ransomware as a Service](https://app.tidalcyber.com/references/833018b5-6ef6-5327-9af5-1a551df25cd2)]</sup>","source":"MITRE","associated_group_id":"f7c0eb40-313c-5bc0-9cdb-3cbd9f2c6f70","owner_id":null,"owner_name":null},{"id":"11f12a48-2f04-5276-a31a-825967c3a411","name":"Sangria Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"e3626ef5-7e82-5b17-86ed-7266d38e0352","owner_id":null,"owner_name":null},{"id":"c91ddd70-0a48-4185-bc9c-bb3ca66bf365","name":"ITG14","description":"ITG14 shares campaign overlap with [FIN7](https://app.tidalcyber.com/groups/4348c510-50fc-4448-ab8d-c8cededd19ff).<sup>[[IBM Ransomware Trends September 2020](https://app.tidalcyber.com/references/eb767436-4a96-4e28-bd34-944842d7593e)]</sup>","source":"MITRE","associated_group_id":"f67c4cea-6f4e-43c9-ab46-2075a57c4aaf","owner_id":null,"owner_name":null},{"id":"ec156de9-0d91-49dc-a1b9-f9331b653f30","name":"ITG14","description":"ITG14 shares campaign overlap with [FIN7](https://app.tidalcyber.com/groups/4348c510-50fc-4448-ab8d-c8cededd19ff).<sup>[[IBM Ransomware Trends September 2020](https://app.tidalcyber.com/references/eb767436-4a96-4e28-bd34-944842d7593e)]</sup>","source":"ICS","associated_group_id":"f67c4cea-6f4e-43c9-ab46-2075a57c4aaf","owner_id":null,"owner_name":null},{"id":"3f97fb4b-c842-42e2-b339-80b42e257d20","name":"Carbon Spider","description":"<sup>[[CrowdStrike Carbon Spider August 2021](https://app.tidalcyber.com/references/36f0ddb0-94af-494c-ad10-9d3f75d1d810)]</sup>","source":"ICS","associated_group_id":"7bdc9be3-109a-42e5-88ff-6260c6407478","owner_id":null,"owner_name":null},{"id":"79bd1305-c8f7-44fd-b711-c32b705176d6","name":"Sangria Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"e3626ef5-7e82-5b17-86ed-7266d38e0352","owner_id":null,"owner_name":null},{"id":"5e5f29f3-c1bc-48c8-a654-9732e6fce3f6","name":"Savage Ladybug","description":"<sup>[[The Hacker News April 2 2025](/references/22857eb3-b5f7-4677-bf5c-bc993f483450)]</sup>","source":"Tidal Cyber","associated_group_id":"9f165645-3a2d-4154-8c6b-496a27125c6a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ca34e23e-910f-413e-bb08-287c823eabef","name":"GOLD NIAGARA","description":"<sup>[[Secureworks GOLD NIAGARA Threat Profile](https://app.tidalcyber.com/references/b11276cb-f6dd-4e91-90cd-9c287fb3e6b1)]</sup>","source":"ICS","associated_group_id":"89f19c2d-3449-4c67-9f1b-710217bc2a6f","owner_id":null,"owner_name":null},{"id":"ee8d5b8e-fa20-4305-bf40-e8f4a5e0c4c7","name":"ELBRUS","description":"<sup>[[Microsoft Ransomware as a Service](https://app.tidalcyber.com/references/833018b5-6ef6-5327-9af5-1a551df25cd2)]</sup>","source":"ICS","associated_group_id":"f7c0eb40-313c-5bc0-9cdb-3cbd9f2c6f70","owner_id":null,"owner_name":null}],"tags":[{"id":"66e90bea-eaf1-4a40-aad3-34551259e320","tag":"0eab0089-86a5-43b1-9ddb-8960f1005267"},{"id":"83f69faf-a57d-4a06-9ab5-1e7baf6ca51b","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"426ee0ce-75eb-447a-81fd-7a6d4cc9f7f4","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"df9824af-a58c-4470-b721-c7b14537b01b","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"aab87452-26bf-4981-94a9-60f211868601","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"996b73f8-3bcb-4f62-85ae-2131ae97f6ac","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"a2eb4ebf-2609-4386-8bd7-f2d4e3dcef63","tag":"33d22eff-59a1-47e0-b9eb-615dee314595"},{"id":"b0e45892-b654-4267-987c-93280855755d","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"},{"id":"572999f9-862b-437a-b2c7-720a87f66290","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"bf4b45fe-dc57-4416-b408-46c34b3cf352","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"b3061284-0335-4dcb-9f8e-a3b0412fd46f","name":"FIN8","source":"MITRE","group_attack_id":"G0061","created":"2018-04-18T17:59:24.739000Z","modified":"2021-10-12T21:31:07.407000Z","tidal_id":"789be95d-7c97-50eb-ba9d-80dfefcb8c66","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"8c20b2f1-4787-59dc-9c08-3412f337ea42","name":"Syssphinx","description":"<sup>[[Symantec FIN8 Jul 2023](https://app.tidalcyber.com/references/9b08b7f0-1a33-5d76-817f-448fac0d165a)]</sup>","source":"MITRE","associated_group_id":"5cd4a69b-7a62-5091-be06-e73477878441","owner_id":null,"owner_name":null}],"tags":[{"id":"76bef490-e2fb-4c84-9340-a81b6cff9e7c","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"dae932f8-b8b1-4ea3-be7a-e8199533d983","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"b39d8eae-12e3-4903-a387-4c31d16a73b2","name":"Flax Typhoon","source":"Tidal Cyber","group_attack_id":"G3018","created":"2024-06-13T20:11:23.581713Z","modified":"2024-06-13T20:11:23.581716Z","tidal_id":"26cf2e34-6ed8-5f3b-bd51-0259ee923257","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"b5ac0059-7e40-4724-80cc-8ccd339c038e","name":"Earth Naga","description":"<sup>[[Trend Micro October 22 2025](/references/230dbb27-9f4b-417f-ae7f-e88de27f4bc5)]</sup>","source":"USER","associated_group_id":"d1d3252c-8cdd-4da7-ae69-c453710d02d9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"28cd4e7c-9fb9-4d0f-905d-f86078068854","name":"RedJuliett","description":"<sup>[[FBI PRC Botnet September 18 2024](/references/cfb6f191-6c43-423b-9289-02beb3d721d1)]</sup>","source":"Tidal Cyber","associated_group_id":"a28118ee-0b91-4c9c-8ccf-f5671e4ef61e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b6edcac5-fda7-44db-9352-7bc8cf2c5f38","name":"ETHEREAL PANDA","description":"<sup>[[Microsoft Flax Typhoon August 24 2023](/references/ec962b72-7b7f-4f7e-b6d6-7c5380b07201)]</sup>","source":"Tidal Cyber","associated_group_id":"1c075a48-1435-4f90-b273-440a83a6f41d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"61c1167c-71f7-4e38-8e16-29b894f80391","tag":"8e674409-2923-4b4e-bc38-c1c06d24c126"},{"id":"265ebc89-ea05-4644-9e6b-f7f10722e153","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"15bb11f1-7ae4-4eb9-b0eb-0a2bfa157a84","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"26393f87-85a6-4976-a712-020484d74a0c","tag":"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a"},{"id":"13316472-0e38-441d-85ab-33d51ccb1006","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"9fa4d893-666a-4858-9463-a5da01b9842c","tag":"70dc52b0-f317-4134-8a42-71aea1443707"},{"id":"d793242c-7337-4149-b282-8a89b46c87b6","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"fd959f93-9039-49cb-82c2-b5898669202a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"69ecd639-d126-4dda-abb8-5ce17f96ac19","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"7094468a-2310-48b5-ad24-e669152bd66d","name":"Fox Kitten","source":"MITRE","group_attack_id":"G0117","created":"2020-12-21T21:49:47.307000Z","modified":"2022-06-02T20:12:00.458000Z","tidal_id":"d9ba8f36-0d31-51c6-805d-a2da7506d56c","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"6195ab08-5020-439d-a89f-783a35013ceb","name":"Finland","country_name":"Finland","country_code":"FI"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"5bdaf4d6-1877-49a3-b180-f7e7839501ae","name":"Parisite","description":"<sup>[[Dragos PARISITE ](https://app.tidalcyber.com/references/15e974db-51a9-4ec1-9725-cff8bb9bc2fa)]</sup><sup>[[ClearkSky Fox Kitten February 2020](https://app.tidalcyber.com/references/a5ad6321-897a-4adc-9cdd-034a2538e3d6)]</sup><sup>[[CrowdStrike PIONEER KITTEN August 2020](https://app.tidalcyber.com/references/4fce29cc-ddab-4b96-b295-83c282a87564)]</sup>","source":"MITRE","associated_group_id":"580af0b1-0ed3-461e-8144-c95364116faa","owner_id":null,"owner_name":null},{"id":"a71af6be-e687-57b3-84ef-e6803bb90fde","name":"Lemon Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"e3f9be32-e73a-58c5-aa5e-793a57e59d3b","owner_id":null,"owner_name":null},{"id":"79669332-588c-4ff0-8d27-4966a1e62c6d","name":"Br0k3r","description":"<sup>[[U.S. CISA Pioneer Kitten August 28 2024](/references/783f4aee-84d9-43dc-accc-99fee6b1ff92)]</sup>","source":"Tidal Cyber","associated_group_id":"7acc0041-d5b3-4816-bee8-1432ff71e38e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b419b6c4-7941-4d4d-a457-3f5f495c45f9","name":"xplfinder","description":"<sup>[[U.S. CISA Pioneer Kitten August 28 2024](/references/783f4aee-84d9-43dc-accc-99fee6b1ff92)]</sup>","source":"Tidal Cyber","associated_group_id":"b797fed3-a5fb-48a6-902c-d138d198b9ea","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4ffe9f06-3d82-4a4e-98a9-4fc684ece5da","name":"UNC757","description":"<sup>[[CISA AA20-259A Iran-Based Actor September 2020](https://app.tidalcyber.com/references/1bbc9446-9214-4fcd-bc7c-bf528370b4f8)]</sup><sup>[[CrowdStrike PIONEER KITTEN August 2020](https://app.tidalcyber.com/references/4fce29cc-ddab-4b96-b295-83c282a87564)]</sup>","source":"MITRE","associated_group_id":"89d106ad-e7dc-4b3c-8bbb-b8acbf45d47e","owner_id":null,"owner_name":null},{"id":"0977cc1e-b932-405f-9b3e-5794f433168b","name":"Pioneer Kitten","description":"<sup>[[CrowdStrike PIONEER KITTEN August 2020](https://app.tidalcyber.com/references/4fce29cc-ddab-4b96-b295-83c282a87564)]</sup><sup>[[CISA AA20-259A Iran-Based Actor September 2020](https://app.tidalcyber.com/references/1bbc9446-9214-4fcd-bc7c-bf528370b4f8)]</sup>","source":"MITRE","associated_group_id":"70b3c377-6e46-45d1-bc24-edb920ad535d","owner_id":null,"owner_name":null},{"id":"cff93aa2-8bd2-5076-8733-6d5e23621c7f","name":"RUBIDIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"8c2ab1e7-1245-5f00-b233-82915123a435","owner_id":null,"owner_name":null}],"tags":[{"id":"38244671-8532-4576-bc33-ca69d033b339","tag":"07f09197-1847-411e-a451-d37211ead1b2"},{"id":"fe487e96-caf4-4ac3-aa39-45c99b9732ba","tag":"0e1abd50-26be-43e7-b8f6-40f8a6aee148"},{"id":"69688c7a-dc57-4a6d-b4c6-0bad56fbe4bc","tag":"1ff4614e-0ee6-4e04-921d-61abba7fcdb7"},{"id":"24cb997f-3a7f-4014-ba5a-9eb480fe1b1b","tag":"c475ad68-3fdc-4725-8abc-784c56125e96"},{"id":"4246cddd-a6bd-40c9-b2b1-628b5e708349","tag":"45c5f939-56c4-4d12-844d-578f32d535c3"},{"id":"e3e4a5d3-b5bd-4f78-b9ae-df11b7b8e445","tag":"5e42e064-1065-44c6-836e-7dc0a2976bd4"},{"id":"cae49b13-5362-4b8e-8893-9dcb17fcb4ce","tag":"ab64f2d8-8da3-48de-ac66-0fd91d634b22"},{"id":"74bb5891-643f-4d43-8f3b-b0bcd415f1cc","tag":"cc370970-a67c-4c74-95e3-4fe053e9bfa9"},{"id":"fcc6efd9-28ec-463b-bdce-7b23662c355a","tag":"0e948c57-6c10-4576-ad27-9832cc2af3a1"},{"id":"979e223b-d474-4ee8-88a1-318937b658aa","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"5c67ff6f-7b3f-480d-9625-5b3b83461fd5","tag":"fe984a01-910d-4e39-9c49-179aa03f75ab"},{"id":"709bfef9-a1eb-4da2-9f4b-db1129ed9985","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"2b95049a-3ac6-45ff-9712-dbb46963c220","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"a9dcb670-be73-4010-80fa-ac03a717b159","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"b13f9c11-d2af-441a-90bb-1909a333352f","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"565e7f84-4a14-4195-a07b-39655deded51","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"4185eff4-5894-45f8-b030-900d6f372a6d","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"}],"owner_name":null},{"id":"cffa9947-001f-48fd-a63a-0b4feba8df6f","name":"FunkSec","source":"Tidal Cyber","group_attack_id":"G3068","created":"2025-01-16T18:37:40.140824Z","modified":"2025-01-16T18:37:40.140828Z","tidal_id":"d24a18de-f0bd-5fe4-ad28-7207453bcb84","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"0a350b5e-98ca-48cf-b23d-8bc6d57311f4","tag":"62bde669-3020-4682-be68-36c83b2588a4"},{"id":"10468c10-dcb5-4ebd-9961-d9f292e98a47","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"f1ac7477-c37f-421a-9023-e5ff201b4f29","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"7534e583-bd4d-4bb7-b911-742bedfdc1df","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"29e854f6-529a-461b-b068-a478428c2b46","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"ec3a69bc-d5b4-407b-ac36-7c6c98a1d5d8","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d3dfb02a-de5a-4f0c-b65c-5d7571bc06c2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"15ff1ce0-44f0-4f1d-a4ef-83444570e572","name":"GALLIUM","source":"MITRE","group_attack_id":"G0093","created":"2019-07-18T20:47:50.050000Z","modified":"2022-08-12T21:26:22.303000Z","tidal_id":"a68685fc-3f12-5ee1-9d5f-6155353b9a23","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[],"observed_sector":[{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"4268b41b-4bd0-5770-9601-0138b52464a1","name":"Granite Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"30f3e800-b8b0-5efc-abb2-69dd87286906","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"cd483597-4eda-4e16-bb58-353488511410","name":"Gallmaker","source":"MITRE","group_attack_id":"G0084","created":"2019-01-30T14:26:42.897000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"db47d34b-38b8-5dce-bf3a-c0ca0b857bfd","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"41e8b4a4-2d31-46ee-bc56-12375084d067","name":"Gamaredon Group","source":"MITRE","group_attack_id":"G0047","created":"2017-05-31T21:32:09.849000Z","modified":"2022-04-15T13:46:34.474000Z","tidal_id":"155c6fa8-2f8f-5492-ab94-0a6373aee958","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c6c2025a-b24b-49a3-aa9d-c3c5fe9029d7","name":"Albania","country_name":"Albania","country_code":"AL"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"8af7cb07-edaa-4b5c-a1f0-bc171151e6b4","name":"Croatia","country_name":"Croatia","country_code":"HR"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"640088a5-d548-4bab-bf41-29c46ed813f6","name":"Guatemala","country_name":"Guatemala","country_code":"GT"},{"id":"053415fa-f1e4-4998-9497-dd6270a79e68","name":"Honduras","country_name":"Honduras","country_code":"HN"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"8c04cdb9-d766-412c-b041-782c879f51c6","name":"Latvia","country_name":"Latvia","country_code":"LV"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"ec5a430a-ab92-42f4-bf3d-6298ceaf3a3e","name":"Papua New Guinea","country_name":"Papua New Guinea","country_code":"PG"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"}],"associated_groups":[{"id":"5609cc42-ba90-5e40-b68d-7c1273ea1d66","name":"Aqua Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"ca0997d3-4089-58cf-8885-9a7a85acbb34","owner_id":null,"owner_name":null},{"id":"b9bccf61-d9c9-47e6-8de1-f79b9ac68e62","name":"Armageddon","description":"<sup>[[Symantec Shuckworm January 2022](https://app.tidalcyber.com/references/3abb9cfb-8927-4447-b904-6ed071787bef)]</sup>","source":"MITRE","associated_group_id":"c06e119e-26b7-46f1-bf6c-35b68f091152","owner_id":null,"owner_name":null},{"id":"51829cc6-51c3-4dfc-bc75-a9d3252d7734","name":"Shuckworm","description":"<sup>[[Symantec Shuckworm January 2022](https://app.tidalcyber.com/references/3abb9cfb-8927-4447-b904-6ed071787bef)]</sup>","source":"MITRE","associated_group_id":"a5b946ca-ce53-4011-bf46-975390ab31d0","owner_id":null,"owner_name":null},{"id":"21677f2b-d795-4f85-ae84-14a413f3659a","name":"ACTINIUM","description":"<sup>[[Microsoft Actinium February 2022](https://app.tidalcyber.com/references/5ab658db-7f71-4213-8146-e22da54160b3)]</sup>","source":"MITRE","associated_group_id":"42979c45-dfcb-4be8-8c6b-2428f87fb96b","owner_id":null,"owner_name":null},{"id":"6d5abd74-b676-43d9-b9d2-7832d668fa75","name":"IRON TILDEN","description":"<sup>[[Secureworks IRON TILDEN Profile](https://app.tidalcyber.com/references/45969d87-02c1-4074-b708-59f4c3e39426)]</sup>","source":"MITRE","associated_group_id":"27cc58cd-ad07-4921-9dcc-bd3d81ab4164","owner_id":null,"owner_name":null},{"id":"f07d1d02-6291-4b01-920a-4bb42cf7f362","name":"BlueAlpha","description":"<sup>[[Recorded Future BlueAlpha December 5 2024](/references/0baac037-864d-47d6-beb2-6243cd816036)]</sup>","source":"Tidal Cyber","associated_group_id":"5b7177f7-d9e6-4b82-baaf-e82046ab130c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"05e88887-5044-47d5-a5f0-a13f316f8e5b","name":"Primitive Bear","description":"<sup>[[Unit 42 Gamaredon February 2022](https://app.tidalcyber.com/references/a5df39b2-77f8-4814-8198-8620655aa79b)]</sup>","source":"MITRE","associated_group_id":"24e4dcfa-128c-455f-9eb9-088ec37b31ca","owner_id":null,"owner_name":null},{"id":"e35e0af5-656b-4227-956b-eb666edaff13","name":"DEV-0157","description":"<sup>[[Microsoft Actinium February 2022](https://app.tidalcyber.com/references/5ab658db-7f71-4213-8146-e22da54160b3)]</sup>","source":"MITRE","associated_group_id":"5c73e944-4ec1-4b9f-92c6-134952b224cd","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"dbc85db0-937d-47d7-9002-7364d41be48a","name":"GCMAN","source":"MITRE","group_attack_id":"G0036","created":"2017-05-31T21:32:05.611000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"471cf19f-b8d7-53f6-85dc-e7f68f9698de","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"9dc09b70-b1c0-45d1-94a8-490943c69166","name":"Ghost Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3079","created":"2025-02-24T20:28:44.716617Z","modified":"2025-02-24T20:28:44.716621Z","tidal_id":"02d39768-92d9-503c-94eb-2ce3f6e5b3f4","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"58e32691-7086-45d6-9927-bae825fdb322","name":"Cring Ransomware Actors","description":"","source":"Tidal Cyber","associated_group_id":"a03e2fa0-0811-46ce-9da4-1d4a2f0a0128","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"64212fc2-6695-4645-8c04-2b15e0e5acf4","name":"Ghost","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"8c135875-bcfe-4cdb-831b-722363a0b821","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4a42ea41-bc60-4ada-b150-4c0d72798af3","name":"Cring","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"95cd4dc8-25fc-46fd-a89d-899bca5f30b3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"5cd1089d-3568-47ac-b575-070ae1188d49","name":"Crypt3r","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"24d773dd-dcb8-48d8-8f49-8e12a107da70","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b24be5c7-bb23-47f0-bceb-e5e2fcb6f2a5","name":"Phantom","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"34b0fe56-c04f-45cd-9261-46e1f4758aae","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"fdad4865-aec0-4308-a22c-20b44c0f3f64","name":"Strike","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"93a68981-ca20-49e9-8301-41f29bf2e376","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7c6af713-8a54-42eb-a98b-9b9767700d7b","name":"Hello","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"d59bbebf-49bd-4c8a-8374-aaa9c17ac2e3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"91c6a5d0-cad1-455a-b1ee-502916f713e3","name":"Wickrme","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"03c1b6a2-4261-4c01-95a3-39318572d330","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b01fdad0-293e-4405-a1ad-9a1f7f307cb4","name":"HsHarada","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"63f6f3c9-b0f6-4b80-bc8a-eeb66dc4010f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e344fbdd-0ec6-4510-b42b-da8c4d1af998","name":"Rapture","description":"<sup>[[U.S. CISA Ghost Cring Ransomware February 19 2025](/references/d3b3cebd-3428-4d71-a81e-a7cb6248e3b7)]</sup>","source":"Tidal Cyber","associated_group_id":"e564b02d-5cce-44ce-a422-a296312c3e69","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"2d97ddcb-afc7-48f2-8418-779ee8efba1f","tag":"d819ae1a-e385-49fd-88d5-f66660729ecb"},{"id":"cacd1707-9383-4e8a-b82d-197550d79d27","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"7fb9c8dd-9a69-4507-b2f3-1f0f1906fbaa","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"9fff406e-8b9f-45a8-9b35-0f3ad79daf11","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"1e686e3f-444c-4cc7-b9f4-2dc90c4b1f6d","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"204b573d-3860-43ea-a7f0-af87ab466057","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"2bbf3bb2-0b7d-4916-a8e8-66368da6a416","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"52458f1d-c4dc-4aed-a805-3644f56808d3","tag":"a689ff95-9f61-4aba-a388-b7fcd8b2df8d"},{"id":"89a3fcd7-3d3d-4fcf-8cc4-d66c53f62952","tag":"1b98f09a-7d93-4abb-8f3e-1eacdb9f9871"},{"id":"f8554fb8-f3a8-4846-bacd-74abf3139abc","tag":"09de661e-60c4-43fb-bfef-df017215d1d8"},{"id":"da33acb5-e50d-4861-836f-f1f7e20b0e7b","tag":"c2380542-36f2-4922-9ed2-80ced06645c9"},{"id":"6b81132d-38ff-465d-bc53-71fd014ce5ce","tag":"ef782523-005c-47ef-9640-5eb51560a44e"},{"id":"e06261d3-0cdc-448e-b1ce-9a56a5f80ffe","tag":"ca9cef14-6150-47ab-8342-7df84090289f"},{"id":"507edab6-2c18-4bd0-b99d-714d14574e4e","tag":"ee3f2529-ae06-444b-b025-957ec20558de"},{"id":"c82c8d13-1340-4cdc-9053-7da60b4f52f7","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"8a859c5c-b800-41ee-b0de-0d396294f483","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"9c499787-87a2-44bc-9452-b55f8b69daa9","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"7023678c-7079-4192-87a8-444f4f691490","name":"GhostRedirector","source":"Tidal Cyber","group_attack_id":"G3123","created":"2025-09-10T16:39:05.869349Z","modified":"2025-09-10T16:39:05.869354Z","tidal_id":"b107d3b0-2e93-58f5-b416-65ca73f6f6ef","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"6195ab08-5020-439d-a89f-783a35013ceb","name":"Finland","country_name":"Finland","country_code":"FI"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"0ad282c4-afc6-420a-b063-96b67e9610b9","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"10c23ad9-297d-480f-bf54-e490e02e31ef","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d9de5d0e-0bff-49b9-be0d-139f49eeb6f3","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"9d1a4d48-33b8-4f14-bec7-ef105c094297","name":"GhostSec","source":"Trellix TIG","group_attack_id":"G3009","created":"2025-04-11T15:06:31.565369Z","modified":"2025-04-11T15:06:31.565372Z","tidal_id":"fdf12ce1-4bb3-5015-94ee-797820e33093","country":[],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"8b01fa4e-6091-4d5b-ba81-8b9937a69a8b","name":"Ghost Security","description":"","source":"Trellix TIG","associated_group_id":"a87dc308-77fb-4555-99ca-6f8da1634d54","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"9e3bd859-acf8-4c9c-8df4-f49e169b0b98","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"31c84924-61f2-4b98-8df4-a6147020b3eb","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"4569f884-4c85-4ea4-a3ab-7b97ed194af6","name":"GLOBAL GROUP","source":"Tidal Cyber","group_attack_id":"G3132","created":"2025-10-07T14:07:13.547120Z","modified":"2025-10-07T14:07:13.547122Z","tidal_id":"91cd67cd-149e-58ba-b73d-3d431113fc21","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"92334096-8fea-41ce-b3b8-bdbd44bfa3cb","name":"BlackLock","description":"<sup>[[CYFIRMA 08 08 2025](/references/2987f12f-0050-4982-b14b-811361b534a0)]</sup>","source":"USER","associated_group_id":"e7ee0bd2-5860-47b9-b469-a46f8cb1dca9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b85701a8-b08d-4997-b603-827ebc4621bc","name":"Mamona","description":"<sup>[[CYFIRMA 08 08 2025](/references/2987f12f-0050-4982-b14b-811361b534a0)]</sup>","source":"USER","associated_group_id":"1b2b672d-ca53-43f5-bd2d-98df37379042","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"de55c5d1-fa5a-46fc-9568-0c4ae14014a8","name":"Eldorado","description":"<sup>[[CYFIRMA 08 08 2025](/references/2987f12f-0050-4982-b14b-811361b534a0)]</sup>","source":"USER","associated_group_id":"019ed83a-3dfe-4e6d-b417-5ca6ad72c703","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"d2494b2e-d598-4c5c-bc20-3ed5077ba38c","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"69fc758d-413c-43ce-ae46-f4a9d28f6352","tag":"70dc52b0-f317-4134-8a42-71aea1443707"},{"id":"3384aecb-4408-472f-bcec-1bad0a8cf730","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"677251a5-5d06-4909-b701-b122bcfe2233","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"6eec8bed-7ab3-4590-8061-9f3f0bf40b81","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"c2a708d7-1a93-40c0-8d12-341cb11e5536","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f63e15c9-7a4b-4621-a259-12d6f7478755","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"418bcbbc-6e22-435a-993c-8433e9bfa4f5","name":"GlorySec","source":"Tidal Cyber","group_attack_id":"G3193","created":"2026-01-06T18:04:02.670458Z","modified":"2026-01-06T18:04:02.670461Z","tidal_id":"729cea19-18d3-589d-a712-6b9b2db3fa22","country":[{"id":"3720daef-8d9a-49ba-b95c-d374c52ba355","name":"North Macedonia","country_name":"North Macedonia","country_code":"MK"}],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"}],"associated_groups":[],"tags":[{"id":"88998d1e-2eff-46d7-920b-43fb54b9ed21","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"acf3742c-0749-4556-a166-266e28a9a23e","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"4ca970cd-9422-46d7-a94d-340f7507638d","name":"GoBruteforcer Operators","source":"Tidal Cyber","group_attack_id":"G3204","created":"2026-01-14T13:30:29.994872Z","modified":"2026-01-14T13:30:29.994876Z","tidal_id":"0b834a86-07a7-5b13-b7ad-9f5cdaf2b150","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"9a77f6ac-5bf2-4d29-b527-b183fe087515","name":"GoBruteforcer botnet operators","description":"<sup>[[Check Point Research January 07 2026](/references/45a9d214-ddee-44e9-9ed1-282f05a65428)]</sup>","source":"USER","associated_group_id":"aac019c3-ca34-4ef0-8853-9842262cdaa2","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d64f3970-09c5-48ae-9c91-961f6de103ce","name":"GoBrut","description":"<sup>[[Check Point Research January 07 2026](/references/45a9d214-ddee-44e9-9ed1-282f05a65428)]</sup>","source":"USER","associated_group_id":"2f0f3d4a-e9fa-4f6c-b6e8-c91cf22bf2d6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"e742cdd3-6aaf-4c2c-885d-6966b72d75a8","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"},{"id":"82f72956-177f-4283-b2c1-8b79258a25dc","tag":"efa33611-88a5-40ba-9bc4-3d85c6c8819b"},{"id":"583b83c5-30e8-4a11-ae08-53df8aaf0ad4","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"4e45e564-3e4b-4172-aff6-9225a9806790","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"84d9e2be-716d-4873-b506-ff7832fd1ac1","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"bd08b74d-4f60-4615-9bde-19d6a899d1e9","name":"GOLD BLADE","source":"Tidal Cyber","group_attack_id":"G3171","created":"2025-12-17T14:18:06.450242Z","modified":"2025-12-17T14:18:06.450246Z","tidal_id":"310fbcbd-456c-587c-9be1-b8b8755b0c1b","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"54f4eb62-e0e5-422d-a3eb-b7d34800798b","name":"RedWolf","description":"<sup>[[Sophos News December 05 2025](/references/30f373ed-0d2e-474a-b17f-29de7beec0c8)]</sup>","source":"USER","associated_group_id":"e4e794cf-5ba0-4709-a2d1-7f8d1038b11e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"cdc68a26-2800-4b30-bfd7-6e9569ff0cfa","name":"RedCurl","description":"<sup>[[Sophos News December 05 2025](/references/30f373ed-0d2e-474a-b17f-29de7beec0c8)]</sup>","source":"USER","associated_group_id":"5a20f3a2-02be-4431-920f-578429ae83fd","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3cd672c2-2282-4a75-8104-5e2f7601c9ea","name":"Earth Kapre","description":"<sup>[[Sophos News December 05 2025](/references/30f373ed-0d2e-474a-b17f-29de7beec0c8)]</sup>","source":"USER","associated_group_id":"9d908d37-031c-488e-ad11-a6f6a49e6158","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"32db7097-a60d-46b2-ae77-981774621d21","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"70f229db-9be0-4244-8c75-c187475a148e","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"82a7d2f8-e6a2-45e3-9745-6a8bda5adae5","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"524c2fcc-56a5-4969-9c11-9ef7724368b4","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"ebf63407-9772-4f38-93ad-48b8c9bb0bcf","name":"Gold Dupont","source":"Trellix TIG","group_attack_id":"G3002","created":"2025-04-11T15:06:30.071740Z","modified":"2025-04-11T15:06:30.071744Z","tidal_id":"2ebc924e-1f74-582a-a852-9f505897cfdb","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"80e7dd0e-36a3-489a-a26b-ceb9460a54a2","name":"GOLD DUPONT","description":"","source":"Trellix TIG","associated_group_id":"872f5b0d-f886-49a5-884b-68f0f7dd4d46","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"924aed6e-127a-4331-9e75-194137607f23","name":"Prying Libra","description":"","source":"Trellix TIG","associated_group_id":"7be0580b-20d7-4053-b55c-9534aac8d19b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[],"owner_name":"TidalCyberIan"},{"id":"b4d068ac-9b68-4cd8-bf0c-019f910ef8e3","name":"GOLD SOUTHFIELD","source":"MITRE","group_attack_id":"G0115","created":"2020-09-22T19:41:27.845000Z","modified":"2021-04-26T12:52:34.528000Z","tidal_id":"f8958317-3e81-5d09-ade5-e6422a6fdbc3","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"},{"id":"6c81c742-07a2-4540-8873-7b2fac9ec47e","name":"Organizational Gain"}],"observed_country":[{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"01341fff-9dbd-5a1e-ae91-18fb56f2d943","name":"Pinchy Spider","description":"<sup>[[CrowdStrike Evolution of Pinchy Spider July 2021](https://app.tidalcyber.com/references/7578541b-1ae3-58d0-a8b9-120bd6cd96f5)]</sup>","source":"MITRE","associated_group_id":"7f1fa605-10cc-5317-a88c-b174f3ad7596","owner_id":null,"owner_name":null},{"id":"eb0802e4-e7e8-44b7-a0b6-d41f7541e25c","name":"Pinchy Spider","description":"<sup>[[CrowdStrike Evolution of Pinchy Spider July 2021](https://app.tidalcyber.com/references/7578541b-1ae3-58d0-a8b9-120bd6cd96f5)]</sup>","source":"ICS","associated_group_id":"7f1fa605-10cc-5317-a88c-b174f3ad7596","owner_id":null,"owner_name":null}],"tags":[{"id":"87fbddf8-2c57-49d7-bb66-396966fd4c52","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"88622246-7fb4-4259-a0bd-ea06cdf531f5","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"},{"id":"692c8d42-619e-445e-8d23-dcf2532b99d8","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"cca4797e-d3ff-44aa-a43d-dec1ceaef6b4","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"efb3b5ac-cd86-44a2-9de1-02e4612b8cc2","name":"Gorgon Group","source":"MITRE","group_attack_id":"G0078","created":"2018-10-17T00:14:20.652000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"02387223-c6b4-59ff-a9f7-11661fa5d658","country":[{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"}],"observed_motivation":[],"observed_country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"1678d6dc-8e4f-4edc-8360-802985bd7846","name":"GrayBravo","source":"Tidal Cyber","group_attack_id":"G3172","created":"2025-12-17T14:18:06.641025Z","modified":"2025-12-17T14:18:06.641028Z","tidal_id":"0de94f80-2d5e-5227-a16a-4022dfe265ab","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"9455fbe8-25c6-41cc-8f6e-59cec6d2b57e","name":"TAG-150","description":"<sup>[[None December 09 2025](/references/ea47bb34-cf65-4abe-ae24-a51fad15154e)]</sup>","source":"USER","associated_group_id":"0233b2ca-6439-4745-a7ef-8c3e86bdd4ab","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"44c9a557-20f4-4ed6-89b4-b913af1e9821","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"468ba6b3-d270-41d1-aabd-c80172d8c58a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"05102573-253b-45e3-af78-d2a6fc2b971b","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"7d17fa48-e897-4a0c-8aa5-c7f2b6cd96a0","name":"GreenMwizi","source":"Tidal Cyber","group_attack_id":"G3001","created":"2024-06-13T20:11:09.426427Z","modified":"2024-06-13T20:11:09.426431Z","tidal_id":"c6b1a009-944f-548d-aa91-9c3d38455802","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"}],"associated_groups":[],"tags":[{"id":"6d728f93-3f03-45cd-bd5c-17478388cc70","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"74ca1edd-11ce-4bf5-b493-efe358e75048","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"fcc6d937-8cd6-4f2c-adb8-48caedbde70a","name":"Group5","source":"MITRE","group_attack_id":"G0043","created":"2017-05-31T21:32:08.304000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"e2f35820-8d67-5c77-97cc-0d3e83212cbc","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"587d6063-8261-484b-b4d7-c8b42a8c4a62","name":"GTG-1002","source":"Tidal Cyber","group_attack_id":"G3149","created":"2025-11-19T17:45:10.700813Z","modified":"2025-11-19T17:45:10.700817Z","tidal_id":"ebf3c61b-e1de-5872-aa07-365675c34fbc","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"d190793c-4487-4085-8ba5-fbf1f884c421","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"5fba51e5-7d97-4896-a62c-727ae1282177","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c6173351-fe07-4520-ac70-cb6e14f24235","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"8a82122d-76bc-4334-adcd-a60bababe92d","name":"Gunra","source":"Tidal Cyber","group_attack_id":"G3133","created":"2025-10-07T14:07:13.697926Z","modified":"2025-10-07T14:07:13.697927Z","tidal_id":"25495ec9-e720-54c7-b35c-fd8ea7a30af1","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"e0f56569-3a64-48d6-a3d1-7415a3436406","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"873c005b-b378-4bd0-bbae-76a218911ac9","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"caf5dfc8-8f5b-456f-886f-c7a881fc3adc","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"88df2061-22cf-44ee-bf32-848d7014c5bc","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"78b09333-76ea-4239-a03d-d601a8032e8e","name":"GXC Team","source":"Tidal Cyber","group_attack_id":"G3061","created":"2024-10-18T13:26:56.733572Z","modified":"2024-10-18T13:26:56.733576Z","tidal_id":"da3502a5-15c1-51ce-9f69-00630a95a32c","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"6c683d1a-7c2e-41c3-88d5-d6a0b37d5136","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":"TidalCyberIan"},{"id":"cd83ecfb-8e42-4b55-8d1e-fd4dbe4b68cd","name":"H0lyGh0st Ransomware Group","source":"Tidal Cyber","group_attack_id":"G3006","created":"2024-06-13T20:11:12.827364Z","modified":"2024-06-13T20:11:12.827368Z","tidal_id":"0aa426ed-28ab-5ae6-b464-9f817a22758d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"454c475c-2a35-4e0e-a10b-d368e6998a8f","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"1461e0f0-58c0-49b9-8481-7be78354dc48","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"0122cdb4-3e9c-4cfe-bd61-2459d7419ac9","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"56a4a870-7ea3-42e6-8635-7aa92c5a7901","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"1bcc9382-ccfe-4b04-91f3-ef1250df5e5b","name":"HAFNIUM","source":"MITRE","group_attack_id":"G0125","created":"2021-03-03T19:40:47.280000Z","modified":"2022-07-06T20:05:26.079000Z","tidal_id":"b6c4960f-2903-550c-b757-5a6a888ff77b","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[{"id":"b6471d09-f006-5f74-9433-961882f0b5f4","name":"Silk Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[Microsoft Silk Typhoon MAR 2025](https://app.tidalcyber.com/references/08dd388f-5c10-57bc-8263-7214fe667b4a)]</sup>","source":"MITRE","associated_group_id":"6219e4e3-4991-55d5-a3e1-ab1373030304","owner_id":null,"owner_name":null},{"id":"df9d2cd4-0d5d-4c66-8fe6-4268d17dd35d","name":"Operation Exchange Marauder","description":"<sup>[[Volexity Exchange Marauder March 2021](https://app.tidalcyber.com/references/ef0626e9-281c-4770-b145-ffe36e18e369)]</sup>","source":"MITRE","associated_group_id":"956cc6a9-b4e2-40ec-aa22-5dc90e2ab2d0","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"9462ee53-0e12-4441-a722-dabf6b3677b9","name":"Handala Hack Team","source":"Tidal Cyber","group_attack_id":"G3113","created":"2025-07-08T16:58:49.451245Z","modified":"2025-07-08T16:58:49.451249Z","tidal_id":"6a1f1fe6-a797-5181-878e-c9b6dcf09e9e","country":[],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"0f2636d9-9461-4b7d-98ac-f302e4cbb731","name":"Handala","description":"<sup>[[Cyber Daily Handala June 16 2025](/references/0d279886-6dfd-4587-b0af-98b425b84a50)]</sup>","source":"USER","associated_group_id":"5e9cafae-da0b-4e8a-92f6-1178d37b7829","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"70bcb12a-4be5-4223-a0e4-f862cc48ca0e","name":"Handala Group","description":"<sup>[[Trellix Iranian Cyber Capability September 19 2024](/references/19ebc031-73c5-49b4-9944-f03bb70cf40e)]</sup>","source":"Tidal Cyber","associated_group_id":"3b062ed1-906b-455c-8efb-d32b880a8822","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"2b96dd07-4a9e-4671-91d9-7de374230714","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a3cf0e38-554f-45e0-a2d9-3e918f822d5c","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"eecf7289-294f-48dd-a747-7705820f4735","name":"HEXANE","source":"MITRE","group_attack_id":"G1001","created":"2018-10-17T00:14:20.652000Z","modified":"2022-08-31T22:16:30.454000Z","tidal_id":"6b0b69a7-a9e8-5f0c-b2d6-188890419a4c","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c6c2025a-b24b-49a3-aa9d-c3c5fe9029d7","name":"Albania","country_name":"Albania","country_code":"AL"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"53e1210a-b379-4569-aba4-9e7f6916f24e","name":"Tunisia","country_name":"Tunisia","country_code":"TN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"10fda21c-e31e-4336-ad27-f8fc56af4286","name":"Siamesekitten","description":"<sup>[[ClearSky Siamesekitten August 2021](https://app.tidalcyber.com/references/9485efce-8d54-4461-b64e-0d15e31fbf8c)]</sup>","source":"MITRE","associated_group_id":"05b6f4a6-e54d-42db-a47e-4bcfae56c0f6","owner_id":null,"owner_name":null},{"id":"25ad0004-6aa1-4f64-822f-bf40302aebac","name":"OilRig subgroup","description":"<sup>[[None December 02 2025](/references/fc19e816-1740-468e-966e-a7cb1165e16e)]</sup>","source":"USER","associated_group_id":"0f31d811-315a-4b38-884a-3cd704484d66","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7c66a4e7-1b16-4825-88d5-958a1cf89443","name":"Storm-0133","description":"<sup>[[None December 02 2025](/references/fc19e816-1740-468e-966e-a7cb1165e16e)]</sup>","source":"USER","associated_group_id":"13c20bf4-1447-4669-b339-e5d15c57a7f3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e623a904-bd7d-4c22-a6d2-73172e6905b2","name":"Lyceum","description":"<sup>[[SecureWorks August 2019](https://app.tidalcyber.com/references/573edbb6-687b-4bc2-bc4a-764a548633b5)]</sup>","source":"MITRE","associated_group_id":"140137f2-039a-4ade-a043-039b2093e25e","owner_id":null,"owner_name":null},{"id":"19a29b1a-d82e-47cd-930c-2af4f66d918e","name":"Spirlin","description":"<sup>[[Accenture Lyceum Targets November 2021](https://app.tidalcyber.com/references/127836ce-e459-405d-a75c-32fd5f0ab198)]</sup>","source":"MITRE","associated_group_id":"16662d03-d9bf-448d-9fef-40af53a2bc76","owner_id":null,"owner_name":null},{"id":"8391e306-a2e9-4ef2-b822-cc2a81f61c7c","name":"Lyceum","description":"<sup>[[SecureWorks August 2019](https://app.tidalcyber.com/references/573edbb6-687b-4bc2-bc4a-764a548633b5)]</sup>","source":"ICS","associated_group_id":"140137f2-039a-4ade-a043-039b2093e25e","owner_id":null,"owner_name":null},{"id":"0d5d36ca-c447-450c-985b-a05d607135d1","name":"Siamesekitten","description":"<sup>[[ClearSky Siamesekitten August 2021](https://app.tidalcyber.com/references/9485efce-8d54-4461-b64e-0d15e31fbf8c)]</sup>","source":"ICS","associated_group_id":"05b6f4a6-e54d-42db-a47e-4bcfae56c0f6","owner_id":null,"owner_name":null},{"id":"86463361-2fb0-4cac-b1ea-c21bc89fe3be","name":"Spirlin","description":"<sup>[[Accenture Lyceum Targets November 2021](https://app.tidalcyber.com/references/127836ce-e459-405d-a75c-32fd5f0ab198)]</sup>","source":"ICS","associated_group_id":"16662d03-d9bf-448d-9fef-40af53a2bc76","owner_id":null,"owner_name":null}],"tags":[{"id":"3c80be7a-f078-4d23-bf21-6f15b75ace6d","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"58856dfd-6880-4013-8b1d-448a15831081","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"}],"owner_name":null},{"id":"f1477581-d485-403f-a95f-c56bf88c5d1e","name":"Higaisa","source":"MITRE","group_attack_id":"G0126","created":"2021-03-05T18:54:56.267000Z","modified":"2021-04-22T02:12:43.892000Z","tidal_id":"d348892c-f2f0-57f9-8bff-77d78d57bfd6","country":[{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"}],"observed_motivation":[],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"05cd82bb-f8fc-40f3-83ba-1586ef953d05","name":"Hive Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3041","created":"2024-06-24T15:00:15.914840Z","modified":"2024-06-24T15:00:15.914845Z","tidal_id":"d653aa8d-bf1f-531c-8eb7-24c5dcfbf0ac","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"0a6f7e58-5bc5-425b-bc6f-ad7b1b1593ed","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"9f10aa7b-1f5c-47da-abd6-165f78d2f7f4","tag":"d903e38b-600d-4736-9e3b-cf1a6e436481"},{"id":"044d5351-8617-4a5f-839b-df4c055daab2","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"61343894-4695-4ebb-a904-95c4ffb43e5a","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"62d9b6e6-78fd-45f6-aaa3-73c0534fa595","tag":"5e9581be-dea3-42b2-a92a-4c307cedec2c"},{"id":"c0067ca8-e4ed-4150-b9f3-03ce98b49ef2","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"48eb70d5-2098-4b7c-9358-933982d5c268","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"eaeacf48-dcf0-4620-a90b-55992aedaff9","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"5a228a3f-a189-4586-b672-877028f862e9","tag":"1423b5a8-cff3-48d5-a0a2-09b3afc9f195"},{"id":"dec04d58-6a1a-45ff-9889-363d7955b5ec","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"a8d9929d-60e4-4315-a91e-8bb584cb63d6","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"b441204f-abf8-4a42-94d2-bec368ea148e","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"35c1d78d-0334-4325-8995-3613f709de26","name":"Hunt3r Kill3rs","source":"Tidal Cyber","group_attack_id":"G3001","created":"2025-01-28T15:53:47.018753Z","modified":"2025-01-28T15:53:47.018757Z","tidal_id":"8c8b33f9-d090-52e1-a18a-e6e487f8b468","country":[],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"c871c4c8-4cfc-45b8-b2d8-047b74354824","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"}],"owner_name":"TidalCyberIan"},{"id":"66c5a800-2876-4d9f-93f9-f7e0979de603","name":"Hunters International","source":"Tidal Cyber","group_attack_id":"G3114","created":"2025-07-15T16:15:45.664085Z","modified":"2025-07-15T16:15:45.664088Z","tidal_id":"9ddf2062-6e81-5dc8-bde2-8bec5feee32a","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"5f0a1c32-1b61-4a5b-b58b-0abb64dc37a3","tag":"95189190-6a0c-4c77-b118-bae611d3fee1"},{"id":"1a2473bf-5595-49f7-9b1f-8f377a7fc96b","tag":"279491e8-262e-4c4c-92fb-e013b1b5e99b"},{"id":"b89e31cc-7ae5-4955-a264-026361f7f83b","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"09ca773a-3daf-442f-ab73-a82a4efe6782","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"a271a75a-1b00-4088-bea7-c9925d25a75f","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"6b9e2e05-5d9a-48c1-aa79-a1cbd90ccf1d","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"e3e75692-e051-4ae4-baed-b2a4577ff214","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d7c58e7f-f0b0-44c6-b205-5adcfb56f0e6","name":"Inception","source":"MITRE","group_attack_id":"G0100","created":"2020-05-08T17:01:04.058000Z","modified":"2021-10-12T23:21:06.480000Z","tidal_id":"f7708015-3702-5a38-8fe4-37b2e05f0558","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"57795c9b-f344-44fb-99fa-85379126bb0b","name":"Moldova, Republic of","country_name":"Moldova","country_code":"MD"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"b3e52766-0a51-4de5-910c-e71e9f5ea0a0","name":"Suriname","country_name":"Suriname","country_code":"SR"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"66df8607-fd7c-49d8-b6f5-5519a200077b","name":"Cloud Atlas","description":"<sup>[[Kaspersky Cloud Atlas December 2014](https://app.tidalcyber.com/references/41a9b3e3-0953-4bde-9e1d-c2f51de1120e)]</sup>","source":"MITRE","associated_group_id":"ec26e42e-45f7-4d88-ae4b-f141dd03e192","owner_id":null,"owner_name":null},{"id":"e5049581-6e7a-4ef4-a437-b6505b51faa0","name":"Inception Framework","description":"<sup>[[Symantec Inception Framework March 2018](https://app.tidalcyber.com/references/166f5c44-7d8c-45d5-8d9f-3b8bd21a2af3)]</sup>","source":"MITRE","associated_group_id":"42936511-3367-4000-b700-cba2ed0a5c6c","owner_id":null,"owner_name":null}],"tags":[{"id":"9c47c71a-53b5-43e6-8b57-a8679995d7cb","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"aaf1baf6-7f99-4bb3-ae6f-58f4a1cb2a97","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"78079f29-caf9-4129-8e5a-5bb2fddc7210","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"}],"owner_name":null},{"id":"8957f42d-a069-542b-bce6-3059a2fa0f2e","name":"INC Ransom","source":"MITRE","group_attack_id":"G1032","created":"2024-10-31T16:28:11.295790Z","modified":"2024-10-31T16:28:11.295792Z","tidal_id":"8957f42d-a069-542b-bce6-3059a2fa0f2e","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"}],"associated_groups":[{"id":"ad373e6c-8bfd-5848-b9bf-b737c0c42b33","name":"GOLD IONIC","description":"<sup>[[Secureworks GOLD IONIC April 2024](https://app.tidalcyber.com/references/e723e7b3-496f-5ab4-abaf-83859e7e912d)]</sup>","source":"MITRE","associated_group_id":"a2c45f2d-8de6-5334-8320-4b40c152ff3f","owner_id":null,"owner_name":null}],"tags":[{"id":"cd75370e-7163-4c4a-8cc8-95eb09fd3b2b","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"92c1c6ea-8136-4c66-a6fd-41c93e2c7f75","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"988f5312-834e-48ea-93b7-e6e01ee0938d","name":"IndigoZebra","source":"MITRE","group_attack_id":"G0136","created":"2021-09-24T21:41:34.797000Z","modified":"2021-10-16T02:06:06.404000Z","tidal_id":"36b06f0e-850e-5a90-9119-4597bba9dd0e","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"f0106493-e44f-43d5-b12b-0971842d81de","name":"Kyrgyzstan","country_name":"Kyrgyzstan","country_code":"KG"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"3c7ad595-1940-40fc-b9ca-3e649c1e5d87","name":"Indrik Spider","source":"MITRE","group_attack_id":"G0119","created":"2021-01-06T17:46:35.134000Z","modified":"2022-09-15T19:49:18.799000Z","tidal_id":"706e62c5-9b06-5f35-b8aa-3df4d5c21395","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"}],"associated_groups":[{"id":"b4cad0f0-4f0d-5865-bfb8-f980761af7df","name":"Manatee Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"495cba3b-30ee-568c-83e6-c451cbc01869","owner_id":null,"owner_name":null},{"id":"c041c105-2f49-54da-87da-23f0f8948e4a","name":"DEV-0243","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"8791f8b4-2d61-5e4a-b6bc-d19f602c2ede","owner_id":null,"owner_name":null},{"id":"135f70c7-b515-5bcd-ad49-afc52c93af66","name":"UNC2165","description":"<sup>[[Mandiant_UNC2165](https://app.tidalcyber.com/references/92e39558-cd2c-54c4-8930-aafdd2f14bca)]</sup>","source":"MITRE","associated_group_id":"c422d5c1-308e-5799-86f0-207314093590","owner_id":null,"owner_name":null},{"id":"c7f362ba-2ba3-4adc-bae7-186cebe57a17","name":"Evil Corp","description":"<sup>[[Crowdstrike EvilCorp March 2021](https://app.tidalcyber.com/references/4b77d313-ef3c-4d2f-bfde-609fa59a8f55)]</sup><sup>[[Treasury EvilCorp Dec 2019](https://app.tidalcyber.com/references/074a52c4-26d9-4083-9349-c14e2639c1bc)]</sup>","source":"MITRE","associated_group_id":"bc61566f-d467-43bd-bea8-b04d6eb26318","owner_id":null,"owner_name":null}],"tags":[{"id":"cf150ce7-6b13-4e17-a7b6-c660cb41b0e1","tag":"c7bd6fa4-288f-4da1-986e-e0fd9a4a3c97"},{"id":"11577ce1-33f4-4488-85a1-b8d390895ff0","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"4c0712fa-56d4-4c49-8a29-7b7d12e60c7b","tag":"47365c8b-5db8-4d3a-9eb9-d49c8df1a90e"},{"id":"676a24b4-916f-42dc-b959-58c2b70551f8","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"734164fe-b6bc-4d72-9855-c2986a6f6e78","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"6f548324-ce25-48b9-b0ba-eed4c60eccff","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"536ed902-7283-439d-9e8d-c1e5f7af648a","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"66b0f5f6-3377-4f5d-ac79-605dad9221f1","name":"Ink Dragon","source":"Tidal Cyber","group_attack_id":"G3179","created":"2025-12-24T14:56:39.571568Z","modified":"2025-12-24T14:56:39.571572Z","tidal_id":"f89a5f71-3c67-59c7-9517-fddfb8f19a4f","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"74d9ee76-fb4b-4ed1-9cd4-b2c478b5ed59","name":"Jewelbug","description":"<sup>[[Check Point Research December 16 2025](/references/1fc24a9b-9636-482a-8413-211b42658872)]</sup>","source":"USER","associated_group_id":"d3e7d68c-eacc-4930-b069-787299d69ec6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7203b2f4-845a-4842-a66d-8bd7f67b3aef","name":"Earth Alux","description":"<sup>[[Check Point Research December 16 2025](/references/1fc24a9b-9636-482a-8413-211b42658872)]</sup>","source":"USER","associated_group_id":"16611e41-b3c1-4564-bf0b-80cffa738488","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"07033270-6b9f-486d-a915-5aa86b206a72","name":"CL-STA-0049","description":"<sup>[[Check Point Research December 16 2025](/references/1fc24a9b-9636-482a-8413-211b42658872)]</sup>","source":"USER","associated_group_id":"970fe010-0ec6-4cdc-b819-d61ad463b2b9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"59770177-6d38-49c1-955b-97b0aeb32e7a","name":"REF7707","description":"<sup>[[Check Point Research December 16 2025](/references/1fc24a9b-9636-482a-8413-211b42658872)]</sup>","source":"USER","associated_group_id":"49113a6e-e665-43ba-b62b-99bb6e745f7a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"9615f8b6-f39a-41d9-9f4d-23aa9ea08413","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"6c9c7d70-03b8-4396-b002-b55a20a16a4a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"cc4adef2-3056-448d-9803-bf7d6f0fc15e","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"ec680afc-ea1f-4b08-93b3-56a6c3f1b365","name":"Interlock Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3116","created":"2025-07-24T19:10:24.356568Z","modified":"2025-07-24T19:10:24.356573Z","tidal_id":"0148d27a-8a90-5654-b0f8-1f28a0c0891d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[],"tags":[{"id":"1ece9c0d-499e-4023-813d-beae2e1c0fe7","tag":"d819ae1a-e385-49fd-88d5-f66660729ecb"},{"id":"9a26fec9-9e3e-460e-a980-6fbd2bbe1f33","tag":"d903e38b-600d-4736-9e3b-cf1a6e436481"},{"id":"b66f5b56-38d1-4aed-875e-b82b94b2d56a","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"4fa58904-0a4d-450b-846a-1ee497b98f0f","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"74e34d0a-5479-4126-afc8-fcf3db6cbe15","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"963fb954-fdd7-45d1-b307-7e389228bfe7","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"8aabbef3-e27b-4b60-8260-c914ddcd90de","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"fa1ae8b3-084d-4367-ae60-24dcf2330082","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"e278381c-b409-4f7b-9eaa-61f3a8796484","name":"IronErn440","source":"Tidal Cyber","group_attack_id":"G3156","created":"2025-12-10T14:14:12.170808Z","modified":"2025-12-10T14:14:12.170811Z","tidal_id":"172f5a4c-3753-5479-9284-6402220c6bdc","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"6c91ae80-9f3c-4ee8-8476-86b2682ae9a6","name":"ironern440-group","description":"<sup>[[Oligo ShadowRay November 18 2025](/references/760d0a0d-620b-45a5-9e8d-06903555a118)]</sup>","source":"USER","associated_group_id":"42f35f21-5e7c-47d8-85fd-19ea3b00e59f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"404fb5d8-1d4d-461c-8e64-bc5231c62389","name":"thisisforwork440-ops","description":"<sup>[[Oligo ShadowRay November 18 2025](/references/760d0a0d-620b-45a5-9e8d-06903555a118)]</sup>","source":"USER","associated_group_id":"0e023074-df80-4c77-bca2-79a15dd9779d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"c4d3786d-61fe-4a60-b523-c5a414f3e0d8","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"9ead32cc-56be-44de-aad8-e9d0c4bf483b","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"c3e35f6e-28b6-4bd0-b9d0-be0d8dbf07d3","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"263ec5f7-e28a-4702-b253-e4145a7cb453","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3ac3ae09-f72f-4f64-a548-41176d5d83b9","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"3ab35de9-6daa-4a69-9f0d-76ba1624883d","name":"IT Army of Russia","source":"Tidal Cyber","group_attack_id":"G3118","created":"2025-08-06T14:56:58.986051Z","modified":"2025-08-06T14:56:58.986054Z","tidal_id":"17e1ea89-3477-5664-94fb-42988a468eed","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"827c50a3-2a97-42b1-9ce3-047ed9882636","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"18dcc469-28bc-4aee-ad4c-1745cbc8dc14","tag":"62bde669-3020-4682-be68-36c83b2588a4"},{"id":"dd88c1b4-306b-42ce-a9f6-6bdd77ccadd6","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"0ba608ac-eb84-42e0-b04c-4c350db2942a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"2b008386-ffdc-433d-9b09-1e2cf4f3a4a4","name":"Jackpot Panda","source":"Tidal Cyber","group_attack_id":"G3161","created":"2025-12-10T14:14:13.034317Z","modified":"2025-12-10T14:14:13.034320Z","tidal_id":"e0d40e3f-0749-5c2b-a970-a91193fa48e9","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"f28624e0-7ef2-4cff-8136-44046a6e3c65","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"f38227d2-76a6-4366-91d2-a8d7ce4a506c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"0d88c6da-fd05-4880-8ecb-bd221cc5ad6b","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"45a5d563-0e93-405a-ae8c-cca71e88f441","name":"J Ransomware Group","source":"Tidal Cyber","group_attack_id":"G3134","created":"2025-10-07T14:07:13.843866Z","modified":"2025-10-07T14:07:13.843868Z","tidal_id":"680cd1f1-c3af-5257-9ecb-d9010e3d1b5f","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"e92bf373-d965-4d59-a246-2b6e02aeafd2","name":"kawa4096","description":"<sup>[[CYFIRMA 08 08 2025](/references/2987f12f-0050-4982-b14b-811361b534a0)]</sup>","source":"USER","associated_group_id":"308a627e-e772-421e-ab6d-b0bc843c97d6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"ddccc221-b286-47ce-9b8f-ed450190e4f9","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"2e1761f7-98b4-470e-98bf-be65601806b0","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"26c0925f-1a3c-4df6-b27a-62b9731299b8","name":"Ke3chang","source":"MITRE","group_attack_id":"G0004","created":"2017-05-31T21:31:47.177000Z","modified":"2022-07-22T18:52:32.762000Z","tidal_id":"311f0611-17c0-5f7b-8ab6-42767bca4bba","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"56a712cc-a917-48fb-ac0c-58a22c8a24ed","name":"Barbados","country_name":"Barbados","country_code":"BB"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"445023e4-5031-43b9-b6bf-c9d0909a46fa","name":"Bosnia and Herzegovina","country_name":"Bosnia and Herzegovina","country_code":"BA"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"8af7cb07-edaa-4b5c-a1f0-bc171151e6b4","name":"Croatia","country_name":"Croatia","country_code":"HR"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"6081d7f5-318b-47d4-bebe-eda4cd16d578","name":"Dominican Republic","country_name":"Dominican Republic","country_code":"DO"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"c945f7ba-806b-47f0-9315-59a734cd786d","name":"El Salvador","country_name":"El Salvador","country_code":"SV"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"640088a5-d548-4bab-bf41-29c46ed813f6","name":"Guatemala","country_name":"Guatemala","country_code":"GT"},{"id":"053415fa-f1e4-4998-9497-dd6270a79e68","name":"Honduras","country_name":"Honduras","country_code":"HN"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"43a5a379-e1ee-4ec4-ae63-7d556e25f120","name":"Jamaica","country_name":"Jamaica","country_code":"JM"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"8faae3de-c64e-4d6f-a226-669f773e4341","name":"Mali","country_name":"Mali","country_code":"ML"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"b3b49312-69e9-426b-b18e-268bbf39f129","name":"Montenegro","country_name":"Montenegro","country_code":"ME"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"c43cd6e5-932a-41c4-a1c6-c517fda79660","name":"Panama","country_name":"Panama","country_code":"PA"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"1cdaf0b5-6ad2-4321-8145-7fccb5bbd59f","name":"Slovakia","country_name":"Slovakia","country_code":"SK"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"2a528093-177d-468f-a83b-e270ca22f0ab","name":"Syrian Arab Republic","country_name":"Syrian Arab Republic","country_code":"SY"},{"id":"a3f0a03c-d2c4-41f0-87e7-b9bb0aa037dd","name":"Trinidad and Tobago","country_name":"Trinidad and Tobago","country_code":"TT"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"}],"associated_groups":[{"id":"54d5de05-eb9c-43ed-a842-9ea5febf0f07","name":"Vixen Panda","description":"<sup>[[NCC Group APT15 Alive and Strong](https://app.tidalcyber.com/references/02a50445-de06-40ab-9ea4-da5c37e066cd)]</sup><sup>[[APT15 Intezer June 2018](https://app.tidalcyber.com/references/0110500c-bf67-43a5-97cb-16eb6c01040b)]</sup>","source":"MITRE","associated_group_id":"3c0dfd27-fc7a-48c5-a431-6f62f3f9319a","owner_id":null,"owner_name":null},{"id":"9d256af2-5d63-46f0-8955-d92fa9de9fad","name":"Playful Dragon","description":"<sup>[[NCC Group APT15 Alive and Strong](https://app.tidalcyber.com/references/02a50445-de06-40ab-9ea4-da5c37e066cd)]</sup><sup>[[APT15 Intezer June 2018](https://app.tidalcyber.com/references/0110500c-bf67-43a5-97cb-16eb6c01040b)]</sup>","source":"MITRE","associated_group_id":"6231a5a9-ca9a-435e-abf3-a78478484513","owner_id":null,"owner_name":null},{"id":"80510930-523c-4f80-8be0-f150a2811b06","name":"GREF","description":"<sup>[[NCC Group APT15 Alive and Strong](https://app.tidalcyber.com/references/02a50445-de06-40ab-9ea4-da5c37e066cd)]</sup>","source":"MITRE","associated_group_id":"85d23b10-4d88-41b5-a1e6-628faf4dfcdd","owner_id":null,"owner_name":null},{"id":"85d2f1ad-bd89-4bd4-96b9-59372240393c","name":"APT15","description":"<sup>[[NCC Group APT15 Alive and Strong](https://app.tidalcyber.com/references/02a50445-de06-40ab-9ea4-da5c37e066cd)]</sup>","source":"MITRE","associated_group_id":"fa320745-a2e5-4f54-8cb6-c0056e18805e","owner_id":null,"owner_name":null},{"id":"852e49f7-6e42-4cc9-b642-4033cf7731c2","name":"NICKEL","description":"<sup>[[Microsoft NICKEL December 2021](https://app.tidalcyber.com/references/29a46bb3-f514-4554-ad9c-35f9a5ad9870)]</sup>","source":"MITRE","associated_group_id":"dac81780-75d0-4e20-91a5-d6f9f4e21de3","owner_id":null,"owner_name":null},{"id":"5ea8cd55-276b-4ef0-bfcd-cab7fc2f6e3d","name":"RoyalAPT","description":"<sup>[[APT15 Intezer June 2018](https://app.tidalcyber.com/references/0110500c-bf67-43a5-97cb-16eb6c01040b)]</sup>","source":"MITRE","associated_group_id":"53e4969e-6d5f-447a-b589-cf4ec546985b","owner_id":null,"owner_name":null},{"id":"6269d7b4-0684-40b5-b50d-2ec1208f2283","name":"Mirage","description":"<sup>[[NCC Group APT15 Alive and Strong](https://app.tidalcyber.com/references/02a50445-de06-40ab-9ea4-da5c37e066cd)]</sup>","source":"MITRE","associated_group_id":"95a17f0a-d6ca-4d82-add7-96f97104a471","owner_id":null,"owner_name":null},{"id":"6a54513c-f45d-51fd-ac95-29e4d0dc6e98","name":"Nylon Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"9bb097e8-ed01-5286-a5fc-9ebbe0403373","owner_id":null,"owner_name":null}],"tags":[{"id":"85c82fad-40cf-4574-b377-e58bfec904c0","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":null},{"id":"004c96a7-5a1a-41b1-913e-547ce346b03e","name":"Kelvin Security","source":"Tidal Cyber","group_attack_id":"G3195","created":"2026-01-06T18:04:03.021189Z","modified":"2026-01-06T18:04:03.021193Z","tidal_id":"ccb286d9-27ac-59e1-81f0-5d9f6c87a0de","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"b9c2449f-baab-41a7-8a6e-056ecafb4567","name":"CURIOUS JACKAL","description":"<sup>[[CrowdStrike CURIOUS JACKAL Profile](/references/7431df54-3d21-4d8f-9337-83d3e5ecb988)]</sup>","source":"USER","associated_group_id":"b6ef2bea-d142-45e4-9bb2-d2f53fbf0df4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"46eaccf3-b39e-4046-9752-d87a78dfab4d","name":"KelvinSecTeam","description":"<sup>[[CrowdStrike CURIOUS JACKAL Profile](/references/7431df54-3d21-4d8f-9337-83d3e5ecb988)]</sup>","source":"USER","associated_group_id":"91486be3-3dc6-4cfa-846f-67aa601bd7fd","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9be8dcf3-2892-4d15-a894-281bcc81757d","name":"Kelvin Security Team","description":"<sup>[[Cybertrainer.uk December 12 2023](/references/c945046b-c266-4646-85ab-0573f86f0a9d)]</sup>","source":"USER","associated_group_id":"b1df3b47-0d93-4185-ab7d-db98bf7f54d2","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d60517b3-bb43-4d63-b450-207edf70271d","name":"ATK140","description":"<sup>[[Cybertrainer.uk December 12 2023](/references/c945046b-c266-4646-85ab-0573f86f0a9d)]</sup>","source":"USER","associated_group_id":"cf6cfa7f-186b-4a40-bc88-09e6b2d0bd3d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"41358c18-69ef-43d7-af95-edc8de603596","name":"KelvinSec Team","description":"<sup>[[Cybertrainer.uk December 12 2023](/references/c945046b-c266-4646-85ab-0573f86f0a9d)]</sup>","source":"USER","associated_group_id":"409ecd2d-22ff-430a-8912-decad41594ba","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"f4a3d6ed-821a-4180-aa23-5993a08c924d","name":"KelvinSecTeamGobVe","description":"<sup>[[Cybertrainer.uk December 12 2023](/references/c945046b-c266-4646-85ab-0573f86f0a9d)]</sup>","source":"USER","associated_group_id":"8d696df2-3310-43e0-822b-302f4aa301d4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7ddbcc19-e76f-4dd0-bb99-c7eb9ddb0196","name":"TAG-CR6","description":"<sup>[[Cybertrainer.uk December 12 2023](/references/c945046b-c266-4646-85ab-0573f86f0a9d)]</sup>","source":"USER","associated_group_id":"0205e6dc-a74c-4f08-8a40-f6813499a92e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"fc8b4e1b-0960-4230-816b-0d7e0e866ce5","name":"KelvinSecurity","description":"<sup>[[Cybertrainer.uk December 12 2023](/references/c945046b-c266-4646-85ab-0573f86f0a9d)]</sup>","source":"USER","associated_group_id":"9c9d443f-0aa8-4ae9-b1a5-68d4a1998a3c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"8f13cdcd-7a2c-4072-ac28-42b6bdaff403","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"640fe2a7-73dc-4849-8b7f-6bae0be10356","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"35fb7663-5c5d-43fe-a507-49612aa7960e","name":"Killnet","source":"Tidal Cyber","group_attack_id":"G3022","created":"2023-10-10T20:48:48.205284Z","modified":"2023-10-10T20:48:48.205288Z","tidal_id":"d8d2f246-493e-5d45-9cad-bc7aea6148b7","country":[],"observed_motivation":[],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"502bfac5-4240-421a-820b-4cb62e15f934","name":"Estonia","country_name":"Estonia","country_code":"EE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"7f97bcd3-5e42-4203-afab-fdfbfc003b03","tag":"62bde669-3020-4682-be68-36c83b2588a4"}],"owner_name":"TidalCyberIan"},{"id":"0ed0c954-780d-46a7-a955-f1f4dc91f0ac","name":"KillSec","source":"Tidal Cyber","group_attack_id":"G3065","created":"2024-11-25T18:01:03.070075Z","modified":"2024-11-25T18:01:03.070082Z","tidal_id":"bed868cd-4d54-5ac6-a95d-84bf76a63dec","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"9b4e157d-9468-411e-bdc9-efa47e4829fc","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"134dea71-7e89-4b4d-8e08-b9367ca97d5b","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"78337c10-afe4-41a7-9965-2b76a739c021","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"cf193582-3d27-497c-8f78-c9209cb1df23","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c3515a9d-7d34-4288-9fc3-6704a7ca147e","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"37f317d8-02f0-43d4-8a7d-7a65ce8aadf1","name":"Kimsuky","source":"MITRE","group_attack_id":"G0094","created":"2019-08-26T15:03:02.577000Z","modified":"2022-05-24T16:28:34.698000Z","tidal_id":"4ae0d883-6626-55da-88b9-7acb66196636","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[{"id":"01f48158-44ef-5dbb-8b8a-652f75f2546f","name":"Emerald Sleet","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup><sup>[[Proofpoint TA427 April 2024](https://app.tidalcyber.com/references/620f5ff7-26c0-55c4-9b1b-c56ad2e1316b)]</sup>","source":"MITRE","associated_group_id":"e68a4206-86b6-5afe-a0de-89ae07a2d4aa","owner_id":null,"owner_name":null},{"id":"7e398a52-c8ba-44be-ac42-e8c002cb7833","name":"Black Banshee","description":"<sup>[[Cybereason Kimsuky November 2020](https://app.tidalcyber.com/references/ecc2f5ad-b2a8-470b-b919-cb184d12d00f)]</sup><sup>[[Malwarebytes Kimsuky June 2021](https://app.tidalcyber.com/references/9a497c56-f1d3-4889-8c1a-14b013f14668)]</sup>","source":"MITRE","associated_group_id":"983f8775-5730-4400-92b3-ef3643b2b33c","owner_id":null,"owner_name":null},{"id":"132b93a4-31e4-4ddf-9138-1c14b8405ece","name":"Velvet Chollima","description":"<sup>[[Zdnet Kimsuky Dec 2018](https://app.tidalcyber.com/references/b17acdc3-0163-4c98-b5fb-a457a7e6b58d)]</sup><sup>[[ThreatConnect Kimsuky September 2020](https://app.tidalcyber.com/references/45d64462-2bed-46e8-ac52-9d4914608a93)]</sup><sup>[[Malwarebytes Kimsuky June 2021](https://app.tidalcyber.com/references/9a497c56-f1d3-4889-8c1a-14b013f14668)]</sup>","source":"MITRE","associated_group_id":"983d7efc-068e-41b2-96da-524af88985a8","owner_id":null,"owner_name":null},{"id":"896d9a87-8a34-51e4-b637-2569300492f1","name":"TA427","description":"<sup>[[Proofpoint TA427 April 2024](https://app.tidalcyber.com/references/620f5ff7-26c0-55c4-9b1b-c56ad2e1316b)]</sup>","source":"MITRE","associated_group_id":"8e8158d4-69cf-5eb4-a4de-5b9cf4a4bc70","owner_id":null,"owner_name":null},{"id":"a3d110c7-a120-459c-9784-7637c987f9c7","name":"APT43","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"a9a85c3a-7136-430e-b7ee-cbca92d7f4d2","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"45a2acc4-d26f-443d-9dd2-2f6e1bda9ff4","name":"TA406","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"43860e2e-6600-4c45-80ed-343fd1ba1fc8","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"34cce42b-0471-533d-9a51-6865416a5706","name":"APT43","description":"<sup>[[Mandiant APT43 March 2024](https://app.tidalcyber.com/references/8ac3fd0a-4a93-5262-9ac2-f676c5d11fda)]</sup><sup>[[Proofpoint TA427 April 2024](https://app.tidalcyber.com/references/620f5ff7-26c0-55c4-9b1b-c56ad2e1316b)]</sup>","source":"MITRE","associated_group_id":"bbbdeb1a-7587-4b8b-ae10-4e1c735d401f","owner_id":null,"owner_name":null},{"id":"1de6e14e-ff24-5f18-ac4b-b5d310f663db","name":"THALLIUM","description":"<sup>[[Cybereason Kimsuky November 2020](https://app.tidalcyber.com/references/ecc2f5ad-b2a8-470b-b919-cb184d12d00f)]</sup><sup>[[Malwarebytes Kimsuky June 2021](https://app.tidalcyber.com/references/9a497c56-f1d3-4889-8c1a-14b013f14668)]</sup><sup>[[Mandiant APT43 March 2024](https://app.tidalcyber.com/references/8ac3fd0a-4a93-5262-9ac2-f676c5d11fda)]</sup><sup>[[Proofpoint TA427 April 2024](https://app.tidalcyber.com/references/620f5ff7-26c0-55c4-9b1b-c56ad2e1316b)]</sup>","source":"MITRE","associated_group_id":"e8128269-22ec-5757-b6ca-c0b43841f3d0","owner_id":null,"owner_name":null},{"id":"1c54fcc7-f8ea-5c64-bf08-7c143ee002b6","name":"Springtail","description":"<sup>[[Symantec Troll Stealer 2024](https://app.tidalcyber.com/references/ebb98b4b-062a-5b48-8318-e5f1244f907c)]</sup>","source":"MITRE","associated_group_id":"ed4e26a6-339e-500d-a247-1a0194fa2f8f","owner_id":null,"owner_name":null}],"tags":[{"id":"a76e58bc-999e-4eac-a82c-e8e04a4071ae","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"50be09b4-4213-45ad-81af-b43b8e8d655c","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"32c21d40-fd3f-4e06-bf0e-fd21e9fbe8a0","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"5e4ebf89-ab31-4ee9-9ad5-df3b0d70c3ed","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":null},{"id":"a0202bc8-abe6-42c1-ac84-1dc27b9e322f","name":"KongTuke","source":"Tidal Cyber","group_attack_id":"G3213","created":"2026-01-23T20:30:07.830568Z","modified":"2026-01-23T20:30:07.830572Z","tidal_id":"eb40836c-064f-5709-a772-0ffb770b2325","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"61acbcaa-dfd6-40a3-880a-98a03383b04c","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"efe69862-a5e0-4777-81b0-8f2208247977","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"194b894b-a0f9-4709-afd3-f4f802b13259","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a80e53d4-bd56-4d15-88a3-b375c60d64a1","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"b44bce1c-76d9-4312-9b75-205740813607","name":"Kraken","source":"Tidal Cyber","group_attack_id":"G3153","created":"2025-12-10T14:14:11.640344Z","modified":"2025-12-10T14:14:11.640347Z","tidal_id":"4572b5e6-b26e-5d10-93b5-3e1d31e299e6","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"c43cd6e5-932a-41c4-a1c6-c517fda79660","name":"Panama","country_name":"Panama","country_code":"PA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[],"associated_groups":[],"tags":[{"id":"77615da4-a2ba-4f79-bce8-306048d9e7e1","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"e3c6eb8a-b4d3-463b-8be8-7d74ba3649fb","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"5a01b0d2-0e14-4787-991c-719c2520bf30","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"f6882666-f078-43af-a4c9-3bc3c40259d3","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c49ad0bc-7546-493c-b021-187dae8093f3","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"0060bb76-6713-4942-a4c0-d4ae01ec2866","name":"LAPSUS$","source":"MITRE","group_attack_id":"G1004","created":"2022-06-09T19:14:31.327000Z","modified":"2022-10-12T12:21:38.612000Z","tidal_id":"68a3e5a5-c0e5-5e53-abc1-e91617b41567","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"0c1bf460-0c44-4fd4-94e3-4f6dbf3c3595","name":"DEV-0537","description":"<sup>[[MSTIC DEV-0537 Mar 2022](https://app.tidalcyber.com/references/a9ce7e34-6e7d-4681-9869-8e8f2b5b0390)]</sup>","source":"MITRE","associated_group_id":"fc95e9b7-ae40-4a2f-b1f6-a42facc3c237","owner_id":null,"owner_name":null},{"id":"58cd0477-1d61-5ff9-89a9-0d1193d50207","name":"Strawberry Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"a4b023ae-7a49-5340-ac18-9bf619987d52","owner_id":null,"owner_name":null},{"id":"72947097-795d-4315-8c5b-efca5982860e","name":"DEV-0537","description":"<sup>[[MSTIC DEV-0537 Mar 2022](https://app.tidalcyber.com/references/a9ce7e34-6e7d-4681-9869-8e8f2b5b0390)]</sup>","source":"Mobile","associated_group_id":"fc95e9b7-ae40-4a2f-b1f6-a42facc3c237","owner_id":null,"owner_name":null},{"id":"1289282f-166a-4b47-981d-6fe1cdde6126","name":"Strawberry Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"a4b023ae-7a49-5340-ac18-9bf619987d52","owner_id":null,"owner_name":null}],"tags":[{"id":"2ee706f5-b071-4567-94e5-da6a81017804","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"e6cc1976-9f82-4f11-bb9f-d0517c61b105","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"a1413a11-196f-478a-8015-adb88f17494f","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"8d882872-35ca-44ca-ba47-4596a5fcc4b5","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"513e895f-9ce8-4639-bfce-aa5d990f12c4","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"8f89ffa5-50bd-4a85-b70c-fc6333f9c25a","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"53869520-c0fd-43aa-b6fc-7396bc8f50c5","tag":"5e7433ad-a894-4489-93bc-41e90da90019"}],"owner_name":null},{"id":"0bc66e95-de93-4de7-b415-4041b7191f08","name":"Lazarus Group","source":"MITRE","group_attack_id":"G0032","created":"2017-05-31T21:32:03.807000Z","modified":"2022-08-23T15:30:44.196000Z","tidal_id":"af41b4a5-63dd-5c96-a41e-1844a8d08b69","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"},{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"}],"associated_groups":[{"id":"6d6d0a15-350e-442b-bbe8-cfc28f40b9e0","name":"HIDDEN COBRA","description":"The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.<sup>[[US-CERT HIDDEN COBRA June 2017](https://app.tidalcyber.com/references/8e57cea3-ee37-4507-bb56-7445050ec8ca)]</sup><sup>[[US-CERT HOPLIGHT Apr 2019](https://app.tidalcyber.com/references/e722b71b-9042-4143-a156-489783d86e0a)]</sup>","source":"MITRE","associated_group_id":"df5caef8-2e25-4ddd-ae58-2c9ad119834d","owner_id":null,"owner_name":null},{"id":"142273a2-ed90-4ba2-8375-bdc3398a7db5","name":"Diamond Sleet","description":"","source":"Tidal Cyber","associated_group_id":"972c0eea-6037-4aac-ac22-e1e991898dcb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1368099b-eada-476e-a752-244afa2c9d16","name":"Citrine Sleet","description":"<sup>[[Microsoft Security Blog August 30 2024](/references/d7ef2e80-30c0-47ce-91d4-db1690c6c689)]</sup>","source":"Tidal Cyber","associated_group_id":"f87b153e-1d5f-4d26-a698-d0516a450f61","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1e0b5557-5aca-46ab-942f-b32a3bba3650","name":"DEV-0139","description":"<sup>[[Microsoft DEV-0139 December 6 2022](/references/f9c070f1-aa83-45a3-bffb-c90f4caf5926)]</sup>","source":"Tidal Cyber","associated_group_id":"c78b6d97-a29c-4648-ae0e-e23550c1bf9f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b9932f9d-b2ba-59a7-8544-33e92f9163da","name":"Diamond Sleet","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"9f1f3d1a-8246-4fe0-a351-9020d5c6b4cc","owner_id":null,"owner_name":null},{"id":"00f50f21-fee3-4328-b628-5e0096489cea","name":"NICKEL ACADEMY","description":"<sup>[[Secureworks NICKEL ACADEMY Dec 2017](https://app.tidalcyber.com/references/aa7393ad-0760-4f27-a068-17beba17bbe3)]</sup>","source":"MITRE","associated_group_id":"b7b671c3-2339-4521-a12d-b57821ad5c12","owner_id":null,"owner_name":null},{"id":"2a2d3baf-5277-43cc-9209-abffd7cc4529","name":"Labyrinth Chollima","description":"<sup>[[CrowdStrike Labyrinth Chollima Feb 2022](https://app.tidalcyber.com/references/ffe31bbf-a40d-4285-96a0-53c54298a680)]</sup>","source":"MITRE","associated_group_id":"a7be1337-efab-48a8-9bf4-6f300291d150","owner_id":null,"owner_name":null},{"id":"f01a88d1-c368-48ca-a8f6-30286ed86e4b","name":"Guardians of Peace","description":"<sup>[[US-CERT HIDDEN COBRA June 2017](https://app.tidalcyber.com/references/8e57cea3-ee37-4507-bb56-7445050ec8ca)]</sup>","source":"MITRE","associated_group_id":"618bd388-b295-4076-a63e-c1e2515dab4e","owner_id":null,"owner_name":null},{"id":"63a91edc-9911-42e9-9970-a3f77fda65a9","name":"ZINC","description":"<sup>[[Microsoft ZINC disruption Dec 2017](https://app.tidalcyber.com/references/99831838-fc8f-43fa-9c87-6ccdf5677c34)]</sup>","source":"MITRE","associated_group_id":"4fc58da4-8398-43f9-b037-fd873ed5864e","owner_id":null,"owner_name":null},{"id":"e2ce820b-fa7a-43ff-82b5-085c84e2eed3","name":"Labyrinth Chollima","description":"<sup>[[CrowdStrike Labyrinth Chollima Feb 2022](https://app.tidalcyber.com/references/ffe31bbf-a40d-4285-96a0-53c54298a680)]</sup>","source":"ICS","associated_group_id":"a7be1337-efab-48a8-9bf4-6f300291d150","owner_id":null,"owner_name":null},{"id":"6d9c233b-8b28-447b-942a-8c5b0adf19a9","name":"Guardians of Peace","description":"<sup>[[US-CERT HIDDEN COBRA June 2017](https://app.tidalcyber.com/references/8e57cea3-ee37-4507-bb56-7445050ec8ca)]</sup>","source":"ICS","associated_group_id":"618bd388-b295-4076-a63e-c1e2515dab4e","owner_id":null,"owner_name":null},{"id":"efdd82bc-8669-4699-8125-145aba2fd17c","name":"ZINC","description":"<sup>[[Microsoft ZINC disruption Dec 2017](https://app.tidalcyber.com/references/99831838-fc8f-43fa-9c87-6ccdf5677c34)]</sup>","source":"ICS","associated_group_id":"4fc58da4-8398-43f9-b037-fd873ed5864e","owner_id":null,"owner_name":null},{"id":"b367ca8a-37f8-4341-ab2b-37a7b32a6be1","name":"NICKEL ACADEMY","description":"<sup>[[Secureworks NICKEL ACADEMY Dec 2017](https://app.tidalcyber.com/references/aa7393ad-0760-4f27-a068-17beba17bbe3)]</sup>","source":"ICS","associated_group_id":"b7b671c3-2339-4521-a12d-b57821ad5c12","owner_id":null,"owner_name":null},{"id":"5bc50769-983a-40c8-a5b8-ea9a9a8ecb86","name":"HIDDEN COBRA","description":"The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.<sup>[[US-CERT HIDDEN COBRA June 2017](https://app.tidalcyber.com/references/8e57cea3-ee37-4507-bb56-7445050ec8ca)]</sup><sup>[[US-CERT HOPLIGHT Apr 2019](https://app.tidalcyber.com/references/e722b71b-9042-4143-a156-489783d86e0a)]</sup>","source":"ICS","associated_group_id":"df5caef8-2e25-4ddd-ae58-2c9ad119834d","owner_id":null,"owner_name":null},{"id":"55bbb79e-5194-4397-96c9-3473d3446df7","name":"Diamond Sleet","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"9f1f3d1a-8246-4fe0-a351-9020d5c6b4cc","owner_id":null,"owner_name":null}],"tags":[{"id":"843fd6f7-4981-4544-b3a2-34174c4ef628","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"},{"id":"44cb79f7-aef0-4da0-84ca-81a9424c3ebd","tag":"95b66dc5-2f49-4b82-8f03-c3eaa579085b"},{"id":"1d41eeb5-d157-4e71-8d06-c0d53eaa125c","tag":"a38ef717-4427-4aa0-9666-bb97c6ff45f3"},{"id":"ae6d64b1-135d-42c6-b809-5501586f8b60","tag":"b9c973c9-062d-4cbd-8bfe-98d0b4e547eb"},{"id":"a3ae6a3b-86ba-41f8-ae7e-e24dcf1d6727","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"0ca9ee57-7331-4baf-a022-f61481b938bd","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"aaf52a34-242b-4014-9b80-f900fc8bae70","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"}],"owner_name":null},{"id":"12279b62-289e-49ee-97cb-c780edd3d091","name":"LazyScripter","source":"MITRE","group_attack_id":"G0140","created":"2021-11-24T19:26:27.305000Z","modified":"2022-04-15T19:09:59.211000Z","tidal_id":"0a13ee42-f6c7-54a1-8e46-9b848cdba2ca","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"b5c28235-d441-40d9-8da2-d49ba2f2568b","name":"Leafminer","source":"MITRE","group_attack_id":"G0077","created":"2018-10-17T00:14:20.652000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"074075ff-2a78-5fc1-8da3-6a78c923abf9","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"8f5e7cb9-6aa8-4115-ab23-fbc6bf4fc287","name":"Raspite","description":"<sup>[[Dragos Raspite Aug 2018](https://app.tidalcyber.com/references/bf4ccd52-0a03-41b6-bde7-34ead90171c3)]</sup>","source":"MITRE","associated_group_id":"044d8fd0-faad-4e9f-bc5a-807e7147a331","owner_id":null,"owner_name":null}],"tags":[{"id":"2c2a5bb8-258f-4858-bef8-17094ad89bb4","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"d31d19ac-6ee7-4e7c-9858-99ef8454afa5","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"}],"owner_name":null},{"id":"eadd78e3-3b5d-430a-b994-4360b172c871","name":"Leviathan","source":"MITRE","group_attack_id":"G0065","created":"2018-04-18T17:59:24.739000Z","modified":"2022-04-15T15:15:51.198000Z","tidal_id":"581d45e0-1ac8-519f-b2d6-4356817c45c2","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"156ac67f-c989-40a6-80bd-2273bae6e46e","name":"APT40","description":"FireEye reporting on TEMP.Periscope (which was combined into APT40) indicated TEMP.Periscope was reported upon as Leviathan.<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[Proofpoint Leviathan Oct 2017](https://app.tidalcyber.com/references/f8c2b67b-c097-4b48-8d95-266a45b7dd4d)]</sup><sup>[[FireEye Periscope March 2018](https://app.tidalcyber.com/references/8edb5d2b-b5c4-4d9d-8049-43dd6ca9ab7f)]</sup><sup>[[FireEye APT40 March 2019](https://app.tidalcyber.com/references/8a44368f-3348-4817-aca7-81bfaca5ae6d)]</sup>","source":"MITRE","associated_group_id":"06d1c9bb-8951-4e14-a775-9a248d6390cf","owner_id":null,"owner_name":null},{"id":"bb7b96da-5773-4314-af76-c9125e49ec76","name":"Kryptonite Panda","description":"<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[Crowdstrike KRYPTONITE PANDA August 2018](https://app.tidalcyber.com/references/42fe94f5-bc4c-4b0b-9c35-0bc32cbc5d79)]</sup>","source":"MITRE","associated_group_id":"e7a109ad-fa21-4fcf-a1fb-2a497146db2b","owner_id":null,"owner_name":null},{"id":"c86cf832-0c84-4960-a735-26c763fb9d37","name":"MUDCARP","description":"<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[Accenture MUDCARP March 2019](https://app.tidalcyber.com/references/811d433d-27a4-4411-8ec9-b3a173ba0033)]</sup>","source":"MITRE","associated_group_id":"97a136d2-2bb1-44ed-a33b-cf87374b24a7","owner_id":null,"owner_name":null},{"id":"136d0c84-2b3e-4c11-bb58-532ac281b6b3","name":"ISLANDDREAMS","description":"<sup>[[Google TAG CVE-2023-38831 October 18 2023](/references/6e8fb629-4bb8-4557-9d42-385060be598f)]</sup>","source":"Tidal Cyber","associated_group_id":"8f207471-7c73-4ac2-b2c0-e83a773799cc","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"bf460be9-8968-4e1e-ad4e-8217a9878636","name":"BRONZE MOHAWK","description":"<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[SecureWorks BRONZE MOHAWK n.d.](https://app.tidalcyber.com/references/b741fe9a-4b08-44b9-b6e7-5988eee486a3)]</sup>","source":"MITRE","associated_group_id":"5b71f978-8056-47a9-b4f9-d2520fc396a0","owner_id":null,"owner_name":null},{"id":"327de388-915c-4457-9508-99fb0916a1cd","name":"TEMP.Periscope","description":"[Leviathan](https://app.tidalcyber.com/groups/eadd78e3-3b5d-430a-b994-4360b172c871) was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[FireEye Periscope March 2018](https://app.tidalcyber.com/references/8edb5d2b-b5c4-4d9d-8049-43dd6ca9ab7f)]</sup><sup>[[FireEye APT40 March 2019](https://app.tidalcyber.com/references/8a44368f-3348-4817-aca7-81bfaca5ae6d)]</sup>","source":"MITRE","associated_group_id":"58f19fca-8c3b-424a-8e1d-cb3996f36417","owner_id":null,"owner_name":null},{"id":"100c99e9-8cd0-4b27-8707-c42ca0b70acb","name":"TEMP.Jumper","description":"[Leviathan](https://app.tidalcyber.com/groups/eadd78e3-3b5d-430a-b994-4360b172c871) was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[FireEye APT40 March 2019](https://app.tidalcyber.com/references/8a44368f-3348-4817-aca7-81bfaca5ae6d)]</sup>","source":"MITRE","associated_group_id":"c9c9a804-2635-4a47-b63c-9ad5363454a3","owner_id":null,"owner_name":null},{"id":"24c17a66-3c9f-5be2-b06e-254a7454fa1a","name":"Gingham Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"2a2f264d-1c6c-592f-a320-dacf2f5720e3","owner_id":null,"owner_name":null},{"id":"a028aacc-e48b-4418-ba6b-7e7d52e4bebb","name":"Gadolinium","description":"<sup>[[CISA AA21-200A APT40 July 2021](https://app.tidalcyber.com/references/3a2dbd8b-54e3-406a-b77c-b6fae5541b6d)]</sup><sup>[[MSTIC GADOLINIUM September 2020](https://app.tidalcyber.com/references/ee352214-421f-4778-ac28-949142a8ef2a)]</sup>","source":"MITRE","associated_group_id":"82ac97dc-8c3e-4fd1-a7a1-76b8513143e1","owner_id":null,"owner_name":null}],"tags":[{"id":"e2caa82e-c770-4830-bdfd-f57b4974d3a7","tag":"96d58ca1-ab18-4e53-8891-d8ba62a47e5d"},{"id":"320aa43b-2861-4a5f-b457-759852385d0f","tag":"6070668f-1cbd-4878-8066-c636d1d8659c"},{"id":"2db472c0-dda4-4cee-a4c9-304deab61948","tag":"d8f7e071-fbfd-46f8-b431-e241bb1513ac"},{"id":"0144600f-a3ef-4396-bfee-f7d38d4d1040","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"5e967dac-faea-47f6-988b-4baa465cc4e1","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"4c123585-0bbd-47ad-afa3-b5e46042afc7","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"6e1de226-adc5-4f1a-97b5-8efdde881017","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"345a62f7-2285-43b8-98cc-7e2c332f204c","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"2104e117-5abf-41e0-a7dd-88e091c280bb","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"58f19290-a266-417e-82dc-e99cf1d65111","tag":"ee3188ce-20e9-4e8e-bbfd-cdc527d5a2b2"},{"id":"75165964-3c61-4342-afb3-25360bb6850e","tag":"a10eccee-317c-40f7-988f-f79517cf42e8"},{"id":"f4a017bc-5f82-43df-bd6d-04545fec47ad","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"1fd87f04-fe6e-4881-9dfd-8f153eaf0896","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"d4cc9bfb-3f8b-4480-9be6-c8a2fe0e6847","tag":"a46c422c-5dad-49fc-a4ac-169a075a4d9a"},{"id":"cb2408a5-e97a-431b-ad26-6c391c0ba1e6","tag":"2eeef0b4-08b5-4d25-84f7-25d41fe6305b"},{"id":"0c21391e-30bb-43cb-bf90-ae77a51a9be5","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"27e2c0b1-3e0f-42da-9d03-0fcbefb60f41","tag":"7e6ef160-8e4f-4132-bdc4-9991f01c472e"},{"id":"0983fb67-8278-4c99-96d1-8ea9aeafb753","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"}],"owner_name":null},{"id":"f9f9358a-f708-4794-af35-784c532427cf","name":"LIMINAL PANDA","source":"Tidal Cyber","group_attack_id":"G3070","created":"2025-02-03T21:08:38.172549Z","modified":"2025-02-03T21:08:38.172554Z","tidal_id":"332d2e6a-470e-5b25-adbc-2405ee79df86","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"39d98d2f-b835-4828-8659-965cc066164d","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"54ddc7be-63f0-4edd-8618-5665285d3d8a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"9554bd84-9e8d-4ad9-afa9-273304b46f18","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d0f3353c-fbdd-4bd5-8793-a42e1f319b59","name":"LockBit Ransomware Actors & Affiliates","source":"Tidal Cyber","group_attack_id":"G3013","created":"2023-08-18T18:56:16.823203Z","modified":"2023-08-18T18:56:16.823210Z","tidal_id":"fd120c80-874d-5a02-89a4-1eb716fd5f71","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"b2f86534-0c1e-4c6a-81af-7c4f9f9bc3dc","name":"Water Selkie","description":"<sup>[[Trend Micro LockBit Spotlight February 08 2023](/references/f72dade0-ec82-40e7-96a0-9f124d59bd35)]</sup>","source":"Tidal Cyber","associated_group_id":"d35be61a-d6d9-4572-8d1f-60367e982f88","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"74b6c38e-020c-46b2-a327-9102c4658b9a","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"e448da4a-d463-46e9-8f1b-c1239901a3ba","tag":"b5536626-d6ba-40cf-a3a2-17b9cd8eb0f5"},{"id":"70b04c51-a9e1-498c-9ddd-28567c51bd82","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"b01479e7-59ac-4bb0-b8ae-8f72b9166923","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"f86e3c4d-0573-4c07-9451-34db3154645d","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"e4116e7f-02b2-4a50-a540-da89e924cbe2","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"1a32a55a-4a4d-4333-9631-0c973b61b7ff","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"2969197a-f6b6-40ed-837b-13226998ae66","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"59be0615-019e-4457-a3b7-ce41f98fb5c9","tag":"793f4441-3916-4b3d-a3fd-686a59dc3de2"},{"id":"994f4187-c0e3-4e88-8b52-92719848b749","tag":"1b5da77a-bf84-4fba-a6d7-8b3b8f7699e0"},{"id":"35302031-b394-4c96-8520-c9506eb36a3e","tag":"c79f7ba7-a2f2-43ff-8c78-521807ef6c92"},{"id":"938f3ab5-9354-4a0e-bd39-b5cd713251e0","tag":"3535caad-a155-4996-b986-70bc3cd5ce1e"},{"id":"139a7e7b-68a3-466c-a752-fb6cf91c1452","tag":"d713747c-2d53-487e-9dac-259230f04460"},{"id":"8c047c02-f089-46fa-99dd-064efef9424f","tag":"fde4c246-7d2d-4d53-938b-44651cf273f1"},{"id":"26c98b75-b1e9-4fc8-80e1-cae287eb4e1c","tag":"964c2590-4b52-48c6-afff-9a6d72e68908"},{"id":"c04c38c8-a49a-477d-859b-96f3c703dc6a","tag":"4fb4824e-1995-4c65-8c71-e818c0aa1086"},{"id":"9f3db81f-11d5-4865-bb1d-dbc7c9e5c78d","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"cc247dfb-dc55-4ec9-ac9c-fa51a8d4651a","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"02754053-0721-4fa0-af66-403e038bef12","tag":"2185ed93-7e1c-4553-9452-c8411b5dca93"},{"id":"6e1a1930-3807-4043-b6bd-bfddf2e252db","tag":"904ad11a-20ca-479c-ad72-74bd5d9dc7e4"},{"id":"c0dbe126-4edd-4e70-90d1-dda436525a51","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"bc573c7b-7889-4805-aeca-be2c62620c39","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"e386a47f-39b1-4ae3-9cfd-9704dd54cd0a","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"77cd6869-5ad9-4e49-bb3d-f3781ac2bd87","tag":"15b77e5c-2285-434d-9719-73c14beba8bd"},{"id":"d9f7bdfe-bde1-4d6a-aa15-2dc23506d6fe","tag":"1b98f09a-7d93-4abb-8f3e-1eacdb9f9871"},{"id":"b2dee130-fb10-4397-b3e1-5c65f04c8f05","tag":"ecd84106-2a5b-4d25-854e-b8d1f57f6b75"},{"id":"0e70c3b4-bb8d-4b84-958c-9d5f6f9795ef","tag":"2743d495-7728-4a75-9e5f-b64854039792"},{"id":"3f33bed1-998e-41cc-bbef-8b4a6492b4c8","tag":"7e6ef160-8e4f-4132-bdc4-9991f01c472e"},{"id":"f7e7c559-b932-4ae9-bda4-bdf5391077d1","tag":"992bdd33-4a47-495d-883a-58010a2f0efb"},{"id":"eb685593-0496-475e-9973-f2054e87408c","tag":"e401022a-36ac-486d-8503-dd531410a927"},{"id":"c9cc7789-4323-4637-9f13-fd98102ed82e","tag":"1a7cb7b6-d151-4fc6-8de1-78f244ac9f72"},{"id":"6f91d1b2-e908-4546-8c75-a5b7b0cf1b53","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"dd025805-4482-4160-b127-c935aabb80cc","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"963b6cb8-f99f-4d3e-b3e3-c02cdebf733a","name":"LongNosedGoblin","source":"Tidal Cyber","group_attack_id":"G3183","created":"2025-12-24T14:56:40.051770Z","modified":"2025-12-24T14:56:40.051773Z","tidal_id":"7dbacfac-d99e-598a-9e25-1d20e807f7da","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"203bf0fb-bf85-417d-80dc-3bd33aa39e58","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"b1b8434e-f0e6-430c-a048-4bb84c1553ca","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"5acffa1f-6ebf-417d-93e1-6bab3ccc93b2","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"ce746208-7618-4ca3-8434-e5cf62d38535","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"2849455a-cf39-4a9f-bd89-c2b3c1e5dd52","name":"Lotus Blossom","source":"MITRE","group_attack_id":"G0030","created":"2017-05-31T21:32:01.092000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"94f152d4-2351-504f-bc6f-d1858f9400bf","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"c02281b0-cb34-53f2-aaea-1bb50591ce4c","name":"Thrip","description":"<sup>[[Cisco LotusBlossom 2025](https://app.tidalcyber.com/references/9b7db916-e62f-5d7e-9574-a85198665a5a)]</sup>","source":"MITRE","associated_group_id":"5ed70202-12a8-513c-9b93-33c6fce63070","owner_id":null,"owner_name":null},{"id":"c724b990-5693-5b4d-ac5c-fdc4cd860337","name":"Bilbug","description":"<sup>[[Symantec Bilbug 2022](https://app.tidalcyber.com/references/0f4f0ac1-2a0b-56a5-9ea9-c5b2d1cb8c05)]</sup>","source":"MITRE","associated_group_id":"b65b871e-4419-5714-a3c2-c31af5840e4a","owner_id":null,"owner_name":null},{"id":"4ef7b110-f08d-4f76-b7f0-86dc2bfa7115","name":"APT30","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"3a22b8b8-69c8-4323-a34a-334e761a7792","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4a53965f-1fd9-412a-b603-9f2ead07787c","name":"LotusBlossom","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"6b8edd8c-71c0-4a9a-9ada-384cfd4962fa","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"23a3ac36-4e79-52ce-8636-bcd727379b71","name":"Raspberry Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"2ca110a8-4238-56b6-b7f9-42f722fc5e3e","owner_id":null,"owner_name":null},{"id":"aa9a2a90-7816-42c8-841d-b74d5dbefbc0","name":"Spring Dragon","description":"<sup>[[Spring Dragon Jun 2015](https://app.tidalcyber.com/references/2cc38587-a18e-47e9-a8bb-e3498e4737f5)]</sup><sup>[[Accenture Dragonfish Jan 2018](https://app.tidalcyber.com/references/f692c6fa-7b3a-4d1d-9002-b1a59f7116f4)]</sup>","source":"MITRE","associated_group_id":"68a87557-6166-4fd7-8a18-4a4e43f9b949","owner_id":null,"owner_name":null},{"id":"e128e7ff-b583-581a-a1f9-6fb7fd962f67","name":"RADIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"46686c14-f915-5d60-8f02-34d6069d7596","owner_id":null,"owner_name":null},{"id":"cbe77f7b-df76-434a-a3f4-a62ac9e13f57","name":"DRAGONFISH","description":"<sup>[[Accenture Dragonfish Jan 2018](https://app.tidalcyber.com/references/f692c6fa-7b3a-4d1d-9002-b1a59f7116f4)]</sup>","source":"MITRE","associated_group_id":"e2890e51-1bc8-4302-9251-149a3f547d36","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"b10aa4c0-10a1-5e08-8d9d-82ce95d45e6a","name":"LuminousMoth","source":"MITRE","group_attack_id":"G1014","created":"2023-05-26T01:20:56.844699Z","modified":"2023-05-26T01:20:56.844702Z","tidal_id":"eefb0440-0be1-5b24-b977-f063e0c9ba00","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"cca12ba9-f65f-4a29-87ab-a9fc0f99521f","name":"Luna Moth","source":"Tidal Cyber","group_attack_id":"G3042","created":"2024-06-28T17:23:23.142687Z","modified":"2024-06-28T17:23:23.142691Z","tidal_id":"d0eb2bfd-dac7-5d8f-91b5-10ac816e65b5","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[{"id":"79d0af0e-1964-4a81-817d-0d4e928e001e","name":"CHATTY SPIDER","description":"<sup>[[FBI Silent Ransom Group PIN May 23 2025](/references/9112728f-e507-4752-b4c7-3b03a719a983)]</sup>","source":"Tidal Cyber","associated_group_id":"65da5527-a2d9-4de0-ab68-6c29be448cd4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"932a5a87-84c2-4ac0-b4cd-7532c826c4d6","name":"UNC3753","description":"<sup>[[FBI Silent Ransom Group PIN May 23 2025](/references/9112728f-e507-4752-b4c7-3b03a719a983)]</sup>","source":"Tidal Cyber","associated_group_id":"a28f1a99-1a8e-4e37-8e8e-709baf924b29","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c7160212-f98d-4639-bc32-f7e0f3e890e5","name":"Silent Ransom Group","description":"<sup>[[FBI Ransomware Tools November 7 2023](/references/e096e1f4-6b62-4756-8811-f263cf1dcecc)]</sup>","source":"Tidal Cyber","associated_group_id":"678ed710-4a55-48c1-b62f-eccc5ab7b6f5","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"71a55824-efc3-4596-845e-3a3044c8ba7b","name":"SRG","description":"<sup>[[FBI Ransomware Tools November 7 2023](/references/e096e1f4-6b62-4756-8811-f263cf1dcecc)]</sup>","source":"Tidal Cyber","associated_group_id":"fa2ca2fd-ef98-452d-ad7d-f69c63e07e76","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ac37e678-5ada-41e6-bbaf-2da90c1f5a98","name":"TG2729","description":"<sup>[[Sygnia Luna Moth July 1 2022](/references/115590b2-ab57-432c-900e-000627464a11)]</sup>","source":"Tidal Cyber","associated_group_id":"e1c3dc08-ac6e-44ff-b4b7-640fa3e2ee26","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"07b6630e-8661-414e-974d-86eb3b7af631","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"423b2368-2726-4841-9361-e03b37021b91","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"a491506b-c511-4dbe-bef0-bdf6c433b1a1","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"4f495d47-f535-4c9c-9e43-f4042fe65171","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5425f89f-3679-45f4-bde3-8dae9448cf90","name":"LUNAR SPIDER","source":"Tidal Cyber","group_attack_id":"G3090","created":"2025-03-25T13:16:12.470764Z","modified":"2025-03-25T13:16:12.470766Z","tidal_id":"cacbee43-6049-5e25-9d1b-4561c7a4d053","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[{"id":"0b207aed-17dd-4368-a52f-427e568ccf9c","name":"GOLD SWATHMORE","description":"<sup>[[Secureworks GOLD SWATHMORE](/references/ed461683-cc69-4d15-bcc9-eeb61058ff4d)]</sup>","source":"Tidal Cyber","associated_group_id":"dcce93c4-43c6-4f72-bf0b-855f80a1bcea","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"9f686faa-7ba7-4a4e-8727-f3dcb2c59595","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a870f919-7580-4471-a4ba-c1744b3f2539","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a3be79a2-3d4f-4697-a8a1-83f0884220af","name":"Machete","source":"MITRE","group_attack_id":"G0095","created":"2019-09-13T12:37:10.394000Z","modified":"2021-10-06T19:26:47.988000Z","tidal_id":"eabc242d-7319-57b7-b0a1-270c64259bbe","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"21002808-4882-4bcf-9cf2-aa2d5a8e4abe","name":"Bolivia, Plurinational State of","country_name":"Bolivia","country_code":"BO"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"1c6e638b-8e75-4e5a-bb88-12a90386f2f4","name":"Cuba","country_name":"Cuba","country_code":"CU"},{"id":"6081d7f5-318b-47d4-bebe-eda4cd16d578","name":"Dominican Republic","country_name":"Dominican Republic","country_code":"DO"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"640088a5-d548-4bab-bf41-29c46ed813f6","name":"Guatemala","country_name":"Guatemala","country_code":"GT"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"125b9f74-e1c0-4256-af53-7ac8c7bdf2e9","name":"Nicaragua","country_name":"Nicaragua","country_code":"NI"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"2ad95cd1-e04c-4bad-877c-c96c5424cd7e","name":"APT-C-43","description":"<sup>[[360 Machete Sep 2020](https://app.tidalcyber.com/references/682c843d-1bb8-4f30-9d2e-35e8d41b1976)]</sup>","source":"MITRE","associated_group_id":"4656c093-80f5-4f33-a695-09180101d3d9","owner_id":null,"owner_name":null},{"id":"4ab530f5-0f57-47da-8e9b-c887220ed1ac","name":"El Machete","description":"<sup>[[Cylance Machete Mar 2017](https://app.tidalcyber.com/references/92a9a311-1e0b-4819-9856-2dfc8dbfc08d)]</sup>","source":"MITRE","associated_group_id":"b5f7c7c6-f079-4e6e-95a5-4fde667b9705","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"6f68bf2a-ddd6-45e4-9194-ec8fd8c98361","name":"Mad Liberator Ransomware Group","source":"Tidal Cyber","group_attack_id":"G3073","created":"2025-02-03T21:08:38.740530Z","modified":"2025-02-03T21:08:38.740537Z","tidal_id":"0c4d549d-fca2-5029-a6c2-912507b8d0a8","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"002fefbe-954c-470b-85f3-f18b2815c40f","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"ae5fe829-b714-49fd-8e3b-720fd37f2cbe","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"4dfe0259-b351-44d9-8436-960a35b4d09a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d9f4a373-49d9-4a49-8bc8-cf65f9f40c51","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"7a9d653c-8812-4b96-81d1-b0a27ca918b4","name":"Magic Hound","source":"MITRE","group_attack_id":"G0059","created":"2018-01-16T16:13:52.465000Z","modified":"2022-06-03T13:20:02.945000Z","tidal_id":"4d280797-31ec-541c-8c14-3bda7558cd38","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"2a528093-177d-468f-a83b-e270ca22f0ab","name":"Syrian Arab Republic","country_name":"Syrian Arab Republic","country_code":"SY"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"},{"id":"856c10c6-a475-4bbf-8f1d-1e06ccff8f2e","name":"Yemen","country_name":"Yemen","country_code":"YE"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"d6773afc-0476-408e-957a-ba7b97b41c58","name":"Phosphorus","description":"<sup>[[Microsoft Phosphorus Mar 2019](https://app.tidalcyber.com/references/c55a112d-4b05-4c32-a5b3-480b12929115)]</sup><sup>[[Microsoft Phosphorus Oct 2020](https://app.tidalcyber.com/references/8986c21c-16a0-4a53-8e37-9935bbbfaa4b)]</sup><sup>[[US District Court of DC Phosphorus Complaint 2019](https://app.tidalcyber.com/references/8f73a709-fb7e-4d9e-9743-4ba39ea26ea8)]</sup><sup>[[Certfa Charming Kitten January 2021](https://app.tidalcyber.com/references/c38a8af6-3f9b-40c3-8122-a2a51eb50664)]</sup><sup>[[Proofpoint TA453 March 2021](https://app.tidalcyber.com/references/5ba4217c-813b-4cc5-b694-3a4dcad776e4)]</sup><sup>[[Check Point APT35 CharmPower January 2022](https://app.tidalcyber.com/references/81dce660-93ea-42a4-902f-0c6021d30f59)]</sup>","source":"MITRE","associated_group_id":"618f578f-a73b-4f47-b123-8c3877325675","owner_id":null,"owner_name":null},{"id":"70db62b8-2214-4532-9880-4d8c7aabcdd4","name":"Newscaster","description":"Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the older attack campaign called Newscaster (aka Newscasters).<sup>[[Unit 42 Magic Hound Feb 2017](https://app.tidalcyber.com/references/f1ef9868-3ddb-4289-aa92-481c35517920)]</sup><sup>[[FireEye APT35 2018](https://app.tidalcyber.com/references/71d3db50-4a20-4d8e-a640-4670d642205c)]</sup>","source":"MITRE","associated_group_id":"1701d47b-d0ad-47dd-965e-0f50737c34ef","owner_id":null,"owner_name":null},{"id":"1b2d8360-2a44-4d81-bd85-a2d6d3881254","name":"COBALT ILLUSION","description":"<sup>[[Secureworks COBALT ILLUSION Threat Profile](https://app.tidalcyber.com/references/8d9a5b77-2516-4ad5-9710-4c8165df2882)]</sup>","source":"MITRE","associated_group_id":"9a6d6b98-17f3-445d-94dc-fb6e942245c3","owner_id":null,"owner_name":null},{"id":"4610784d-876d-46e5-ac9c-d8c40456706b","name":"Charming Kitten","description":"<sup>[[ClearSky Charming Kitten Dec 2017](https://app.tidalcyber.com/references/23ab1ad2-e9d4-416a-926f-6220a59044ab)]</sup><sup>[[Eweek Newscaster and Charming Kitten May 2014](https://app.tidalcyber.com/references/a3407cd2-d579-4d64-8f2e-162c31a99534)]</sup><sup>[[ClearSky Kittens Back 2 Oct 2019](https://app.tidalcyber.com/references/f5114978-2528-4199-a586-0158c5f8a138)]</sup><sup>[[ClearSky Kittens Back 3 August 2020](https://app.tidalcyber.com/references/a10c6a53-79bb-4454-b444-cfb9136ecd36)]</sup><sup>[[Proofpoint TA453 March 2021](https://app.tidalcyber.com/references/5ba4217c-813b-4cc5-b694-3a4dcad776e4)]</sup><sup>[[Check Point APT35 CharmPower January 2022](https://app.tidalcyber.com/references/81dce660-93ea-42a4-902f-0c6021d30f59)]</sup>","source":"MITRE","associated_group_id":"2a379f9c-0c8b-4066-8131-dfc6aad03b30","owner_id":null,"owner_name":null},{"id":"6ed89970-2658-450e-bed0-e6e2e94fa61d","name":"TA455","description":"<sup>[[ClearSky Dream Job November 12 2024](/references/e53ea724-6783-4616-a6ca-30316aeca03e)]</sup>","source":"Tidal Cyber","associated_group_id":"d8550960-a73f-454e-9c47-4adaf83fe7d6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"bb7524e8-9131-4f9d-abd0-de2b9650cf9d","name":"Agent Serpens","description":"<sup>[[Threat Actor Groups Tracked by Palo Alto Networks Unit 42](/references/12a0e22b-987d-4169-b037-b7a817bc4e7c)]</sup>","source":"Tidal Cyber","associated_group_id":"f34fa57a-6442-41d6-8874-5d38561767f6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d939cf61-8fab-4172-9244-8c5f5b43f17d","name":"TA453","description":"<sup>[[Proofpoint TA453 March 2021](https://app.tidalcyber.com/references/5ba4217c-813b-4cc5-b694-3a4dcad776e4)]</sup><sup>[[Proofpoint TA453 July2021](https://app.tidalcyber.com/references/a987872f-2176-437c-a38f-58676b7b12de)]</sup><sup>[[Check Point APT35 CharmPower January 2022](https://app.tidalcyber.com/references/81dce660-93ea-42a4-902f-0c6021d30f59)]</sup>","source":"MITRE","associated_group_id":"69d9316e-daa7-4fe4-86e0-c79c4ab27c5e","owner_id":null,"owner_name":null},{"id":"f9671b18-8de3-430b-9531-99bfab0e1f72","name":"ITG18","description":"<sup>[[IBM ITG18 2020](https://app.tidalcyber.com/references/523b7a1e-88ef-4440-a7b3-3fd0b8d5e199)]</sup>","source":"MITRE","associated_group_id":"ae8cdb8b-d572-427b-93ad-195a3d41a08a","owner_id":null,"owner_name":null},{"id":"243c5c64-fe77-5c2d-a9d9-d9c908b37c44","name":"Mint Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"33be4e56-0a55-519d-b783-d6b2bdfe4e7f","owner_id":null,"owner_name":null},{"id":"118c430f-24db-40e0-8a54-5015c59ea151","name":"APT35","description":"<sup>[[FireEye APT35 2018](https://app.tidalcyber.com/references/71d3db50-4a20-4d8e-a640-4670d642205c)]</sup><sup>[[Certfa Charming Kitten January 2021](https://app.tidalcyber.com/references/c38a8af6-3f9b-40c3-8122-a2a51eb50664)]</sup><sup>[[Check Point APT35 CharmPower January 2022](https://app.tidalcyber.com/references/81dce660-93ea-42a4-902f-0c6021d30f59)]</sup>","source":"MITRE","associated_group_id":"b908442f-7e76-48d9-ba6f-448ce1e8b071","owner_id":null,"owner_name":null}],"tags":[{"id":"24de7a78-c64d-4a9b-bb9b-272582056af1","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"af13c833-1ca0-4e8b-8a9d-e4b7606c026e","tag":"24448a05-2337-4bc9-a889-a83f2fd1f3ad"},{"id":"cf9620f2-8f6f-402c-954b-5bba980cd233","tag":"3ed2343c-a29c-42e2-8259-410381164c6a"},{"id":"6b2aa6fb-46a5-47c6-a68b-9ae1c901f0b3","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"56acc4b1-cae4-4493-a32c-04bde610f952","tag":"64d3f7d8-30b7-4b03-bee2-a6029672216c"},{"id":"a71577a6-5bb6-4d2e-80f8-90527ac3b0ec","tag":"915e7ac2-b266-45d7-945c-cb04327d6246"},{"id":"8366f816-bdcb-4dee-a499-9bee0065ac79","tag":"e499005b-adba-45bb-85e3-07043fd9edf9"},{"id":"0a4aa27a-2d24-4d68-89fe-5c619fc601e2","tag":"8b1cb0dc-dd3e-44ba-828c-55c040e93b93"},{"id":"2b444a42-534e-4741-b553-c71bcd2c2eeb","tag":"5f5e40cd-0732-4eb4-a083-06940623c3f9"},{"id":"e064de6a-5b28-4355-93fb-6789065d67fd","tag":"1b98f09a-7d93-4abb-8f3e-1eacdb9f9871"}],"owner_name":null},{"id":"803f8018-6e45-5b0f-978f-1fe96b217120","name":"Malteiro","source":"MITRE","group_attack_id":"G1026","created":"2024-04-25T13:28:24.594497Z","modified":"2024-04-25T13:28:24.594499Z","tidal_id":"14d3c4f9-50dc-5d4f-8004-e3d637fc5807","country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"5dd29b96-60b6-5c98-8fc0-510502c700b0","name":"Medusa Group","source":"MITRE","group_attack_id":"G1051","created":"2025-10-29T21:08:48.108183Z","modified":"2025-10-29T21:08:48.108189Z","tidal_id":"5dd29b96-60b6-5c98-8fc0-510502c700b0","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"7ffb715f-01a7-49b4-a641-66f13647cef5","name":"Cyprus","country_name":"Cyprus","country_code":"CY"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"905be2b0-59f9-44d3-bd68-26436105edb8","name":"French Polynesia","country_name":"French Polynesia","country_code":"PF"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"049a518b-01db-471d-b399-3a2e56451799","name":"Tonga","country_name":"Tonga","country_code":"TO"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"72288a08-749c-4280-8361-b60064cabb1b","name":"Medusa Ransomware Group","description":"<sup>[[Sophos News December 07 2025](/references/d74c88c0-25fe-419a-bf69-1603d1b3a597)]</sup>","source":"USER","associated_group_id":"114be543-a8df-4c1d-acdb-5327ba6a9423","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2dd08803-d9a4-419e-9516-c14eaa33842c","name":"Medusa","description":"<sup>[[Sophos News December 07 2025](/references/d74c88c0-25fe-419a-bf69-1603d1b3a597)]</sup>","source":"USER","associated_group_id":"d3026516-7a9a-4e69-a80f-7c4f6306b077","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"e961c199-5d3b-4cf4-97c1-000f7698eb3a","tag":"d819ae1a-e385-49fd-88d5-f66660729ecb"},{"id":"3d81bbc0-84e1-46b0-901c-2b6ad62abc74","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"2361083f-8838-4991-88bf-f981c6219d05","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"b09420e5-3db8-4322-896c-580dcf03eefa","tag":"8046a757-48f0-4787-81ab-9dc8c1eb77cd"},{"id":"5261874f-bfd5-4238-ace0-aaca89a0ce13","tag":"d431939f-2dc0-410b-83f7-86c458125444"},{"id":"e826561e-7574-4e3e-8af9-20a9ff90825b","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"2b9a3b2e-d061-4622-8f96-59abb9c7f49f","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"f7594e12-7b0d-4504-a49b-2ed699c227e9","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"a4044eee-2067-443f-a5b1-16f33550b5ea","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"55b20209-c04a-47ab-805d-ace83522ef6a","name":"MedusaLocker Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3015","created":"2023-08-11T21:14:13.676254Z","modified":"2023-08-11T21:14:13.676259Z","tidal_id":"3c83e945-3d18-585d-8a4a-844d3249884b","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"}],"associated_groups":[],"tags":[{"id":"3803f332-d2b3-4a23-bbfd-abd4e3a29b33","tag":"65cf80be-342d-4eba-bf8d-2477923f0ce4"},{"id":"e2a5bce4-9cf8-489e-a573-de92b2af9612","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"c58853cf-2fb0-43b7-922d-d17193a01050","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"af1e8a54-b1aa-49fa-9dc3-0445ee5c0e6b","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"c1e0716b-d3e6-4491-8b09-7ece28bc3bfa","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"316a49d5-5fe0-4e0b-a276-f955f4277162","name":"Medusa Ransomware Actors (Deprecated)","source":"Tidal Cyber","group_attack_id":"G3021","created":"2023-09-14T20:18:03.792458Z","modified":"2023-09-14T20:18:03.792462Z","tidal_id":"741a9abb-48a7-5a51-9fbc-0769fda3931f","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"7ffb715f-01a7-49b4-a641-66f13647cef5","name":"Cyprus","country_name":"Cyprus","country_code":"CY"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"905be2b0-59f9-44d3-bd68-26436105edb8","name":"French Polynesia","country_name":"French Polynesia","country_code":"PF"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"049a518b-01db-471d-b399-3a2e56451799","name":"Tonga","country_name":"Tonga","country_code":"TO"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"704ebc63-6b4b-4039-8c17-c7331809c11b","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"1f30eb78-3e05-4263-b6e9-83c1b6e32732","tag":"d819ae1a-e385-49fd-88d5-f66660729ecb"},{"id":"82517499-85a9-4c9a-8eff-aa84ca1b09f3","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"c6faf415-6f9f-4893-8bde-c4ebe9628b9b","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"6a10f9ab-0ae1-4175-8cab-9bdc61187bf8","tag":"8046a757-48f0-4787-81ab-9dc8c1eb77cd"},{"id":"20e69686-eaa8-4fa3-9c54-f9d52f3efa24","tag":"d431939f-2dc0-410b-83f7-86c458125444"},{"id":"84d6681b-5be1-4202-843e-c2e2c4643f64","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"f3a1584f-c473-47e2-95f2-32a52f39a6ab","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"35f8ca69-49d7-4353-8a55-dfcdc619e625","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"fb93231d-2ae4-45da-9dea-4c372a11f322","name":"menuPass","source":"MITRE","group_attack_id":"G0045","created":"2017-05-31T21:32:09.054000Z","modified":"2022-07-20T20:07:40.169000Z","tidal_id":"149dcb54-1b48-5da8-b5b1-9bfd02f0996b","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"6195ab08-5020-439d-a89f-783a35013ceb","name":"Finland","country_name":"Finland","country_code":"FI"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"b3b49312-69e9-426b-b18e-268bbf39f129","name":"Montenegro","country_name":"Montenegro","country_code":"ME"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"c687c273-9b3a-4225-8228-525794fcac77","name":"APT10","description":"<sup>[[Palo Alto menuPass Feb 2017](https://app.tidalcyber.com/references/ba4f7d65-73ec-4726-b1f6-f2443ffda5e7)]</sup><sup>[[Accenture Hogfish April 2018](https://app.tidalcyber.com/references/c8e9fee1-9981-499f-a62f-ffe59f4bb1e7)]</sup><sup>[[FireEye APT10 Sept 2018](https://app.tidalcyber.com/references/5f122a27-2137-4016-a482-d04106187594)]</sup><sup>[[DOJ APT10 Dec 2018](https://app.tidalcyber.com/references/3ddc68b4-53f1-4fa5-b7f3-4e5d7d9661f2)]</sup><sup>[[Symantec Cicada November 2020](https://app.tidalcyber.com/references/28a7bbd8-d664-4234-9311-2befe0238b5b)]</sup>","source":"MITRE","associated_group_id":"f18b971c-5d70-4884-8069-983324946274","owner_id":null,"owner_name":null},{"id":"b7ee7cdf-2db5-4c3e-8657-e9bac227d24b","name":"Purple Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"77fcebff-90d6-4ae3-a501-e0d95def1a31","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"66498f77-dadd-4f2c-ae94-2d6d09b0b359","name":"Cloudhopper","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"717f17de-1711-4178-9e60-0e602859ac95","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"f458d884-0b27-455d-8b9d-e9b9fcba6345","name":"Operation Cloud Hopper","description":"<sup>[[PWC Cloud Hopper April 2017](/references/fe741064-8cd7-428b-bdb9-9f2ab7e92489)]</sup>","source":"Tidal Cyber","associated_group_id":"9bbcee15-85fb-4bcf-bf69-a2f2e3673c2d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c383f724-e2b5-4640-8666-5800c101664a","name":"Stone Panda","description":"<sup>[[Palo Alto menuPass Feb 2017](https://app.tidalcyber.com/references/ba4f7d65-73ec-4726-b1f6-f2443ffda5e7)]</sup><sup>[[Accenture Hogfish April 2018](https://app.tidalcyber.com/references/c8e9fee1-9981-499f-a62f-ffe59f4bb1e7)]</sup><sup>[[DOJ APT10 Dec 2018](https://app.tidalcyber.com/references/3ddc68b4-53f1-4fa5-b7f3-4e5d7d9661f2)]</sup><sup>[[District Court of NY APT10 Indictment December 2018](https://app.tidalcyber.com/references/79ccbc74-b9c4-4dc8-91ae-1d15c4db563b)]</sup><sup>[[Symantec Cicada November 2020](https://app.tidalcyber.com/references/28a7bbd8-d664-4234-9311-2befe0238b5b)]</sup>","source":"MITRE","associated_group_id":"54b7d2ff-e1e3-49f7-8cb5-a9089b9f9807","owner_id":null,"owner_name":null},{"id":"ce558501-8ee1-4825-b389-3bcf229c3379","name":"Cicada","description":"<sup>[[Symantec Cicada November 2020](https://app.tidalcyber.com/references/28a7bbd8-d664-4234-9311-2befe0238b5b)]</sup>","source":"MITRE","associated_group_id":"f7cac76e-8c1f-43ca-8769-9fb573fe6328","owner_id":null,"owner_name":null},{"id":"0f8db655-40d1-4c0a-98d0-b84195a72934","name":"CVNX","description":"<sup>[[PWC Cloud Hopper April 2017](https://app.tidalcyber.com/references/fe741064-8cd7-428b-bdb9-9f2ab7e92489)]</sup><sup>[[DOJ APT10 Dec 2018](https://app.tidalcyber.com/references/3ddc68b4-53f1-4fa5-b7f3-4e5d7d9661f2)]</sup><sup>[[District Court of NY APT10 Indictment December 2018](https://app.tidalcyber.com/references/79ccbc74-b9c4-4dc8-91ae-1d15c4db563b)]</sup>","source":"MITRE","associated_group_id":"3eb5f80a-0069-4f3f-9c25-6139254b307c","owner_id":null,"owner_name":null},{"id":"742b6e73-305f-4556-849a-0985bfa780f2","name":"POTASSIUM","description":"<sup>[[DOJ APT10 Dec 2018](https://app.tidalcyber.com/references/3ddc68b4-53f1-4fa5-b7f3-4e5d7d9661f2)]</sup><sup>[[District Court of NY APT10 Indictment December 2018](https://app.tidalcyber.com/references/79ccbc74-b9c4-4dc8-91ae-1d15c4db563b)]</sup>","source":"MITRE","associated_group_id":"30f0cb4f-7bb5-4794-8843-bd925bafeb59","owner_id":null,"owner_name":null},{"id":"d41f86bc-0492-40ae-9234-0c38c720300a","name":"HOGFISH","description":"<sup>[[Accenture Hogfish April 2018](https://app.tidalcyber.com/references/c8e9fee1-9981-499f-a62f-ffe59f4bb1e7)]</sup>","source":"MITRE","associated_group_id":"cdd6a361-e7b5-48a0-a866-96ccc79f9dda","owner_id":null,"owner_name":null},{"id":"5ecba11f-acbc-5c84-9e33-0d47b640df97","name":"BRONZE RIVERSIDE","description":"<sup>[[SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022](https://app.tidalcyber.com/references/0b275cf9-a885-58cc-b859-112090a711e3)]</sup>","source":"MITRE","associated_group_id":"cd47a98a-37f1-5010-84f9-8d5217272363","owner_id":null,"owner_name":null},{"id":"4478e90a-a153-4092-9694-758921bb949b","name":"Red Apollo","description":"<sup>[[PWC Cloud Hopper April 2017](https://app.tidalcyber.com/references/fe741064-8cd7-428b-bdb9-9f2ab7e92489)]</sup><sup>[[DOJ APT10 Dec 2018](https://app.tidalcyber.com/references/3ddc68b4-53f1-4fa5-b7f3-4e5d7d9661f2)]</sup><sup>[[District Court of NY APT10 Indictment December 2018](https://app.tidalcyber.com/references/79ccbc74-b9c4-4dc8-91ae-1d15c4db563b)]</sup>","source":"MITRE","associated_group_id":"31fc92e8-3de5-47a2-a63e-37cb82fd8bdb","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"a3a3a1d3-7fe7-5578-8c5f-9c0f2f68079b","name":"Metador","source":"MITRE","group_attack_id":"G1013","created":"2023-05-26T01:20:56.855700Z","modified":"2023-05-26T01:20:56.855703Z","tidal_id":"6c9f08a3-5745-50ce-bbc9-c2562bb5aea0","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"a59f3dd2-7685-4442-894c-bbb068540321","name":"MirrorFace","source":"Tidal Cyber","group_attack_id":"G3095","created":"2025-04-11T15:33:37.361638Z","modified":"2025-04-11T15:33:37.361641Z","tidal_id":"ae69de7c-6f0a-5bf5-942b-f3b6b5f057ef","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[{"id":"d4612a2e-c57e-45dc-ae4d-3d166d7e0875","name":"Earth Kasha","description":"<sup>[[ESET MirrorFace March 18 2025](/references/d8f4d661-ad8a-451d-9799-afe36e200bb3)]</sup>","source":"Tidal Cyber","associated_group_id":"aed28b6a-f00f-4af8-a9ae-4e9f1e7f4ba6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"c6ca0bcf-05d4-48ec-9263-6ca3ba79727f","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"5d761a04-8a93-4e04-8ee5-48f037fc4af9","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"4510ce41-27b9-479c-9bf3-a328b77bae29","name":"Moafee","source":"MITRE","group_attack_id":"G0002","created":"2017-05-31T21:31:46.025000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"c43e0d5e-76fc-52fb-a749-af087ce3a527","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"8bc69792-c26d-4493-87e3-d8e47605fed8","name":"Mofang","source":"MITRE","group_attack_id":"G0103","created":"2020-05-12T21:23:59.021000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"e0b7a54c-00d2-5653-a76c-2e0d86a257d6","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"679b7b6b-9659-4e56-9ffd-688a6fab01b6","name":"Molerats","source":"MITRE","group_attack_id":"G0021","created":"2017-05-31T21:31:55.093000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"fec8044c-fdf9-5d1a-aa7a-cb7414b63360","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"5237c9b3-b0d1-4979-98d9-8ff0decd3d16","name":"Palestine, State of","country_name":"Palestine","country_code":"PS"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"}],"associated_groups":[{"id":"ddbfe002-11d9-470f-89b3-1952ecfff3f9","name":"Gaza Cybergang","description":"<sup>[[DustySky](https://app.tidalcyber.com/references/b9e0770d-f54a-4ada-abd1-65c45eee00fa)]</sup><sup>[[Kaspersky MoleRATs April 2019](https://app.tidalcyber.com/references/38216a34-5ffd-4e79-80b1-7270743b728e)]</sup><sup>[[Cybereason Molerats Dec 2020](https://app.tidalcyber.com/references/81a10a4b-c66f-4526-882c-184436807e1d)]</sup>","source":"MITRE","associated_group_id":"7399d632-1b1d-47da-8f8e-0f8decd62bf7","owner_id":null,"owner_name":null},{"id":"346086f7-4510-43de-bb11-09b3679f2862","name":"Operation Molerats","description":"<sup>[[FireEye Operation Molerats](https://app.tidalcyber.com/references/6b24e4aa-e773-4ca3-8267-19e036dc1144)]</sup><sup>[[Cybereason Molerats Dec 2020](https://app.tidalcyber.com/references/81a10a4b-c66f-4526-882c-184436807e1d)]</sup>","source":"MITRE","associated_group_id":"d33e9c35-2176-44c8-8d5e-77ed5de472b2","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"33a5fa48-89ee-5c0b-9c9c-e0ee69032fca","name":"Moonstone Sleet","source":"MITRE","group_attack_id":"G1036","created":"2024-10-31T16:28:11.435025Z","modified":"2024-10-31T16:28:11.435028Z","tidal_id":"33a5fa48-89ee-5c0b-9c9c-e0ee69032fca","country":[{"id":"bce6471a-69d3-4116-9782-23d798aa1657","name":"Korea, Democratic People's Republic of","country_name":"Democratic People's Republic of Korea","country_code":"KP"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"03908e4f-afc8-5766-8666-792782a30b23","name":"Storm-1789","description":"<sup>[[Microsoft Moonstone Sleet 2024](https://app.tidalcyber.com/references/b9ee14c9-75fe-552e-81b5-a1fd5aa916d7)]</sup>","source":"MITRE","associated_group_id":"fcee4228-6d62-4112-ad75-2a5e042d6dee","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"a41725c5-eb3a-4772-8d1e-17c3bbade79c","name":"Moses Staff","source":"MITRE","group_attack_id":"G1009","created":"2022-08-11T22:47:27.686000Z","modified":"2022-10-18T13:09:11.486000Z","tidal_id":"8a4b8991-cc26-5cb5-a822-f5bf87411bc8","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"}],"observed_country":[{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"780438c0-0ffb-5b70-a1e5-1e4511300057","name":"DEV-0500","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"fe9d7335-0066-5e2f-80e4-03649fd10040","owner_id":null,"owner_name":null},{"id":"3c8d1452-bc0f-58bd-a5dc-47b7b53cd8a1","name":"Marigold Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"7e629575-4315-5782-8c4c-c9073c155cee","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"f31df12e-66ea-5a49-87bc-2bc1756a89fc","name":"MoustachedBouncer","source":"MITRE","group_attack_id":"G1019","created":"2023-11-07T00:35:52.234147Z","modified":"2023-11-07T00:35:52.234151Z","tidal_id":"e57e40c8-2b04-5a77-9138-650aaa460d38","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"dcb260d8-9d53-404f-9ff5-dbee2c6effe6","name":"MuddyWater","source":"MITRE","group_attack_id":"G0069","created":"2018-04-18T17:59:24.739000Z","modified":"2022-10-17T12:43:55.847000Z","tidal_id":"1965da66-69ee-52ff-ae74-42c4b9764891","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"b23d13af-1445-4219-a1b9-a559d1873102","name":"Armenia","country_name":"Armenia","country_code":"AM"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"a0bfbad9-4a8d-451b-9401-df2db3b2da4c","name":"Bahrain","country_name":"Bahrain","country_code":"BH"},{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"e8f8da13-386b-4027-8fe0-f4e3e341ae07","name":"Lao People's Democratic Republic","country_name":"Lao People's Democratic Republic","country_code":"LA"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"8faae3de-c64e-4d6f-a226-669f773e4341","name":"Mali","country_name":"Mali","country_code":"ML"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"252115d5-b120-4db5-846d-829ac4ebfc54","name":"Oman","country_name":"Oman","country_code":"OM"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"74026dba-423a-49c5-afea-4f18bc021a6a","name":"Tajikistan","country_name":"Tajikistan","country_code":"TJ"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"53e1210a-b379-4569-aba4-9e7f6916f24e","name":"Tunisia","country_name":"Tunisia","country_code":"TN"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"13c28e85-cde0-4db5-9008-2ad8afcffcfb","name":"Turkmenistan","country_name":"Turkmenistan","country_code":"TM"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"e5ab4f29-3271-4072-be1a-afc001347179","name":"Seedworm","description":"<sup>[[Symantec MuddyWater Dec 2018](https://app.tidalcyber.com/references/a8e58ef1-91e1-4f93-b2ff-faa7a6365f5d)]</sup><sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup><sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"MITRE","associated_group_id":"9c03d056-8c91-43c9-a9e9-ef7c82b12bca","owner_id":null,"owner_name":null},{"id":"2c8fc9c4-b7b4-4386-94ea-41934b242f00","name":"Muddy Water","description":"<sup>[[Www.cloudsek.com January 09 2026](/references/1f12b457-540c-4e11-bd9b-df360a318aa6)]</sup>","source":"USER","associated_group_id":"458d97ba-2f71-4195-96cb-80ab8c9fe83f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"f8f99bfa-5f93-4ddc-a72e-fc572a47719e","name":"TEMP.Zagros","description":"<sup>[[FireEye MuddyWater Mar 2018](https://app.tidalcyber.com/references/82cddfa6-9463-49bb-8bdc-0c7d6b0e1472)]</sup><sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup><sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"MITRE","associated_group_id":"b4215569-ec22-43ad-839a-67cd09030e2e","owner_id":null,"owner_name":null},{"id":"97647729-3b4c-4d11-a9e7-7a3f4a561ef1","name":"Earth Vetala","description":"<sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"MITRE","associated_group_id":"a862ce87-d79a-485a-8ba2-c7c843e60422","owner_id":null,"owner_name":null},{"id":"201ec12b-c81a-4473-8afa-a3d57f552f59","name":"MERCURY","description":"<sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup>","source":"MITRE","associated_group_id":"d4cd493f-b88d-4687-b040-60be94e42a65","owner_id":null,"owner_name":null},{"id":"46251839-ff6e-430e-91e4-a8cb848c1127","name":"Static Kitten","description":"<sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup><sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"MITRE","associated_group_id":"ac24e233-2250-477b-a4cb-6ae018d5836b","owner_id":null,"owner_name":null},{"id":"24873854-9919-5727-b233-026b347b1290","name":"TA450","description":"<sup>[[Proofpoint TA450 Phishing March 2024](https://app.tidalcyber.com/references/263be6fe-d9ed-5216-a0be-e8391dbd83e6)]</sup>","source":"MITRE","associated_group_id":"c28ea865-24cc-5b56-9c2b-4ad8bfa12687","owner_id":null,"owner_name":null},{"id":"e8f41854-ac2a-5a05-bf2d-4be7726c62ca","name":"Mango Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"5f935dd4-5a84-502a-a98e-83ea5b488cf3","owner_id":null,"owner_name":null},{"id":"21d50790-8108-4432-adfe-61af6b8e36e3","name":"MERCURY","description":"<sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup>","source":"Mobile","associated_group_id":"d4cd493f-b88d-4687-b040-60be94e42a65","owner_id":null,"owner_name":null},{"id":"fed4c0a0-c402-49e1-9dad-0809f2a508c1","name":"TEMP.Zagros","description":"<sup>[[FireEye MuddyWater Mar 2018](https://app.tidalcyber.com/references/82cddfa6-9463-49bb-8bdc-0c7d6b0e1472)]</sup><sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup><sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"Mobile","associated_group_id":"b4215569-ec22-43ad-839a-67cd09030e2e","owner_id":null,"owner_name":null},{"id":"f784674f-0d9b-47ef-ba91-148c8b1739c8","name":"Mango Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"5f935dd4-5a84-502a-a98e-83ea5b488cf3","owner_id":null,"owner_name":null},{"id":"cc407f0a-9b9b-461e-85db-85940bc1a701","name":"TA450","description":"<sup>[[Proofpoint TA450 Phishing March 2024](https://app.tidalcyber.com/references/263be6fe-d9ed-5216-a0be-e8391dbd83e6)]</sup>","source":"Mobile","associated_group_id":"c28ea865-24cc-5b56-9c2b-4ad8bfa12687","owner_id":null,"owner_name":null},{"id":"bddbc25c-8085-4d06-a44a-45039e60df4e","name":"Earth Vetala","description":"<sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"Mobile","associated_group_id":"a862ce87-d79a-485a-8ba2-c7c843e60422","owner_id":null,"owner_name":null},{"id":"bd68503d-10c3-4ce3-a80a-86be210e4892","name":"Static Kitten","description":"<sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup><sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"Mobile","associated_group_id":"ac24e233-2250-477b-a4cb-6ae018d5836b","owner_id":null,"owner_name":null},{"id":"4f826480-3542-4588-954b-755c43a2c618","name":"Seedworm","description":"<sup>[[Symantec MuddyWater Dec 2018](https://app.tidalcyber.com/references/a8e58ef1-91e1-4f93-b2ff-faa7a6365f5d)]</sup><sup>[[Anomali Static Kitten February 2021](https://app.tidalcyber.com/references/710ed789-de1f-4601-a8ba-32147827adcb)]</sup><sup>[[Trend Micro Muddy Water March 2021](https://app.tidalcyber.com/references/16b4b834-2f44-4bac-b810-f92080c41f09)]</sup>","source":"Mobile","associated_group_id":"9c03d056-8c91-43c9-a9e9-ef7c82b12bca","owner_id":null,"owner_name":null}],"tags":[{"id":"eb7cc5aa-a653-498d-990b-1677d97cd15d","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"6c69dbd1-40ef-4473-b51a-a9d4af917c1a","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"2aa5d95f-d478-4ca6-bd0d-5b38aaa047b3","tag":"ee3188ce-20e9-4e8e-bbfd-cdc527d5a2b2"},{"id":"b0468190-d609-4fa8-b380-be8b28f8fd34","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"7aa247fc-603c-4fa1-ac4a-cf3375a1dbe1","tag":"0eab0089-86a5-43b1-9ddb-8960f1005267"},{"id":"73ab90fe-d56a-4e23-8a50-dee04233af89","tag":"992bdd33-4a47-495d-883a-58010a2f0efb"}],"owner_name":null},{"id":"4a4641b1-7686-49da-8d83-00d8013f4b47","name":"Mustang Panda","source":"MITRE","group_attack_id":"G0129","created":"2021-04-12T15:56:28.861000Z","modified":"2022-04-11T16:43:52.231000Z","tidal_id":"9ffd196e-94ca-500a-9621-75f6c2610e44","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7ffb715f-01a7-49b4-a641-66f13647cef5","name":"Cyprus","country_name":"Cyprus","country_code":"CY"},{"id":"bad594b7-b57b-4e02-bd87-c7eef7f45e37","name":"Ethiopia","country_name":"Ethiopia","country_code":"ET"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"07578934-334f-4a04-b0c0-7157b1257617","name":"Greece","country_name":"Greece","country_code":"GR"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"7c4254c1-cd34-40da-a39c-65239c56e87d","name":"South Sudan","country_name":"South Sudan","country_code":"SS"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"}],"associated_groups":[{"id":"94589f0e-0c95-533b-a9aa-287c50d9588c","name":"CAMARO DRAGON","description":"<sup>[[HorseShell](https://app.tidalcyber.com/references/ef9f8e9d-1622-5227-a4a3-7d857e577def)]</sup>","source":"MITRE","associated_group_id":"c09a9b03-99f6-53f4-966c-7f24b24e0559","owner_id":null,"owner_name":null},{"id":"518f12bb-451c-5448-9561-6cd817b7f0f9","name":"EARTH PRETA","description":"<sup>[[2022 November_TrendMicro_Earth Preta_Toneshell_Pubload](https://app.tidalcyber.com/references/0afb412d-45ea-5c50-99d9-d915d5796a60)]</sup><sup>[[Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024](https://app.tidalcyber.com/references/0e593cd3-19fd-597a-9788-2356c31bfa09)]</sup><sup>[[Trend Micro Mustang Panda Earth Preta Toneshell February 2025](https://app.tidalcyber.com/references/bd7fdacd-9e2c-5bc0-befd-2aeeedd16b0b)]</sup><sup>[[Trend Micro Mustang Panda Earth Preta TONESHELL June 2023](https://app.tidalcyber.com/references/631c6e38-0253-5618-abeb-d67abe102da4)]</sup>","source":"MITRE","associated_group_id":"7692e856-8e0f-5357-892c-415ead2eb2f4","owner_id":null,"owner_name":null},{"id":"7c189421-e1ca-5a3a-8763-360f4d3c4ee4","name":"STATELY TAURUS","description":"<sup>[[Palo Alto Networks, Unit 42](https://app.tidalcyber.com/references/7428e855-a965-5c67-b6c5-4874e48f612f)]</sup><sup>[[Unit42 Bookworm Nov2015](https://app.tidalcyber.com/references/794a1cb4-1eb4-587a-92f6-eb5c8e98de97)]</sup><sup>[[Unit42 Chinese VSCode 06 September 2024](https://app.tidalcyber.com/references/2157f860-0a64-50a1-b368-be96d5228bf3)]</sup><sup>[[Broadcom](https://app.tidalcyber.com/references/97eb3c97-229c-523e-8604-c276a8a36584)]</sup><sup>[[Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023](https://app.tidalcyber.com/references/dc97908c-d8e5-5e5d-a1b3-8ee65894f53a)]</sup><sup>[[CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024](https://app.tidalcyber.com/references/28d9290f-de56-540e-9211-fa0a96f5d42d)]</sup>","source":"MITRE","associated_group_id":"6f55e9f0-1ab0-56ab-859d-c771f27be71c","owner_id":null,"owner_name":null},{"id":"1ecf0133-b10d-4621-819d-6efa12db1726","name":"RedDelta","description":"<sup>[[Recorded Future REDDELTA July 2020](https://app.tidalcyber.com/references/e2bc037e-d483-4670-8281-70e51b16effe)]</sup><sup>[[Proofpoint TA416 Europe March 2022](https://app.tidalcyber.com/references/5731d7e4-dd19-4d08-b493-7b1a467599d3)]</sup>","source":"MITRE","associated_group_id":"6e798bec-4713-4242-88ec-e4a77b29db22","owner_id":null,"owner_name":null},{"id":"2276ed5b-9794-4127-b703-bbaf5fab3d1d","name":"HoneyMyte","description":"<sup>[[BleepingComputer Mustang Panda September 9 2024](/references/40774c9c-daca-4ea0-a504-ca73b11e4f29)]</sup>","source":"Tidal Cyber","associated_group_id":"64b6e1c9-75fb-4316-a9d8-23e12914952d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"920b1799-8d1e-4f05-8afc-621a9a5be551","name":"Earth Preta","description":"<sup>[[BleepingComputer Mustang Panda September 9 2024](/references/40774c9c-daca-4ea0-a504-ca73b11e4f29)]</sup>","source":"Tidal Cyber","associated_group_id":"176a856b-addb-4352-89b1-9626b177486f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"226eb2d8-1503-4363-852c-0cfe0e8796ec","name":"Polaris","description":"<sup>[[BleepingComputer Mustang Panda September 9 2024](/references/40774c9c-daca-4ea0-a504-ca73b11e4f29)]</sup>","source":"Tidal Cyber","associated_group_id":"846c686d-12b1-47e5-ae06-699dfaf1f3bb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"78774eb4-17eb-4e62-b046-20d39e038573","name":"Stately Taurus","description":"<sup>[[BleepingComputer Mustang Panda September 9 2024](/references/40774c9c-daca-4ea0-a504-ca73b11e4f29)]</sup>","source":"Tidal Cyber","associated_group_id":"dad608a9-b92d-4ac6-b3a9-054cb6cce36e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a2ae73f8-b7b2-49dd-a5e6-391f1e5d5d84","name":"TA416","description":"<sup>[[Proofpoint TA416 November 2020](https://app.tidalcyber.com/references/f72685de-c775-41c4-94ed-45fd7f873a1d)]</sup>","source":"MITRE","associated_group_id":"04d6b7f4-19e6-41a7-b76a-2e82a7d69e3e","owner_id":null,"owner_name":null},{"id":"e8305088-3e86-4126-b24b-fa810d7fc9f0","name":"BRONZE PRESIDENT","description":"<sup>[[Secureworks BRONZE PRESIDENT December 2019](https://app.tidalcyber.com/references/019889e0-a2ce-476f-9a31-2fc394de2821)]</sup><sup>[[Sophos PlugX September 2022](https://app.tidalcyber.com/references/fe21fcdf-ddd9-5a92-9b49-c4e536703460)]</sup><sup>[[Sophos Mustang Panda PLUGX](https://app.tidalcyber.com/references/7d629729-53fd-5831-8f39-485ebd551898)]</sup>","source":"MITRE","associated_group_id":"ed80cd5e-afc8-4f59-b567-ec97fdc37a37","owner_id":null,"owner_name":null},{"id":"dc61cd8e-22b1-53e2-8cce-c7eca8d939bc","name":"TANTALUM","description":"<sup>[[Microsoft Naming Conventions Frequently Updated](https://app.tidalcyber.com/references/b079fff9-472d-57bf-b23b-8a9971f5c974)]</sup>","source":"MITRE","associated_group_id":"4508d3ca-accd-5a8e-9658-2f264553683b","owner_id":null,"owner_name":null},{"id":"982b4d4c-406b-5487-a5ba-f44a30afb798","name":"TEMP.Hex","description":"<sup>[[Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025](https://app.tidalcyber.com/references/5fce4659-d82d-5498-a060-95b34984d66a)]</sup>","source":"MITRE","associated_group_id":"0d21100f-c6b6-5929-bde4-27395850034e","owner_id":null,"owner_name":null},{"id":"dc8e8a30-7b2c-40bb-b7c4-339307e568cd","name":"Twill Typhoon","description":"<sup>[[U.S. DoJ PlugX Disruption January 14 2025](/references/fbaae2c6-3ab1-4e37-becc-30c53e5b02c4)]</sup>","source":"Tidal Cyber","associated_group_id":"0a88d59c-5d3c-4618-b39f-c12c4c30cad6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a7d59e57-8232-5cd1-9371-25cec1e18e88","name":"FIREANT","description":"<sup>[[Broadcom](https://app.tidalcyber.com/references/97eb3c97-229c-523e-8604-c276a8a36584)]</sup>","source":"MITRE","associated_group_id":"1c786737-ae7b-5cb4-a9de-bd6b3d966c16","owner_id":null,"owner_name":null},{"id":"7b804e5b-5c36-58fa-bf1f-2b9915159726","name":"HIVE0154","description":"<sup>[[IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025](https://app.tidalcyber.com/references/0ca87e7b-f32e-5265-9dba-c059d1ba92c6)]</sup><sup>[[2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA](https://app.tidalcyber.com/references/386af393-d4be-5590-9b9e-592d30d431f8)]</sup>","source":"MITRE","associated_group_id":"04a16185-478a-51f6-ab5b-4bc931f20e33","owner_id":null,"owner_name":null},{"id":"edc828b8-0247-554d-9726-1dbc42201d10","name":"TWILL TYPHOON","description":"<sup>[[Microsoft Naming Conventions Frequently Updated](https://app.tidalcyber.com/references/b079fff9-472d-57bf-b23b-8a9971f5c974)]</sup>","source":"MITRE","associated_group_id":"60502c79-6714-5c20-8d69-c369acc0f838","owner_id":null,"owner_name":null},{"id":"10e516aa-f21d-57f3-b506-3b83f7f280ce","name":"LUMINOUS MOTH","description":"<sup>[[Microsoft Naming Conventions Frequently Updated](https://app.tidalcyber.com/references/b079fff9-472d-57bf-b23b-8a9971f5c974)]</sup>","source":"MITRE","associated_group_id":"f07ce116-ddd7-5519-a85a-42ea51a243f0","owner_id":null,"owner_name":null},{"id":"247d0dda-d916-5d5b-b507-37f1bf21b22d","name":"UNC6384","description":"<sup>[[Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025](https://app.tidalcyber.com/references/5fce4659-d82d-5498-a060-95b34984d66a)]</sup>","source":"MITRE","associated_group_id":"52e6a5a9-8265-5c0f-b0d9-60166b941512","owner_id":null,"owner_name":null},{"id":"f37eb680-4497-5d97-8e6f-005ac4d8ae00","name":"Red Lich","description":"<sup>[[PWC UK MUSTANG PANDA RED LICH February 2021](https://app.tidalcyber.com/references/fbaaf8fc-f733-54fe-a01e-c571d5c99ace)]</sup>","source":"MITRE","associated_group_id":"36815b0b-e4df-5d3d-afed-f53c605a19dc","owner_id":null,"owner_name":null}],"tags":[{"id":"805094f7-6ade-46ff-847f-e31ef93e4ce9","tag":"76195cff-8fc9-41a0-9914-86c2e258b284"}],"owner_name":null},{"id":"0898e7cb-118e-5eeb-b856-04e56ed18182","name":"Mustard Tempest","source":"MITRE","group_attack_id":"G1020","created":"2024-04-25T13:28:23.791644Z","modified":"2024-04-25T13:28:23.791648Z","tidal_id":"e68e2ccc-2f17-5782-b095-ca5c0ec5a12f","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"e67b1453-8874-5d4b-b762-37a562ba8733","name":"GOLD PRELUDE","description":"<sup>[[Secureworks Gold Prelude Profile](https://app.tidalcyber.com/references/b16ae37d-5244-5c1e-92a9-e494b5a9ef49)]</sup>","source":"MITRE","associated_group_id":"613c7a33-7659-5305-8aa0-875d6d4866a6","owner_id":null,"owner_name":null},{"id":"91160b53-2de4-5301-9214-c859bfb77d17","name":"TA569","description":"<sup>[[Secureworks Gold Prelude Profile](https://app.tidalcyber.com/references/b16ae37d-5244-5c1e-92a9-e494b5a9ef49)]</sup>","source":"MITRE","associated_group_id":"f1c70dde-3474-5e7d-8880-fae585f5bed5","owner_id":null,"owner_name":null},{"id":"caef649c-0fc2-49be-88da-7700b0de3dbd","name":"Purple Vallhund","description":"<sup>[[Arctic Wolf November 25 2025](/references/24a1832e-ffc5-4504-8e47-32ba0be97b0c)]</sup>","source":"USER","associated_group_id":"c171acfd-b557-443c-8975-08e8870d6f51","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"5ff7cadb-9c73-5f59-8c38-91ace2fc418d","name":"DEV-0206","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"493fdb5b-19c5-56af-bf8c-8037c7c9ad37","owner_id":null,"owner_name":null},{"id":"386ec88c-3d50-563a-a96b-e9c3c3fc5d07","name":"UNC1543","description":"<sup>[[Secureworks Gold Prelude Profile](https://app.tidalcyber.com/references/b16ae37d-5244-5c1e-92a9-e494b5a9ef49)]</sup>","source":"MITRE","associated_group_id":"9a2b4a7b-53f3-5f63-ae83-5d226c858f9c","owner_id":null,"owner_name":null}],"tags":[{"id":"4b56ef04-f883-4c1f-8074-1c314d1bb1e6","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"}],"owner_name":null},{"id":"5706f0e7-ae41-47fd-9c3c-8fe47d53ba0d","name":"Mysterious Elephant","source":"Tidal Cyber","group_attack_id":"G3209","created":"2026-01-23T20:30:07.184953Z","modified":"2026-01-23T20:30:07.184956Z","tidal_id":"05b87030-93ad-5b6d-9ee9-4186d4893aaa","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"c584d0fc-db1d-4c2b-90ff-5a9b936c8e90","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"20c8c3ce-8f67-4363-a5f2-6b290847467f","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c0c87ce9-ed08-4653-9eba-8236f857bb26","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a80c00b2-b8b6-4780-99bb-df8fe921947d","name":"Naikon","source":"MITRE","group_attack_id":"G0019","created":"2017-05-31T21:31:54.232000Z","modified":"2021-08-19T18:23:23.507000Z","tidal_id":"30f3109e-f215-5011-8545-f7e863fdff2e","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"50877c20-18c5-48d0-936a-a6bc462810f5","name":"Brunei Darussalam","country_name":"Brunei Darussalam","country_code":"BN"},{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"e8f8da13-386b-4027-8fe0-f4e3e341ae07","name":"Lao People's Democratic Republic","country_name":"Lao People's Democratic Republic","country_code":"LA"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"3a660ef3-9954-4252-8946-f903f3f42d0c","name":"NEODYMIUM","source":"MITRE","group_attack_id":"G0055","created":"2018-01-16T16:13:52.465000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"98872b97-4938-55c8-a6c9-50ddc61c2b19","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"35aa3c2a-eea0-480a-b338-c82808643026","name":"NightSpire","source":"Tidal Cyber","group_attack_id":"G3100","created":"2025-05-20T16:17:39.976209Z","modified":"2025-05-20T16:17:39.976213Z","tidal_id":"b87de313-77d8-58a1-a5cf-58f151244a25","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"917155f0-9c24-40a3-9876-439530d7cdfb","name":"Rbfs","description":"<sup>[[S-RM March 25 2025](/references/ffa47884-4eef-445e-99e3-02f64cc2f7fc)]</sup>","source":"Tidal Cyber","associated_group_id":"fbec1c80-af55-4376-ae69-60a6cc903998","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"70e226f0-c28b-4b47-8558-e1620021559e","tag":"abff87bf-5c28-489b-8fe6-e1fc74abb70a"},{"id":"4d4d7cd0-48d3-4d4c-aae6-b70645d157c3","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"de43ade5-13c6-46a7-9afc-82998854bfbc","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"05b52457-9c5b-4829-a9ea-a632ade431f8","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"17454d5f-1fc3-4fae-8a37-6b4ef023ccd2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"52d66e29-08e2-4c5f-b15f-8274a5c770b8","name":"Nimbus Manticore","source":"Tidal Cyber","group_attack_id":"G3127","created":"2025-10-07T14:07:12.743512Z","modified":"2025-10-07T14:07:12.743514Z","tidal_id":"cf205cd2-f745-5835-8318-8e9c029c6ae2","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"f1d1e23e-a4a2-4f68-8446-bb653f6c55f9","name":"UNC1549","description":"<sup>[[Check Point Research 09 22 2025](/references/e813f0cf-b9de-429a-8699-aadd90b5de4f)]</sup>","source":"USER","associated_group_id":"59bcf799-e053-4a7d-a3a8-af79df49f232","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"259518c9-6d7b-46ec-b804-196c0b4267ab","name":"Smoke Sandstorm","description":"<sup>[[Check Point Research 09 22 2025](/references/e813f0cf-b9de-429a-8699-aadd90b5de4f)]</sup>","source":"USER","associated_group_id":"03d3588c-8d94-4538-a482-67e5428ecef3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"0a2aa33f-56e8-496f-8140-2cb4f57ea78e","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"fa81a36f-5ac4-45ee-b093-359f378c514e","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"665c9ac0-43b6-4dfe-841d-c4554a66a607","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"75eeb41a-5fd5-4103-a74b-aa3fafbc44eb","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5f8c6ee0-f302-403b-b712-f1e3df064c0c","name":"Nomadic Octopus","source":"MITRE","group_attack_id":"G0133","created":"2021-08-24T17:04:27.002000Z","modified":"2022-09-02T18:03:55.294000Z","tidal_id":"8de74526-c3ee-56a5-ba0a-f99d37f5f25d","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"9179b832-142b-401f-95c0-907544b71dad","name":"DustSquad","description":"<sup>[[Security Affairs DustSquad Oct 2018](https://app.tidalcyber.com/references/0e6b019c-cf8e-40a7-9e7c-6a7dc5309dc6)]</sup><sup>[[Securelist Octopus Oct 2018](https://app.tidalcyber.com/references/77407057-53f1-4fde-bc74-00f73d417f7d)]</sup><sup>[[SecurityWeek Nomadic Octopus Oct 2018](https://app.tidalcyber.com/references/659f86ef-7e90-42ff-87b7-2e289f9f6cc2)]</sup>","source":"MITRE","associated_group_id":"2e09d081-dcb5-4b3e-8dca-2b64dc37cc2b","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"7c1a627e-7ea8-4919-a590-7637f1c887f3","name":"NoName057(16)","source":"Trellix TIG","group_attack_id":"G3006","created":"2025-04-11T15:06:30.957418Z","modified":"2025-04-11T15:06:30.957422Z","tidal_id":"46cc795c-65a1-5b20-b071-8473dc05e578","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"1fcb75e3-b14c-437f-bc36-411ee3110a6f","name":"NoName(057)16","description":"<sup>[[Censys December 15 2025](/references/896d30b9-30aa-4323-945b-30ed4113a2b8)]</sup>","source":"USER","associated_group_id":"283f2cc6-fc1c-471d-8c68-c6030ca887b6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"549d61b1-78ea-4d49-9237-4fc0e24e4b86","name":"NoName057(16) Spain","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"1774a90b-77f5-4595-9d21-77d181339c0b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ab2796b8-9841-4ab5-823d-16d944411f13","name":"NoName057(16) Italy","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"c5b94f53-7fab-4e70-ae60-c1bd1f04a431","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"bc95c931-dd9e-40c1-b00f-075148946520","name":"NoName057(16) France","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"c62a5961-33cc-4d45-ac90-5e9482080feb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"94e4d8d0-4c32-4881-a59a-cebda64c8fe0","name":"05716nnm","description":"","source":"Trellix TIG","associated_group_id":"7ec90c99-bc23-408e-922f-21291c71fa55","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d647a84a-4054-44d0-888b-682c8f26a04c","name":"Nnm05716","description":"","source":"Trellix TIG","associated_group_id":"86be2b28-acbf-4ec1-9b28-7ea054adaa76","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"0943f041-0246-4c71-b89e-a9c431f9f558","name":"NoName05716","description":"","source":"Trellix TIG","associated_group_id":"af39dd2d-0404-4d55-8920-c6b89324eb28","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"05138482-a462-4649-8324-750ffb43420b","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"ab5590aa-164a-42bb-8081-9320b6f7b1cf","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"8198d04d-5869-4e42-8ae9-5c0ed639ecef","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"c5bd6037-9928-48fe-86a0-8c2b3d481f92","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"537fd665-f612-4535-9847-4164d01e09c1","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"9d2ba967-36ce-4712-8428-eea6b75bf688","tag":"2185ed93-7e1c-4553-9452-c8411b5dca93"},{"id":"52f025a5-2132-478e-a7ee-744043e64817","tag":"cc4ea215-87ce-4351-9579-cf527caf5992"},{"id":"a5c90a4e-af38-4575-b48a-01849f5f2def","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"4b2c58ff-50c3-43ac-8211-0a197351056d","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"e0c4a607-57a1-4f0f-8dbe-972a86e97539","tag":"de6a1b26-f36e-4003-80f0-a4747f83329c"}],"owner_name":"TidalCyberIan"},{"id":"0c26f51f-35d8-40e8-9ad0-e5092cb3c04e","name":"Nova RaaS","source":"Tidal Cyber","group_attack_id":"G3101","created":"2025-05-20T16:17:40.364239Z","modified":"2025-05-20T16:17:40.364242Z","tidal_id":"2db576ff-0c1f-5555-8ed5-512eb04de8f3","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"831e539b-2f61-4c55-8c07-1cb0b1b9412f","name":"Nova Ransomware-as-a-Service","description":"<sup>[[SonicWall Nova Ransomware April 11 2025](/references/4926be5f-0eea-44cc-a73e-2f173eee901b)]</sup>","source":"Tidal Cyber","associated_group_id":"b4cbf8da-5317-45f8-b6fa-49c5496d6549","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"901bab26-8c86-4573-ac1f-00c060ed0871","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"6b47737e-baf6-4cde-ba1c-53ae3c04202a","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"8b7980a0-077f-4e25-a3f3-df4d74079ebf","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"d1b89760-b0ff-477d-a466-5a97621b2271","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"7f425522-4d48-46ce-b53a-02bb975e7aac","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d01abdb1-0378-4654-aa38-1a4a292703e2","name":"OilRig","source":"MITRE","group_attack_id":"G0049","created":"2017-12-14T16:46:06.044000Z","modified":"2022-06-02T20:18:52.733000Z","tidal_id":"fb248fdb-8610-579f-a9c3-1cd16ddf0ffd","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"126181e2-e36b-4108-8b4c-61f7275c8fbb","name":"Mauritius","country_name":"Mauritius","country_code":"MU"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"6c8291a4-b1f2-4ba7-b803-4a0c211169e9","name":"APT34","description":"This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity.<sup>[[Unit 42 QUADAGENT July 2018](https://app.tidalcyber.com/references/320f49df-7b0a-4a6a-8542-17b0f56c94c9)]</sup><sup>[[FireEye APT34 Dec 2017](https://app.tidalcyber.com/references/88f41728-08ad-4cd8-a418-895738d68b04)]</sup><sup>[[Check Point APT34 April 2021](https://app.tidalcyber.com/references/593e8f9f-88ec-4bdc-90c3-1a320fa8a041)]</sup>","source":"MITRE","associated_group_id":"17ac9e60-dfad-4ee5-a61c-7b7ee6686a73","owner_id":null,"owner_name":null},{"id":"3babdce3-2d7b-4f15-971d-d1272690e9f4","name":"Helix Kitten","description":"<sup>[[Unit 42 QUADAGENT July 2018](https://app.tidalcyber.com/references/320f49df-7b0a-4a6a-8542-17b0f56c94c9)]</sup><sup>[[Crowdstrike Helix Kitten Nov 2018](https://app.tidalcyber.com/references/3fc0d7ad-6283-4cfd-b72f-5ce47594531e)]</sup>","source":"MITRE","associated_group_id":"8779d808-ed34-44bc-a3e3-8b0954bc8022","owner_id":null,"owner_name":null},{"id":"fe8c0d12-39e8-50ed-ad78-f50a260c60ca","name":"EUROPIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"82a2e864-3187-586e-9606-18ccc65c4f91","owner_id":null,"owner_name":null},{"id":"dd78cd8a-81ca-545b-961b-1db632dcffaf","name":"Hazel Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"83d1b16c-934f-52e2-9139-8475fc20c225","owner_id":null,"owner_name":null},{"id":"84f08298-a9cc-4408-8d68-a5040c927a43","name":"Siamesekitten","description":"<sup>[[ESET OilRig December 14 2023](/references/f96b74d5-ff75-47c6-a9a2-b2f43db351bc)]</sup>","source":"Tidal Cyber","associated_group_id":"05b6f4a6-e54d-42db-a47e-4bcfae56c0f6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1db08f3e-4545-4419-9780-109ed09cc173","name":"Lyceum","description":"<sup>[[ESET OilRig December 14 2023](/references/f96b74d5-ff75-47c6-a9a2-b2f43db351bc)]</sup>","source":"Tidal Cyber","associated_group_id":"140137f2-039a-4ade-a043-039b2093e25e","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"5c04cf48-adf3-4f19-a380-0f4eeec1acfe","name":"Twisted Kitten","description":"<sup>[[CFR OilRig Profile](/references/db9985eb-d536-45b9-a82b-34d8cdd2b699)]</sup>","source":"Tidal Cyber","associated_group_id":"e77a15cc-a7aa-4ec5-9150-15ddeb51120b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1772bbfb-5a16-4d63-85c2-6ad38f7c9169","name":"Crambus","description":"<sup>[[ESET OilRig December 14 2023](/references/f96b74d5-ff75-47c6-a9a2-b2f43db351bc)]</sup>","source":"Tidal Cyber","associated_group_id":"ff8d70ae-1038-4315-873b-b3025afc65e9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d5f99e60-e704-4e97-824e-cc3b42236f66","name":"COBALT GYPSY","description":"<sup>[[Secureworks COBALT GYPSY Threat Profile](https://app.tidalcyber.com/references/f1c21834-7536-430b-8539-e68373718b4d)]</sup>","source":"MITRE","associated_group_id":"e8d4a791-a117-4e1e-8a7a-8a90422d4a90","owner_id":null,"owner_name":null},{"id":"cab57b45-2a66-50c5-afc5-32fc4b23d2bf","name":"ITG13","description":"<sup>[[IBM ZeroCleare Wiper December 2019](https://app.tidalcyber.com/references/26ba5292-265d-5db4-a571-215c984fe095)]</sup>","source":"MITRE","associated_group_id":"c4e00029-b877-5544-97d6-92a4f3b91971","owner_id":null,"owner_name":null},{"id":"e704aaee-86b5-5fc8-8b51-5c5a3fa0ebf5","name":"TA452","description":"<sup>[[Proofpoint Iranian Aligned Attacks JAN 2020](https://app.tidalcyber.com/references/090da2a7-1a9d-5828-ab08-18cc285ea504)]</sup>","source":"MITRE","associated_group_id":"38557cbb-6d69-5fca-be0c-a9aa605d76f4","owner_id":null,"owner_name":null},{"id":"c0ef1c64-d573-4a34-93e4-37a536d9c00d","name":"GreenBug","description":"<sup>[[Check Point Research September 11 2024](/references/53320d81-4060-4414-b5b8-21d09362bc44)]</sup>","source":"Tidal Cyber","associated_group_id":"6cb3938a-8987-4ae7-82da-50718d7e34bc","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"951b761f-1c6f-4321-8c37-84c857408b06","name":"IRN2","description":"<sup>[[Crowdstrike Helix Kitten Nov 2018](https://app.tidalcyber.com/references/3fc0d7ad-6283-4cfd-b72f-5ce47594531e)]</sup>","source":"MITRE","associated_group_id":"d840e923-ef0c-45d6-926f-e12016d1fe54","owner_id":null,"owner_name":null},{"id":"20f00c34-6797-5a00-b03f-80d47bc6a650","name":"Evasive Serpens","description":"<sup>[[Unit42 OilRig Playbook 2023](https://app.tidalcyber.com/references/e38902bb-9bab-5beb-817b-668a67a76541)]</sup>","source":"MITRE","associated_group_id":"9cbeb785-fe7e-5bf7-b860-bf1bf8bf7f09","owner_id":null,"owner_name":null},{"id":"c0758fcf-c5a4-54e5-9f7e-2b600e70a9d7","name":"Earth Simnavaz","description":"<sup>[[Trend Micro Earth Simnavaz October 2024](https://app.tidalcyber.com/references/aff9097b-43ea-50aa-88ed-62b98f2d58ce)]</sup>","source":"MITRE","associated_group_id":"ceecd2db-afb7-5116-b6d9-53e6783c476f","owner_id":null,"owner_name":null},{"id":"b36b2d7c-2af5-5c10-99d2-74c11b4bc8c0","name":"Crambus","description":"<sup>[[Symantec Crambus OCT 2023](https://app.tidalcyber.com/references/ecfdd6e1-caa0-5611-a1f5-d96873cf2222)]</sup>","source":"MITRE","associated_group_id":"32c8d2f9-7a8d-4c5b-bb6a-7ee85865da09","owner_id":null,"owner_name":null},{"id":"d16db97f-c808-48db-9011-ee6cc4135fd4","name":"COBALT GYPSY","description":"<sup>[[Secureworks COBALT GYPSY Threat Profile](https://app.tidalcyber.com/references/f1c21834-7536-430b-8539-e68373718b4d)]</sup>","source":"ICS","associated_group_id":"e8d4a791-a117-4e1e-8a7a-8a90422d4a90","owner_id":null,"owner_name":null},{"id":"df4d0258-5211-4270-b1d5-7eddb9ef2058","name":"IRN2","description":"<sup>[[Crowdstrike Helix Kitten Nov 2018](https://app.tidalcyber.com/references/3fc0d7ad-6283-4cfd-b72f-5ce47594531e)]</sup>","source":"ICS","associated_group_id":"d840e923-ef0c-45d6-926f-e12016d1fe54","owner_id":null,"owner_name":null},{"id":"02534690-9a0d-440b-b08b-c7d297ab7797","name":"Helix Kitten","description":"<sup>[[Unit 42 QUADAGENT July 2018](https://app.tidalcyber.com/references/320f49df-7b0a-4a6a-8542-17b0f56c94c9)]</sup><sup>[[Crowdstrike Helix Kitten Nov 2018](https://app.tidalcyber.com/references/3fc0d7ad-6283-4cfd-b72f-5ce47594531e)]</sup>","source":"ICS","associated_group_id":"8779d808-ed34-44bc-a3e3-8b0954bc8022","owner_id":null,"owner_name":null},{"id":"6e1a3670-ca1f-42c6-98e5-47045a1cb52c","name":"Evasive Serpens","description":"<sup>[[Unit42 OilRig Playbook 2023](https://app.tidalcyber.com/references/e38902bb-9bab-5beb-817b-668a67a76541)]</sup>","source":"ICS","associated_group_id":"9cbeb785-fe7e-5bf7-b860-bf1bf8bf7f09","owner_id":null,"owner_name":null},{"id":"082e65a7-5401-44f0-822e-9807500279ec","name":"Hazel Sandstorm","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"83d1b16c-934f-52e2-9139-8475fc20c225","owner_id":null,"owner_name":null},{"id":"e1cb2600-ceb5-468f-8682-55718adbd2a1","name":"EUROPIUM","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"82a2e864-3187-586e-9606-18ccc65c4f91","owner_id":null,"owner_name":null},{"id":"35fc942d-9102-4407-ab3e-0d8ab50fc8e0","name":"ITG13","description":"<sup>[[IBM ZeroCleare Wiper December 2019](https://app.tidalcyber.com/references/26ba5292-265d-5db4-a571-215c984fe095)]</sup>","source":"ICS","associated_group_id":"c4e00029-b877-5544-97d6-92a4f3b91971","owner_id":null,"owner_name":null},{"id":"463f40e8-6133-4896-99c5-e322703ad84a","name":"Crambus","description":"<sup>[[Symantec Crambus OCT 2023](https://app.tidalcyber.com/references/ecfdd6e1-caa0-5611-a1f5-d96873cf2222)]</sup>","source":"ICS","associated_group_id":"32c8d2f9-7a8d-4c5b-bb6a-7ee85865da09","owner_id":null,"owner_name":null},{"id":"78e0c2ff-edf0-492c-9a0f-39349940077f","name":"TA452","description":"<sup>[[Proofpoint Iranian Aligned Attacks JAN 2020](https://app.tidalcyber.com/references/090da2a7-1a9d-5828-ab08-18cc285ea504)]</sup>","source":"ICS","associated_group_id":"38557cbb-6d69-5fca-be0c-a9aa605d76f4","owner_id":null,"owner_name":null},{"id":"d0fc7830-022a-4b11-938a-aae798b58990","name":"APT34","description":"This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity.<sup>[[Unit 42 QUADAGENT July 2018](https://app.tidalcyber.com/references/320f49df-7b0a-4a6a-8542-17b0f56c94c9)]</sup><sup>[[FireEye APT34 Dec 2017](https://app.tidalcyber.com/references/88f41728-08ad-4cd8-a418-895738d68b04)]</sup><sup>[[Check Point APT34 April 2021](https://app.tidalcyber.com/references/593e8f9f-88ec-4bdc-90c3-1a320fa8a041)]</sup>","source":"ICS","associated_group_id":"17ac9e60-dfad-4ee5-a61c-7b7ee6686a73","owner_id":null,"owner_name":null},{"id":"0b22055e-5761-4d75-bb06-259ae0e1e145","name":"Earth Simnavaz","description":"<sup>[[Trend Micro Earth Simnavaz October 2024](https://app.tidalcyber.com/references/aff9097b-43ea-50aa-88ed-62b98f2d58ce)]</sup>","source":"ICS","associated_group_id":"ceecd2db-afb7-5116-b6d9-53e6783c476f","owner_id":null,"owner_name":null}],"tags":[{"id":"8801bc81-745c-4f52-be55-2c052213262f","tag":"0f1b7cb0-c4de-485e-8ff5-fe12ffccd738"},{"id":"7345aa42-8ea8-4579-9a55-d3e5e91b00d2","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"3e09a9ce-0ed9-4421-8547-5e51962b85d4","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"}],"owner_name":null},{"id":"1a882094-eabf-4692-b5d7-702a8bd5b766","name":"OPERATOR PANDA","source":"Tidal Cyber","group_attack_id":"G3084","created":"2025-03-04T15:55:07.694974Z","modified":"2025-03-04T15:55:07.694979Z","tidal_id":"3779e2de-71f0-53ce-a464-47e5607b9aab","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"6dd80217-ed2e-4e05-bd5e-0480563ebe63","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c675bdc4-574e-46fd-ad48-62ece1590f3e","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"863b7013-133d-4a82-93d2-51b53a8fd30e","name":"Orangeworm","source":"MITRE","group_attack_id":"G0071","created":"2018-10-17T00:14:20.652000Z","modified":"2021-10-26T22:29:09.327000Z","tidal_id":"ce66c8f2-616b-5bec-9643-0f8002157e1c","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"86a9fd02-00d4-40da-acb5-15c953cb126c","name":"Paper Werewolf","source":"Tidal Cyber","group_attack_id":"G3186","created":"2025-12-29T17:40:15.415607Z","modified":"2025-12-29T17:40:15.415610Z","tidal_id":"dc44a330-46fc-5cd7-9077-77453eacabc8","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[{"id":"209d7bc4-dc64-4343-a514-942dfc6de8d0","name":"GOFFEE","description":"<sup>[[Intezer December 19 2025](/references/53d1f9b0-855f-4478-9e13-a15f2dcdec9f)]</sup>","source":"USER","associated_group_id":"9e6ff634-704b-4fd4-8dee-b65fa1695dc8","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"06a489df-1fc9-49f2-aa5c-656787bbd02b","tag":"241d20a1-bda4-469b-854a-10113e64387d"},{"id":"649c6045-03d4-4f32-83df-18bed8548af0","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a4fed39d-45b8-4de0-9161-f4d4e2e940fa","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"32385eba-7bbf-439e-acf2-83040e97165a","name":"Patchwork","source":"MITRE","group_attack_id":"G0040","created":"2017-05-31T21:32:07.145000Z","modified":"2022-09-02T18:04:32.246000Z","tidal_id":"d454493d-6e6b-5f79-b3fe-de9631f15939","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[{"id":"68d9b964-3996-43b9-aabc-e3b3a8a8f4ce","name":"Dropping Elephant","description":"<sup>[[Symantec Patchwork](https://app.tidalcyber.com/references/a6172463-56e2-49f2-856d-f4f8320d7c6e)]</sup> <sup>[[Securelist Dropping Elephant](https://app.tidalcyber.com/references/2efa655f-ebd3-459b-9fd7-712d3f4ba1f8)]</sup> <sup>[[PaloAlto Patchwork Mar 2018](https://app.tidalcyber.com/references/2609e461-1e23-4dc2-aa44-d09f4acb8c6e)]</sup> <sup>[[Volexity Patchwork June 2018](https://app.tidalcyber.com/references/d3ed7dd9-0941-4160-aa6a-c0244c63560f)]</sup>","source":"MITRE","associated_group_id":"8f4890c6-6db0-4536-8624-35cb02bb94a7","owner_id":null,"owner_name":null},{"id":"65af7d73-1452-4c1c-bf48-344adc7e2bde","name":"Hangover Group","description":"[Patchwork](https://app.tidalcyber.com/groups/32385eba-7bbf-439e-acf2-83040e97165a) and the Hangover Group have both been referenced as aliases for the threat group associated with Operation Monsoon.<sup>[[PaloAlto Patchwork Mar 2018](https://app.tidalcyber.com/references/2609e461-1e23-4dc2-aa44-d09f4acb8c6e)]</sup><sup>[[Unit 42 BackConfig May 2020](https://app.tidalcyber.com/references/f26629db-c641-4b6b-abbf-b55b9cc91cf1)]</sup><sup>[[Forcepoint Monsoon](https://app.tidalcyber.com/references/ea64a3a5-a248-44bb-98cd-f7e3d4c23d4e)]</sup>","source":"MITRE","associated_group_id":"2c043629-b8f6-475f-a436-abc01aad9421","owner_id":null,"owner_name":null},{"id":"9e9ba191-f9e6-441e-83bd-6c91051f1c4d","name":"Operation Hangover","description":"It is believed that the actors behind [Patchwork](https://app.tidalcyber.com/groups/32385eba-7bbf-439e-acf2-83040e97165a) are the same actors behind Operation Hangover. <sup>[[Forcepoint Monsoon](https://app.tidalcyber.com/references/ea64a3a5-a248-44bb-98cd-f7e3d4c23d4e)]</sup> <sup>[[Operation Hangover May 2013](https://app.tidalcyber.com/references/fd581c0c-d93e-4396-a372-99cde3cd0c7c)]</sup>","source":"MITRE","associated_group_id":"364de163-80dc-4f0f-8b42-837ae97a2088","owner_id":null,"owner_name":null},{"id":"77abe6f0-7cf8-4dd5-8856-b75d1372ddd9","name":"Chinastrats","description":"<sup>[[Securelist Dropping Elephant](https://app.tidalcyber.com/references/2efa655f-ebd3-459b-9fd7-712d3f4ba1f8)]</sup>","source":"MITRE","associated_group_id":"938d3a61-cb8b-4ec3-9bf0-f27833a0f96f","owner_id":null,"owner_name":null},{"id":"6f6fbe52-56f6-4475-a705-76931c425513","name":"MONSOON","description":"MONSOON is the name of an espionage campaign; we use it here to refer to the actor group behind the campaign. <sup>[[Forcepoint Monsoon](https://app.tidalcyber.com/references/ea64a3a5-a248-44bb-98cd-f7e3d4c23d4e)]</sup> <sup>[[PaloAlto Patchwork Mar 2018](https://app.tidalcyber.com/references/2609e461-1e23-4dc2-aa44-d09f4acb8c6e)]</sup>","source":"MITRE","associated_group_id":"23ef9d36-8cb3-4992-abda-709777b97cc3","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"a28a00b1-dbee-448c-9f91-690dcca00de8","name":"PHALT#BLYX Threat Actor","source":"Tidal Cyber","group_attack_id":"G3197","created":"2026-01-14T13:30:28.646904Z","modified":"2026-01-14T13:30:28.646909Z","tidal_id":"902a4c04-eaf5-5f61-88b2-0be058b24441","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"}],"associated_groups":[{"id":"0f5d3370-eefa-4b01-96b4-120da3ed786b","name":"Russian DCRat Operators","description":"<sup>[[Securonix January 05 2026](/references/314a9db4-8a16-4732-aa23-b24b38897943)]</sup>","source":"USER","associated_group_id":"01df8900-db68-458c-b557-e98a97f93b5b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"25728156-5fcb-4655-997a-b53d733fc825","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"e35d6277-e96c-422a-bf97-4f57af7ee173","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"bff61144-4f48-4cbe-8371-96d77098eca1","name":"Phantom Taurus","source":"Tidal Cyber","group_attack_id":"G3136","created":"2025-10-13T17:28:59.917320Z","modified":"2025-10-13T17:28:59.917324Z","tidal_id":"1e1f364e-2925-51c0-a2fa-823bc49846ec","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"8786f9e0-6491-49b6-b8f7-7421cd9ce667","name":"TGR-STA-0043","description":"<sup>[[Unit 42 September 30 2025 09 30 2025](/references/257d2f0e-d60c-4317-b9ab-ed6e76b90d2d)]</sup>","source":"USER","associated_group_id":"772a18a8-986f-4430-84e6-07fa496f50b3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"5ebe5ee9-95e7-4dba-8516-0e1da315a494","name":"CL-STA-0043","description":"<sup>[[Unit 42 September 30 2025 09 30 2025](/references/257d2f0e-d60c-4317-b9ab-ed6e76b90d2d)]</sup>","source":"USER","associated_group_id":"3653632c-cf66-4011-9647-f8afc8e3c6ba","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"321951bd-985d-43e9-9460-58925e2d255c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f601d13e-ff2b-4b87-b24c-53bbd81d0abc","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f138c814-48c0-4638-a4d6-edc48e7ac23a","name":"Phobos Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3033","created":"2024-03-07T21:01:03.698995Z","modified":"2024-03-07T21:01:03.698999Z","tidal_id":"4dc28f66-519f-5281-bdef-67f5599fb3e0","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"}],"associated_groups":[],"tags":[{"id":"61e465fa-0733-4a09-b1b3-77d7b24dce18","tag":"1d06c2ad-3f16-44e4-908c-d6a3191aa29c"},{"id":"bc3f085f-5d1f-4039-9df1-5d30b6082c0b","tag":"c306a190-d66a-43f0-befd-b7c3249cc8d5"},{"id":"d852b1a6-b1ac-4007-a61b-4ac4af6eb57e","tag":"ee8be47a-dbd8-4067-8785-2fc1450587eb"},{"id":"6ed0ba98-ac5c-4247-a99c-93ae06a79b77","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"13d5c132-980a-4c64-832d-757b3f4efc2d","tag":"d819ae1a-e385-49fd-88d5-f66660729ecb"},{"id":"02779649-f83d-4e28-944d-c991354849d3","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"15d3fed4-b31b-44a7-a321-551ab6378955","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"153c1b96-4531-4ba8-93c0-546c2928b484","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"e6769be8-61da-430f-bbb3-fffc43f926ac","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"b5fce40f-39b9-4c63-bd56-834bef34381c","name":"PirateJack Actor","source":"Tidal Cyber","group_attack_id":"G3094","created":"2025-04-11T15:33:37.158235Z","modified":"2025-04-11T15:33:37.158239Z","tidal_id":"241a7932-8dbe-55ef-814a-7d2f287769ab","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"4907333d-6a26-4673-8a0d-80f817106800","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"ccba1a3b-473c-4c57-94f0-efd373929368","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f94f4bc5-f4f1-46e1-ba29-20d53b1a7e1c","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"60936d3c-37ed-4116-a407-868da3aa4446","name":"PittyTiger","source":"MITRE","group_attack_id":"G0011","created":"2017-05-31T21:31:50.198000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"807f3a35-02e6-518b-bfee-1f7fb2f339a6","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"}],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"08dd2310-0980-4c61-9815-7d40b456e61b","name":"APT24","description":"<sup>[[SecurityWeek APT24 November 21 2025](/references/47a47a46-5cac-4513-a950-156486ae2eb9)]</sup>","source":"USER","associated_group_id":"68cfd9da-98b8-418a-8d97-75d8fdc0e882","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2b079152-26e3-420b-bc11-3f4e0ef00e7f","name":"Pitty Tiger","description":"<sup>[[SecurityWeek APT24 November 21 2025](/references/47a47a46-5cac-4513-a950-156486ae2eb9)]</sup>","source":"USER","associated_group_id":"ea9790a7-dfee-473d-a968-91cfe3402264","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7acd77f7-a9c0-4bb4-8c6a-53c677a1f382","name":"Pitty Panda","description":"<sup>[[SecurityWeek APT24 November 21 2025](/references/47a47a46-5cac-4513-a950-156486ae2eb9)]</sup>","source":"USER","associated_group_id":"702b2c09-3edc-47f9-9321-7ea5657fe225","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"0d67db41-e628-4622-aff9-0fe86d7f2158","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"5f8b321f-eda8-4c46-975d-8346a5066df7","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"}],"owner_name":null},{"id":"f036b992-4c3f-47b7-a458-94ac133bce74","name":"PLATINUM","source":"MITRE","group_attack_id":"G0068","created":"2018-04-18T17:59:24.739000Z","modified":"2021-04-22T00:39:49.529000Z","tidal_id":"ab8757fc-bcac-500f-83c2-67b0145b3665","country":[],"observed_motivation":[],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"60f686d0-ae3d-5662-af32-119217dee2a7","name":"Play","source":"MITRE","group_attack_id":"G1040","created":"2024-10-31T16:28:11.455837Z","modified":"2024-10-31T16:28:11.455840Z","tidal_id":"60f686d0-ae3d-5662-af32-119217dee2a7","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"aaeaa7a1-7d15-4cb7-b75e-d35547cb0689","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"067bbfe3-667c-42c6-b91b-f7898dec3fd3","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"3052e7c4-9bc5-4ca6-96cb-014870c2bb0b","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"7e3c37ed-b1dc-4533-9983-ebfb0c8c19a9","tag":"27eaae77-7e2d-4ab3-8349-a24134c5f6a9"},{"id":"d610afbe-d2dc-465f-bb6e-0e536b6df5a5","tag":"17864218-bc4f-4564-8abf-97c988eea9f7"},{"id":"f47402b0-9706-4367-917e-9921dc924e76","tag":"b6458e46-650e-4e96-8e68-8a9d70bcf045"},{"id":"04974355-791a-45fd-96e9-9759ccf07932","tag":"bac51672-8240-4182-9087-23626023e509"},{"id":"1692972c-ad89-458b-a611-0344a3f10c41","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"6c6954f5-66c3-4c12-a80b-2d2c2e839631","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"87237de4-0824-471c-a416-03fde27aa2fa","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"9d101bef-0eb9-4226-ba6c-d0470f8f5054","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"52c40bc3-e1e3-4bf6-a169-24e117493def","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"3444e9ed-d79a-4c53-90a2-a3bd2fcc3f7c","name":"PLUMP SPIDER","source":"Tidal Cyber","group_attack_id":"G3083","created":"2025-03-04T15:55:07.386243Z","modified":"2025-03-04T15:55:07.386247Z","tidal_id":"25d45102-7e9e-5734-8723-7f44b93b1587","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"}],"observed_sector":[],"associated_groups":[],"tags":[{"id":"b5c8cd50-d1d0-4526-b78a-2a6460ce4d7e","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"b94276c2-0992-42f2-a1a6-fc6bc0e934d5","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"25242252-7700-454d-a8c0-e6e8b78da1b6","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"44692ae5-0b6d-4411-a16d-3c13eab30e6f","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"3a97e7d2-d3f3-4a6c-bd5f-0e82fcc08ae6","name":"PlushDaemon","source":"Tidal Cyber","group_attack_id":"G3069","created":"2025-01-28T15:53:47.937485Z","modified":"2025-01-28T15:53:47.937489Z","tidal_id":"7a6c216b-91cb-5376-8e5a-c9b28b2605ca","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"4684465c-9860-40a6-bd7a-632b74f768c3","name":"Semi Conductors"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"1e9fde9f-c723-4f37-b839-894f4ff52a0f","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"d5c8c46e-6914-4809-aa36-3174c517c4f1","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"},{"id":"7b922eec-0054-4f9e-87eb-c565d202e9e3","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d0c2b6fc-4df2-4df8-b1cd-143d716b63ae","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"7fbd7514-76e9-4696-8c66-9f95546e3315","name":"POLONIUM","source":"MITRE","group_attack_id":"G1005","created":"2022-07-01T19:07:04.253000Z","modified":"2022-08-10T12:31:10.192000Z","tidal_id":"1e97a915-262d-53bd-8a7f-797728a85686","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"18a5b09d-5b22-5456-9373-381cde95045f","name":"Plaid Rain","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"f260c098-78da-571e-a0e4-2dceb2c8824c","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"553e2b7b-170c-4eb5-812b-ea33fe1dd4a0","name":"Poseidon Group","source":"MITRE","group_attack_id":"G0033","created":"2017-05-31T21:32:04.179000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"da82c2c4-b9dc-5101-8098-429b0e6f9c07","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"b69bf099-25ac-4c62-8b17-e5b85e48bfc5","name":"Predatory Sparrow","source":"Tidal Cyber","group_attack_id":"G3112","created":"2025-06-23T13:53:42.575104Z","modified":"2025-06-23T13:53:42.575108Z","tidal_id":"5ffdb517-cb85-5e0d-8f82-7f3259e5caa8","country":[],"observed_motivation":[{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"345fc92f-03c0-4da1-852b-ade2a1ceeb84","name":"Gonjeshke Darande","description":"<sup>[[CyberScoop June 17 2025](/references/5b1f92f0-fa2f-4c19-9ec5-164e5f957e73)]</sup>","source":"Tidal Cyber","associated_group_id":"7c91b759-9b39-433d-a089-ea9be0c4a859","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"50d36855-5565-4c6a-87a9-713089d9b624","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"fbac47f8-baf2-44e5-a193-ae7764b06b29","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"cc798766-8662-4b55-8536-6d057fbc58f0","name":"PROMETHIUM","source":"MITRE","group_attack_id":"G0056","created":"2018-01-16T16:13:52.465000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"3c06173c-412b-50f8-b8ef-85983bbee75b","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"}],"observed_sector":[],"associated_groups":[{"id":"225f451f-621e-406d-94ee-bcff9ee39367","name":"StrongPity","description":"The name StrongPity has also been used to describe the group and the malware used by the group.<sup>[[Bitdefender StrongPity June 2020](https://app.tidalcyber.com/references/7d2e20f2-20ba-4d51-9495-034c07be41a8)]</sup><sup>[[Talos Promethium June 2020](https://app.tidalcyber.com/references/188d990e-f0be-40f2-90f3-913dfe687d27)]</sup>","source":"MITRE","associated_group_id":"aa5e87f3-6e59-4abf-aeba-a49eb9d495f3","owner_id":null,"owner_name":null},{"id":"046f8ca6-406a-4b2d-a0fc-e3bf1be9d701","name":"Magenta Dust","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"33fb9eb2-0e9d-46b8-a882-d13e5b748e7c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"bea8ba86-d7e7-419a-b3ff-db687ccba140","name":"SmallPity","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"82230e24-a0a9-4efc-94d9-d9afbcf8decd","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"68f79f90-609c-4db0-b689-ae87fe53e493","name":"StrongPity","description":"The name StrongPity has also been used to describe the group and the malware used by the group.<sup>[[Bitdefender StrongPity June 2020](https://app.tidalcyber.com/references/7d2e20f2-20ba-4d51-9495-034c07be41a8)]</sup><sup>[[Talos Promethium June 2020](https://app.tidalcyber.com/references/188d990e-f0be-40f2-90f3-913dfe687d27)]</sup>","source":"Mobile","associated_group_id":"aa5e87f3-6e59-4abf-aeba-a49eb9d495f3","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"6005f4a9-fe26-4237-a44e-3f6cbb1fe75c","name":"Putter Panda","source":"MITRE","group_attack_id":"G0024","created":"2017-05-31T21:31:56.785000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"a1d743d5-7d04-5653-b0fb-fe12146ba67c","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"b80baeda-6ed3-413d-9412-1d49e035a898","name":"MSUpdater","description":"<sup>[[CrowdStrike Putter Panda](https://app.tidalcyber.com/references/413962d0-bd66-4000-a077-38c2677995d1)]</sup>","source":"MITRE","associated_group_id":"9975905f-c429-4911-800d-d21e9a29b3f8","owner_id":null,"owner_name":null},{"id":"d55c62a4-1477-4a32-a669-7bc113e52f95","name":"APT2","description":"<sup>[[Cylance Putter Panda](https://app.tidalcyber.com/references/058d6e8e-7ab9-4151-97de-1778ac95e18d)]</sup>","source":"MITRE","associated_group_id":"bab4d1df-a6c6-40ae-b583-83c4492cbbd2","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"6cafa6a6-8fb4-49f0-b55e-8c95042cc7ff","name":"PyStoreRAT Operators","source":"Tidal Cyber","group_attack_id":"G3201","created":"2026-01-14T13:30:29.398385Z","modified":"2026-01-14T13:30:29.398389Z","tidal_id":"6e85a98a-f8ef-58ee-8860-94a15ed5f75a","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"2812837c-b7c9-4342-a376-d2a7e4da4f70","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"b65df7ef-e5dc-4719-9a63-1128aa7198b9","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"00290f58-be82-4218-af92-7c0c26eca64a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"e5395df4-59e0-4eb7-b864-335bfd3a9bc2","name":"Qilin Ransomware Actors (Deprecated)","source":"Tidal Cyber","group_attack_id":"G3108","created":"2025-06-10T15:50:37.529666Z","modified":"2025-06-10T15:50:37.529668Z","tidal_id":"e8cd4b4c-227c-5c03-aa68-78c8ad15b87c","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"5d57529c-ee73-415c-a57e-a398264c049a","name":"STAC4365","description":"<sup>[[Sophos News April 1 2025](/references/7066ca7e-03e9-4d3c-8d10-2a659c79c859)]</sup>","source":"USER","associated_group_id":"cd639d72-585e-4734-bb10-9580c5005577","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"66eeea9a-107e-413d-bab5-47b6c3ab4ba4","name":"Phantom Mantis","description":"<sup>[[BleepingComputer June 6 2025](/references/2572c252-f3a7-4e0f-bf87-2c92f7379397)]</sup>","source":"Tidal Cyber","associated_group_id":"df4d28da-d091-4eea-a01e-e033b551e677","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ff67e84b-3a4e-4437-965d-8a9805cdba7f","name":"Agenda","description":"<sup>[[BleepingComputer June 6 2025](/references/2572c252-f3a7-4e0f-bf87-2c92f7379397)]</sup>","source":"Tidal Cyber","associated_group_id":"2b4191f3-bd79-449e-b273-30b9b2aff295","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"4341f48a-c872-421d-817d-2dd45c8454f7","tag":"0094c0cb-29f2-4d61-a62a-fb3b3ef3d9a0"},{"id":"254de8bf-0978-4a59-b9d1-21d32a1e6417","tag":"33d22eff-59a1-47e0-b9eb-615dee314595"},{"id":"9971eaaa-4146-4114-8945-4b8357730164","tag":"15b77e5c-2285-434d-9719-73c14beba8bd"},{"id":"aa7f36ad-532a-4fe2-aec4-f8de2bbc9e23","tag":"dac201ad-a6f6-44d3-89b4-957414336eed"},{"id":"40a07640-2039-4075-87b5-f8e847d172f9","tag":"abff87bf-5c28-489b-8fe6-e1fc74abb70a"},{"id":"3a44c3b2-3c21-4039-bb58-4ab160ad283e","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"986a0029-a0c1-4475-ab36-722924660b03","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"342fc846-9885-49b0-8612-d567bdf36f0d","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"b2e06f95-33cd-4880-8438-bbc4268dffd0","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"3056ecf9-825b-4348-a5d1-77cef1cddd7b","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"344030f1-47c5-474a-8312-eb6fbb924961","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"bf3d1108-0bcd-47ae-8d71-4df48e3e2b43","name":"Quad7 Botnet Operators","source":"Tidal Cyber","group_attack_id":"G3052","created":"2024-09-13T19:21:14.649054Z","modified":"2024-09-13T19:21:14.649057Z","tidal_id":"9995fe6d-4ce7-5a38-b7e9-90fd55577716","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"36fbf19d-8822-4b05-8b0e-85e7c33b134d","name":"7777 Botnet Operators","description":"<sup>[[Sekoia.io Blog July 23 2024](/references/ae84e72a-56b3-4dc4-b053-d3766764ac0d)]</sup>","source":"Tidal Cyber","associated_group_id":"83f1f3da-297b-44b4-8ff6-7ffe62238491","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"d57de022-09ab-4749-bddd-6a2ca10f9444","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"455dae9e-a499-4c92-b3fd-14cbc7c5ab84","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"eb966e79-1d03-4634-9812-6d42b4123d4f","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"236d6717-74df-46df-a2a5-c7b5976a1bcb","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"79f292fb-517d-4746-9f1e-ffb9a7c86b01","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"b2f16aeb-b92d-4130-a741-b19055b1dfa9","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"e75a1b98-be68-467f-a8df-bcb7671543b3","name":"Quantum Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3043","created":"2024-06-28T17:23:23.403679Z","modified":"2024-06-28T17:23:23.403683Z","tidal_id":"ac564931-ba13-5787-ac24-78b860deb26d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"19cc4398-22ce-4bd4-aa34-f9e48b82e58a","name":"Conti Team Two","description":"","source":"Tidal Cyber","associated_group_id":"de43849f-87d7-4965-a919-7186154cfa57","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"a0d1194f-8adf-467d-8754-11c16bfb8f64","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"30064916-4e2e-492f-a09c-4335043cb346","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"8e0360a0-d9ff-48b3-b7d2-bddcfe60aee8","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"489bd3de-d1c7-4bb0-b53e-18f4d529d332","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"5302bb0a-b830-49ba-9ec9-b9e60732d261","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3d60642b-cfa7-49ad-953e-7fb378b4f808","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"021b3c71-6467-4e46-a413-8b726f066f2c","name":"Rancor","source":"MITRE","group_attack_id":"G0075","created":"2018-10-17T00:14:20.652000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"0ec2ad4b-d65f-5b76-9c48-370d48b04660","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"61fe900f-d317-41fb-aed8-7f1052acfc5e","name":"Ransomhouse Group","source":"Trellix TIG","group_attack_id":"G3001","created":"2025-04-11T15:06:29.794983Z","modified":"2025-04-11T15:06:29.794988Z","tidal_id":"ec963938-6885-56f4-bef7-ac74c2b71a23","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"c5eae101-2ff1-4cee-8cb3-fb3ca7054020","name":"Jolly Scorpius","description":"<sup>[[Unit 42 December 17 2025](/references/5d5a68da-5ad3-4707-ba0d-410ac770e673)]</sup>","source":"USER","associated_group_id":"1662997b-c1d5-43a7-974b-a8d0c6c1f834","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"745837e9-7795-46e6-84f0-665297ca1c04","name":"RansomHouse operators","description":"<sup>[[Unit 42 December 17 2025](/references/5d5a68da-5ad3-4707-ba0d-410ac770e673)]</sup>","source":"USER","associated_group_id":"bee49817-8314-4b2a-8e3b-df3d5e97b57f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"29d77a10-a060-4faa-b39f-4f0cbf3fbb80","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"6ac6f97b-8e05-41e4-b3bc-5c3d5e76581b","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"703a228c-d123-4702-9f3e-34f386fa7df0","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"94794e7b-8b54-4be8-885a-fd1009425ed5","name":"RansomHub Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3049","created":"2024-08-23T18:43:09.403704Z","modified":"2024-08-23T18:43:09.403708Z","tidal_id":"fe9f2737-210e-5daa-859b-76b21ccd5f5c","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"2af18b16-7943-4c2c-993d-f79010212854","name":"RansomHub","description":"<sup>[[None October 29 2025](/references/3dacc043-780d-46fc-b61b-4be1d1dbdbad)]</sup>","source":"USER","associated_group_id":"d4908d31-5e93-4f41-af93-10493c42475d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"edf9b556-3b68-4492-b841-7c6df3fb930c","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"7426481a-31cb-4db4-a7b7-5e1d4dbebf25","tag":"d903e38b-600d-4736-9e3b-cf1a6e436481"},{"id":"3792f678-c7ac-4ccf-b111-c7f6aad1a9d3","tag":"d819ae1a-e385-49fd-88d5-f66660729ecb"},{"id":"1f0a8e77-6d3f-46c9-823e-6550f6bb0eef","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"20df432f-0773-48a1-889e-16d827d45ede","tag":"32b1a271-7856-4dda-a802-42325f465d36"},{"id":"ab751179-a07a-47cb-b375-2df8e5887f82","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"22710949-d797-427e-b143-7aa5b27b14b3","tag":"09de661e-60c4-43fb-bfef-df017215d1d8"},{"id":"4117a1fb-45ed-47c5-8a94-5512104c96e2","tag":"8046a757-48f0-4787-81ab-9dc8c1eb77cd"},{"id":"c80ae63c-7078-4333-96ca-3ac07d94f101","tag":"abe1c785-4f3a-4f4f-96eb-c47da570face"},{"id":"40775390-bd03-4541-9f24-206230e23bee","tag":"9794c389-183b-4d6b-bd59-95cfa4a5afc7"},{"id":"6d8d582b-f3df-4732-a689-4b0de135000d","tag":"4ac8dcde-2665-4066-9ad9-b5572d5f0d28"},{"id":"ffc71435-9877-4e2a-aa0e-9b04fa08411a","tag":"b8448700-7ed0-48b8-85f5-ed23e0d9ab97"},{"id":"8420c7ae-9fda-4a38-ab83-512051e5e4a3","tag":"c475ad68-3fdc-4725-8abc-784c56125e96"},{"id":"a903649c-237d-4082-ab42-4d6f4f505065","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"78766faf-f94b-4fde-9d80-c34c0cdcc916","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"97117930-0ab9-4a4d-999a-be2a2e80c8f2","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"8302ac29-872e-564b-8525-f00002be2e58","name":"RedCurl","source":"MITRE","group_attack_id":"G1039","created":"2024-10-31T16:28:10.860561Z","modified":"2024-10-31T16:28:10.860564Z","tidal_id":"8302ac29-872e-564b-8525-f00002be2e58","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"}],"associated_groups":[{"id":"224454f0-7ca4-463b-b206-71b7706dbd51","name":"Earth Kapre","description":"<sup>[[trendmicro_redcurl](/references/f0b8be1d-5174-5172-8a0d-1628ddd09092)]</sup>","source":"Tidal Cyber","associated_group_id":"9d908d37-031c-488e-ad11-a6f6a49e6158","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[],"owner_name":null},{"id":"a6dea520-12ab-5c7b-8142-db3a308122de","name":"RedEcho","source":"MITRE","group_attack_id":"G1042","created":"2025-04-22T20:47:03.687169Z","modified":"2025-04-22T20:47:03.687172Z","tidal_id":"a6dea520-12ab-5c7b-8142-db3a308122de","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"}],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[],"tags":[{"id":"dd393155-01ba-4fa7-9413-b06d0aa805cb","tag":"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a"}],"owner_name":null},{"id":"d858b6e6-329a-462e-b55b-4fb4aa33291b","name":"Red Menshen","source":"Tidal Cyber","group_attack_id":"G3162","created":"2025-12-17T14:18:04.766825Z","modified":"2025-12-17T14:18:04.766829Z","tidal_id":"ed0d86e7-a04c-55c9-af37-1f9d886e063b","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"60a1bd2b-0f73-40a5-9b02-3ad87fc82a97","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3a588f6a-d3b9-439c-9c15-a60741827559","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"0610cd57-2511-467a-97e3-3c810384074f","name":"Rhysida Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3017","created":"2023-11-17T17:09:23.975061Z","modified":"2023-11-17T17:09:23.975064Z","tidal_id":"f88c3906-18fe-52a1-8d74-aab1c9d3bcc3","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"77c64d2b-c99c-467a-8b2c-2d3317a35f66","name":"Rhysida","description":"<sup>[[Expel October 31 2025](/references/ce92580a-66f0-431c-9ee8-7efec2bd4585)]</sup>","source":"USER","associated_group_id":"81165a4c-a7af-45ad-bb1e-2863a4bc2d3a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1cfdfc11-44fb-4c54-bb19-b3065c7ea13f","name":"Vice Society","description":"<sup>[[Expel October 31 2025](/references/ce92580a-66f0-431c-9ee8-7efec2bd4585)]</sup>","source":"USER","associated_group_id":"bad74f9b-e165-420e-bfad-aebc81250a52","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"6ba905ea-e428-4a1e-ae36-2a8bdf0ecf6e","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"0f573c8b-fc28-4a32-8ec0-9edd1be55946","tag":"1bafa336-67a8-4094-bb2e-2079a7bdaab5"},{"id":"aacd1991-cc2a-4fbf-aca6-832683cc730a","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"14b9b8fd-c51e-4190-8c8b-3698eee5b95e","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"10dd4351-fe25-4531-a4ad-1974f8f3a447","tag":"2743d495-7728-4a75-9e5f-b64854039792"},{"id":"47132d63-d778-4eaf-914a-c731d7f27cac","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"69e5b002-9230-49d1-a3be-9b7aaa7165f4","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"71222310-2807-4599-bb92-248eaf2e03ab","name":"Rocke","source":"MITRE","group_attack_id":"G0106","created":"2020-05-26T14:20:20.623000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"f46fb266-5fc9-521d-9842-54c09c80754e","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"0dcab757-e43c-4f0d-a90c-95c69f117e98","name":"RondoDoX Operators","source":"Tidal Cyber","group_attack_id":"G3189","created":"2026-01-06T18:04:01.815413Z","modified":"2026-01-06T18:04:01.815417Z","tidal_id":"7739bc93-babe-5f83-9c3d-485eee85181f","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"e6163b99-3b63-4570-bf4f-6c82695eb876","name":"Rondo botnet operators","description":"<sup>[[Www.cloudsek.com December 29 2025](/references/4c94a4d9-242c-4b15-8fa0-0d7f7273d43f)]</sup>","source":"USER","associated_group_id":"ece8a237-8479-4af6-9b00-3e7bdb092910","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"03def3db-aa36-4b55-848f-4ecc915ebc94","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"f3ab6307-9af9-4f68-8e8c-0d992585bd01","tag":"33d35d5e-f0cf-4c66-9be3-a3ffe6610b1a"},{"id":"a97ed8de-453f-454d-b2d7-5d53b5ea3c9a","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"f48acb67-3f37-40a3-a381-8e77f7b3b1fc","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"9cb69b42-c96c-4f5e-abe2-472afc7def24","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"e7d45edd-6991-4bc5-8410-7aea7c0e1947","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"86b97a39-49c3-431e-bcc8-f4e13dbfcdf5","name":"Royal Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3003","created":"2023-11-17T17:09:24.259094Z","modified":"2023-11-17T17:09:24.259097Z","tidal_id":"a12095f6-9679-5a80-87e6-eb7390995e99","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[],"tags":[{"id":"67ad69e5-13d8-4063-9ba1-122efb66a2f8","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"b12118e9-9ab5-48af-9b43-24d7b301c5df","tag":"d602ade5-148e-4f57-a202-87845bab308b"},{"id":"76184596-3785-44ad-8c8d-c24f9f4b6303","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"1f733905-b7b7-4626-9833-a4395f44611f","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"5d41d531-1d91-40a1-bbdd-c3615127c41a","tag":"d63754b9-0267-4a70-82a3-212ef32fa796"},{"id":"5372674f-0e33-429f-9c97-78425cfb610e","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"016ea364-a748-427a-a740-ecea77ae3d05","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"477263c3-5967-4c3e-a936-c1321610ec9d","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"666ab5f0-3ef1-4e74-8a10-65c60a7d1acd","name":"RTM","source":"MITRE","group_attack_id":"G0048","created":"2017-05-31T21:32:10.206000Z","modified":"2020-05-12T22:16:44.650000Z","tidal_id":"ff2fff22-e28b-5ed4-b7ca-6f584bc76294","country":[],"observed_motivation":[],"observed_country":[{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"92cbac61-7999-465a-9afc-5476f84b3a2e","name":"RudePanda","source":"Tidal Cyber","group_attack_id":"G3180","created":"2025-12-24T14:56:39.719669Z","modified":"2025-12-24T14:56:39.719672Z","tidal_id":"daf46ede-674c-5870-a12f-76cf31ed7d1f","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"664c6221-9ace-4d70-b9fc-92bc1dbda058","name":"REF3927","description":"<sup>[[Check Point Research December 16 2025](/references/1fc24a9b-9636-482a-8413-211b42658872)]</sup>","source":"USER","associated_group_id":"a2d64dba-0078-466c-a2da-115ab6828745","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"66984e27-73bd-4724-b56f-d23601b85d68","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"fad1d3de-bdb5-422a-ae30-d14bcf8aa45a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"7015d001-9dcc-4361-9d27-4799d73ec426","name":"SafePay Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3098","created":"2025-04-15T17:47:29.949176Z","modified":"2025-04-15T17:47:29.949180Z","tidal_id":"0536bdcf-028e-529b-bc05-15c2f271337c","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"}],"associated_groups":[],"tags":[{"id":"3e772bea-1e3d-4167-a077-d1649ea52d06","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"0ee67dd4-15b2-4653-a033-c15faacad25a","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"16ba1856-2389-45fa-b3c7-b615fced93b3","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"42ad7d2a-ba06-4451-8d80-6a54b6e5758c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"94171b19-69bb-452e-b41e-3ee91209ee9a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"eb64ce69-f106-5e8e-8efd-a29385a05973","name":"Saint Bear","source":"MITRE","group_attack_id":"G1031","created":"2024-10-31T16:28:10.711558Z","modified":"2024-10-31T16:28:10.711561Z","tidal_id":"eb64ce69-f106-5e8e-8efd-a29385a05973","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[],"observed_country":[{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[],"associated_groups":[{"id":"8f5c5bc4-9b95-53d3-bc7c-0cd88ee2b011","name":"Storm-0587","description":"<sup>[[Cadet Blizzard emerges as novel threat actor](https://app.tidalcyber.com/references/7180c6a7-e6ea-54bf-bcd7-c5238bbc5f5b)]</sup>","source":"MITRE","associated_group_id":"36ba22af-9916-5e3d-84a9-e4feade7dcf0","owner_id":null,"owner_name":null},{"id":"fcae49c1-aef6-5315-b0e5-7f1bd11ad98e","name":"Lorec53","description":"<sup>[[Palo Alto Unit 42 OutSteel SaintBot February 2022 ](https://app.tidalcyber.com/references/b0632490-76be-4018-982d-4b73b3d13881)]</sup>","source":"MITRE","associated_group_id":"458c2ae1-5ddf-40d6-9f57-e38ce07f7af0","owner_id":null,"owner_name":null},{"id":"8d9fa051-2d96-5353-9dce-4300f5be8afb","name":"TA471","description":"<sup>[[Palo Alto Unit 42 OutSteel SaintBot February 2022 ](https://app.tidalcyber.com/references/b0632490-76be-4018-982d-4b73b3d13881)]</sup>","source":"MITRE","associated_group_id":"6abb61f5-554a-5d25-b794-0bf3c2f936d8","owner_id":null,"owner_name":null},{"id":"39c3362e-008e-548d-b470-5a04e1210dab","name":"UAC-0056","description":"<sup>[[Palo Alto Unit 42 OutSteel SaintBot February 2022 ](https://app.tidalcyber.com/references/b0632490-76be-4018-982d-4b73b3d13881)]</sup>","source":"MITRE","associated_group_id":"00c980c7-47ad-409d-bb62-374e5a078de8","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"815777f5-63a2-4718-8056-c430d49e58c0","name":"Salmon Typhoon","source":"Tidal Cyber","group_attack_id":"G3060","created":"2024-10-18T13:26:56.500659Z","modified":"2024-10-18T13:26:56.500663Z","tidal_id":"e503666f-7f5a-5d63-99be-1641f6222ecf","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"0893be0d-daa1-48d8-8ae0-d6a64497cbf5","name":"Sykipot Group","description":"<sup>[[Mandiant Advanced Persistent Threats](/references/2d16615b-09fc-5925-8f59-6d20f334d236)]</sup>","source":"Tidal Cyber","associated_group_id":"84a39632-e3e2-4d82-86fc-1e1c091160c6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"843f7d2d-9cf0-474c-8d28-aa9311b257e0","name":"APT4","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"613a34f9-cd5a-452d-9812-2227309cdc5d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d0d2cfaf-eda2-4d9a-8c36-66ffdce10f86","name":"Wisp","description":"<sup>[[Mandiant Advanced Persistent Threats](/references/2d16615b-09fc-5925-8f59-6d20f334d236)]</sup>","source":"Tidal Cyber","associated_group_id":"58fe3567-7e19-4fb5-a3be-cefd42730cfe","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"26785653-53be-4516-9ccb-5c6c76266418","name":"Sodium","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"c968b70c-3978-44eb-b9bd-2fe90e696a94","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"fc55e522-a6b5-4dc8-99dc-76a9b0871281","name":"Samurai Panda","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"06d8eaed-66ef-4cd3-874f-97d52295049d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"0ba6424f-32dd-42e5-a92e-8dc32d4e8b8f","name":"Maverick Panda","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"3acbf57e-f105-4b57-b244-c62198f3f8de","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"997c178f-f8fc-464e-9aa4-57ddd804d804","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":"TidalCyberIan"},{"id":"759dcc8f-01ae-503f-922f-b144cd54ea15","name":"Salt Typhoon","source":"MITRE","group_attack_id":"G1045","created":"2025-04-22T20:47:03.586713Z","modified":"2025-04-22T20:47:03.586715Z","tidal_id":"759dcc8f-01ae-503f-922f-b144cd54ea15","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"aab8f93e-c4ef-421a-ac8a-e6eed9749a4f","name":"Burkina Faso","country_name":"Burkina Faso","country_code":"BF"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"9aa1426a-8a8d-4bcc-9596-531ff2f8663d","name":"Eswatini","country_name":"Eswatini","country_code":"SZ"},{"id":"bad594b7-b57b-4e02-bd87-c7eef7f45e37","name":"Ethiopia","country_name":"Ethiopia","country_code":"ET"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"640088a5-d548-4bab-bf41-29c46ed813f6","name":"Guatemala","country_name":"Guatemala","country_code":"GT"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"a54a4c6a-49f4-492c-90f3-cdb59d5a24a4","name":"GhostEmperor","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"5748761c-2a97-45ce-bce5-9d28789180aa","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"83f4c3c5-f9d6-4405-a3c6-5e8943b529ea","name":"FamousSparrow","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"58ccb27d-3baf-4012-be1a-5e4f0e29c2c7","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"5b4015a4-1c0e-4f9d-a53a-74b122a441dd","name":"UNC2286","description":"<sup>[[Mandiant UNC4841 August 29 2023](/references/f990745d-06c1-4b0a-8394-66c7a3cf0818)]</sup>","source":"Tidal Cyber","associated_group_id":"8a7bc150-845c-49d3-a79f-35aa14fdc270","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c89c7476-e22b-48be-bee1-e0f31c222a99","name":"Earth Estries","description":"<sup>[[Trend Micro November 25 2024](/references/8bf807bc-5103-4962-9a19-c12396cdb767)]</sup>","source":"Tidal Cyber","associated_group_id":"e184e38d-eb65-4198-aa6e-23df4e64e6a6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"986565ff-de67-4ab5-a233-acc003d855dc","name":"RedMike","description":"<sup>[[Recorded Future RedMike February 13 2025](/references/004bb617-4a46-4e95-84d3-6ce4aeb49f2f)]</sup>","source":"Tidal Cyber","associated_group_id":"302ad992-6cf7-41b0-835b-aa4676819818","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"235c9529-34c4-4823-b6bd-7f80f4e19719","tag":"c9918363-4019-41da-89b7-3622f59d93ab"},{"id":"ebc61ca6-8d00-4866-8fe0-7f71fe0ef38e","tag":"483a33e5-e6fb-49d8-b071-6d6d21706e15"},{"id":"2efe8234-d913-4b91-8891-dbe0f8b037dd","tag":"2185ed93-7e1c-4553-9452-c8411b5dca93"},{"id":"23fe6423-8e13-43ea-a97f-b31e7b745e1e","tag":"d8f7e071-fbfd-46f8-b431-e241bb1513ac"},{"id":"eaea432f-d3c0-416e-9199-788f185f591e","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"f33c97ca-035e-43d8-aacb-2881b4503597","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"6b6996b9-c36a-439f-b7a8-54723420f576","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"f4de64b1-da10-4dfe-97b8-835472f10033","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"4d174478-b7dc-4535-b6c0-2b4ba59a321d","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"f3c099ce-80ca-4e15-8ae4-8ec8c008a6fe","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"910d8810-50fe-4141-8f62-a6ee2a7e21da","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"47afb4ac-32c3-4c99-a462-69c1b07fe062","tag":"9ed63cc4-ed9d-4e8f-8297-4a5b6bd66858"},{"id":"ccebb3c2-432b-4544-87ee-d6daedddeb4b","tag":"07f09197-1847-411e-a451-d37211ead1b2"},{"id":"61094250-f7dd-4764-a9ca-2d89a76dad83","tag":"76195cff-8fc9-41a0-9914-86c2e258b284"},{"id":"516650ac-fc1d-4179-af59-b630f4755801","tag":"53335a97-79dd-4ea6-9e8f-24ec8380a7bf"},{"id":"b202d7cf-2bef-4a1f-a2f1-f8d5167ac062","tag":"1b0321d7-4d9a-4977-bd2a-092c2693b328"},{"id":"4971a10e-0b12-45cd-8cdf-a441e0ce3b6a","tag":"e00b65fc-8f56-4a9e-9f09-ccf3124a3272"},{"id":"28836263-9981-4408-97ef-190c36d7495a","tag":"1ff4614e-0ee6-4e04-921d-61abba7fcdb7"},{"id":"f0526166-ac84-4666-8bcf-1824a3d91a53","tag":"8046a757-48f0-4787-81ab-9dc8c1eb77cd"},{"id":"6e0b9f99-800d-4126-b50a-1c395d82b406","tag":"5b8371c5-1173-4496-82c7-5f0433987e77"},{"id":"17beae19-fa8b-41e5-b82f-e3557f9d985b","tag":"915e7ac2-b266-45d7-945c-cb04327d6246"},{"id":"fe4c882b-1c9c-452e-9774-154d6e453b99","tag":"e499005b-adba-45bb-85e3-07043fd9edf9"},{"id":"8819cb23-1675-4af7-9bc6-5be160e39ac4","tag":"8b1cb0dc-dd3e-44ba-828c-55c040e93b93"},{"id":"0e171314-1f6f-48d6-91d9-16f7bbbe7b6e","tag":"5f5e40cd-0732-4eb4-a083-06940623c3f9"},{"id":"6ff4a018-a965-48f5-82e3-a1169690be60","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"b522e733-0198-4449-afd3-31251f66558e","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"}],"owner_name":null},{"id":"753c7cd1-ca9f-4632-bbd2-fd55b9e70b10","name":"Salt Typhoon (Deprecated)","source":"Tidal Cyber","group_attack_id":"G3062","created":"2024-10-25T19:44:20.619464Z","modified":"2024-10-25T19:44:20.619468Z","tidal_id":"ec1ef2ad-8451-5832-adaa-b2cba6067248","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"aab8f93e-c4ef-421a-ac8a-e6eed9749a4f","name":"Burkina Faso","country_name":"Burkina Faso","country_code":"BF"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"9aa1426a-8a8d-4bcc-9596-531ff2f8663d","name":"Eswatini","country_name":"Eswatini","country_code":"SZ"},{"id":"bad594b7-b57b-4e02-bd87-c7eef7f45e37","name":"Ethiopia","country_name":"Ethiopia","country_code":"ET"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"640088a5-d548-4bab-bf41-29c46ed813f6","name":"Guatemala","country_name":"Guatemala","country_code":"GT"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"92d633ce-197c-4e9a-a44e-b842dc0270f3","name":"GhostEmperor","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"5748761c-2a97-45ce-bce5-9d28789180aa","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3d1ede57-6781-47b5-8486-cfd51feaef97","name":"FamousSparrow","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"58ccb27d-3baf-4012-be1a-5e4f0e29c2c7","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"369536cd-135e-4b56-be1d-d2dbcd2c19f9","name":"UNC2286","description":"<sup>[[Mandiant UNC4841 August 29 2023](/references/f990745d-06c1-4b0a-8394-66c7a3cf0818)]</sup>","source":"Tidal Cyber","associated_group_id":"8a7bc150-845c-49d3-a79f-35aa14fdc270","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"476c64de-0b4e-4e0a-8176-47f658cf7f56","name":"Earth Estries","description":"<sup>[[Trend Micro November 25 2024](/references/8bf807bc-5103-4962-9a19-c12396cdb767)]</sup>","source":"Tidal Cyber","associated_group_id":"e184e38d-eb65-4198-aa6e-23df4e64e6a6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"72f7f1cf-e744-48a6-9f99-b94c1fafd9c4","tag":"e00b65fc-8f56-4a9e-9f09-ccf3124a3272"},{"id":"ffb50065-8e21-462a-a76b-8091f40123af","tag":"1ff4614e-0ee6-4e04-921d-61abba7fcdb7"},{"id":"e9c5115f-8813-4e8a-9bed-f351bb481704","tag":"8046a757-48f0-4787-81ab-9dc8c1eb77cd"},{"id":"d66e35df-66e8-4c01-847d-a694c6bfeb14","tag":"5b8371c5-1173-4496-82c7-5f0433987e77"},{"id":"d7887883-a0a9-4c5b-8cc6-cd575a475179","tag":"76195cff-8fc9-41a0-9914-86c2e258b284"},{"id":"beee3f41-5580-4f91-80ce-457c6b8144d7","tag":"915e7ac2-b266-45d7-945c-cb04327d6246"},{"id":"0a706d7c-bab3-4e98-93d0-88d101d6ac95","tag":"e499005b-adba-45bb-85e3-07043fd9edf9"},{"id":"21333a13-3c1e-4773-ab61-4d5c8277a3c0","tag":"8b1cb0dc-dd3e-44ba-828c-55c040e93b93"},{"id":"1bf3afdc-5ac1-4251-ba1e-45300ed04c7a","tag":"5f5e40cd-0732-4eb4-a083-06940623c3f9"},{"id":"51823407-a1de-4def-afec-d1ac1c90a6f6","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"ce45b090-734c-45e4-9ec1-93e777151d70","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"b6b62fd5-d195-4347-babd-68a6e100abb4","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"16a65ee9-cd60-4f04-ba34-f2f45fcfc666","name":"Sandworm Team","source":"MITRE","group_attack_id":"G0034","created":"2017-05-31T21:32:04.588000Z","modified":"2022-10-12T20:11:40.313000Z","tidal_id":"7fb250bb-4dcb-5fa1-82ab-2bc2e6142b7b","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"},{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"}],"observed_country":[{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"f0106493-e44f-43d5-b12b-0971842d81de","name":"Kyrgyzstan","country_name":"Kyrgyzstan","country_code":"KG"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"9fe01b2a-9edb-4fee-b061-f73e977868bd","name":"Quedagh","description":"<sup>[[iSIGHT Sandworm 2014](https://app.tidalcyber.com/references/63622990-5467-42b2-8f45-b675dfc4dc8f)]</sup> <sup>[[F-Secure BlackEnergy 2014](https://app.tidalcyber.com/references/5f228fb5-d959-4c4a-bb8c-f9dc01d5af07)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"MITRE","associated_group_id":"5f428057-fad5-4ba5-bd2e-ff0505184371","owner_id":null,"owner_name":null},{"id":"e5332865-a9af-4596-b3e9-ecc9ceb81d67","name":"Sandworm","description":"<sup>[[Symantec Ukraine Targeting October 29 2025](/references/08b6d849-2837-4af9-bb8a-e0425e6a02e4)]</sup>","source":"USER","associated_group_id":"1eaf2f1e-676b-4b0c-bec8-9609c3a4c9a7","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"44ca1cdb-4402-4542-b820-cafe1540c80b","name":"IRON VIKING","description":"<sup>[[Secureworks IRON VIKING ](https://app.tidalcyber.com/references/900753b3-c5a2-4fb5-ab7b-d38df867077b)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"MITRE","associated_group_id":"eeb7e31b-93e9-4244-a31a-6ce9116a4b70","owner_id":null,"owner_name":null},{"id":"ac48f366-0dbb-47b7-8257-5e6bd7e55a2e","name":"Curly COMrades","description":"<sup>[[Amazon Web Services December 15 2025](/references/cb9ff075-d033-4990-b389-4760d089e255)]</sup>","source":"USER","associated_group_id":"c4b5572b-8824-420e-94b7-a7f8576518f0","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6b447e1c-95ae-4d7b-a46b-021ce5253312","name":"BlackEnergy (Group)","description":"<sup>[[NCSC Sandworm Feb 2020](https://app.tidalcyber.com/references/d876d037-9d24-44af-b8f0-5c1555632b91)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"MITRE","associated_group_id":"42a50ea5-66f1-4802-b2a0-3fe6ea4f42d4","owner_id":null,"owner_name":null},{"id":"4fa0ab56-8b04-4947-b54c-f7ce39c47f38","name":"Voodoo Bear","description":"<sup>[[CrowdStrike VOODOO BEAR](https://app.tidalcyber.com/references/ce07d409-292d-4e8e-b1af-bd5ba46c1b95)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"MITRE","associated_group_id":"819b7ba2-f3be-4649-b499-525f8c0579eb","owner_id":null,"owner_name":null},{"id":"068de0e9-d7d5-4cf2-85d0-ef5aa3c6fd1f","name":"GRU military unit 74455","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"1632b64e-2636-4a73-96b7-7b506d321b1d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"0eb61a7c-2b53-49fe-80d4-6cb9a6b83773","name":"Telebots","description":"<sup>[[NCSC Sandworm Feb 2020](https://app.tidalcyber.com/references/d876d037-9d24-44af-b8f0-5c1555632b91)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"MITRE","associated_group_id":"4316121a-b50b-40bc-bb4b-2c6fc9ec127b","owner_id":null,"owner_name":null},{"id":"8ea201af-b6a4-45c7-8a30-2dfa1bde217d","name":"FROZENBARENTS","description":"<sup>[[Mandiant APT44 April 17 2024](/references/a64f689e-2bb4-4253-86cd-545e7f633a7e)]</sup>","source":"Tidal Cyber","associated_group_id":"36c25a2b-5e95-4384-910e-cd41e45b106f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"5a3f04de-cd4a-4a8a-a064-dcd24c4fb7ee","name":"APT44","description":"<sup>[[Mandiant APT44 April 17 2024](/references/a64f689e-2bb4-4253-86cd-545e7f633a7e)]</sup>","source":"Tidal Cyber","associated_group_id":"f21f4304-668e-4a08-bacc-c8767a0a45ae","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c52ba732-264c-4e27-89bc-c83ccf4b6e50","name":"UNC3810","description":"<sup>[[Mandiant Sandworm November 9 2023](/references/e35f005d-a3cd-4733-88ac-92bbf46e2c8a)]</sup>","source":"Tidal Cyber","associated_group_id":"63b47aa9-4138-4044-aa0d-70f2d748f32c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"754d3b0b-9852-4c79-b505-dc17aa90fb9e","name":"Telebots","description":"<sup>[[NCSC Sandworm Feb 2020](https://app.tidalcyber.com/references/d876d037-9d24-44af-b8f0-5c1555632b91)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"Mobile","associated_group_id":"4316121a-b50b-40bc-bb4b-2c6fc9ec127b","owner_id":null,"owner_name":null},{"id":"44b326fe-fca8-490d-9641-d1271cf5fea3","name":"BlackEnergy (Group)","description":"<sup>[[NCSC Sandworm Feb 2020](https://app.tidalcyber.com/references/d876d037-9d24-44af-b8f0-5c1555632b91)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"Mobile","associated_group_id":"42a50ea5-66f1-4802-b2a0-3fe6ea4f42d4","owner_id":null,"owner_name":null},{"id":"24ff6d2d-9250-4728-995d-027969139653","name":"Voodoo Bear","description":"<sup>[[CrowdStrike VOODOO BEAR](https://app.tidalcyber.com/references/ce07d409-292d-4e8e-b1af-bd5ba46c1b95)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"Mobile","associated_group_id":"819b7ba2-f3be-4649-b499-525f8c0579eb","owner_id":null,"owner_name":null},{"id":"b976b934-7cdb-4134-b8af-2c99d8fd4ad5","name":"ELECTRUM","description":"<sup>[[Dragos ELECTRUM](https://app.tidalcyber.com/references/494f7056-7a39-4fa0-958d-fb1172d01852)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"MITRE","associated_group_id":"483450ad-d811-4f3e-85db-f2761fa308a6","owner_id":null,"owner_name":null},{"id":"a075400e-04d7-456f-b64e-efb75f0d77fd","name":"APT44","description":"<sup>[[mandiant_apt44_unearthing_sandworm](https://app.tidalcyber.com/references/cc03d668-e4d9-5dc1-b365-203db84938f2)]</sup>","source":"Mobile","associated_group_id":"283ded15-897c-4180-b431-4a30a268d22d","owner_id":null,"owner_name":null},{"id":"03298966-a754-5998-9590-bd0ac9c1c01a","name":"Seashell Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"f101b5aa-8676-5c51-8934-0a6c7c757d4d","owner_id":null,"owner_name":null},{"id":"3e832259-e53e-5080-9af4-89c94f5675da","name":"IRIDIUM","description":"<sup>[[Microsoft Prestige ransomware October 2022](https://app.tidalcyber.com/references/b57e1181-461b-5ada-a739-873ede1ec079)]</sup>","source":"MITRE","associated_group_id":"84c4e254-d02f-5141-b0c6-d52618177024","owner_id":null,"owner_name":null},{"id":"48199962-04a8-5426-9e03-91973cb5628a","name":"FROZENBARENTS","description":"<sup>[[Leonard TAG 2023](https://app.tidalcyber.com/references/95c6ad1d-df16-5dd3-a6ef-75c1247ec5e0)]</sup>","source":"MITRE","associated_group_id":"4c3ac1e4-a6ff-43ee-97d0-ec1f4cff88a1","owner_id":null,"owner_name":null},{"id":"d641fda1-87b8-5fc3-8702-bd464894e130","name":"APT44","description":"<sup>[[mandiant_apt44_unearthing_sandworm](https://app.tidalcyber.com/references/cc03d668-e4d9-5dc1-b365-203db84938f2)]</sup>","source":"MITRE","associated_group_id":"283ded15-897c-4180-b431-4a30a268d22d","owner_id":null,"owner_name":null},{"id":"75ee641a-3cf6-4523-8c4c-0de9c308c2aa","name":"BlackEnergy (Group)","description":"<sup>[[NCSC Sandworm Feb 2020](https://app.tidalcyber.com/references/d876d037-9d24-44af-b8f0-5c1555632b91)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"ICS","associated_group_id":"42a50ea5-66f1-4802-b2a0-3fe6ea4f42d4","owner_id":null,"owner_name":null},{"id":"512b3609-7a91-4777-9c6d-9637de3ce15d","name":"Quedagh","description":"<sup>[[iSIGHT Sandworm 2014](https://app.tidalcyber.com/references/63622990-5467-42b2-8f45-b675dfc4dc8f)]</sup> <sup>[[F-Secure BlackEnergy 2014](https://app.tidalcyber.com/references/5f228fb5-d959-4c4a-bb8c-f9dc01d5af07)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"ICS","associated_group_id":"5f428057-fad5-4ba5-bd2e-ff0505184371","owner_id":null,"owner_name":null},{"id":"abcae5a0-cb11-45f7-b967-a11bfd02f4ea","name":"IRIDIUM","description":"<sup>[[Microsoft Prestige ransomware October 2022](https://app.tidalcyber.com/references/b57e1181-461b-5ada-a739-873ede1ec079)]</sup>","source":"ICS","associated_group_id":"84c4e254-d02f-5141-b0c6-d52618177024","owner_id":null,"owner_name":null},{"id":"8dff3926-115c-4678-94a8-62226c6e11b2","name":"Seashell Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"f101b5aa-8676-5c51-8934-0a6c7c757d4d","owner_id":null,"owner_name":null},{"id":"1d160835-ef7a-45b0-9c92-732ec2021152","name":"FROZENBARENTS","description":"<sup>[[Leonard TAG 2023](https://app.tidalcyber.com/references/95c6ad1d-df16-5dd3-a6ef-75c1247ec5e0)]</sup>","source":"ICS","associated_group_id":"4c3ac1e4-a6ff-43ee-97d0-ec1f4cff88a1","owner_id":null,"owner_name":null},{"id":"8ad6d72c-84fa-4a72-a223-2f31f7e71814","name":"APT44","description":"<sup>[[mandiant_apt44_unearthing_sandworm](https://app.tidalcyber.com/references/cc03d668-e4d9-5dc1-b365-203db84938f2)]</sup>","source":"ICS","associated_group_id":"283ded15-897c-4180-b431-4a30a268d22d","owner_id":null,"owner_name":null},{"id":"be6c1ab9-058d-4c27-b7d2-ded5268e0911","name":"Hades","description":"<sup>[[Kaspersky APT Trends Q1 April 2021](/references/3fd0ba3b-7919-46d3-a444-50508603956f)]</sup>","source":"Tidal Cyber","associated_group_id":"d8538172-6d67-485a-9c50-740eba11f8d4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"91589836-9246-4ee7-a5da-f977f6bc26f4","name":"ELECTRUM","description":"<sup>[[Dragos ELECTRUM](https://app.tidalcyber.com/references/494f7056-7a39-4fa0-958d-fb1172d01852)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"Mobile","associated_group_id":"483450ad-d811-4f3e-85db-f2761fa308a6","owner_id":null,"owner_name":null},{"id":"715af66e-39c4-468f-869a-9ee05c29ea7c","name":"IRON VIKING","description":"<sup>[[Secureworks IRON VIKING ](https://app.tidalcyber.com/references/900753b3-c5a2-4fb5-ab7b-d38df867077b)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"Mobile","associated_group_id":"eeb7e31b-93e9-4244-a31a-6ce9116a4b70","owner_id":null,"owner_name":null},{"id":"a8c12248-3783-46a0-8f86-1b674e568aa6","name":"Quedagh","description":"<sup>[[iSIGHT Sandworm 2014](https://app.tidalcyber.com/references/63622990-5467-42b2-8f45-b675dfc4dc8f)]</sup> <sup>[[F-Secure BlackEnergy 2014](https://app.tidalcyber.com/references/5f228fb5-d959-4c4a-bb8c-f9dc01d5af07)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"Mobile","associated_group_id":"5f428057-fad5-4ba5-bd2e-ff0505184371","owner_id":null,"owner_name":null},{"id":"ce699fbb-6b70-4bf0-bd3a-50dd797cb9e3","name":"IRIDIUM","description":"<sup>[[Microsoft Prestige ransomware October 2022](https://app.tidalcyber.com/references/b57e1181-461b-5ada-a739-873ede1ec079)]</sup>","source":"Mobile","associated_group_id":"84c4e254-d02f-5141-b0c6-d52618177024","owner_id":null,"owner_name":null},{"id":"99c5f52d-481f-4c50-8668-27792ae8d5d7","name":"Seashell Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"f101b5aa-8676-5c51-8934-0a6c7c757d4d","owner_id":null,"owner_name":null},{"id":"f9f7edac-28d6-44ba-a01d-de2ef772d6ee","name":"FROZENBARENTS","description":"<sup>[[Leonard TAG 2023](https://app.tidalcyber.com/references/95c6ad1d-df16-5dd3-a6ef-75c1247ec5e0)]</sup>","source":"Mobile","associated_group_id":"4c3ac1e4-a6ff-43ee-97d0-ec1f4cff88a1","owner_id":null,"owner_name":null},{"id":"f3a0f363-cacd-4cba-b1a7-70f7b73abfec","name":"ELECTRUM","description":"<sup>[[Dragos ELECTRUM](https://app.tidalcyber.com/references/494f7056-7a39-4fa0-958d-fb1172d01852)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"ICS","associated_group_id":"483450ad-d811-4f3e-85db-f2761fa308a6","owner_id":null,"owner_name":null},{"id":"d9cd43f4-a25a-41b0-a17f-e1ea6727a6dc","name":"Telebots","description":"<sup>[[NCSC Sandworm Feb 2020](https://app.tidalcyber.com/references/d876d037-9d24-44af-b8f0-5c1555632b91)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"ICS","associated_group_id":"4316121a-b50b-40bc-bb4b-2c6fc9ec127b","owner_id":null,"owner_name":null},{"id":"027728ec-dfe4-48f9-bf48-3ca55da374d6","name":"IRON VIKING","description":"<sup>[[Secureworks IRON VIKING ](https://app.tidalcyber.com/references/900753b3-c5a2-4fb5-ab7b-d38df867077b)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"ICS","associated_group_id":"eeb7e31b-93e9-4244-a31a-6ce9116a4b70","owner_id":null,"owner_name":null},{"id":"028a5884-bb87-45dc-be8d-4f2f568deccf","name":"Voodoo Bear","description":"<sup>[[CrowdStrike VOODOO BEAR](https://app.tidalcyber.com/references/ce07d409-292d-4e8e-b1af-bd5ba46c1b95)]</sup><sup>[[US District Court Indictment GRU Unit 74455 October 2020](https://app.tidalcyber.com/references/77788d05-30ff-4308-82e6-d123a3c2fd80)]</sup><sup>[[UK NCSC Olympic Attacks October 2020](https://app.tidalcyber.com/references/93053f1b-917c-4573-ba20-99fcaa16a2dd)]</sup>","source":"ICS","associated_group_id":"819b7ba2-f3be-4649-b499-525f8c0579eb","owner_id":null,"owner_name":null}],"tags":[{"id":"df5c8549-f792-448a-9f5a-4be90b352837","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"c4a9443f-df03-4700-82c4-76f417987a47","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"5cb0bcf7-04c9-4549-8040-1f4a81288701","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"d97478a8-9a98-46a0-8b45-62e1a73d3a58","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"ed44ae7a-8d73-4352-bfac-2ec08e144c9d","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"86e42be7-d680-48e9-8352-2360b0688ae0","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"90e6ea72-a3bd-420b-83fb-53f2fbdaf8f9","tag":"fe984a01-910d-4e39-9c49-179aa03f75ab"},{"id":"fa01fb4e-27b3-4bc5-9641-98947a39e634","tag":"62bde669-3020-4682-be68-36c83b2588a4"},{"id":"653825f1-f131-485b-abe7-c3f133608465","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"b3c58aa5-7d77-4eb9-a406-483dec6e7cd7","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"0da33259-5757-4432-a114-5c1da87350db","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"}],"owner_name":null},{"id":"788ffbf6-1a36-481a-a504-bbcd9f907886","name":"SCARLETEEL","source":"Tidal Cyber","group_attack_id":"G3032","created":"2024-06-13T20:12:16.777200Z","modified":"2024-06-13T20:12:16.777204Z","tidal_id":"f4185c68-8850-57ea-906a-16b6f3e7e259","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"7015da62-de30-4811-ad90-572c3ab95073","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"6e2a6ae1-851e-4610-97d7-581dc2b677a1","tag":"efa33611-88a5-40ba-9bc4-3d85c6c8819b"},{"id":"ab4810d7-8358-4076-8dfb-7e848f672fa2","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"df9d2aca-c2d1-4f00-92ad-6a0a13928877","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"a910140b-10a8-424e-a1e4-74583cb313b4","tag":"8d95e4d6-9a1e-4920-9f5c-83d9fe07a66e"},{"id":"63b085a9-2bba-4d7d-8329-3173446defa0","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"54a13c54-a1d5-46e9-b155-56d981a5ad8f","name":"Scarlet Goldfinch","source":"Tidal Cyber","group_attack_id":"G3056","created":"2024-09-27T17:01:29.712765Z","modified":"2024-09-27T17:01:29.712769Z","tidal_id":"fdd038bf-7b19-5cd1-a648-05b7733943c7","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"ff99b019-2440-49a3-af06-134d86212cf6","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3a61b28c-a6fa-43f4-b997-66c962df6e76","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6c1bdc51-f633-4512-8b20-04a11c2d97f4","name":"Scarlet Mimic","source":"MITRE","group_attack_id":"G0029","created":"2017-05-31T21:32:00.677000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"9aa4a25e-bfaf-548d-aa08-93057077394c","country":[],"observed_motivation":[],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_sector":[{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"3d77fb6c-cfb4-5563-b0be-7aa1ad535337","name":"Scattered Spider","source":"MITRE","group_attack_id":"G1015","created":"2023-11-07T00:35:51.993841Z","modified":"2023-11-07T00:35:51.993844Z","tidal_id":"27f903d2-15f1-54fd-990f-97937c5338dc","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"284bedec-2fd7-47c2-83aa-cd937c829bf5","name":"Costa Rica","country_name":"Costa Rica","country_code":"CR"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"69dd3e9b-a2bb-4afc-bd54-3154343e266c","name":"Video Games"}],"associated_groups":[{"id":"58c2a920-5cd2-5658-8889-a6a6dd0111fd","name":"Storm-0875","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"c839c2c6-8143-560e-9b35-2f68369c5920","owner_id":null,"owner_name":null},{"id":"05f0941e-be2a-5072-b7ac-2a99c04b47ff","name":"UNC3944","description":"<sup>[[Mandiant UNC3944 May 2025](https://app.tidalcyber.com/references/ba2831ec-0f30-574b-afdc-e8a7ec12b1ea)]</sup><sup>[[Mandiant VMware vSphere JUL 2025](https://app.tidalcyber.com/references/c25f2ae7-639d-5792-812b-83a17144f41a)]</sup>","source":"MITRE","associated_group_id":"d050a4be-0ede-527c-babc-3f424aeccdc1","owner_id":null,"owner_name":null},{"id":"3b0261ad-1695-41fe-96cf-94fb122b211b","name":"The Community","description":"<sup>[[ReliaQuest September 15 2025](/references/8693bfa8-2b15-4697-b519-24833e2e8822)]</sup>","source":"USER","associated_group_id":"3d44d3c8-9ca6-4e98-b9a4-9a6ac8f624ce","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"56b7dd5f-005f-4585-9702-7d91d7c7caaf","name":"The Com","description":"<sup>[[ReliaQuest September 15 2025](/references/8693bfa8-2b15-4697-b519-24833e2e8822)]</sup>","source":"USER","associated_group_id":"67f1a330-eda0-4d7f-937a-12ef81b72ac9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a0ed4d06-a566-4ef5-bb54-f49bf761539b","name":"Octo Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"8b64dc0e-530c-5de2-859a-b04486caedf8","owner_id":null,"owner_name":null},{"id":"f1952bcd-a640-4a2b-a5d1-41ed44f8e647","name":"Storm-0875","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Mobile","associated_group_id":"c839c2c6-8143-560e-9b35-2f68369c5920","owner_id":null,"owner_name":null},{"id":"29f2a6c2-405e-5b7b-8222-cd5bb4c1fc97","name":"Roasted 0ktapus","description":"<sup>[[CrowdStrike Scattered Spider BYOVD January 2023](https://app.tidalcyber.com/references/d7d86f5d-1f02-54b0-b6f4-879878563245)]</sup>","source":"MITRE","associated_group_id":"a8be581c-10b8-5d79-b35b-ebc47e511597","owner_id":null,"owner_name":null},{"id":"59e6dc0c-ff8f-43bf-8780-90101ab98dbc","name":"Muddled Libra","description":"<sup>[[U.S. CISA Scattered Spider November 16 2023](/references/9c242265-c28c-4580-8e6a-478d8700b092)]</sup>","source":"Tidal Cyber","associated_group_id":"fd282f3e-0aba-4f40-873f-1b1e56f55591","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7ea7046f-314f-5e95-91d3-561cc8841c9b","name":"Octo Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"8b64dc0e-530c-5de2-859a-b04486caedf8","owner_id":null,"owner_name":null},{"id":"cb9929a9-66f4-4191-9caf-47c211c308b0","name":"Starfraud","description":"<sup>[[U.S. CISA Scattered Spider November 16 2023](/references/9c242265-c28c-4580-8e6a-478d8700b092)]</sup>","source":"Tidal Cyber","associated_group_id":"890f22c5-6e7f-461f-8099-bb7d7c062d27","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7b671400-1177-42a2-a5f6-26c0b7e10fed","name":"UNC3944","description":"<sup>[[U.S. CISA Scattered Spider November 16 2023](/references/9c242265-c28c-4580-8e6a-478d8700b092)]</sup>","source":"Tidal Cyber","associated_group_id":"d850076d-6caa-46f2-958d-4e93f43b88f6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"007713f3-6afe-4398-9e6c-9596be3f4c59","name":"Scatter Swine","description":"<sup>[[U.S. CISA Scattered Spider November 16 2023](/references/9c242265-c28c-4580-8e6a-478d8700b092)]</sup>","source":"Tidal Cyber","associated_group_id":"36002039-b1dc-46bd-affe-fd37edae375c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a9f927a0-e154-4747-b787-6278e773f44b","name":"Roasted 0ktapus","description":"<sup>[[CrowdStrike Scattered Spider BYOVD January 2023](https://app.tidalcyber.com/references/d7d86f5d-1f02-54b0-b6f4-879878563245)]</sup>","source":"Mobile","associated_group_id":"a8be581c-10b8-5d79-b35b-ebc47e511597","owner_id":null,"owner_name":null},{"id":"f288f69e-3f7b-40b0-b7b3-a216305ce621","name":"UNC3944","description":"<sup>[[Mandiant UNC3944 May 2025](https://app.tidalcyber.com/references/ba2831ec-0f30-574b-afdc-e8a7ec12b1ea)]</sup><sup>[[Mandiant VMware vSphere JUL 2025](https://app.tidalcyber.com/references/c25f2ae7-639d-5792-812b-83a17144f41a)]</sup>","source":"Mobile","associated_group_id":"d050a4be-0ede-527c-babc-3f424aeccdc1","owner_id":null,"owner_name":null}],"tags":[{"id":"1a99c0c7-fe1a-4667-90ea-d5303563d0b4","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"f12a8184-0490-470c-8933-3584d96cbc2f","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"f9c857ae-9bcd-4906-a3cf-143e928fd051","tag":"a6f84748-6463-4e50-a5a4-bbb8bab0ab64"},{"id":"daf4f5e3-e780-40fb-9905-fede8da4b0a1","tag":"de6a1b26-f36e-4003-80f0-a4747f83329c"},{"id":"5f2162d4-3685-4a90-90ca-1c28ca50d1c2","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"df9c608d-32f1-42cf-b72f-54b7ea343164","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"030a29d3-4840-457c-9e30-cb736899ab69","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"531bd53f-c083-4102-9ebd-76431435bc27","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"f2a18b4a-fd8f-4453-91b3-397a76f10c5a","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"2ce9a2bd-6a0f-4006-8215-a65f2e423c68","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"f4c06506-cdff-4168-8990-ba017c605e72","tag":"47365c8b-5db8-4d3a-9eb9-d49c8df1a90e"},{"id":"999454cb-355c-4eaf-b03f-595f939e5e82","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"02cf7c06-c63e-4f2c-883f-18e92913653d","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"245a6a50-6278-41ea-8953-e33b59654cd2","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"d2ae0704-778a-4b7a-b030-e77901463860","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"b4bdd321-22ba-4d1a-9c1c-ad5a7bee7383","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"97face70-edb4-4921-ab07-28400c95d1f0","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"83e05a42-9d93-4667-8bda-f3499aa47722","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"869ba2fa-d88c-4225-afc1-ff0e7287a652","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"785c4038-3c47-402c-93eb-9e4036a6366c","name":"Seashell Blizzard Subgroup","source":"Tidal Cyber","group_attack_id":"G3089","created":"2025-03-04T15:55:08.545701Z","modified":"2025-03-04T15:55:08.545706Z","tidal_id":"7460fa06-1889-58fa-9a3e-08cffcb50a38","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"01f998a9-6991-4c79-a54d-20df9a45d43a","name":"Destruction"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"82996d62-5083-4687-afb7-ee2ef56cc2ee","name":"Angola","country_name":"Angola","country_code":"AO"},{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"445023e4-5031-43b9-b6bf-c9d0909a46fa","name":"Bosnia and Herzegovina","country_name":"Bosnia and Herzegovina","country_code":"BA"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"074116ab-ef86-412f-a0a1-2b7aaacd9d6e","name":"Cambodia","country_name":"Cambodia","country_code":"KH"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"8af7cb07-edaa-4b5c-a1f0-bc171151e6b4","name":"Croatia","country_name":"Croatia","country_code":"HR"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"005b5c57-ecff-4cfb-8011-cd2a38a4ebbd","name":"Ghana","country_name":"Ghana","country_code":"GH"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"8c04cdb9-d766-412c-b041-782c879f51c6","name":"Latvia","country_name":"Latvia","country_code":"LV"},{"id":"57795c9b-f344-44fb-99fa-85379126bb0b","name":"Moldova, Republic of","country_name":"Moldova","country_code":"MD"},{"id":"b3b49312-69e9-426b-b18e-268bbf39f129","name":"Montenegro","country_name":"Montenegro","country_code":"ME"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"252115d5-b120-4db5-846d-829ac4ebfc54","name":"Oman","country_name":"Oman","country_code":"OM"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"a34d87a1-df7e-4f68-9e1c-73ca623d7ef5","name":"Paraguay","country_name":"Paraguay","country_code":"PY"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"da9f06f0-a7bf-4951-9127-e192ab66b5c3","name":"Serbia","country_name":"Serbia","country_code":"RS"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"2a528093-177d-468f-a83b-e270ca22f0ab","name":"Syrian Arab Republic","country_name":"Syrian Arab Republic","country_code":"SY"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[{"id":"e5adabc2-25d3-427e-bb3a-27e7ead98ed0","name":"BE2","description":"<sup>[[Microsoft Security Blog February 12 2025](/references/300bf6cb-582b-4e15-8cca-cb68c8856e6f)]</sup>","source":"Tidal Cyber","associated_group_id":"68eb52d2-0703-4be1-bafe-8b8bae6d92fe","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"56edc856-d2b7-4bb9-81f9-274259a6f259","name":"UAC-0133","description":"<sup>[[Microsoft Security Blog February 12 2025](/references/300bf6cb-582b-4e15-8cca-cb68c8856e6f)]</sup>","source":"Tidal Cyber","associated_group_id":"a50520c3-84c6-436e-92d6-9a725ef3c603","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a32340ca-b85e-4d48-b11a-eb6cd865375f","name":"Blue Echidna","description":"<sup>[[Microsoft Security Blog February 12 2025](/references/300bf6cb-582b-4e15-8cca-cb68c8856e6f)]</sup>","source":"Tidal Cyber","associated_group_id":"4cd62e9a-88ea-4759-b82e-a15eb9003581","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"dad4d31b-443b-47b5-982c-23e8ae02fd27","name":"Sandworm Team","description":"<sup>[[Microsoft Security Blog February 12 2025](/references/300bf6cb-582b-4e15-8cca-cb68c8856e6f)]</sup>","source":"Tidal Cyber","associated_group_id":"25486975-1a7b-4ff2-9a63-42547424a806","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c992420a-bffa-4328-a0e8-415ac1474f3a","name":"Phantom","description":"<sup>[[Microsoft Security Blog February 12 2025](/references/300bf6cb-582b-4e15-8cca-cb68c8856e6f)]</sup>","source":"Tidal Cyber","associated_group_id":"34b0fe56-c04f-45cd-9261-46e1f4758aae","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"80c03398-9103-4502-b289-00392f5c65df","name":"BlackEnergy Lite","description":"<sup>[[Microsoft Security Blog February 12 2025](/references/300bf6cb-582b-4e15-8cca-cb68c8856e6f)]</sup>","source":"Tidal Cyber","associated_group_id":"7f83bf83-3e0a-4692-8c92-5b5fd1518758","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2bc17bd3-24fe-47a0-85d1-670c520aee15","name":"APT44","description":"<sup>[[Microsoft Security Blog February 12 2025](/references/300bf6cb-582b-4e15-8cca-cb68c8856e6f)]</sup>","source":"Tidal Cyber","associated_group_id":"283ded15-897c-4180-b431-4a30a268d22d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"7e4020d6-7a92-46f7-b072-b1e83e184dec","tag":"916ea1e8-d117-45a4-8564-0597a02b06e4"},{"id":"73511ccd-dfcc-4eea-90c1-7b818b8e17ee","tag":"08809fa0-61b6-4394-b103-1c4d19a5be16"},{"id":"0a3e6364-a04c-4dce-8894-ba904dad6434","tag":"f0c58aa3-5d21-4ade-95a0-b775dde7e8a3"},{"id":"797e1ea4-e3bd-429a-84db-c6a259f0bfb4","tag":"21c64d34-e52a-42ba-a8c7-85aa82dc0b3f"},{"id":"f8ce2ded-bab6-4271-a159-5241616549dd","tag":"375983b3-6e87-4281-99e2-1561519dd17b"},{"id":"2042d7cf-68fd-4661-8360-18d2c9e7b549","tag":"8046a757-48f0-4787-81ab-9dc8c1eb77cd"},{"id":"1f99219c-8316-4d01-bb2c-f52865494441","tag":"d431939f-2dc0-410b-83f7-86c458125444"},{"id":"885b133e-bd47-42eb-a6f8-84adfd476896","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"edeaac55-ce56-4131-be0b-1edd06b6caa3","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"98887fa4-3e96-4046-a2a1-b9bcbc2635f9","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a511f4e7-9a04-5f37-a599-0d0eee85cfec","name":"Sea Turtle","source":"MITRE","group_attack_id":"G1041","created":"2025-04-22T20:47:03.937283Z","modified":"2025-04-22T20:47:03.937293Z","tidal_id":"a511f4e7-9a04-5f37-a599-0d0eee85cfec","country":[{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"07578934-334f-4a04-b0c0-7157b1257617","name":"Greece","country_name":"Greece","country_code":"GR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"16cfa17d-3787-5486-919b-5416a6f3b5bd","name":"Cosmic Wolf","description":"<sup>[[PWC Sea Turtle 2023](https://app.tidalcyber.com/references/b018a875-559a-5998-b50a-b87b19cb3807)]</sup><sup>[[Hunt Sea Turtle 2024](https://app.tidalcyber.com/references/cf84498c-110e-5f94-ace8-059703615654)]</sup>","source":"MITRE","associated_group_id":"0d200453-b7f6-5a2f-a38f-9b04810cb846","owner_id":null,"owner_name":null},{"id":"ad63cf48-83b8-5d1b-baf0-785915e17442","name":"Teal Kurma","description":"<sup>[[PWC Sea Turtle 2023](https://app.tidalcyber.com/references/b018a875-559a-5998-b50a-b87b19cb3807)]</sup><sup>[[Hunt Sea Turtle 2024](https://app.tidalcyber.com/references/cf84498c-110e-5f94-ace8-059703615654)]</sup>","source":"MITRE","associated_group_id":"14f62286-4b49-5637-84f9-b685458ae662","owner_id":null,"owner_name":null},{"id":"26ea4ffd-4f02-42c5-bdeb-f560325c1796","name":"UNC1326","description":"<sup>[[Microsoft Security Blog May 12 2025](/references/8fb1a0ff-2977-4f50-aba9-e5f5c2b63647)]</sup>","source":"Tidal Cyber","associated_group_id":"dd088358-845e-4434-a29d-dfb0d38bb988","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"09d0ec3d-8cd0-50ec-a6d3-2257c67cb5bc","name":"Marbled Dust","description":"<sup>[[PWC Sea Turtle 2023](https://app.tidalcyber.com/references/b018a875-559a-5998-b50a-b87b19cb3807)]</sup><sup>[[Hunt Sea Turtle 2024](https://app.tidalcyber.com/references/cf84498c-110e-5f94-ace8-059703615654)]</sup>","source":"MITRE","associated_group_id":"3c63d85f-ebbc-5df8-857e-e2c11ffccc32","owner_id":null,"owner_name":null},{"id":"c675e2d8-9f02-5971-bcb4-3d10148b4ce6","name":"SILICON","description":"<sup>[[Microsoft Digital Defense 2021](https://app.tidalcyber.com/references/6a88fdef-e482-55ff-a9cb-adc970cd92f3)]</sup><sup>[[Hunt Sea Turtle 2024](https://app.tidalcyber.com/references/cf84498c-110e-5f94-ace8-059703615654)]</sup>","source":"MITRE","associated_group_id":"26debe8e-0f41-5890-bf5e-551d00781c32","owner_id":null,"owner_name":null}],"tags":[{"id":"6ceac1dd-3a85-4656-a02c-16b94f575b96","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"321f6d34-c7a7-48a5-b778-eb736a210bfd","tag":"4cf3ee7b-b06d-40f8-a455-64e5605d7790"},{"id":"dd4f992f-18a6-4bd1-9268-b4a16e4a4e8e","tag":"d9e62a18-f6c0-40f5-a216-155da690c934"},{"id":"23ae9b3c-967d-49ae-a29c-40307147ba65","tag":"50476b22-71e2-4a0f-802f-0088bb314273"},{"id":"3e80d24b-8310-47ab-9887-d4eae16b9a8a","tag":"ecc8c30e-d2e6-4dc8-9667-07895b19162b"},{"id":"942b994d-f6ad-4092-8a94-c8c0170af132","tag":"dfe6c28d-f301-4fb8-a8a1-c89f4f03f42f"},{"id":"6dc188cc-6268-4687-8a59-ec311081fe14","tag":"868d07e5-a5b5-4fc4-8ca1-11f0130448fc"},{"id":"ecdd5a4a-104f-4663-9348-f099495d1236","tag":"de1029b3-1210-40d2-8f23-390d3109248d"},{"id":"76f2bc42-9078-48fa-844c-3f6d6954241c","tag":"aa0db56f-f2b5-4e7b-930d-03d6f7e5a085"}],"owner_name":null},{"id":"11cc9126-532c-4c37-944f-d4585840ead8","name":"Sector16","source":"Tidal Cyber","group_attack_id":"G3168","created":"2025-12-17T14:18:05.807109Z","modified":"2025-12-17T14:18:05.807112Z","tidal_id":"eb70e054-ee62-5809-868d-7d4802bda311","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"}],"associated_groups":[],"tags":[{"id":"d3c9318c-5325-43da-b6bd-1eccfef53f1b","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"17c15949-9e79-432c-b784-4053dc1ee7ac","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"c395cd00-b457-4dee-901a-a701215a67d2","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"ac22d494-38d2-4276-8e33-66a7f2340986","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"7b8b116d-770a-40af-a39c-115c2b184dae","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"7d1ebf11-fe33-4b35-9543-e4e9a8028475","tag":"2185ed93-7e1c-4553-9452-c8411b5dca93"},{"id":"0a31322c-787b-4ce3-997f-980ab217fcd8","tag":"cc4ea215-87ce-4351-9579-cf527caf5992"},{"id":"352de499-abee-4204-b99a-39fef02c3261","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"44915f23-1fdc-4484-8568-34bdea48ffbc","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"80aaacee-6c69-41a5-bf93-144203a2f242","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"d72eb97b-0287-4360-98d8-2e492be751de","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c39aaf3f-32cb-4e63-9a40-e3c4a0c98c1c","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"83996f9f-7f96-479b-9295-6582b13905c2","name":"SesameOp threat actor","source":"Tidal Cyber","group_attack_id":"G3148","created":"2025-11-19T17:45:10.547382Z","modified":"2025-11-19T17:45:10.547385Z","tidal_id":"12b5d9f1-4135-521d-a8aa-86df959c5ae9","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"4a6cdf4a-2e08-4314-a3fe-3122e55386db","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"2d2d2472-db3f-478f-bcd9-5a0c42eb881f","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"da37f2d1-923d-4b40-9518-b16c6eb7bab8","name":"SGL Actor","source":"Tidal Cyber","group_attack_id":"G3092","created":"2025-04-11T15:33:36.734025Z","modified":"2025-04-11T15:33:36.734029Z","tidal_id":"a41406fd-ddb6-586a-ab5a-7c4f408bbb7b","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[],"associated_groups":[{"id":"0dc6d360-f297-4ba9-a27f-c5d64aa07b58","name":"Sganarelle","description":"<sup>[[CYJAX 2024 Year in Review January 29 2025](/references/f22b8c2c-6307-420d-9aac-7da4f054bd1f)]</sup>","source":"Tidal Cyber","associated_group_id":"b65935a2-a153-4ab1-8c5a-3edac48704ba","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"9eb80264-0a9b-44ae-991f-9f9f8efd71eb","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"765ff4df-ecbf-4c6d-a051-5ad6f585703b","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"bfd58461-31df-4598-9d46-e7384543e39f","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"055c83d5-46b8-48d7-9428-4ade89d3991a","name":"SHADOW-VOID-042","source":"Tidal Cyber","group_attack_id":"G3176","created":"2025-12-17T14:18:07.294684Z","modified":"2025-12-17T14:18:07.294687Z","tidal_id":"6ac40d8b-ec87-59cc-aad3-7137dec34098","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"aee3e01d-a962-4821-b0b9-0050277303e8","name":"Credit Unions"},{"id":"dc3a18bb-093d-4d02-a859-d2f15304b155","name":"Dams"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"4684465c-9860-40a6-bd7a-632b74f768c3","name":"Semi Conductors"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"6320d3c7-ed23-46da-94cf-fb4054114d85","name":"Travel Services"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"69dd3e9b-a2bb-4afc-bd54-3154343e266c","name":"Video Games"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[],"tags":[{"id":"fceef936-8983-4be2-ba28-267c499bae32","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"eb955968-a9f8-4cd2-89f4-a52f14832eaa","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f4febeca-76bc-4961-879d-87bd3b053fb2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"dddd119f-edac-4077-958b-6a775dd4a147","name":"Shanya Packer Operator","source":"Tidal Cyber","group_attack_id":"G3170","created":"2025-12-17T14:18:06.279334Z","modified":"2025-12-17T14:18:06.279337Z","tidal_id":"226804ab-421e-507e-b46c-765ff66af841","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"284bedec-2fd7-47c2-83aa-cd937c829bf5","name":"Costa Rica","country_name":"Costa Rica","country_code":"CR"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"6081d7f5-318b-47d4-bebe-eda4cd16d578","name":"Dominican Republic","country_name":"Dominican Republic","country_code":"DO"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"53e1210a-b379-4569-aba4-9e7f6916f24e","name":"Tunisia","country_name":"Tunisia","country_code":"TN"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[],"associated_groups":[{"id":"dda29be6-8701-4da1-9ebe-e5951c2cee78","name":"VX Crypt","description":"<sup>[[Sophos News December 07 2025](/references/d74c88c0-25fe-419a-bf69-1603d1b3a597)]</sup>","source":"USER","associated_group_id":"409ab501-bcbe-45bd-b7a5-d23302f4430d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7705e3b5-5e46-4126-82c6-b81d631cb1cb","name":"Shanya","description":"<sup>[[Sophos News December 07 2025](/references/d74c88c0-25fe-419a-bf69-1603d1b3a597)]</sup>","source":"USER","associated_group_id":"f6b89ef4-9552-4fa9-863f-b206f4231704","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ff423fbd-d053-419b-b3e1-00b63f63dbb2","name":"Armillaria Loader Service","description":"<sup>[[Sophos News December 07 2025](/references/d74c88c0-25fe-419a-bf69-1603d1b3a597)]</sup>","source":"USER","associated_group_id":"014b980b-858b-4b12-8723-2c90acf0b7f1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"7918e1fd-a0e9-42e7-8189-20ddaf3a309c","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"5fc18026-9576-4071-a4d2-c713f466afe5","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"798e8a73-5e61-494b-97fe-0916b0498841","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"bd396d01-231e-4b59-ab3d-fbf1aceb2a26","name":"SheldIO","source":"Tidal Cyber","group_attack_id":"G3155","created":"2025-12-10T14:14:11.990960Z","modified":"2025-12-10T14:14:11.990963Z","tidal_id":"33881b1c-6b89-5df6-8348-ca55e5a36c99","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"102fe60d-294e-421f-8158-f2fb47bf023c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"81b4cc52-f0ff-4a09-8b9a-ecefd3401967","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"3792cb2f-205a-4a70-962b-a84f8b445584","name":"ShinyHunters","source":"Tidal Cyber","group_attack_id":"G3126","created":"2025-09-19T19:47:56.365779Z","modified":"2025-09-19T19:47:56.365782Z","tidal_id":"fa107e08-cee5-50be-a951-e1c2f31daef7","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"77fb02d9-8844-4e95-9c18-99375c9de3c1","name":"Uruguay","country_name":"Uruguay","country_code":"UY"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"477cd93a-5b0e-4f6b-9321-bb4fb463af26","name":"SLSH","description":"(Citation: Unit42 ShinySp1der Ransomware Samples November 21 2025)","source":"USER","associated_group_id":"26469f85-4148-4f51-86cc-71daf85fe58b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4c65f4ff-0aad-4a95-9fcf-8d4e80ee3784","name":"Sh1nySp1d3r","description":"(Citation: Unit42 ShinySp1der Ransomware Samples November 21 2025)","source":"USER","associated_group_id":"e27dd253-7d5e-4217-88ed-a0c008583149","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"46f11055-dd25-45d6-bca1-5947122635c2","name":"Scattered LAPSUS$ Hunters","description":"<sup>[[BleepingComputer November 19 2025](/references/ec75f7aa-a908-46b5-896f-bc4ed40d58c0)]</sup>","source":"USER","associated_group_id":"e057a659-4824-4dd4-a35a-9c24871d8f76","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6e280b8f-5966-45c3-9e0f-3a527915a48a","name":"ShinySp1d3r","description":"<sup>[[BleepingComputer November 19 2025](/references/ec75f7aa-a908-46b5-896f-bc4ed40d58c0)]</sup>","source":"USER","associated_group_id":"3a9a7194-a102-4ebb-907e-4b9fc3721aa1","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ee5b50aa-787c-45ca-87b7-0a3330a957c0","name":"Sp1d3rhunters","description":"<sup>[[ReliaQuest September 15 2025](/references/8693bfa8-2b15-4697-b519-24833e2e8822)]</sup>","source":"USER","associated_group_id":"5f58db18-92b8-45f1-80d4-b0c2ac05c8c5","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b1747651-c5c2-430f-9ea0-38c6d7453491","name":"Bling Libra","description":"<sup>[[Unit 42 August 23 2024](/references/d6c50145-2bf9-4f7c-97b9-81cc2e1575f2)]</sup>","source":"USER","associated_group_id":"002bea4b-1098-4ec7-a9e9-cca50ca32e34","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"cbb70c26-8124-4c37-a312-dd21d5a0c470","name":"UNC6240","description":"<sup>[[Google Cloud June 4 2025](/references/4feebcde-4471-4275-80b1-0a9ade1745a5)]</sup>","source":"USER","associated_group_id":"70bfb068-8b64-445b-b49c-cf8a292fc581","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"80989142-5e92-438a-bc91-023290ba52bc","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"95f90665-37de-4f6d-812f-67fb8a13cd0d","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"cb16118c-dacb-4e1d-8284-b1d87fef3398","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"986344ed-bf49-42c7-b422-69ed0f0cca05","tag":"6a75169c-cda0-42de-bd3d-652d770911e3"},{"id":"f73ab397-ec9c-4588-a1fb-c16a613c1cfa","tag":"39e1f80f-f099-4602-a307-866a8caaf0d9"},{"id":"5eb01b0e-a40a-4571-b58b-930a10565f9c","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"00a0d06f-f362-49f1-917f-9e41b21e4f22","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"e130671d-d861-4a06-a3f0-430d8ad21c79","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"462327ef-cf52-4d1f-ab2d-0609ca755dab","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"26b9f51e-8131-434a-8071-f65462fd6946","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"8b7eca51-7ac6-4afc-a407-515f105f28ba","tag":"cfd20df4-a5fa-448c-bffc-6a78a7cbbab0"},{"id":"c0a4ae7a-c71f-49d3-8027-c95c792a6fa4","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"8ecb7df3-0b99-4ad8-8e03-89bf8b4c2b8a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"31bc763e-623f-4870-9780-86e43d732594","name":"SideCopy","source":"MITRE","group_attack_id":"G1008","created":"2022-08-07T13:52:07.791000Z","modified":"2022-10-20T18:29:03.956000Z","tidal_id":"7460f4fc-3984-5f9c-bdd5-e8d992e1c8b5","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"44f8bd4e-a357-4a76-b031-b7455a305ef0","name":"Sidewinder","source":"MITRE","group_attack_id":"G0121","created":"2021-01-27T15:57:11.183000Z","modified":"2021-04-21T12:32:46.791000Z","tidal_id":"23b27149-6011-5c3a-8d5d-9c7f821c5de6","country":[{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"bc2cc570-b03a-4b25-a6c2-f43b08718a2b","name":"Myanmar","country_name":"Myanmar","country_code":"MM"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"b0f3f694-f414-4e42-b95d-1a790b64b6ca","name":"Rattlesnake","description":"<sup>[[Cyble Sidewinder September 2020](https://app.tidalcyber.com/references/25d8d6df-d3b9-4f57-bce0-d5285660e746)]</sup>","source":"MITRE","associated_group_id":"023a26e3-77a9-44b3-932f-23c82100881c","owner_id":null,"owner_name":null},{"id":"fec3ddd1-7f8e-48c6-9697-075e1ffec9db","name":"SideWinder(Group-IB SideWinder June 1 2022)","description":"","source":"USER","associated_group_id":"1e5759e3-260f-4387-bddf-74603ae5a28c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"99150dba-de97-4a2f-a19c-2896a6f7375c","name":"Hardcore Nationalist(Group-IB SideWinder June 1 2022)","description":"","source":"USER","associated_group_id":"540b6f41-0cb3-46f2-90c6-e90524caf551","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3052c9d8-d753-4003-904f-4e8c4c069a3f","name":"RAZOR TIGER(Group-IB SideWinder June 1 2022)","description":"","source":"USER","associated_group_id":"4916011c-fe58-4221-901f-8bf1d49d8f76","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2520a2c7-38ad-4360-8adc-bc309746ff52","name":"T-APT-04","description":"<sup>[[Cyble Sidewinder September 2020](https://app.tidalcyber.com/references/25d8d6df-d3b9-4f57-bce0-d5285660e746)]</sup>","source":"MITRE","associated_group_id":"3e580fae-6d8a-4c1c-b132-ddf47d0ff6c9","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"b534349f-55a4-41b8-9623-6707765c3c50","name":"Silence","source":"MITRE","group_attack_id":"G0091","created":"2019-05-24T17:57:36.491000Z","modified":"2022-06-02T20:13:56.605000Z","tidal_id":"b4c606ee-149e-5ff2-8b61-c33cb628e8de","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"}],"associated_groups":[{"id":"5e7bdbc9-27c0-4801-bd67-26a5afa78cc5","name":"Whisper Spider","description":"<sup>[[Crowdstrike GTR2020 Mar 2020](https://app.tidalcyber.com/references/a2325ace-e5a1-458d-80c1-5037bd7fa727)]</sup>","source":"MITRE","associated_group_id":"4e28aead-8a85-4ae2-88d0-fa21fc7aa6a0","owner_id":null,"owner_name":null}],"tags":[{"id":"a2215d76-37e3-47ba-9d24-793f87441622","tag":"15787198-6c8b-4f79-bf50-258d55072fee"}],"owner_name":null},{"id":"0e7bd4da-7974-49c9-b213-116bd7157761","name":"Silent Librarian","source":"MITRE","group_attack_id":"G0122","created":"2021-02-03T16:36:38.145000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"e9c63fde-440c-5408-9715-4976c19a94c0","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"252115d5-b120-4db5-846d-829ac4ebfc54","name":"Oman","country_name":"Oman","country_code":"OM"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"5d46e5fe-8597-4606-bd43-9a0426548854","name":"TA407","description":"<sup>[[Proofpoint TA407 September 2019](https://app.tidalcyber.com/references/e787e9af-f496-442a-8b36-16056ff8bfc1)]</sup><sup>[[Malwarebytes Silent Librarian October 2020](https://app.tidalcyber.com/references/9bb8ddd0-a8ec-459b-9983-79ccf46297ca)]</sup>","source":"MITRE","associated_group_id":"c39d60d6-bb43-47e5-bc8d-e73fa1ef8c1d","owner_id":null,"owner_name":null},{"id":"770197f5-de40-4936-962a-f256e1ee7717","name":"COBALT DICKENS","description":"<sup>[[Secureworks COBALT DICKENS August 2018](https://app.tidalcyber.com/references/addbb46b-b2b5-4844-b4be-f6294cf51caa)]</sup><sup>[[Secureworks COBALT DICKENS September 2019](https://app.tidalcyber.com/references/45815e4d-d678-4823-8315-583893e263e6)]</sup><sup>[[Proofpoint TA407 September 2019](https://app.tidalcyber.com/references/e787e9af-f496-442a-8b36-16056ff8bfc1)]</sup><sup>[[Malwarebytes Silent Librarian October 2020](https://app.tidalcyber.com/references/9bb8ddd0-a8ec-459b-9983-79ccf46297ca)]</sup>","source":"MITRE","associated_group_id":"1a968e44-b931-4373-96f8-ecb976540fd3","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"7ce6d4f0-d737-4cb2-ab2a-a44ed500d666","name":"Silver Fox","source":"Tidal Cyber","group_attack_id":"G3188","created":"2025-12-29T17:40:15.719142Z","modified":"2025-12-29T17:40:15.719146Z","tidal_id":"8719746b-ee58-5f90-b07f-d746683c6cad","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"}],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"}],"associated_groups":[{"id":"28626b3c-d054-4e16-a8b8-9b5cd3a77bae","name":"Void Arachne","description":"<sup>[[ReliaQuest December 04 2025](/references/3eea040e-75fb-4e52-b9b6-9e1476f0ddcb)]</sup>","source":"USER","associated_group_id":"e90898b6-5468-4a4f-b10f-fa762ddfc2d6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"77d4e927-1882-41d2-b604-6599bc4b0b27","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"602a3ec4-09f0-4762-9390-6614314314f2","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"d323538d-72a8-4292-ab7d-11d17ac789a5","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"0415e269-50de-467d-a08e-973a83051782","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"0de0b0cd-3e43-4225-9b68-53c52d48b541","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"e47ae2a7-d34d-4528-ba67-c9c07daa91ba","name":"SilverTerrier","source":"MITRE","group_attack_id":"G0083","created":"2019-01-29T21:36:59.793000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"aa27772c-a586-5c44-8e72-228a55b416bd","country":[{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"}],"observed_motivation":[],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"bd33c962-4fc1-49d8-8416-259a032863b8","name":"Sinobi Ransomware Actors","source":"Tidal Cyber","group_attack_id":"G3124","created":"2025-09-15T19:13:39.294853Z","modified":"2025-09-15T19:13:39.294857Z","tidal_id":"afec8874-c0a7-5cd8-8481-282eea8b0011","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"f042cea2-76bd-4cf7-a2e0-9963a410770b","name":"Electronics"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"a5eacf64-9f07-4ac1-8772-500b2ab850de","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"bf8175fc-315b-4740-ad4e-295f6dacc6ce","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"35e554e9-767f-43ff-abe8-570434c48697","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"1968e4e4-f94b-4ca2-953b-d67a040db2aa","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"2560ec12-1ebd-410b-883d-b9e920dbc2b3","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"5c16f0ee-ee85-4e30-adc8-5ebe23880952","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6632f07f-7c6b-4d12-8544-82edc6a7a577","name":"Sowbug","source":"MITRE","group_attack_id":"G0054","created":"2018-01-16T16:13:52.465000Z","modified":"2020-03-30T02:46:16.483000Z","tidal_id":"9abc000c-1145-5100-a83d-306cdd3f8206","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"50877c20-18c5-48d0-936a-a6bc462810f5","name":"Brunei Darussalam","country_name":"Brunei Darussalam","country_code":"BN"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"eb10ed9e-ea8d-4b61-bfc3-5994d30970df","name":"Spandex Tempest","source":"Tidal Cyber","group_attack_id":"G3012","created":"2024-06-13T20:11:16.268019Z","modified":"2024-06-13T20:11:16.268022Z","tidal_id":"c134f4ed-7f8b-5726-9eb9-06284afa3a34","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"81c185f0-5689-4735-b963-2cd064dca657","name":"CHIMBORAZO","description":"<sup>[[Microsoft Threat Intelligence Tweet June 17 2020](/references/98fc7485-9424-412f-8162-a69d6c10c243)]</sup>","source":"Tidal Cyber","associated_group_id":"5bd670ca-8e28-52d2-95ee-b4df7772428c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"242b8e8b-c3ba-41c7-befa-65da54840c5b","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"1443168a-4cea-4ce0-93c2-d6729c94a70b","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"649642a4-0659-5e10-ae19-1282f73a1785","name":"Star Blizzard","source":"MITRE","group_attack_id":"G1033","created":"2024-10-31T16:28:11.046295Z","modified":"2024-10-31T16:28:11.046297Z","tidal_id":"649642a4-0659-5e10-ae19-1282f73a1785","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[{"id":"a5a1a9a0-3ffd-5221-bd3e-c492022d97f9","name":"SEABORGIUM","description":"<sup>[[Microsoft Star Blizzard August 2022](https://app.tidalcyber.com/references/d5fc25ad-2337-55f5-9eac-050178a533d6)]</sup>","source":"MITRE","associated_group_id":"909388e1-ac0f-42e3-9937-c161ff9bedc0","owner_id":null,"owner_name":null},{"id":"acad533a-8466-4a5b-808e-ed27dbcb737f","name":"TAG-53","description":"<sup>[[U.S. CISA Star Blizzard December 2023](/references/3d53c154-8ced-4dbe-ab4e-db3bc15bfe4b)]</sup>","source":"Tidal Cyber","associated_group_id":"f4dc0f96-3111-433d-991d-fda590aac297","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"117b5c06-ce5c-418a-9e75-e03c0e2a9e5a","name":"BlueCharlie","description":"<sup>[[U.S. CISA Star Blizzard December 2023](/references/3d53c154-8ced-4dbe-ab4e-db3bc15bfe4b)]</sup>","source":"Tidal Cyber","associated_group_id":"3ca01f19-a089-419e-8c32-b58e8eee8cbd","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1808d8b3-a80e-45ba-821e-62e57fb0b686","name":"Cold River","description":"<sup>[[Reuters Cold River January 6 2023](/references/15bac539-2561-4f97-a9fb-4e081417215f)]</sup>","source":"Tidal Cyber","associated_group_id":"6ca0b253-e961-430c-957f-14619a98e0ce","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"83a382a9-dfdb-4bfc-a26e-a24cc12f357b","name":"Calisto","description":"<sup>[[Sekoia Calisto December 5 2022](/references/02fed1d1-b8a9-4bca-9e96-2cffe6f7ba89)]</sup>","source":"Tidal Cyber","associated_group_id":"5b668911-32e6-4856-9b27-543415c72940","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2897383b-901d-4e41-baec-ac3fd05ed056","name":"Blue Callisto","description":"<sup>[[PwC Blue Callisto December 6 2022](/references/ab48a205-ca06-4328-96a4-876007024a7d)]</sup>","source":"Tidal Cyber","associated_group_id":"289e8bf2-ca5e-4e00-ad90-31bd45797c2d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ad78608e-5d6c-43eb-a270-02232b54fd38","name":"UNC4057","description":"<sup>[[Google TAG COLDRIVER January 18 2024](/references/0b26c6f8-51ee-4419-9842-245c0e5e6f58)]</sup>","source":"Tidal Cyber","associated_group_id":"4ee31b72-718d-4766-86d6-b5856e6956fe","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"f70b80ac-d447-55f9-9e38-0026f623604d","name":"Callisto Group","description":"<sup>[[CISA Star Blizzard Advisory December 2023](https://app.tidalcyber.com/references/96b26cfc-b31d-5226-879f-4888801ec268)]</sup>","source":"MITRE","associated_group_id":"7d532de0-8ab2-4df7-a008-0ee49f9da3bc","owner_id":null,"owner_name":null},{"id":"4500af59-3524-5289-841d-8b7d816d36f6","name":"COLDRIVER","description":"<sup>[[Google TAG COLDRIVER January 2024](https://app.tidalcyber.com/references/cff26ad8-b8dc-557d-9751-530f7ebfaa02)]</sup>","source":"MITRE","associated_group_id":"cc7032b0-ce53-48e3-809e-90f499d5c5df","owner_id":null,"owner_name":null},{"id":"e6061b3e-7ada-503f-bc2e-d1a84519d00f","name":"TA446","description":"<sup>[[CISA Star Blizzard Advisory December 2023](https://app.tidalcyber.com/references/96b26cfc-b31d-5226-879f-4888801ec268)]</sup>","source":"MITRE","associated_group_id":"ff69fb2d-a29b-4e7c-8b82-0629c0ce59d9","owner_id":null,"owner_name":null},{"id":"8a75df54-399d-4a3d-bb03-83fea676d19f","name":"SEABORGIUM","description":"<sup>[[Microsoft Star Blizzard August 2022](https://app.tidalcyber.com/references/d5fc25ad-2337-55f5-9eac-050178a533d6)]</sup>","source":"Mobile","associated_group_id":"909388e1-ac0f-42e3-9937-c161ff9bedc0","owner_id":null,"owner_name":null},{"id":"fd806f31-84a1-4da3-818e-85561f07f867","name":"Callisto Group","description":"<sup>[[CISA Star Blizzard Advisory December 2023](https://app.tidalcyber.com/references/96b26cfc-b31d-5226-879f-4888801ec268)]</sup>","source":"Mobile","associated_group_id":"7d532de0-8ab2-4df7-a008-0ee49f9da3bc","owner_id":null,"owner_name":null},{"id":"f95e41d7-e805-487f-8753-33bcdd427e80","name":"TA446","description":"<sup>[[CISA Star Blizzard Advisory December 2023](https://app.tidalcyber.com/references/96b26cfc-b31d-5226-879f-4888801ec268)]</sup>","source":"Mobile","associated_group_id":"ff69fb2d-a29b-4e7c-8b82-0629c0ce59d9","owner_id":null,"owner_name":null},{"id":"02c340c2-6ba7-42c0-a307-7204b6a0cd66","name":"COLDRIVER","description":"<sup>[[Google TAG COLDRIVER January 2024](https://app.tidalcyber.com/references/cff26ad8-b8dc-557d-9751-530f7ebfaa02)]</sup>","source":"Mobile","associated_group_id":"cc7032b0-ce53-48e3-809e-90f499d5c5df","owner_id":null,"owner_name":null}],"tags":[{"id":"8dcffa37-7b37-41ab-bbc0-29fa26338b03","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"b04bf58b-ddd2-4e17-85f9-35afd82e9e9b","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"ffa42462-634b-43a9-bbed-6427233855c9","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"86c32c9f-3b4b-43a1-a60a-c2d2b1bdf194","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"6e269591-e249-47f8-8495-8dabe7d6e7c2","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"f69bfdf7-c3d4-4aa3-9852-5bf0c28ae402","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"bcbbd629-f46c-4391-bb55-bc0f059537be","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"af40e222-b69a-43ce-a54d-551112703ae6","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"059cff07-f353-4bba-9d7e-0cb81fe059f6","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"2561fe98-5201-4705-93bf-a8aae262d951","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"}],"owner_name":null},{"id":"62f010b9-707f-4161-99dc-69e3c6e54e13","name":"Stately Taurus","source":"Tidal Cyber","group_attack_id":"G3074","created":"2025-02-03T21:08:38.962864Z","modified":"2025-02-03T21:08:38.962868Z","tidal_id":"50ad68d3-d70c-565e-8898-0bb12a6877fe","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"b0ca825d-b36d-49af-9039-8a71c171e450","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"87336832-cdca-49bb-9a0e-6e84eb9a46fd","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"ca3016f3-642a-4ae0-86bc-7258475d6937","name":"Stealth Falcon","source":"MITRE","group_attack_id":"G0038","created":"2017-05-31T21:32:06.390000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"4c929768-abec-5ee4-9aca-a190f05f1c17","country":[],"observed_motivation":[],"observed_country":[{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"}],"observed_sector":[{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"23cfa293-246c-414b-acbe-a6d47cd2ad3e","name":"Human Rights"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"2a834c03-7339-481f-8fcb-787e13f990c6","name":"Storm-0249","source":"Tidal Cyber","group_attack_id":"G3175","created":"2025-12-17T14:18:07.120490Z","modified":"2025-12-17T14:18:07.120494Z","tidal_id":"3b1a565d-3e0c-54a9-9537-93dee64aba87","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"e97f37b4-7ba5-410d-8fce-b640ce2fb1c7","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"936c8c30-a395-471a-b624-e4980f652bf7","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"8d8e318c-6ee5-4a00-ac86-53c241be455a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"aa351f3d-b917-45c9-a99e-2fe5ef23a970","name":"Storm-0494","source":"Tidal Cyber","group_attack_id":"G3146","created":"2025-11-11T13:26:01.545240Z","modified":"2025-11-11T13:26:01.545245Z","tidal_id":"84abee9a-b129-54f5-b992-4cbb0a1fe9cc","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"77fd318d-fa73-4f15-831e-11173f78f14f","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"336689b9-8b1e-4531-ac2d-75c79e7c5300","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"416acbe3-8993-56e1-9a89-e65c2eefcc86","name":"Storm-0501","source":"MITRE","group_attack_id":"G1053","created":"2025-10-29T21:08:48.108218Z","modified":"2025-10-29T21:08:48.108219Z","tidal_id":"416acbe3-8993-56e1-9a89-e65c2eefcc86","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"5ba086cb-a219-4223-8e9d-051de5696768","name":"UNC2190","description":"<sup>[[Tyler McLellan UNC2190 September 26 2024](/references/32298444-284a-4991-ba3b-a80bd62be903)]</sup>","source":"USER","associated_group_id":"6cfc5216-e45c-4701-9fd3-cffbd5f66acb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"040f7f28-92c1-4863-96dd-a6b26a000c7e","name":"Arcane","description":"<sup>[[Mandiant Sabbath Ransomware November 29 2021](/references/ab3a20a5-2df1-4f8e-989d-baa96ffaca74)]</sup>","source":"USER","associated_group_id":"d908c450-5ed2-44a3-89c9-3b800142cfa3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e79b73c9-bf8c-4337-93a4-6a77dab2f1e1","name":"Eruption","description":"<sup>[[Mandiant Sabbath Ransomware November 29 2021](/references/ab3a20a5-2df1-4f8e-989d-baa96ffaca74)]</sup>","source":"USER","associated_group_id":"0b14d950-c009-43d6-b26a-ad783ba8742f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"96bebf77-eaff-45b3-a03e-863617ab1dce","tag":"ecfc9a06-e970-4310-ac3f-0af98163563b"},{"id":"5ced6f66-d07d-4f97-b082-09c8dec354d5","tag":"1c1a335a-dc30-470d-9539-b09aa87e2f8c"},{"id":"20d71362-a5bf-497c-86f0-e29e7ec77c5f","tag":"15b77e5c-2285-434d-9719-73c14beba8bd"},{"id":"4db24a28-1138-4699-915a-1945c19ec6c1","tag":"532b7819-d407-41e9-9733-0d716b69eb17"},{"id":"de49d789-fc54-4d2a-b673-d15c2a5290dd","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"2d134d3c-7c0c-4dc5-8231-d01783ec7cf0","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"b391745a-8de3-4799-a844-4899d114fefb","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"087e4a0f-778d-4554-b417-629c12419fa1","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"de72d564-6487-4cf3-be3e-0a961cf15d5d","name":"Storm-0501 (Deprecated)","source":"Tidal Cyber","group_attack_id":"G3057","created":"2024-10-04T20:33:10.260062Z","modified":"2024-10-04T20:33:10.260067Z","tidal_id":"a766ff06-6e3d-5f95-aecb-2ba784295e48","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"3436bd33-073e-4dbc-b59a-0706e36c57ab","name":"Arcane","description":"<sup>[[Mandiant Sabbath Ransomware November 29 2021](/references/ab3a20a5-2df1-4f8e-989d-baa96ffaca74)]</sup>","source":"Tidal Cyber","associated_group_id":"d908c450-5ed2-44a3-89c9-3b800142cfa3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a355946b-d3ac-4966-bd6a-5c7ca5e042df","name":"Eruption","description":"<sup>[[Mandiant Sabbath Ransomware November 29 2021](/references/ab3a20a5-2df1-4f8e-989d-baa96ffaca74)]</sup>","source":"Tidal Cyber","associated_group_id":"0b14d950-c009-43d6-b26a-ad783ba8742f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c2f96c43-c691-43f6-8c4b-a6e47296b952","name":"UNC2190","description":"<sup>[[Tyler McLellan UNC2190 September 26 2024](/references/32298444-284a-4991-ba3b-a80bd62be903)]</sup>","source":"Tidal Cyber","associated_group_id":"6cfc5216-e45c-4701-9fd3-cffbd5f66acb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"0f11c6db-1f0b-4ab5-80d1-58497517ce5f","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"7c082fa1-6ba0-4960-a21b-ca257dcdf218","tag":"ecfc9a06-e970-4310-ac3f-0af98163563b"},{"id":"2742ca24-fd78-4f50-a718-9e105c67b8e8","tag":"1c1a335a-dc30-470d-9539-b09aa87e2f8c"},{"id":"4ef39e8b-62b1-428e-877c-99023b3ccbe6","tag":"15b77e5c-2285-434d-9719-73c14beba8bd"},{"id":"09c8c053-5dec-45fc-8d7b-8cf14d9f4e1b","tag":"532b7819-d407-41e9-9733-0d716b69eb17"},{"id":"37cf68c9-ee43-44d5-8d4f-dd2cbc483ca5","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"58d032a8-45db-45ac-814d-fe2e379f5075","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"164ee646-a601-4982-b6c3-5f69b7c9069b","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"99b02e33-33d8-439d-b8d5-74e31a9c1494","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"05f1d993-f68e-4943-ae27-dc214b37337b","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a83090fc-0407-4eb5-9130-6ff13dc27ed0","name":"STORM-0817","source":"Tidal Cyber","group_attack_id":"G3072","created":"2025-02-03T21:08:38.550860Z","modified":"2025-02-03T21:08:38.550864Z","tidal_id":"465cfea1-f114-501b-a325-106b572d76e6","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"}],"associated_groups":[],"tags":[{"id":"660816f6-bdbd-41fb-afb6-5660b3f3e6f4","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"6b1a3016-f888-471f-aeab-eaf4722cd9d9","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"6a949618-8d37-4eed-b0f4-e4aa8c49eb24","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"fcbf6963-839b-4853-8b80-73ff6831b7d7","name":"Storm-0844","source":"Tidal Cyber","group_attack_id":"G3046","created":"2024-08-02T14:59:25.176573Z","modified":"2024-08-02T14:59:25.176577Z","tidal_id":"d10c0d2f-f836-512f-ab5a-e6aea5e87032","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"59ba7172-3f8b-48bf-b39f-5120e55aafeb","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"649e0978-0aa3-4b5d-b949-b6a7ce24dd45","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"bf5faf3f-5979-4940-8744-d03daf8dd156","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"2f7fceba-611a-426a-8bff-818d95c33648","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d6f92f90-4be7-4176-9a97-98a5e63674e8","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"0aa009a3-4c8d-44d9-aa5f-6f68eb7d846c","name":"Storm-1175","source":"Tidal Cyber","group_attack_id":"G3139","created":"2025-10-13T17:29:00.527878Z","modified":"2025-10-13T17:29:00.527882Z","tidal_id":"ecde1f52-6ac3-5a8d-b496-0a17c30b67e8","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"25d7b888-35a9-4d27-a470-7efdc17326a9","tag":"99916272-acf8-4201-8cfb-6ba16a3d5fbe"},{"id":"847e206a-30fb-4c89-b4a3-0dd2ca4e01c0","tag":"241d20a1-bda4-469b-854a-10113e64387d"},{"id":"1784d983-08a3-432b-b517-5ae329daa494","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"afd5df50-598b-4049-9dad-42f26210d4a5","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"8c4e55cf-5355-4dc2-9d4f-10891c6e27f9","name":"Storm-1747","source":"Tidal Cyber","group_attack_id":"G3198","created":"2026-01-14T13:30:28.826163Z","modified":"2026-01-14T13:30:28.826169Z","tidal_id":"da47012b-376f-50d8-a7d5-29a6d5b95a01","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"a9acbcf4-8c1d-4e29-a326-8159c5b2489d","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"b347d503-80ab-46a4-bcee-f2028d9cb921","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"0b645689-91c9-4308-9622-703e3aad1e5c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"45c254a8-f46e-480f-b898-222c9cad21dd","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f17d1768-9563-539a-8d3a-e3e9500658bf","name":"Storm-1811","source":"MITRE","group_attack_id":"G1046","created":"2025-04-22T20:47:03.724089Z","modified":"2025-04-22T20:47:03.724092Z","tidal_id":"f17d1768-9563-539a-8d3a-e3e9500658bf","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"0652d067-8d3f-46b5-ae94-7dbab3300ef5","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"a431c504-b906-4ef7-adef-082cf4891a28","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"0816419f-7f5e-4c8a-82af-ae22347668f8","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"34936b29-25bd-4251-a701-97fb74d5e3e3","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"}],"owner_name":null},{"id":"ee2da206-2532-44e3-a343-d66e9bfdbca0","name":"Storm-1811 (Deprecated)","source":"Tidal Cyber","group_attack_id":"G3038","created":"2024-06-13T20:12:22.092699Z","modified":"2024-06-13T20:12:22.092702Z","tidal_id":"f7119ca2-f0b2-5d18-8122-37d917b46e5d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"202e8f99-755a-420f-8caa-8cafe2f7d7fc","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c2e81fcd-139e-4356-8528-42cd86f9f3e5","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"87c73f53-703d-4b2b-aa3a-f86e0b2edc02","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"a5b3791a-d000-47f9-a433-84a5b391fcb3","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"0b16470b-2947-47fa-95df-f16631175b11","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a2e14543-ab54-4c9a-ab0e-755b925363e2","name":"Storm-2139","source":"Tidal Cyber","group_attack_id":"G3080","created":"2025-03-04T15:55:06.624590Z","modified":"2025-03-04T15:55:06.624594Z","tidal_id":"8c7eead7-f70f-5737-87c4-c11f869173f1","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"f8918cad-aad5-4efe-95b1-3e1095db2295","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"8cd0ad30-b0ae-4643-93a6-96abc6fb97c6","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"621076ec-c8e3-4f9b-acfb-ab894cc1cd21","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c284aec3-521a-4c61-913a-f5b9436cfd48","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6338d74d-155f-4728-8171-b7148b88ec53","name":"Storm-2603","source":"Tidal Cyber","group_attack_id":"G3117","created":"2025-08-04T14:21:06.314929Z","modified":"2025-08-04T14:21:06.314933Z","tidal_id":"60e8173f-2c70-590e-ba55-75c714f99809","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"b59a6eba-0272-407b-ade5-4e05912d84bb","name":"Nuclear"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"047bac07-d91d-4134-899e-f1b7eb6b6b6f","name":"GOLD SALEM","description":"<sup>[[None December 11 2025](/references/1037dd5b-a209-4ea6-9a97-ac80c0f35ca3)]</sup>","source":"USER","associated_group_id":"534f7eea-e102-4e66-a54c-bbca6c5e1fcb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"1c6e80e8-ca17-41e1-b1bd-1101121e84c2","name":"Warlock Group","description":"<sup>[[None December 11 2025](/references/1037dd5b-a209-4ea6-9a97-ac80c0f35ca3)]</sup>","source":"USER","associated_group_id":"4902e5fb-003f-48c3-8e48-bb5d76f58245","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"ba368873-7033-4321-9497-0834e2a8cf8c","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"69f4ee33-ec7e-459b-95fb-fb5efe46f132","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"98cdc687-6bd4-4f42-b995-7a74ebc2c7fa","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"7a48ec3e-2da3-4821-b633-2b437fefea1d","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"bd2bda62-cfaf-40fc-944f-cf17fe356cad","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"9f7b767c-c39c-4f6c-b6ca-3b65f54ee38f","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"1b76d6eb-ad30-4447-a32c-6e4ca9f28e63","name":"Stormous","source":"Tidal Cyber","group_attack_id":"G3091","created":"2025-04-11T15:33:36.504354Z","modified":"2025-04-11T15:33:36.504359Z","tidal_id":"885e8c39-ce66-5c6c-8073-cceba4af118c","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"1c6e638b-8e75-4e5a-bb88-12a90386f2f4","name":"Cuba","country_name":"Cuba","country_code":"CU"},{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[],"tags":[{"id":"77650dd4-890c-45c7-b717-abb47a8b8431","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"891cbe5e-99b5-4d0c-9478-6f00dfde3ec9","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"675ccb4b-2897-4576-bd38-4bd724ea2c80","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"fadaa011-486a-429b-8eb3-79d761197e09","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"163dc691-a798-46d3-ae77-5466fe2c61aa","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"deb573c6-071a-4b50-9e92-4aa648d8bdc1","name":"Strider","source":"MITRE","group_attack_id":"G0041","created":"2017-05-31T21:32:07.541000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"f240e0a5-7cc6-5a3c-9437-396879832243","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"e5bde9f2-6b63-4216-b3c0-d978c09a8215","name":"Rwanda","country_name":"Rwanda","country_code":"RW"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"081ed982-e5c6-46c4-b84b-c30e6c3f76b0","name":"ProjectSauron","description":"ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125. <sup>[[Kaspersky ProjectSauron Blog](https://app.tidalcyber.com/references/baeaa632-3fa5-4d2b-9537-ccc7674fd7d6)]</sup> <sup>[[Kaspersky ProjectSauron Full Report](https://app.tidalcyber.com/references/6840c1d6-89dc-4138-99e8-fbd2a45f2a1c)]</sup>","source":"MITRE","associated_group_id":"bb2eac9b-3dfc-487a-8dff-b8de5f6e3041","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"562cc30a-b238-477b-9cce-592afe68ec66","name":"Subtle Snail","source":"Tidal Cyber","group_attack_id":"G3128","created":"2025-10-07T14:07:12.911416Z","modified":"2025-10-07T14:07:12.911419Z","tidal_id":"8c868450-f471-5b4b-b84f-0a9d0cfd7f2e","country":[{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"}],"observed_sector":[{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"aca84fe6-a06e-4a39-a4c1-96b6b3de419a","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"c500fe55-7ed5-4883-949f-6654c693f2ab","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"96cfde47-5fb2-44be-b23c-325df0f7dea6","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"06549082-ff70-43bf-985e-88c695c7113c","name":"Suckfly","source":"MITRE","group_attack_id":"G0039","created":"2017-05-31T21:32:06.777000Z","modified":"2022-05-11T14:00:00.188000Z","tidal_id":"dcb99de8-e780-5435-8353-6184f56fda78","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"d9434f91-6f23-4347-8745-986955e74f3e","name":"SweetSpecter","source":"Tidal Cyber","group_attack_id":"G3071","created":"2025-02-03T21:08:38.360440Z","modified":"2025-02-03T21:08:38.360443Z","tidal_id":"037d1005-a4d6-5e68-9d63-98e4676a8162","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"0ef4572d-d4a1-4b76-8132-e3f1ed3fc468","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"770e4a6a-c059-4685-9e41-0acd46881d30","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a1b3ff6a-cdd7-45f6-ab4b-cab05c3b35d1","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"1bfbb1e1-022c-57e9-b70e-711c601640be","name":"TA2541","source":"MITRE","group_attack_id":"G1018","created":"2023-11-07T00:35:52.016161Z","modified":"2023-11-07T00:35:52.016164Z","tidal_id":"ab83f948-1ef3-5428-b52f-fff419636f23","country":[],"observed_motivation":[],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"e7f14039-1e63-4708-8565-bbd72f7b8d84","name":"TA2723","source":"Tidal Cyber","group_attack_id":"G3184","created":"2025-12-29T17:40:15.046504Z","modified":"2025-12-29T17:40:15.046508Z","tidal_id":"12b274b8-9028-5feb-bdf0-9551cf89a1c1","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"4b8dac73-3604-45be-bf41-e1d8e224ba15","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"d5775db3-4885-4ccc-af02-19d0e0383dda","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"9c64e8c7-b779-4478-8301-c2185f759599","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c34fb13f-0333-4e8e-b951-d1127478d4ea","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"e343c1f1-458c-467b-bc4a-c1b97b2127e3","name":"TA459","source":"MITRE","group_attack_id":"G0062","created":"2018-04-18T17:59:24.739000Z","modified":"2020-03-30T19:22:32.962000Z","tidal_id":"172a921a-ef35-54ae-87cb-13586d04005b","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"b3220638-6682-4a4e-ab64-e7dc4202a3f1","name":"TA505","source":"MITRE","group_attack_id":"G0092","created":"2019-05-28T15:54:17.213000Z","modified":"2022-10-13T16:17:20.601000Z","tidal_id":"8c23e7a8-1e8a-55c9-999a-b9ce3103feb2","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[],"associated_groups":[{"id":"9ab8f137-2f8b-530e-8d78-e5cf94214098","name":"CHIMBORAZO","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"5bd670ca-8e28-52d2-95ee-b4df7772428c","owner_id":null,"owner_name":null},{"id":"1b8be083-5a61-4258-9930-c9af51134220","name":"Hive0065","description":"<sup>[[IBM TA505 April 2020](https://app.tidalcyber.com/references/bcef8bf8-5fc2-4921-b920-74ef893b8a27)]</sup>","source":"MITRE","associated_group_id":"4f21a323-28d3-498d-8cfe-a1835eebd561","owner_id":null,"owner_name":null},{"id":"f58a3c86-126b-5503-a47c-11ce3b092a5e","name":"Spandex Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"2e686851-2b49-5a9d-806b-a8c15784ba8d","owner_id":null,"owner_name":null}],"tags":[{"id":"7a4ea2a3-88eb-48e3-ab9d-3f78dea064cc","tag":"173e1480-8d9b-49c5-854d-594dde9740d6"},{"id":"7aa295d3-e8ea-428e-b017-9bdf9f1ecfc9","tag":"241d20a1-bda4-469b-854a-10113e64387d"},{"id":"cd259076-8db8-49b0-8243-085e7c0e8c50","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"28414c05-d6b1-48d6-918f-3a53aa923406","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"101c179d-bdab-4463-803b-9da0d3c91b0b","tag":"a98d7a43-f227-478e-81de-e7299639a355"}],"owner_name":null},{"id":"ac3426c4-6d7e-4e99-9546-266fb7fd8c44","name":"TA547","source":"Tidal Cyber","group_attack_id":"G3059","created":"2024-10-18T13:26:55.616639Z","modified":"2024-10-18T13:26:55.616645Z","tidal_id":"93f7984a-b053-5311-bb75-817d06e55a06","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[],"associated_groups":[{"id":"d393ab55-8250-4d53-8da2-c01c03a72901","name":"Scully Spider","description":"<sup>[[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence](/references/b595af7e-ff84-49fa-8e07-cd2abe9e1d65)]</sup>","source":"Tidal Cyber","associated_group_id":"3cc4fbf5-9556-4606-bf26-be76c587a67f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"7654a73f-17f9-4189-bc04-8358bc54b9e5","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"}],"owner_name":"TidalCyberIan"},{"id":"8951bff3-c444-4374-8a9e-b2115d9125b2","name":"TA551","source":"MITRE","group_attack_id":"G0127","created":"2021-03-19T21:04:00.692000Z","modified":"2021-09-30T12:58:59.065000Z","tidal_id":"d5d692aa-d636-539e-a657-d01ba0aae0c0","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"9e152191-3791-4025-bacc-2ce10f849daa","name":"Shathak","description":"<sup>[[Unit 42 Valak July 2020](https://app.tidalcyber.com/references/9a96da13-5795-49bc-ab82-dfd4f964d9d0)]</sup><sup>[[Unit 42 TA551 Jan 2021](https://app.tidalcyber.com/references/8e34bf1e-86ce-4d52-a6fa-037572766e99)]</sup>","source":"MITRE","associated_group_id":"2d829442-7a16-46ab-9d4d-b92cd1f0be7e","owner_id":null,"owner_name":null},{"id":"26c30ee4-7bf4-432e-ab46-b0ae9c8eaa51","name":"GOLD CABIN","description":"<sup>[[Secureworks GOLD CABIN](https://app.tidalcyber.com/references/778babec-e7d3-4341-9e33-aab361f2b98a)]</sup>","source":"MITRE","associated_group_id":"f9c58990-a69d-4edc-ad9d-ec74412da18a","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"e1e72810-4661-54c7-b05e-859128fb327d","name":"TA577","source":"MITRE","group_attack_id":"G1037","created":"2024-10-31T16:28:10.231999Z","modified":"2024-10-31T16:28:10.232005Z","tidal_id":"e1e72810-4661-54c7-b05e-859128fb327d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"b47551ba-8036-5527-abba-fed787c854a5","name":"TA578","source":"MITRE","group_attack_id":"G1038","created":"2024-10-31T16:28:11.073429Z","modified":"2024-10-31T16:28:11.073432Z","tidal_id":"b47551ba-8036-5527-abba-fed787c854a5","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"7e4dd0e2-4fa0-4dd5-ad0e-41aa9effe8bf","name":"TAG-160","source":"Tidal Cyber","group_attack_id":"G3173","created":"2025-12-17T14:18:06.806393Z","modified":"2025-12-17T14:18:06.806396Z","tidal_id":"0a64b9ff-4be9-566e-a4e6-8bed8673af11","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"d1166bc7-215c-4118-98da-96bcf1f00132","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"101af4d1-ba7c-4743-ae08-4a31f78ff09d","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6bc7e9b9-dac0-4223-8761-0a9b6033426b","name":"TAG-161","source":"Tidal Cyber","group_attack_id":"G3174","created":"2025-12-17T14:18:06.961698Z","modified":"2025-12-17T14:18:06.961701Z","tidal_id":"bb03b2d0-ab1e-52dd-810d-35e88dfcb3e0","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"}],"associated_groups":[],"tags":[{"id":"3fc2b229-a4f5-4eeb-8d6e-f2dcad75d21a","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"0d246e4c-37c5-439c-95df-d3550112dcdd","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"46fc99c5-f125-4fd6-9a15-25d4f370c6d0","name":"Tamil Eelam Cyber Force","source":"Tidal Cyber","group_attack_id":"G3207","created":"2026-01-23T20:30:06.852958Z","modified":"2026-01-23T20:30:06.852960Z","tidal_id":"a526d651-2ca9-5e6a-bdb6-2c01ebc9c6ed","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"82e626c4-1192-4997-b461-a814f43503ba","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"551e9020-d33f-4363-bb45-cd35113bed30","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"325c11be-e1ee-47db-afa6-44ac5d16f0e7","name":"TeamTNT","source":"MITRE","group_attack_id":"G0139","created":"2021-10-01T01:57:31.229000Z","modified":"2022-10-19T21:35:03.147000Z","tidal_id":"35b5ea46-6ff3-58d3-8663-ca9572bb5df5","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"9513bcc7-5c9e-4917-8aa5-873fade91dd9","tag":"efa33611-88a5-40ba-9bc4-3d85c6c8819b"},{"id":"a32946fc-3ce7-42a5-85af-eedbdb03d219","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"6e06660c-dada-420e-a9a6-40fcd076dc89","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"aff422cb-f546-4edb-bdf1-82e70900cc8d","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"}],"owner_name":null},{"id":"3a54b8dc-a231-4db8-96da-1c0c1aa396f6","name":"TEMP.Veles","source":"MITRE","group_attack_id":"G0088","created":"2019-04-16T15:14:38.533000Z","modified":"2022-05-24T16:22:20.856000Z","tidal_id":"6348f202-da1d-5c01-816c-23de872340b8","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[],"observed_country":[{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"}],"associated_groups":[{"id":"a6810875-326d-4627-8802-75eedd09ad8a","name":"XENOTIME","description":"The activity group XENOTIME, as defined by Dragos, has overlaps with activity reported upon by FireEye about TEMP.Veles as well as the actors behind [TRITON](https://app.tidalcyber.com/software/).<sup>[[Dragos Xenotime 2018](https://app.tidalcyber.com/references/b20fe65f-df43-4a59-af3f-43afafba15ab)]</sup><sup>[[Pylos Xenotime 2019](https://app.tidalcyber.com/references/e2f246d8-c75e-4e0f-bba8-869d82be26da)]</sup><sup>[[FireEye TRITON 2019](https://app.tidalcyber.com/references/49c97b85-ca22-400a-9dc4-6290cc117f04)]</sup><sup>[[FireEye TEMP.Veles 2018](https://app.tidalcyber.com/references/e41151fa-ea11-43ca-9689-c65aae63a8d2)]</sup>","source":"MITRE","associated_group_id":"cbba6443-46cd-4602-87ff-1142995202ab","owner_id":null,"owner_name":null},{"id":"600dccf1-2af4-4806-a735-a6a94c84eedc","name":"XENOTIME","description":"The activity group XENOTIME, as defined by Dragos, has overlaps with activity reported upon by FireEye about TEMP.Veles as well as the actors behind [TRITON](https://app.tidalcyber.com/software/).<sup>[[Dragos Xenotime 2018](https://app.tidalcyber.com/references/b20fe65f-df43-4a59-af3f-43afafba15ab)]</sup><sup>[[Pylos Xenotime 2019](https://app.tidalcyber.com/references/e2f246d8-c75e-4e0f-bba8-869d82be26da)]</sup><sup>[[FireEye TRITON 2019](https://app.tidalcyber.com/references/49c97b85-ca22-400a-9dc4-6290cc117f04)]</sup><sup>[[FireEye TEMP.Veles 2018](https://app.tidalcyber.com/references/e41151fa-ea11-43ca-9689-c65aae63a8d2)]</sup>","source":"ICS","associated_group_id":"cbba6443-46cd-4602-87ff-1142995202ab","owner_id":null,"owner_name":null}],"tags":[{"id":"28dd499a-00e5-42d9-a47a-3c1259c220cb","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"}],"owner_name":null},{"id":"286da832-f055-4ca4-a52a-9eb62461dc48","name":"Termite Ransomware Operators","source":"Tidal Cyber","group_attack_id":"G3067","created":"2024-12-17T14:34:00.672745Z","modified":"2024-12-17T14:34:00.672749Z","tidal_id":"e05c61b8-5c3a-5425-9402-e8ce016395ae","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"252115d5-b120-4db5-846d-829ac4ebfc54","name":"Oman","country_name":"Oman","country_code":"OM"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"5cb08eb6-1366-482b-8fea-2aed70e3da4b","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"4bcf3f25-dfbe-46cd-9916-fa88651530ee","tag":"f513f863-5910-4e32-ab1c-c7b118cb5f41"},{"id":"9419610d-222a-48c7-8af5-adf79b545243","tag":"d9c05db7-e2eb-45da-b468-17d8c5fb6394"},{"id":"c4f1eaea-f8df-46e7-ab81-513b88de6890","tag":"241d20a1-bda4-469b-854a-10113e64387d"},{"id":"d378a66f-ebd6-4ace-a267-45593c12f49c","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"c8fdcab4-cde6-496b-b76c-c36b571f186c","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"ec3e060a-80ce-4ae0-9372-4b5ad18f06c7","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3c7f802b-b120-4941-961f-fc87de00d1d2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"12c278d3-42e6-4691-b356-178f94362bca","name":"The Binary Guardians","source":"Tidal Cyber","group_attack_id":"G3194","created":"2026-01-06T18:04:02.846565Z","modified":"2026-01-06T18:04:02.846568Z","tidal_id":"0c466cc6-4861-540c-9127-b0364e3fb3fd","country":[{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_motivation":[{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"b7a13436-cd10-45eb-a05e-247dd67ffc6e","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"dc0c89f3-32c5-4d03-9b41-a6f0e9469fc0","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"7c12d5b6-be33-4611-836f-4f95b6d99070","name":"The Gentlemen","source":"Tidal Cyber","group_attack_id":"G3140","created":"2025-10-17T17:09:27.180507Z","modified":"2025-10-17T17:09:27.180510Z","tidal_id":"0ae540a6-46ab-5b1d-81e4-d6c15696da1f","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"}],"associated_groups":[],"tags":[{"id":"3cc9a5d4-bc04-47f0-a1ad-7a4da2fd36c4","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"16eb4e3a-61da-4477-9816-65d50cfd291d","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"56de3308-6bf0-4251-95b8-7415113c6d4d","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"939d9f87-eb37-4d79-bb06-b98a14153804","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"2d23ae3c-49be-4331-bd19-f503f719f923","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"5036be50-aedc-4613-b606-a7a5f0f95d5e","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"98aba847-22f2-424f-97d4-67fa23d388d3","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"04b87599-cafc-48ee-96d6-cab8e4aa749b","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"},{"id":"a86f89ba-c670-4f33-8ac8-f0f0b311c724","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"6b29f660-2757-4549-bba9-00a90612ef07","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"1f020ed3-2a31-4a44-8199-983287c08c9c","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"8ac39e5c-ff51-4dbd-af29-74f768658800","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"5bdd69bd-8240-4789-80eb-dee9e6a944a1","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"830079fe-9824-405b-93e0-c28592155c49","name":"The White Company","source":"MITRE","group_attack_id":"G0089","created":"2019-05-02T00:08:18.314000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"764328b0-a9d5-5fe7-b92f-8522bb3d2601","country":[],"observed_motivation":[],"observed_country":[{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"0f86e871-0c6c-4227-ae28-3f3696d6ae9d","name":"Threat Group-1314","source":"MITRE","group_attack_id":"G0028","created":"2017-05-31T21:31:59.120000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"26026309-49f5-59f1-b5bb-db317c67310d","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"68535ecf-5a76-42b1-8a2e-e3366b01b95c","name":"TG-1314","description":"<sup>[[Dell TG-1314](https://app.tidalcyber.com/references/79fc7568-b6ff-460b-9200-56d7909ed157)]</sup>","source":"MITRE","associated_group_id":"a3bf437b-2805-424a-8122-b1f07f68c3c2","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"79be2f31-5626-425e-844c-fd9c99e38fe5","name":"Threat Group-3390","source":"MITRE","group_attack_id":"G0027","created":"2017-05-31T21:31:58.518000Z","modified":"2022-04-11T18:05:20.983000Z","tidal_id":"9af70923-eb12-5a88-9b0a-6b361c44a051","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"4dd1a6d5-8f50-47ba-9e1d-1ae3f341fe3b","name":"Emissary Panda","description":"<sup>[[Gallagher 2015](https://app.tidalcyber.com/references/b1540c5c-0bbc-4b9d-9185-fae224ba31be)]</sup><sup>[[Nccgroup Emissary Panda May 2018](https://app.tidalcyber.com/references/e279c308-fabc-47d3-bdeb-296266c80988)]</sup><sup>[[Securelist LuckyMouse June 2018](https://app.tidalcyber.com/references/f974708b-598c-46a9-aac9-c5fbdd116c2a)]</sup><sup>[[Hacker News LuckyMouse June 2018](https://app.tidalcyber.com/references/de78446a-cb46-4422-820b-9ddf07557b1a)]</sup><sup>[[Unit42 Emissary Panda May 2019](https://app.tidalcyber.com/references/3a3ec86c-88da-40ab-8e5f-a7d5102c026b)]</sup><sup>[[Trend Micro Iron Tiger April 2021](https://app.tidalcyber.com/references/d0890d4f-e7ca-4280-a54e-d147f6dd72aa)]</sup>","source":"MITRE","associated_group_id":"6892414f-3428-4ff4-bb27-cefb2c7177e4","owner_id":null,"owner_name":null},{"id":"0f5e1d81-0631-4c8d-9021-7d60fd899ba8","name":"APT27","description":"<sup>[[Nccgroup Emissary Panda May 2018](https://app.tidalcyber.com/references/e279c308-fabc-47d3-bdeb-296266c80988)]</sup><sup>[[Securelist LuckyMouse June 2018](https://app.tidalcyber.com/references/f974708b-598c-46a9-aac9-c5fbdd116c2a)]</sup><sup>[[Hacker News LuckyMouse June 2018](https://app.tidalcyber.com/references/de78446a-cb46-4422-820b-9ddf07557b1a)]</sup><sup>[[Trend Micro Iron Tiger April 2021](https://app.tidalcyber.com/references/d0890d4f-e7ca-4280-a54e-d147f6dd72aa)]</sup>","source":"MITRE","associated_group_id":"bc77908c-dcb0-4d07-933d-a1dded911306","owner_id":null,"owner_name":null},{"id":"2bdc8ad0-5eb2-4ec8-8a58-16234a044647","name":"TG-3390","description":"<sup>[[Dell TG-3390](https://app.tidalcyber.com/references/dfd2d832-a6c5-40e7-a554-5a92f05bebae)]</sup><sup>[[Nccgroup Emissary Panda May 2018](https://app.tidalcyber.com/references/e279c308-fabc-47d3-bdeb-296266c80988)]</sup><sup>[[Hacker News LuckyMouse June 2018](https://app.tidalcyber.com/references/de78446a-cb46-4422-820b-9ddf07557b1a)]</sup>","source":"MITRE","associated_group_id":"851cfd6f-8ca5-4048-b5a0-c23729456f12","owner_id":null,"owner_name":null},{"id":"1c394f39-84e0-45b8-a34b-22cf69cf709d","name":"BRONZE UNION","description":"<sup>[[SecureWorks BRONZE UNION June 2017](https://app.tidalcyber.com/references/42adda47-f5d6-4d34-9b3d-3748a782f886)]</sup><sup>[[Nccgroup Emissary Panda May 2018](https://app.tidalcyber.com/references/e279c308-fabc-47d3-bdeb-296266c80988)]</sup>","source":"MITRE","associated_group_id":"621b8362-b819-40af-8534-80efd9af3fd1","owner_id":null,"owner_name":null},{"id":"b5108b13-a574-4d92-9915-f32f87893fdb","name":"Linen Typhoon","description":"<sup>[[Microsoft Naming Conventions Frequently Updated](https://app.tidalcyber.com/references/b079fff9-472d-57bf-b23b-8a9971f5c974)]</sup>","source":"MITRE","associated_group_id":"47b46a8a-bc63-4afe-b570-511dd5e5b633","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"161f4194-5138-47c2-9666-d55b5287dc21","name":"Earth Smilodon","description":"<sup>[[Trend Micro Iron Tiger April 2021](https://app.tidalcyber.com/references/d0890d4f-e7ca-4280-a54e-d147f6dd72aa)]</sup>","source":"MITRE","associated_group_id":"acc5d023-b5f9-40c0-9061-8424c14334a4","owner_id":null,"owner_name":null},{"id":"cb736b8f-7388-4a0e-940d-5ed4a3c627d1","name":"IODINE","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"c0e6f89e-eef3-4899-90e0-b666f70156f7","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"a2d56108-62ed-4750-abb0-40611f782adf","name":"Red Phoenix","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"79378820-2d3c-49d1-ab76-36b7624038c9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"240fc8c9-7bac-49da-b7ee-8d8bcd7835b3","name":"Hippo","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"4bf495a1-37fd-47cb-a9cf-6f7d733efd1f","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"19e08179-749f-486a-ac42-e7fe9ab55639","name":"BOWSER","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"3a280ba6-0c31-4758-95ed-5ab60103f7e2","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e81e57ee-6672-4fe9-8602-10e64a60afdd","name":"Wekby2","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"f55b62e7-8a23-41e6-a2eb-3a9a552396c8","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"75bc1248-ffe9-46aa-82e4-44a4e3bd18b5","name":"UNC215","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"dbbf008b-e825-4283-9a15-5501cb9e0b39","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"af363795-4a49-4c3f-a693-aeb4092dcb87","name":"Iron Tiger","description":"<sup>[[Hacker News LuckyMouse June 2018](https://app.tidalcyber.com/references/de78446a-cb46-4422-820b-9ddf07557b1a)]</sup><sup>[[Trend Micro Iron Tiger April 2021](https://app.tidalcyber.com/references/d0890d4f-e7ca-4280-a54e-d147f6dd72aa)]</sup>","source":"MITRE","associated_group_id":"0aec785f-db69-49f4-ad4f-68fe226a5399","owner_id":null,"owner_name":null},{"id":"c07fdac7-3f1a-4321-9caf-2e117eefa720","name":"LuckyMouse","description":"<sup>[[Securelist LuckyMouse June 2018](https://app.tidalcyber.com/references/f974708b-598c-46a9-aac9-c5fbdd116c2a)]</sup><sup>[[Hacker News LuckyMouse June 2018](https://app.tidalcyber.com/references/de78446a-cb46-4422-820b-9ddf07557b1a)]</sup><sup>[[Trend Micro Iron Tiger April 2021](https://app.tidalcyber.com/references/d0890d4f-e7ca-4280-a54e-d147f6dd72aa)]</sup>","source":"MITRE","associated_group_id":"869b23ab-c9a6-4fa3-abc8-2982707e68d7","owner_id":null,"owner_name":null}],"tags":[{"id":"efe41e7c-acc0-4cc4-9a7e-61ff12666130","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"45e9a6f2-ed47-4816-8286-37f165ae0934","tag":"8490bce5-3ac4-4285-8ec5-bd79a4670492"},{"id":"e1ee1afe-74fb-4186-b32d-292a491a38df","tag":"c8ee7c0d-8a65-4c86-b0fa-8d5430788cff"},{"id":"36e6b901-293e-4c8f-a611-d35d6829207c","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"d897d9f9-63ef-4b58-a137-aa16c77120fa","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"}],"owner_name":null},{"id":"a3b39b07-0bfa-4c69-9f01-acf7dc6033b4","name":"Thrip","source":"MITRE","group_attack_id":"G0076","created":"2018-10-17T00:14:20.652000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"dcacebe7-e5f9-54d5-aca9-13170dae22fe","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"0f41da7d-1e47-58fe-ba6e-ee658a985e1b","name":"ToddyCat","source":"MITRE","group_attack_id":"G1022","created":"2024-04-25T13:28:24.558293Z","modified":"2024-04-25T13:28:24.558296Z","tidal_id":"4190b279-0eed-54fd-93ab-f82b9ed8d456","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"0f30ed15-1b01-419e-8b7e-9f9dee0996d8","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"c0d301ce-c96c-4d33-8e11-758b61449d94","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"}],"owner_name":null},{"id":"9f5c5672-5e7e-4440-afc8-3fdf46a1bb6c","name":"Tonto Team","source":"MITRE","group_attack_id":"G0131","created":"2021-05-05T17:18:25.987000Z","modified":"2022-05-11T14:00:00.188000Z","tidal_id":"95d72568-24b5-5c7e-b80d-c4fd732d97cd","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[],"observed_country":[{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"d748b970-fab9-4ae3-919b-2188e7f0ad95","name":"CactusPete","description":"<sup>[[Kaspersky CactusPete Aug 2020](https://app.tidalcyber.com/references/1c393964-e717-45ad-8eb6-5df5555d3c70)]</sup>","source":"MITRE","associated_group_id":"70c9c7d6-d51a-4c73-823f-fffd0d75f63e","owner_id":null,"owner_name":null},{"id":"910288bd-71dd-4635-b559-ccb2d7879ab6","name":"Earth Akhlut","description":"<sup>[[TrendMicro Tonto Team October 2020](https://app.tidalcyber.com/references/140e6b01-6b98-4f82-9455-0c84b3856b86)]</sup>","source":"MITRE","associated_group_id":"9f9382c1-edc9-434c-945a-71bfdf28ca6f","owner_id":null,"owner_name":null},{"id":"b81e735d-40ea-4fc8-a84a-7cf717346155","name":"BRONZE HUNTLEY","description":"<sup>[[Secureworks BRONZE HUNTLEY ](https://app.tidalcyber.com/references/9558ebc5-4de3-4b1d-b32c-a170adbc3451)]</sup>","source":"MITRE","associated_group_id":"aee5a88d-6695-4221-a4fb-1f7aa1bfdcd4","owner_id":null,"owner_name":null},{"id":"9ac5e0d4-9387-4111-9b05-15613722fdcc","name":"Karma Panda","description":"<sup>[[Kaspersky CactusPete Aug 2020](https://app.tidalcyber.com/references/1c393964-e717-45ad-8eb6-5df5555d3c70)]</sup><sup>[[CrowdStrike Manufacturing Threat July 2020](https://app.tidalcyber.com/references/5ed6a702-dcc5-4021-95cc-5b720dbd8774)]</sup>","source":"MITRE","associated_group_id":"7e6588d8-8d1e-4ed0-a233-38f3b37c2aad","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"441b91d1-256a-4763-bac6-8f1c76764a25","name":"Transparent Tribe","source":"MITRE","group_attack_id":"G0134","created":"2021-09-02T15:14:33.738000Z","modified":"2022-09-22T20:27:21.053000Z","tidal_id":"6e536811-5665-5852-87dd-c7a7c0d57656","country":[{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"b575240d-6cf0-4ce3-a803-2021bcf10fc1","name":"Botswana","country_name":"Botswana","country_code":"BW"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"14565856-173b-4ac1-b333-4dafe50c2d52","name":"Kenya","country_name":"Kenya","country_code":"KE"},{"id":"afe0c542-fd5c-48d5-bbf4-f505dff7169b","name":"Liechtenstein","country_name":"Liechtenstein","country_code":"LI"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"252115d5-b120-4db5-846d-829ac4ebfc54","name":"Oman","country_name":"Oman","country_code":"OM"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"e41ed1f8-7e23-46d3-ae3b-aed9d2caffda","name":"Mythic Leopard","description":"<sup>[[Crowdstrike Mythic Leopard Profile](https://app.tidalcyber.com/references/efa5dc67-3364-4049-bb13-8b9e1b55f172)]</sup><sup>[[Kaspersky Transparent Tribe August 2020](https://app.tidalcyber.com/references/42c7faa2-f664-4e4a-9d23-93c88a09da5b)]</sup><sup>[[Talos Transparent Tribe May 2021](https://app.tidalcyber.com/references/5d58c285-bc7d-4a8a-a96a-ac7118c1089d)]</sup>","source":"MITRE","associated_group_id":"150aeea7-b49e-49cf-a884-f9e0f69a6742","owner_id":null,"owner_name":null},{"id":"eec8f5d0-a7df-4ace-b82b-1108d5f09fd5","name":"ProjectM","description":"<sup>[[Unit 42 ProjectM March 2016](https://app.tidalcyber.com/references/adee82e6-a74a-4a91-ab5a-97847b135ca3)]</sup><sup>[[Kaspersky Transparent Tribe August 2020](https://app.tidalcyber.com/references/42c7faa2-f664-4e4a-9d23-93c88a09da5b)]</sup>","source":"MITRE","associated_group_id":"6d979811-8a41-4407-be4b-b657a3bd3d20","owner_id":null,"owner_name":null},{"id":"7411aa5c-b1f3-413c-82bf-c397996b6106","name":"COPPER FIELDSTONE","description":"<sup>[[Secureworks COPPER FIELDSTONE Profile](https://app.tidalcyber.com/references/d7f5f154-3638-47c1-8e1e-a30a6504a735)]</sup>","source":"MITRE","associated_group_id":"4db20d24-3005-4fbb-af6e-94bb3841c25b","owner_id":null,"owner_name":null},{"id":"5cfb7f3b-93bf-4430-938b-1d0b5efb721b","name":"APT36","description":"<sup>[[Talos Transparent Tribe May 2021](https://app.tidalcyber.com/references/5d58c285-bc7d-4a8a-a96a-ac7118c1089d)]</sup>","source":"MITRE","associated_group_id":"da9e7789-2d64-4684-87b9-8185f11b7410","owner_id":null,"owner_name":null}],"tags":[{"id":"a93b1a30-461f-48fb-837a-6a09f5cc8ee5","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"c6905f84-f4e0-4d86-b1a0-7f2d4ab95424","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"}],"owner_name":null},{"id":"0a245c5e-c1a8-480f-8655-bb2594e3266b","name":"Tropic Trooper","source":"MITRE","group_attack_id":"G0081","created":"2019-01-29T20:17:48.717000Z","modified":"2021-04-26T14:15:15.610000Z","tidal_id":"76ff90de-e450-5ac2-930b-627a1c647fcc","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"1fae48a9-1f79-4895-8bcc-e1cdc2b986d4","name":"Pirate Panda","description":"<sup>[[Crowdstrike Pirate Panda April 2020](https://app.tidalcyber.com/references/f71410b4-5f79-439a-ae9e-8965f9bc577f)]</sup>","source":"MITRE","associated_group_id":"7157a2fe-6e59-40ae-a7de-4961444f9c56","owner_id":null,"owner_name":null},{"id":"afd6e8f7-62f4-46cd-a366-8bd35da48511","name":"KeyBoy","description":"<sup>[[Unit 42 Tropic Trooper Nov 2016](https://app.tidalcyber.com/references/cad84e3d-9506-44f8-bdd9-d090e6ce9b06)]</sup><sup>[[TrendMicro Tropic Trooper Mar 2018](https://app.tidalcyber.com/references/5d69d122-13bc-45c4-95ab-68283a21b699)]</sup>","source":"MITRE","associated_group_id":"72ad17b4-d973-48c4-aae9-5a95aaf2ee88","owner_id":null,"owner_name":null},{"id":"2a1ce659-ead8-4d1d-9720-14864747f238","name":"Earth Centaur","description":"<sup>[[TrendMicro Tropic Trooper December 14 2021](/references/0d4aea26-56ac-48cf-9b5a-d878bf30c503)]</sup>","source":"Tidal Cyber","associated_group_id":"6528b1e5-b220-4a5b-96a1-391ac7b33502","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"fd02011a-dae6-4fa0-bc67-1d995d1ae3b5","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"}],"owner_name":null},{"id":"47ae4fb1-fc61-4e8e-9310-66dda706e1a2","name":"Turla","source":"MITRE","group_attack_id":"G0010","created":"2017-05-31T21:31:49.816000Z","modified":"2022-09-28T21:27:07.133000Z","tidal_id":"06bc225d-f386-52a6-9c7c-1772b286a33b","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"5cfbf5c3-aa5c-4de0-84e9-52e961c65d95","name":"Algeria","country_name":"Algeria","country_code":"DZ"},{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"b23d13af-1445-4219-a1b9-a559d1873102","name":"Armenia","country_name":"Armenia","country_code":"AM"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"a76b6f01-5417-4121-9041-12460d7633db","name":"Azerbaijan","country_name":"Azerbaijan","country_code":"AZ"},{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"21002808-4882-4bcf-9cf2-aa2d5a8e4abe","name":"Bolivia, Plurinational State of","country_name":"Bolivia","country_code":"BO"},{"id":"b575240d-6cf0-4ce3-a803-2021bcf10fc1","name":"Botswana","country_name":"Botswana","country_code":"BW"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"15b5743c-82cb-4254-a646-20a1f4f00046","name":"Bulgaria","country_name":"Bulgaria","country_code":"BG"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7ffb715f-01a7-49b4-a641-66f13647cef5","name":"Cyprus","country_name":"Cyprus","country_code":"CY"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"41e53391-e431-4181-9a4d-7a3995964845","name":"Denmark","country_name":"Denmark","country_code":"DK"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"502bfac5-4240-421a-820b-4cb62e15f934","name":"Estonia","country_name":"Estonia","country_code":"EE"},{"id":"6195ab08-5020-439d-a89f-783a35013ceb","name":"Finland","country_name":"Finland","country_code":"FI"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"0b53c8eb-72b4-4453-b7e0-915892a0f000","name":"Georgia","country_name":"Georgia","country_code":"GE"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"18daa87e-f001-4d14-885a-500ea223c4f5","name":"Iran, Islamic Republic of","country_name":"Iran","country_code":"IR"},{"id":"8e5e57db-d89e-4b82-9ed6-ce1e58814732","name":"Iraq","country_name":"Iraq","country_code":"IQ"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"43a5a379-e1ee-4ec4-ae63-7d556e25f120","name":"Jamaica","country_name":"Jamaica","country_code":"JM"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"93f6c919-efc5-4ff5-aed0-5d91cf5b70bc","name":"Kazakhstan","country_name":"Kazakhstan","country_code":"KZ"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"f0106493-e44f-43d5-b12b-0971842d81de","name":"Kyrgyzstan","country_name":"Kyrgyzstan","country_code":"KG"},{"id":"8c04cdb9-d766-412c-b041-782c879f51c6","name":"Latvia","country_name":"Latvia","country_code":"LV"},{"id":"07689613-cb8b-464a-9bb4-339cc28aea03","name":"Lithuania","country_name":"Lithuania","country_code":"LT"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"57795c9b-f344-44fb-99fa-85379126bb0b","name":"Moldova, Republic of","country_name":"Moldova","country_code":"MD"},{"id":"b3b49312-69e9-426b-b18e-268bbf39f129","name":"Montenegro","country_name":"Montenegro","country_code":"ME"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"a34d87a1-df7e-4f68-9e1c-73ca623d7ef5","name":"Paraguay","country_name":"Paraguay","country_code":"PY"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"2178746f-d741-4e5c-9335-719765f087ed","name":"Qatar","country_name":"Qatar","country_code":"QA"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"da9f06f0-a7bf-4951-9127-e192ab66b5c3","name":"Serbia","country_name":"Serbia","country_code":"RS"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"2a528093-177d-468f-a83b-e270ca22f0ab","name":"Syrian Arab Republic","country_name":"Syrian Arab Republic","country_code":"SY"},{"id":"74026dba-423a-49c5-afea-4f18bc021a6a","name":"Tajikistan","country_name":"Tajikistan","country_code":"TJ"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"53e1210a-b379-4569-aba4-9e7f6916f24e","name":"Tunisia","country_name":"Tunisia","country_code":"TN"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"13c28e85-cde0-4db5-9008-2ad8afcffcfb","name":"Turkmenistan","country_name":"Turkmenistan","country_code":"TM"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"77fb02d9-8844-4e95-9c18-99375c9de3c1","name":"Uruguay","country_name":"Uruguay","country_code":"UY"},{"id":"6736f423-4fed-4c51-aa41-a873daae3d1d","name":"Uzbekistan","country_name":"Uzbekistan","country_code":"UZ"},{"id":"f898a1eb-e176-4b25-9bab-94d5098dfad7","name":"Venezuela, Bolivarian Republic of","country_name":"Venezuela","country_code":"VE"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"},{"id":"856c10c6-a475-4bbf-8f1d-1e06ccff8f2e","name":"Yemen","country_name":"Yemen","country_code":"YE"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"3633bd53-4478-48b2-aadf-5b959bdd8de0","name":"Group 88","description":"<sup>[[Leonardo Turla Penquin May 2020](https://app.tidalcyber.com/references/09d8bb54-6fa5-4842-98aa-6e9656a19092)]</sup>","source":"MITRE","associated_group_id":"3cf95a2f-a7b8-4061-b477-16729657f8f3","owner_id":null,"owner_name":null},{"id":"42650149-9fc9-40ab-9780-792825fd8b99","name":"Venomous Bear","description":"<sup>[[CrowdStrike VENOMOUS BEAR](https://app.tidalcyber.com/references/ee400057-2b26-4464-96b4-484c9eb9d5c2)]</sup><sup>[[Talos TinyTurla September 2021](https://app.tidalcyber.com/references/94cdbd73-a31a-4ec3-aa36-de3ea077c1c7)]</sup>","source":"MITRE","associated_group_id":"3637113f-d45f-4c97-aec0-16eaa7e3fc62","owner_id":null,"owner_name":null},{"id":"f6a74f26-fcd8-4128-9b76-6fbda75ff6a9","name":"Snake","description":"<sup>[[CrowdStrike VENOMOUS BEAR](https://app.tidalcyber.com/references/ee400057-2b26-4464-96b4-484c9eb9d5c2)]</sup><sup>[[ESET Turla PowerShell May 2019](https://app.tidalcyber.com/references/68c0f34b-691a-4847-8d49-f18b7f4e5188)]</sup><sup>[[Talos TinyTurla September 2021](https://app.tidalcyber.com/references/94cdbd73-a31a-4ec3-aa36-de3ea077c1c7)]</sup>","source":"MITRE","associated_group_id":"e934559a-b3c1-4e72-a5c9-e1abd7b2ae78","owner_id":null,"owner_name":null},{"id":"201c6a8b-499b-4dc7-a4c4-c23a7355d502","name":"WhiteBear","description":"WhiteBear is a designation used by Securelist to describe a cluster of activity that has overlaps with activity described by others as Turla, but appears to have a separate focus.<sup>[[Securelist WhiteBear Aug 2017](https://app.tidalcyber.com/references/44626060-3d9b-480e-b4ea-7dac27878e5e)]</sup><sup>[[Talos TinyTurla September 2021](https://app.tidalcyber.com/references/94cdbd73-a31a-4ec3-aa36-de3ea077c1c7)]</sup>","source":"MITRE","associated_group_id":"9cea8cef-dd46-4997-baba-d2dea899e193","owner_id":null,"owner_name":null},{"id":"fc87b05b-4404-410c-b27d-7d9b077245f1","name":"Waterbug","description":"Based similarity in TTPs and malware used, Turla and Waterbug appear to be the same group.<sup>[[Symantec Waterbug](https://app.tidalcyber.com/references/ec02f951-17b8-44cb-945a-e5c313555124)]</sup>","source":"MITRE","associated_group_id":"58827a83-6a90-4cee-8b9a-7c033bf90dee","owner_id":null,"owner_name":null},{"id":"462301bf-d936-436a-95f8-4b7c7b972428","name":"IRON HUNTER","description":"<sup>[[Secureworks IRON HUNTER Profile](https://app.tidalcyber.com/references/af5cb7da-61e0-49dc-8132-c019ce5ea6d3)]</sup>","source":"MITRE","associated_group_id":"1bf28831-a2fd-4dc5-885c-9cdf84d43535","owner_id":null,"owner_name":null},{"id":"72100212-b904-45e8-932e-3fc5ab1040df","name":"Krypton","description":"<sup>[[CrowdStrike VENOMOUS BEAR](https://app.tidalcyber.com/references/ee400057-2b26-4464-96b4-484c9eb9d5c2)]</sup>","source":"MITRE","associated_group_id":"7a2f17eb-6674-461d-89c4-6f40e1b6cdf5","owner_id":null,"owner_name":null},{"id":"7705dbc2-da22-5789-8dab-937384a5d79e","name":"Secret Blizzard","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"af18e34f-67e9-501e-942b-112fb5bd65cc","owner_id":null,"owner_name":null},{"id":"8d39f808-a561-58a9-8ee0-3b2c67fcd089","name":"BELUGASTURGEON","description":"<sup>[[Accenture HyperStack October 2020](https://app.tidalcyber.com/references/680f2a0b-f69d-48bd-93ed-20ee2f79e3f7)]</sup>","source":"MITRE","associated_group_id":"26cc8fd3-9985-5ad1-aa2c-c344dc75b44e","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"9d665cc1-8ecc-4064-8221-c74bd6ffd97a","name":"UAC-0098","source":"Tidal Cyber","group_attack_id":"G3077","created":"2025-02-18T15:18:14.372730Z","modified":"2025-02-18T15:18:14.372733Z","tidal_id":"946e95e2-fb0a-5bc4-afe3-4477a69946ba","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"}],"associated_groups":[],"tags":[{"id":"4812c419-af63-4f01-9035-4c555c3fabc9","tag":"4cd85398-c33a-4374-9a76-2bbf297cca63"},{"id":"c8574cbf-6e6f-4040-9d07-d11ec3234ad1","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a55cb209-3386-4211-93cb-ea07fae1eb0e","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"facdd29f-0455-4822-8f84-d5ac44c66d32","name":"UAC-0218","source":"Tidal Cyber","group_attack_id":"G3141","created":"2025-10-17T17:09:27.426459Z","modified":"2025-10-17T17:09:27.426462Z","tidal_id":"501c6e41-cb36-56ab-a211-56b5617eda71","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"50f23d82-2732-4c1b-b3dc-5bb06b7d4a37","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"b0704f73-8b2d-4a82-b7a1-58800c34c9aa","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"01a5e829-e94d-49f5-881e-35c879b2bbff","name":"UAC-0219","source":"Tidal Cyber","group_attack_id":"G3142","created":"2025-10-17T17:09:27.635840Z","modified":"2025-10-17T17:09:27.635842Z","tidal_id":"4901d5bc-c974-558b-b638-103e182a09ea","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"1f4e283a-634d-42ee-babb-acef1aa49342","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"36364776-4481-45e4-9ef6-a48a5d5f746d","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"2ead99a9-31b6-4972-8642-11159e5516e1","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"409d46c4-0e9d-4e6f-9561-6741d7a0f864","name":"UAC-0226","source":"Tidal Cyber","group_attack_id":"G3143","created":"2025-10-17T17:09:27.829720Z","modified":"2025-10-17T17:09:27.829722Z","tidal_id":"11110f8b-b2da-5ce9-b864-349a0df96a22","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"}],"associated_groups":[],"tags":[{"id":"48450bbb-804f-4f08-b5cd-6067accf3691","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"1375d58d-1341-4862-a598-4046742c8b44","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"492b7bbd-8324-4cae-9dce-f85bf2d1638a","name":"UAC-0227","source":"Tidal Cyber","group_attack_id":"G3144","created":"2025-10-17T17:09:28.058851Z","modified":"2025-10-17T17:09:28.058854Z","tidal_id":"ccf8b034-16c8-568d-b569-ae482726c7ab","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"}],"associated_groups":[],"tags":[{"id":"b26c1df8-dc54-4be3-b3ac-e610a13c0613","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a0123a41-6f57-4551-aa54-eee67f1d5a00","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"fa40b235-5e76-4cc7-894c-92c5c81fc623","name":"UAC-0245","source":"Tidal Cyber","group_attack_id":"G3137","created":"2025-10-13T17:29:00.202980Z","modified":"2025-10-13T17:29:00.202984Z","tidal_id":"3e7e4802-296a-55b6-8b6f-9ac58e09d7f1","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"99610dfc-f7a0-4788-bc60-bc58030e03ed","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f6f8ee3b-20d7-495b-9553-60911d7ec16a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f69c7e2f-b616-4782-b2f3-28e9b6702eb4","name":"UAT4356","source":"Tidal Cyber","group_attack_id":"G3036","created":"2024-05-07T16:51:46.016042Z","modified":"2024-05-07T16:51:46.016049Z","tidal_id":"85987975-49cc-5287-aee8-d419215ae8ed","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"0efb34ec-40bc-4bc2-9467-7e5dbe02d318","name":"Storm-1849","description":"<sup>[[Cisco Talos ArcaneDoor April 24 2024](/references/531c3f6f-2d2b-4774-b069-e2b7a13602c1)]</sup>","source":"Tidal Cyber","associated_group_id":"f2dd71c4-9409-4063-852f-8450fef10146","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"070536cc-1a50-4dea-bc2a-82bef40787e9","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"64cdd64a-2b00-4889-bc2c-c5131f62a3b7","tag":"6bb2f579-a5cd-4647-9dcd-eff05efe3679"},{"id":"5b422001-0fb6-41bf-be58-a5a70ad44501","tag":"c25f341a-7030-4688-a00b-6d637298e52e"},{"id":"d0f01ed2-9905-4662-8b64-ea6a53df303e","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"}],"owner_name":"TidalCyberIan"},{"id":"6df06da1-6f73-45a9-afb7-9087cd24cbff","name":"UAT-7290","source":"Tidal Cyber","group_attack_id":"G3203","created":"2026-01-14T13:30:29.786779Z","modified":"2026-01-14T13:30:29.786785Z","tidal_id":"dd55c24b-3a62-5350-8ddb-d353f6b6d9c3","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"3c46dd92-6f7b-45dd-92e9-cc3c083713e9","name":"Bangladesh","country_name":"Bangladesh","country_code":"BD"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"}],"observed_sector":[{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"fa69fd4b-b34e-4384-8ad9-7830e5becfcf","name":"Red Foxtrot","description":"<sup>[[Cisco Talos Blog January 08 2026](/references/74959041-08ca-41fc-8ceb-675f1fefd765)]</sup>","source":"USER","associated_group_id":"3ff20e4f-b61f-4f1c-aa30-15c60f41d45b","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"5db9b29c-2840-45a2-8003-2da870e56139","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"f8c704ce-433e-46d8-b5f7-5b849aa722cc","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"5c7d2a5d-5d40-402c-9043-97d218b1e9c1","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"c7ed4e75-24b9-41f6-90f8-0fd3d08b9c57","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"c7b07e2a-8c2d-4a86-a83a-e820e4aaeb92","name":"UAT-8099","source":"Tidal Cyber","group_attack_id":"G3138","created":"2025-10-13T17:29:00.372797Z","modified":"2025-10-13T17:29:00.372800Z","tidal_id":"c3de5581-41ca-556c-8394-4481d08d0769","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"1f93dee5-9657-42fe-90df-c553f2b3b589","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"5de128e6-18a3-4738-8a19-7fa001233b54","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"07beb42b-2609-4b33-9957-6e9511268431","name":"UAT-9686","source":"Tidal Cyber","group_attack_id":"G3182","created":"2025-12-24T14:56:39.872116Z","modified":"2025-12-24T14:56:39.872120Z","tidal_id":"210e9a21-bcbf-5b98-a7a3-11cfb78002cd","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"f05c0f6a-1c46-488d-aa99-fbabecc263e9","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"b5f329f9-e060-484e-bb22-a048226f8e62","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"667ece2f-8439-4891-8815-7342e98b97d0","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"8adc41b2-e496-4e2c-ba1f-6420e7359669","name":"Unattributed Chinese-speaking ESXi Exploit Developer","source":"Tidal Cyber","group_attack_id":"G3200","created":"2026-01-14T13:30:29.215025Z","modified":"2026-01-14T13:30:29.215035Z","tidal_id":"13dc1d25-93ca-5590-bfae-fc02cf1ad517","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"c6db3ab7-bbaa-442b-b847-9ed1990f5498","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"cbde73cd-9ab0-4147-b56f-538364553451","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d461fe1f-c1a8-4de0-95da-04b80e0c6d33","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"0c0670ec-f052-44ad-a1bd-5d6d61d0fca8","name":"UNC3784","source":"Tidal Cyber","group_attack_id":"G3002","created":"2025-01-28T15:53:47.568182Z","modified":"2025-01-28T15:53:47.568186Z","tidal_id":"7c071dcb-5f0c-5754-a9af-748089ebd2cc","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"c93af95e-e264-43d7-92a7-76d94da264f2","name":"Nepal","country_name":"Nepal","country_code":"NP"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"268bdeec-4fbf-4816-951b-48afd809bce8","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"2cfda8df-d622-475a-9133-a7f3dbfff906","tag":"4cd85398-c33a-4374-9a76-2bbf297cca63"}],"owner_name":"TidalCyberIan"},{"id":"037aba85-f1a1-53d0-9631-992a2295d198","name":"UNC3886","source":"MITRE","group_attack_id":"G1048","created":"2025-10-29T21:08:48.108206Z","modified":"2025-10-29T21:08:48.108207Z","tidal_id":"037aba85-f1a1-53d0-9631-992a2295d198","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"a953a93a-c6d3-4fa9-9230-477c6909526e","tag":"ee311380-b755-4da9-ba42-d0190edaa4d2"},{"id":"360b7de2-f24e-4eec-8504-3713dc0e3ac4","tag":"43c1ba1f-febe-4176-b1e0-b825919d3b00"},{"id":"f7aaa13b-63a2-4234-a90d-8c610a8000b2","tag":"1b5644d0-7abc-435b-817a-1fcb0b04e440"},{"id":"f75f4c6c-1b1e-4257-8489-c5864950857b","tag":"27330765-f30d-49dc-b41a-976bfd2235a0"},{"id":"1d5a4274-af65-485c-b31e-5e1a1f982fe5","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"9842259c-17b7-4076-a966-a0bf3c4f0744","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"a3ac7f5a-cc1e-4495-a4a8-32907bdd5943","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"}],"owner_name":null},{"id":"23af694a-11f4-43eb-a176-683059b301cb","name":"UNC3886","source":"Trellix TIG","group_attack_id":"G3010","created":"2025-04-11T15:06:31.765161Z","modified":"2025-04-11T15:06:31.765165Z","tidal_id":"2512582d-444c-5739-bfe9-44cd69e011d9","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[{"id":"6fd7dcea-cdb1-49dc-b982-02d855cb381d","tag":"ee311380-b755-4da9-ba42-d0190edaa4d2"},{"id":"3b74d07c-7e13-40d3-959c-6de372d50ee3","tag":"43c1ba1f-febe-4176-b1e0-b825919d3b00"},{"id":"dddf8282-d5b3-446a-b8d4-360d6f718a05","tag":"1b5644d0-7abc-435b-817a-1fcb0b04e440"},{"id":"88fb4fed-b11e-47ec-8fd0-cf598137f6f2","tag":"27330765-f30d-49dc-b41a-976bfd2235a0"},{"id":"a2530686-add2-42fc-bb07-b78a476324df","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"d45e2690-8a02-41eb-99c9-08f9659ebba6","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"a48b8319-f998-4446-a4ea-20ee049f1f7e","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"}],"owner_name":"TidalCyberIan"},{"id":"b07431f8-fcf0-4204-8e7c-138eb5cd5342","name":"UNC3966","source":"Tidal Cyber","group_attack_id":"G3027","created":"2024-06-13T20:11:41.976860Z","modified":"2024-06-13T20:11:41.976863Z","tidal_id":"55c5508c-b305-5e80-9f2d-227f8edce86d","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"835233a8-950f-4809-b3f8-6c62dcd86ace","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"42a30e82-ffa3-41d9-be67-a0c94f844fcc","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a5e30967-59b8-4700-ac82-3d626dc92bb1","name":"UNC4841","source":"Tidal Cyber","group_attack_id":"G3121","created":"2025-08-28T19:35:28.640656Z","modified":"2025-08-28T19:35:28.640659Z","tidal_id":"74d6edf9-417c-5724-8624-3e85cada2b04","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"4684465c-9860-40a6-bd7a-632b74f768c3","name":"Semi Conductors"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"5ddcf7e9-d7d8-4857-b703-ba29d542fa95","name":"Slime57","description":"<sup>[[BankInfoSecurity UNC4841 February 27 2025](/references/c3a04d5b-09dc-4f95-bfb6-1ea82dcaaa13)]</sup>","source":"Tidal Cyber","associated_group_id":"92322cc7-897e-456f-9da5-30262588defe","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"b11bea69-d001-4d62-9b41-056676c9063a","tag":"12b074b9-6748-4ad7-880f-836cb80587e1"},{"id":"cd4b61b3-5a40-4c93-9cd7-1442f02cd844","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"f4299797-0f0b-4f42-b323-78d026436d31","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"89441af4-665e-4229-aedb-f5f15863631c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"383b9bc6-cb25-4c4c-b4a4-60ce985d85b8","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"13ef6741-2b07-494f-98a9-35b9031ac020","name":"UNC5142","source":"Tidal Cyber","group_attack_id":"G3145","created":"2025-10-24T16:13:22.967229Z","modified":"2025-10-24T16:13:22.967233Z","tidal_id":"cbf11522-bbc0-5a7e-90e3-72d8a8b866ee","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"9bb2bb5d-c485-4c0d-86e7-46e1b0d52938","tag":"cce5f564-f7f0-4aa6-a908-b857cb2cbfe4"},{"id":"bc588973-714c-4f2d-b198-bee5bff12743","tag":"f2ae2283-f94d-4f8f-bbde-43f2bed66c55"},{"id":"822e06a8-074e-4934-802a-bd3d7c1c4703","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"0bf7defe-735c-44a2-9c2b-512b75a9dd9c","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3489998a-f742-43c6-bce6-95c00646b71c","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"21df749a-1e70-4c11-921c-071a61d9a900","name":"UNC5174","source":"Tidal Cyber","group_attack_id":"G3078","created":"2025-02-18T15:18:14.574851Z","modified":"2025-02-18T15:18:14.574855Z","tidal_id":"c1356911-b3da-5280-bde6-ecdedb241189","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"375e5854-7feb-4229-807d-81c3f1f86609","name":"CL-STA-1015","description":"<sup>[[BleepingComputer React2Shell December 07 2025](/references/4b67e021-f0d9-43c8-91aa-ae84c14e85db)]</sup>","source":"USER","associated_group_id":"6a0dcc2b-a118-4d1d-af8c-8929cf6d12ca","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3cd4e482-ed58-46f1-baf5-64225c645871","name":"uetus","description":"<sup>[[Google Cloud Blog March 21 2024](/references/efba67c7-a481-44de-84bd-cf74bc946f6e)]</sup>","source":"USER","associated_group_id":"170bdffe-9dcb-4a1d-98ee-cc8bc727ac4d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"b70e9b03-451f-4291-994b-6e2de68180a1","name":"Uteus","description":"","source":"Tidal Cyber","associated_group_id":"5964f766-22e9-4956-a5e6-f36a905d2fe4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"3e28d387-e776-4b2a-8df9-4d456950935d","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"f4239c89-2bd6-494e-80ed-0c6e2c852c02","tag":"efa33611-88a5-40ba-9bc4-3d85c6c8819b"},{"id":"d91629ff-68ff-417d-8454-0ff5aa57684d","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"3265d99b-ee82-4976-99f9-686b2da5aa72","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"984825ab-a962-4a4a-b049-e6ba936c3423","tag":"0094c0cb-29f2-4d61-a62a-fb3b3ef3d9a0"},{"id":"0b8575c3-9c72-4b78-bad3-dee41fee1781","tag":"07f09197-1847-411e-a451-d37211ead1b2"},{"id":"21ecca2f-22da-46e7-8296-1acf9618d5e9","tag":"d431939f-2dc0-410b-83f7-86c458125444"},{"id":"1324d5b4-c09a-4289-bd33-44a5cc6b41b4","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"e16d86c8-a143-44b3-8af8-2fe7131d5a4b","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"71e9b27e-8d68-4ed6-b3ab-14142558b9ff","name":"UNC5221","source":"Trellix TIG","group_attack_id":"G3007","created":"2025-04-11T15:06:31.199888Z","modified":"2025-04-11T15:06:31.199891Z","tidal_id":"a4e488ed-9191-5a18-a8c8-0977fa42ae5c","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"4f0b3a08-ede7-4cfc-818a-7f1ef3a5cddc","name":"WARP PANDA","description":"<sup>[[CrowdStrike.com December 04 2025](/references/24d4a6ac-2f5a-4155-bb14-7fb68a977fce)]</sup>","source":"USER","associated_group_id":"771afd2b-568b-40b4-8671-04d2ab6d0a74","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"d45de579-2721-4da5-b950-ea18a06695d9","name":"UTA0178","description":"","source":"Trellix TIG","associated_group_id":"80b49add-aaee-4711-97b5-f782fb31f7c6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"8cf72208-2825-4de2-bd60-0553b97dcf22","tag":"0094c0cb-29f2-4d61-a62a-fb3b3ef3d9a0"},{"id":"de36ab9c-21ef-4dd9-a52d-d045d6658b3a","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"cef53505-efc0-4ebc-9a6c-4f6fd172642a","tag":"1ff4614e-0ee6-4e04-921d-61abba7fcdb7"},{"id":"eb6d2027-307d-401d-a88f-27003c4f07a5","tag":"e00b65fc-8f56-4a9e-9f09-ccf3124a3272"},{"id":"919c84f2-bc5e-4a17-928e-80e94e269728","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"}],"owner_name":"TidalCyberIan"},{"id":"be7243cb-6031-4e2a-97d9-3522c002becd","name":"UNC5325","source":"Trellix TIG","group_attack_id":"G3005","created":"2025-04-11T15:06:30.777465Z","modified":"2025-04-11T15:06:30.777468Z","tidal_id":"3f4efbda-f4c0-5145-b859-941c49c0c1f0","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"71645bae-0dd1-4833-b34c-8c03e8a6e57b","tag":"d1ab6bd6-2688-4e54-a1d3-d180bb8fd41a"},{"id":"41b77209-6bf2-4f43-bbf7-9745b24b110c","tag":"9768aada-9d63-4d46-ab9f-d41b8c8e4010"}],"owner_name":"TidalCyberIan"},{"id":"809c288d-2dec-4c34-8ac1-f91d227ddfbd","name":"UNC5537","source":"Tidal Cyber","group_attack_id":"G3040","created":"2024-06-13T20:12:23.779603Z","modified":"2024-06-13T20:12:23.779606Z","tidal_id":"2a28452a-aa5f-5e5d-816e-b377d6d25258","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"25526482-0c19-49ed-bfa7-733635b398f0","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"3af89628-2db6-4e35-b091-a142bfd9357b","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"79bed1f8-fd97-476f-bc47-9d9e42635cd7","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"4ee3b97e-a8b1-4b04-b997-853fd3869f47","name":"UNC5820","source":"Tidal Cyber","group_attack_id":"G3063","created":"2024-10-25T19:44:20.921757Z","modified":"2024-10-25T19:44:20.921760Z","tidal_id":"b33c3ca6-c078-5619-87fa-5532c78bd0b6","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"1b99584a-b787-43af-a160-347eb09c9622","tag":"ef7715f8-526a-4df5-bad3-74b66170a52b"},{"id":"8b669b1a-0d1d-47f3-9ab7-e7f5cedf0996","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"91a65b25-a1a3-405a-b35f-a9d1a92e4f75","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a370c133-323a-42a1-8eb0-486049c6960a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"b80a92d8-756f-4a7d-9400-8cb5aa46a741","name":"UNC6040","source":"Tidal Cyber","group_attack_id":"G3107","created":"2025-06-10T15:50:37.245591Z","modified":"2025-06-10T15:50:37.245594Z","tidal_id":"62e467ff-4dc0-5499-8890-c55037c235e5","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"1cd8a30f-588c-441a-a389-77ae03ff10d7","tag":"e90b243c-99e2-46fe-8f04-eca9c7939250"},{"id":"c0f6dc28-c848-4b9c-92bf-84ddafd7129a","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"e22d3ae0-6a0b-43da-ae11-95915dea5417","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"23f93b0c-4b6f-4389-b1fa-0cdd2b11ebc5","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"1e20da4a-e12c-401b-b952-8432c7bb1c6b","name":"UNC6395","source":"Tidal Cyber","group_attack_id":"G3122","created":"2025-08-28T19:35:28.836091Z","modified":"2025-08-28T19:35:28.836094Z","tidal_id":"1ae2ff44-fdd0-59f5-aadc-7ebc132f5a5d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[],"tags":[{"id":"0f9d19ac-5058-4d24-a56b-0cb467aeb063","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"b354115a-5592-4af9-8ca4-93e70e371e45","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"6763bd4e-b5f3-4be8-a54c-b7054d6bdcae","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"4b4671bf-975e-4ca6-8ea3-2a2fccdf0f30","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"ad1251f6-9d49-46ae-ac8e-27cefd099b26","name":"UNC6485","source":"Tidal Cyber","group_attack_id":"G3147","created":"2025-11-19T17:45:10.382308Z","modified":"2025-11-19T17:45:10.382311Z","tidal_id":"7225b5a7-018d-59cb-879a-74b174fb12aa","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"8ad65e88-4cba-4463-be46-51efb619bcc2","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"0ebaff1e-f279-4d8a-a66d-8a4f2f5d49ab","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"a80c62db-7e04-44a8-8692-945aa22e09d6","name":"UNC6586","source":"Tidal Cyber","group_attack_id":"G3163","created":"2025-12-17T14:18:04.947112Z","modified":"2025-12-17T14:18:04.947116Z","tidal_id":"dad7b7eb-ca0f-577a-9328-6b086f2c4b1c","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"0266284a-5cd9-403a-adb9-a5beda09647d","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"08d4ee72-5ead-4e7f-b41c-e4e3f438ed2d","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"0ca3cd2f-9650-4b70-9a65-6a5b512554ca","name":"UNC6588","source":"Tidal Cyber","group_attack_id":"G3164","created":"2025-12-17T14:18:05.124188Z","modified":"2025-12-17T14:18:05.124190Z","tidal_id":"77eeea01-98c1-5c60-8aec-0072ba90f4a1","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"4a440605-59db-4f3b-ab6f-f056dd4c8e9b","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"03b44aa9-3751-4df6-a59d-64677f963aad","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5f8d373c-6992-4a2b-8a86-a16cbd45165a","name":"UNC6595","source":"Tidal Cyber","group_attack_id":"G3165","created":"2025-12-17T14:18:05.300548Z","modified":"2025-12-17T14:18:05.300551Z","tidal_id":"3df92245-270c-51b0-907b-0521c8bf0c16","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"0ea847a0-0c1c-460c-9a29-ba6538d6cb66","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"b0eca3e3-c918-41d3-8f27-6683924f4dc2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d92dff67-9704-4503-ad57-867bea3e6bfa","name":"UNC6600","source":"Tidal Cyber","group_attack_id":"G3166","created":"2025-12-17T14:18:05.463259Z","modified":"2025-12-17T14:18:05.463263Z","tidal_id":"2398467a-ed62-52a0-9d53-81d746e32909","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"4201780f-d376-4fe6-b752-6d20b70e0c8a","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"b5f2fe27-b525-437d-820d-18777f4e9484","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"28887ee1-3955-4012-9fd3-ef9c3e0ea47f","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"f9d74edd-4dde-4fce-90b9-59b4bcda0d3d","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"0e6985de-e4c1-494b-8901-9aa491202f6f","name":"UNC6603","source":"Tidal Cyber","group_attack_id":"G3167","created":"2025-12-17T14:18:05.637190Z","modified":"2025-12-17T14:18:05.637194Z","tidal_id":"870a934c-c402-50a6-90be-ce7b562443c9","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[],"associated_groups":[],"tags":[{"id":"b8f9c6b9-2ecb-46ec-8261-738983d32d3f","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"52f5974f-cfd0-4298-8bfa-ceed3182a0a4","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"1a303275-1cc7-41cc-832f-83b9cf93c01d","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d5ce615b-efdc-4e68-b93f-abff442f22f2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"51150c81-01de-50ed-a178-85ff0255c79f","name":"UNC788","source":"Mobile","group_attack_id":"G1029","created":"2026-01-28T13:08:09.923773Z","modified":"2026-01-28T13:08:09.923774Z","tidal_id":"51150c81-01de-50ed-a178-85ff0255c79f","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"e47b2958-b7c4-4fe1-a006-03137db91963","name":"UNC961","source":"Tidal Cyber","group_attack_id":"G3026","created":"2024-06-13T20:11:41.764115Z","modified":"2024-06-13T20:11:41.764118Z","tidal_id":"f8483559-9fa8-5b50-80e7-453ebf59d881","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[{"id":"9a321b82-1271-4662-bf61-1256a4ecfbe2","name":"Commercial"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"0d483838-ea42-4609-bbc7-3cec7c767fc7","name":"Prophet Spider","description":"<sup>[[Mandiant UNC961 March 23 2023](/references/cef19ceb-179f-4d49-acba-5ce40ab9f65e)]</sup>","source":"Tidal Cyber","associated_group_id":"4088f4fd-901a-4d3d-aab5-04d9e26680bd","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"e299149b-d7f0-4adf-a0a4-171a1300a909","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"8deadf99-dfc7-4ad7-ad62-af2e5404d5fd","tag":"7e6ef160-8e4f-4132-bdc4-9991f01c472e"},{"id":"ec273608-150d-42b8-940f-516b7b3248fb","tag":"b1944c88-95cf-41db-b11c-d9284e733bf2"},{"id":"e9464b32-6eba-4597-95d8-f778a191cadb","tag":"2eeef0b4-08b5-4d25-84f7-25d41fe6305b"},{"id":"970ca922-d2a1-43d7-935d-b56cd6b35371","tag":"f8b11afb-0876-4cd2-af74-9b305ff1b311"},{"id":"438bce4f-48ec-4bd3-8eee-52aca5545d06","tag":"51287d7b-2674-4842-a880-c192d886eac3"},{"id":"2bf254d4-c9f0-4371-9f8e-082b4723453f","tag":"ab64f2d8-8da3-48de-ac66-0fd91d634b22"},{"id":"e07cf170-ff68-4263-add7-a8d0bc03bacc","tag":"8e05f5f0-6e25-448d-b08f-4c7627124fbd"},{"id":"2f412e54-9e07-408b-b536-be7521d65aae","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d0d11d5a-30a6-4513-a4c9-cefc97b0caed","name":"UNK_AcademicFlare","source":"Tidal Cyber","group_attack_id":"G3185","created":"2025-12-29T17:40:15.246743Z","modified":"2025-12-29T17:40:15.246747Z","tidal_id":"87f9702d-9d05-5687-9ad5-8f30c6bfacf0","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"9fde8840-4920-4487-906a-003870ea08e0","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"35e5d571-2c30-4548-971e-aa133ac22588","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"d6635df9-147c-4b80-b707-3614a894f916","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"5cd2efb5-0f04-45c8-8072-e5841528e980","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"6aab63be-425e-474c-9fdd-3a8fab890c5e","name":"Unknown Sri Lanka Hacktivist Group","source":"Tidal Cyber","group_attack_id":"G3208","created":"2026-01-23T20:30:07.012716Z","modified":"2026-01-23T20:30:07.012721Z","tidal_id":"47876344-949d-55ac-892c-f2783ab4ef93","country":[],"observed_motivation":[{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"}],"associated_groups":[],"tags":[{"id":"3a808d9f-ea34-42e7-84e5-652f1cd98b17","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"6a94d165-c673-4b71-8a67-2d87bac47c1e","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"0063ed37-c4e2-4dd7-8f24-84fc0b6e3d33","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f9bf749f-dbd0-4e25-948e-0c9d27e6208c","name":"UTA0355","source":"Tidal Cyber","group_attack_id":"G3159","created":"2025-12-10T14:14:12.704174Z","modified":"2025-12-10T14:14:12.704176Z","tidal_id":"d3d1e886-67f5-5006-b24f-d07674c824d0","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"da9f06f0-a7bf-4951-9127-e192ab66b5c3","name":"Serbia","country_name":"Serbia","country_code":"RS"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"d0378da1-e051-436f-bdfd-dc3306516882","name":"Think Tanks"}],"associated_groups":[],"tags":[{"id":"a3f7932c-0a23-480d-a8f1-c0177cf818f4","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"a9035316-0fda-4bf3-970f-09d6d2fe589f","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"d8cec227-7735-49c2-acc8-91f6e49280b4","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"b39e78a8-7fd5-4c85-bb51-91b6e871a798","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"ff36ede1-9375-4b1a-83f3-38b12d1ec3f4","name":"ValleyRAT Operators","source":"Tidal Cyber","group_attack_id":"G3199","created":"2026-01-14T13:30:29.015021Z","modified":"2026-01-14T13:30:29.015025Z","tidal_id":"8548144d-a87f-5fb0-b9a4-1e1a1c19c557","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"840d6dbf-9d8c-480d-8688-03da019bc86f","name":"Hong Kong","country_name":"Hong Kong","country_code":"HK"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"}],"observed_sector":[],"associated_groups":[],"tags":[{"id":"3519041d-9195-46ed-8cd3-0ca08683d3c9","tag":"e7ea1f6d-59f2-40c1-bbfe-835dedf033ee"},{"id":"9de00477-5fb4-404e-baad-9e672611cde2","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"a4eca949-3e48-48e8-8763-0bf7cf601038","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"efd2fca2-45fb-4eaf-82e7-0d20c156f84f","name":"Vanilla Tempest","source":"Tidal Cyber","group_attack_id":"G3054","created":"2024-09-20T15:10:40.124739Z","modified":"2024-09-20T15:10:40.124743Z","tidal_id":"02e964a4-79dc-5443-8f10-6bf5d3dd63ab","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"520daef4-50cf-4924-962d-34f8adc54509","name":"DEV-0832","description":"<sup>[[MSTIC Vanilla Tempest September 18 2024](/references/24c11dff-21df-4ce9-b3df-2e0a886339ff)]</sup>","source":"Tidal Cyber","associated_group_id":"e3d3ad70-120e-4001-91bb-1ea048afeffb","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"ccb6b9f9-bf49-41ac-bee6-c526801165fb","name":"Vice Society","description":"<sup>[[MSTIC Vanilla Tempest September 18 2024](/references/24c11dff-21df-4ce9-b3df-2e0a886339ff)]</sup>","source":"Tidal Cyber","associated_group_id":"bad74f9b-e165-420e-bfad-aebc81250a52","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"493d1fa9-80d0-4e4e-b31d-aa0b9aef7ab6","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"bfadc716-304b-4a6e-ba44-c53ce5e28017","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"8002fadb-6923-4331-8566-376f07c0a2d2","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"078c49a9-f5f5-412d-9f1c-9e97cf29c3c7","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"3766e5ff-14a3-44c2-8971-92527ca1b674","name":"VAULT PANDA","source":"Tidal Cyber","group_attack_id":"G3085","created":"2025-03-04T15:55:07.915318Z","modified":"2025-03-04T15:55:07.915322Z","tidal_id":"57502bba-b644-52ac-8f6a-ab03c54cc39d","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"d0536469-2db2-40e9-9a0b-49b1b531e431","name":"Casinos Gambling"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[],"tags":[{"id":"02fcfbed-19a9-4cac-821b-33480e404155","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"121f41a5-5098-4cdb-a48d-844265b9155d","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f1c80880-e3ed-5223-90f5-840a3b89fe39","name":"Velvet Ant","source":"MITRE","group_attack_id":"G1047","created":"2025-04-22T20:47:04.651777Z","modified":"2025-04-22T20:47:04.651781Z","tidal_id":"f1c80880-e3ed-5223-90f5-840a3b89fe39","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"0a6f0483-318b-4dfe-bc21-6b3a58abc8d7","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"da4721e8-b5b2-4142-9947-a1e4606d3dc2","tag":"72bc70fa-3979-4d3b-a0e9-b9ebebcf2a38"},{"id":"d08ca55d-cdbb-4838-aadb-a88e472423fc","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"}],"owner_name":null},{"id":"9327f7c0-2187-4b98-9c33-8d89849be0bc","name":"Velvet Ant (Deprecated)","source":"Tidal Cyber","group_attack_id":"G3044","created":"2024-07-03T15:43:54.792839Z","modified":"2024-07-03T15:43:54.792844Z","tidal_id":"ba2e26d4-621c-5761-a2c5-b95361021f6c","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"170b0105-fa1e-4e7e-a656-76d9dd3e72f7","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"49fc9bcb-b556-4f26-9e27-ee4fe8b3836c","tag":"72bc70fa-3979-4d3b-a0e9-b9ebebcf2a38"},{"id":"cf37ac5a-4ff1-4106-ab29-543fca34d194","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"54d66d75-3676-4d62-b448-77ab3624cfcf","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"7a7f1a48-00b4-461f-99e3-a4f5aa3355d2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"2e2d3e75-1160-4ba5-80cc-8e7685fcfc44","name":"Vice Society","source":"Tidal Cyber","group_attack_id":"G3004","created":"2023-11-17T17:09:23.637688Z","modified":"2023-11-17T17:09:23.637692Z","tidal_id":"fec8182c-0bb6-5101-ba39-62e764887758","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"83ed4573-54ed-4a3f-80c8-9ac5acd7024c","name":"French Guiana","country_name":"French Guiana","country_code":"GF"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"07578934-334f-4a04-b0c0-7157b1257617","name":"Greece","country_name":"Greece","country_code":"GR"},{"id":"f64ca545-0216-4cd5-bd4e-928c6531c0df","name":"Greenland","country_name":"Greenland","country_code":"GL"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"75ea10ca-6359-41dc-a679-dd0027e13e2a","name":"Malaysia","country_name":"Malaysia","country_code":"MY"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"8d57d805-d525-4c56-b6d8-c6c72391ac71","name":"Portugal","country_name":"Portugal","country_code":"PT"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[],"tags":[{"id":"538279da-d0f4-46ca-a5f9-adbc930f4a67","tag":"4bc9ab8f-7f57-4b1a-8857-ffaa7e5cc930"},{"id":"8c407c27-c6e1-4676-aa63-c4898408d044","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"fa73be7e-37f8-4e12-83cd-8ca52d38ed84","tag":"a6ba64e1-4b4a-4bbd-a26d-ce35c22b2530"},{"id":"c7650a81-9e27-4ccc-b514-84797c8fbc54","tag":"adf0c8d2-f06f-49a5-a3f4-e6cf5f502b1c"},{"id":"8be1ef51-f117-47b1-87c6-c20c6dfdb759","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"3ffcbf7f-0bfa-4a9c-8ccd-3a971d86e960","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"42219d16-7ed7-4716-b88f-b29a456f0f8d","name":"Void Blizzard","source":"Tidal Cyber","group_attack_id":"G3104","created":"2025-06-03T14:14:28.102718Z","modified":"2025-06-03T14:14:28.102723Z","tidal_id":"b1eb80b4-133c-53a8-823c-1df10951406d","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[{"id":"b24e69e1-a77d-4ab2-bbb6-cebf157f0f16","name":"Laundry Bear","description":"<sup>[[Microsoft Security Blog May 27 2025](/references/e7ea6602-f448-46f2-9ce8-9afbc226807d)]</sup>","source":"Tidal Cyber","associated_group_id":"f7ea73ec-1e73-45ed-bbd6-a8362a903146","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"f9abe00e-1d8b-47d0-ae68-4c4ac5a501e7","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"51939294-2247-47cf-8669-ccff0357b3d7","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"478fcb7b-864d-4c8d-9b6e-bc0bc309c7f7","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"6bfee7f7-7363-4a24-a0eb-d02a8697ce0e","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"d0318cad-b5f9-4e9e-af04-f479e52b5c30","name":"VoidLink Developers","source":"Tidal Cyber","group_attack_id":"G3212","created":"2026-01-23T20:30:07.673911Z","modified":"2026-01-23T20:30:07.673914Z","tidal_id":"7c06f9a8-795c-5dbf-bc29-df73820f0944","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"ef033900-6e90-4ae0-9861-a4cf98df8830","tag":"efa33611-88a5-40ba-9bc4-3d85c6c8819b"},{"id":"a21c8e10-ceaf-4d59-8755-bdd11276c546","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"b2619f14-654d-44dd-9d32-d624c7e1ed54","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"35b76f06-ae03-4f56-8327-6c3e91148b24","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"316f792f-fdef-48ae-9e5b-a8768595d31f","tag":"4fa6f8e1-b0d5-4169-8038-33e355c08bde"},{"id":"5d1ba734-77b6-40f2-a3ad-aa3ab90acd17","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"b8a2aae8-1f59-459a-bcd0-26cd06237987","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"2b1a3202-5d58-4b5e-9e0e-ab5a422b9227","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"c2015888-72c0-4367-b2cf-df85688a56b7","name":"Void Rabisu","source":"Tidal Cyber","group_attack_id":"G3009","created":"2024-06-13T20:11:14.906325Z","modified":"2024-06-13T20:11:14.906329Z","tidal_id":"4473d512-7508-51bf-9e13-993ba72d04e3","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"5f7fc4eb-a12b-47d4-a003-3a3ff97a7609","name":"Tropical Scorpius","description":"<sup>[[Trend Micro Void Rabisu May 30 2023](/references/5fd628ca-f366-4f0d-b493-8be19fa4dd4e)]</sup>","source":"Tidal Cyber","associated_group_id":"47e4fc24-8bde-42d1-9804-28c01f2bfb1a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7de46fa3-ea06-491a-8e54-ac14a62c7325","name":"RomCom","description":"","source":"Tidal Cyber","associated_group_id":"a1c49781-440c-4860-b10c-79ee0ac1ea52","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"7aeed8f2-8364-4c5c-9c2f-e6eff91992d7","name":"Storm-0978","description":"<sup>[[ESET RomCom November 26 2024](/references/adb2d336-cc35-4ac5-b7ba-ab44e92533d9)]</sup>","source":"Tidal Cyber","associated_group_id":"e74e76de-90f6-4db7-bba4-53a5c8ac08ac","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"84fd25c1-047c-4ee5-af60-8f3e0892cad0","name":"UNC2596","description":"<sup>[[ESET RomCom November 26 2024](/references/adb2d336-cc35-4ac5-b7ba-ab44e92533d9)]</sup>","source":"Tidal Cyber","associated_group_id":"0201b5cd-8430-4cbd-8f81-9c1fca5efcbc","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"16cd710f-af09-43b1-900c-34e8ce54ef88","name":"UNC4895","description":"<sup>[[Google Cybercrime Report February 11 2025](/references/17685d5c-4255-445e-a546-e0dfb92378c2)]</sup>","source":"Tidal Cyber","associated_group_id":"a95b7db5-2a62-4846-8781-d389ad04d81d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"0f272cc8-cc4e-4974-9fc1-2ffeb4aaa1b3","name":"CIGAR","description":"<sup>[[Google Cybercrime Report February 11 2025](/references/17685d5c-4255-445e-a546-e0dfb92378c2)]</sup>","source":"Tidal Cyber","associated_group_id":"e4fcef55-d770-4371-8bd4-41d8f33bfb96","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"bf9f3313-79eb-4d70-9c06-6ee94c754ceb","name":"UAC-0168","description":"<sup>[[OPSWAT Detection Engineering August 30 2024](/references/78c0c51d-5757-4701-8626-c0d99be6f9ac)]</sup>","source":"Tidal Cyber","associated_group_id":"c5bc9f48-4fb3-4fe4-8195-4e4011ad34db","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"f8739670-2ac8-4510-a418-69e43cf378ad","tag":"1dc2830c-99a9-4615-91f2-12c278077959"},{"id":"6052597a-9753-4a43-a7a6-31e2f2aa1517","tag":"4bc9ab8f-7f57-4b1a-8857-ffaa7e5cc930"},{"id":"8bebfd86-4b76-48b2-a952-21162a138e32","tag":"89c5b94b-ecf4-4d53-9b74-3465086d4565"},{"id":"0cf898ec-ab6d-487b-8c99-63e8a79f3d71","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"c5f1ee75-5158-46d6-acff-3178984fb8d1","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"ed93d844-aaf3-4b82-b4c8-eaff0d30e0a0","tag":"dbefbfe0-db4e-438f-a68f-7085680bf37a"},{"id":"680065a1-1e94-411d-972d-a627b5661ebd","tag":"11fd185b-4959-4422-8bf8-6566a5f1a61c"},{"id":"ed969346-e7e8-420b-9448-f91839d3c74c","tag":"bcff125f-cdbd-433f-95fb-57b33b85efa3"},{"id":"0f2ed402-0736-4670-9a27-37e4dafdfa1d","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"33ec00c4-6239-4ada-ade1-1724b0636234","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"d2892c0e-2865-432b-8dcc-1f7ff65cea7b","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"d2b7bd12-1369-465c-a2b5-1d135e29596d","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"7c3ef21c-0e1c-43d5-afb0-3a07c5a66937","name":"Volatile Cedar","source":"MITRE","group_attack_id":"G0123","created":"2021-02-08T20:30:30.578000Z","modified":"2022-05-11T14:00:00.188000Z","tidal_id":"bbc07e70-7b8f-5075-a06f-7e3d9fcf73f9","country":[{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"fc086dce-553c-452b-886d-906d17df9fb8","name":"Lebanon","country_name":"Lebanon","country_code":"LB"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"86a8c2fa-6d5d-49c0-b0da-edc0066e9c9f","name":"Turkey","country_name":"Turkey","country_code":"TR"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"11222cec-4905-40d8-a9ec-100735108365","name":"Lebanese Cedar","description":"<sup>[[ClearSky Lebanese Cedar Jan 2021](https://app.tidalcyber.com/references/53944d48-caa9-4912-b42d-94a3789ed15b)]</sup>","source":"MITRE","associated_group_id":"3dc34f21-1b3f-4952-97e9-c9df61379962","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"4ea1245f-3f35-5168-bd10-1fc49142fd4e","name":"Volt Typhoon","source":"MITRE","group_attack_id":"G1017","created":"2023-11-07T00:35:51.716550Z","modified":"2023-11-07T00:35:51.716554Z","tidal_id":"455f6b10-832a-5c27-8b49-6788b2f44990","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"6ba2a367-84e6-4985-b297-de62ae9ffcf8","name":"Guam","country_name":"Guam","country_code":"GU"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"79d61bbc-a37c-4b9e-bf2d-f220e01b6d71","name":"Maritime"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"3845a076-bf99-5224-bbe1-7e9e5393a25f","name":"BRONZE SILHOUETTE","description":"<sup>[[Secureworks BRONZE SILHOUETTE May 2023](https://app.tidalcyber.com/references/77624549-e170-5894-9219-a15b4aa31726)]</sup><sup>[[CISA AA24-038A PRC Critical Infrastructure February 2024](https://app.tidalcyber.com/references/bfa16dc6-f075-5bd3-9d9d-255df8789298)]</sup>","source":"MITRE","associated_group_id":"a7d8b128-d997-5d59-9aa2-9db35ff658c7","owner_id":null,"owner_name":null},{"id":"f495d8ed-a142-5405-8e60-cb04177a0166","name":"DEV-0391","description":"<sup>[[CISA AA24-038A PRC Critical Infrastructure February 2024](https://app.tidalcyber.com/references/bfa16dc6-f075-5bd3-9d9d-255df8789298)]</sup>","source":"MITRE","associated_group_id":"2e61f8cc-78b0-52c5-9e2a-50b03bd50bb5","owner_id":null,"owner_name":null},{"id":"8176572f-3ddc-541f-b48b-003e07d4175b","name":"Insidious Taurus","description":"<sup>[[CISA AA24-038A PRC Critical Infrastructure February 2024](https://app.tidalcyber.com/references/bfa16dc6-f075-5bd3-9d9d-255df8789298)]</sup>","source":"MITRE","associated_group_id":"7cdf5f28-e7d9-4c96-b94e-8d37730ad2d3","owner_id":null,"owner_name":null},{"id":"03e90112-9c43-5bfc-9e28-fb00e153dc86","name":"Vanguard Panda","description":"<sup>[[CISA AA24-038A PRC Critical Infrastructure February 2024](https://app.tidalcyber.com/references/bfa16dc6-f075-5bd3-9d9d-255df8789298)]</sup>","source":"MITRE","associated_group_id":"50ae8124-5ded-4279-859c-c67cb18b8af6","owner_id":null,"owner_name":null},{"id":"c85b7d9e-3eff-57cf-a22c-22721e0019ff","name":"UNC3236","description":"<sup>[[CISA AA24-038A PRC Critical Infrastructure February 2024](https://app.tidalcyber.com/references/bfa16dc6-f075-5bd3-9d9d-255df8789298)]</sup>","source":"MITRE","associated_group_id":"510de22f-b52b-4e8f-afca-bb142b972bbf","owner_id":null,"owner_name":null},{"id":"51d4827f-0cec-5635-add8-3f449130af80","name":"Voltzite","description":"<sup>[[CISA AA24-038A PRC Critical Infrastructure February 2024](https://app.tidalcyber.com/references/bfa16dc6-f075-5bd3-9d9d-255df8789298)]</sup>","source":"MITRE","associated_group_id":"2e15fead-f4ff-4667-b688-95678cf60bdd","owner_id":null,"owner_name":null},{"id":"55384b19-c2c3-4527-b759-d23d61d8014a","name":"Vanguard Panda","description":"<sup>[[U.S. CISA Volt Typhoon February 7 2024](/references/c74f5ecf-8810-4670-b778-24171c078724)]</sup>","source":"Tidal Cyber","associated_group_id":"33ec6e60-3e48-4ad8-9960-d59af6260c52","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"c12f51e2-30ea-4cdd-a2df-abc7d17e961a","name":"Dev-0391","description":"<sup>[[U.S. CISA Volt Typhoon February 7 2024](/references/c74f5ecf-8810-4670-b778-24171c078724)]</sup>","source":"Tidal Cyber","associated_group_id":"dba5e3cd-8c54-4129-a4f3-adcb1ded182a","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"89106490-5646-4fa6-9bae-c83098e41874","name":"UNC3236","description":"<sup>[[U.S. CISA Volt Typhoon February 7 2024](/references/c74f5ecf-8810-4670-b778-24171c078724)]</sup>","source":"Tidal Cyber","associated_group_id":"b38b4cff-e574-4d39-b2c5-365bcb14b7b6","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"757b8c7c-9c62-405b-ae3c-37ef25f45144","name":"Voltzite","description":"<sup>[[U.S. CISA Volt Typhoon February 7 2024](/references/c74f5ecf-8810-4670-b778-24171c078724)]</sup>","source":"Tidal Cyber","associated_group_id":"950dd0a9-0045-4956-bf7b-3b3be491b086","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e8ad4226-71c7-4f9c-a1f7-4fc3e339d2fb","name":"Insidious Taurus","description":"<sup>[[U.S. CISA Volt Typhoon February 7 2024](/references/c74f5ecf-8810-4670-b778-24171c078724)]</sup>","source":"Tidal Cyber","associated_group_id":"c93b36a8-c2b7-4f54-830e-86040830a9f5","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"59779357-164e-4658-bcdc-223b8573c34a","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"},{"id":"24114083-bc73-4714-8d61-90bedfdd4694","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"453322fb-7d4f-4853-b9be-7a9464a90e30","tag":"712d4124-8860-488a-a780-2938f9df6313"},{"id":"19db0443-b226-4772-a02d-09b567554d8d","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"60e85368-7153-4721-8a64-f42916f17d50","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"bcb2a5b0-42b3-4dfd-9e81-e0c4c726f4bd","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"a421dbcd-15ef-4637-b9be-7e5bc854bfbe","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"33f575de-ea70-4fd1-a0d3-ec208289f553","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"816e6cd7-adbd-4749-9458-e50d0b4b1e8b","tag":"97cc0c9b-3625-42c3-824a-646a91702977"},{"id":"f0e5bbaa-c74c-4bb8-ad40-d0cb085d0740","tag":"53331b05-782f-45fc-b925-27c9598dde80"}],"owner_name":null},{"id":"c88e3c8d-cb71-48e1-a2c4-5f00300dfa0b","name":"WANDERING SPIDER","source":"Tidal Cyber","group_attack_id":"G3087","created":"2025-03-04T15:55:08.364149Z","modified":"2025-03-04T15:55:08.364154Z","tidal_id":"56c3d9f2-f668-5e32-9d59-ba3668e13da1","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"82e8d6a5-43f7-4667-96ce-732d3b004a7c","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"7489790a-f6f0-48aa-9264-4a96b74f764b","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"a8e61aba-286a-498a-8acc-0ae71c8972f3","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"},{"id":"254ada9f-a7d8-44dd-b61c-95e8b53da479","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"5d835d68-b8c0-4c3e-9488-6ab4c63c20e0","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"4c8288fd-df9f-48b7-911b-19651074561d","name":"Water Curupira","source":"Trellix TIG","group_attack_id":"G3003","created":"2025-04-11T15:06:30.319191Z","modified":"2025-04-11T15:06:30.319194Z","tidal_id":"159d6211-867c-551d-b901-684690dac07d","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"d1ec734c-6f67-45d6-ae23-814b17131846","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"f771eea7-7f3b-4e50-929b-253fc63ecc20","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":"TidalCyberIan"},{"id":"29243321-228e-4d45-99a3-848c7fc1dbd1","name":"Water Daruanak","source":"Tidal Cyber","group_attack_id":"G3177","created":"2025-12-17T14:18:07.461843Z","modified":"2025-12-17T14:18:07.461846Z","tidal_id":"d3840985-48b1-5b3f-8963-32a61ecf0c01","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[{"id":"43e0e3dc-0d52-4f3e-a642-52205352fc0e","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"d0c292d4-173c-4a8e-a868-cb97ad157931","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"6906c3dd-1fd7-4a99-9c37-839dcc6c7966","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"93901942-0750-59a5-a244-3ee9ae3bc255","name":"Water Galura","source":"MITRE","group_attack_id":"G1050","created":"2025-10-29T21:08:48.108239Z","modified":"2025-10-29T21:08:48.108239Z","tidal_id":"93901942-0750-59a5-a244-3ee9ae3bc255","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"abfa7b72-fb7e-4b58-8f4f-ba6a9326a762","name":"Mining"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"7ae7a8c6-7eef-434c-b5db-2a44dae91761","name":"Professional Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"e202ec62-1892-49c9-aaae-077969f095e3","name":"Phantom Mantis","description":"<sup>[[BleepingComputer June 6 2025](/references/2572c252-f3a7-4e0f-bf87-2c92f7379397)]</sup>","source":"USER","associated_group_id":"df4d28da-d091-4eea-a01e-e033b551e677","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3578582d-8706-4e5e-b8f4-aeb265293e24","name":"Agenda","description":"<sup>[[BleepingComputer June 6 2025](/references/2572c252-f3a7-4e0f-bf87-2c92f7379397)]</sup>","source":"USER","associated_group_id":"2b4191f3-bd79-449e-b273-30b9b2aff295","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"2cf1df23-6024-440a-8778-b90c122ea27e","name":"STAC4365","description":"<sup>[[Sophos News April 1 2025](/references/7066ca7e-03e9-4d3c-8d10-2a659c79c859)]</sup>","source":"USER","associated_group_id":"cd639d72-585e-4734-bb10-9580c5005577","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e7227cde-e798-4992-98b3-919519e0ba6f","name":"Qilin Ransomware Actors","description":"","source":"USER","associated_group_id":"b720a022-4101-46b0-9bf4-ce5f3ce924b0","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9f938953-2f17-4488-b84e-11c3608818d1","name":"Qilin","description":"<sup>[[Cisco Talos Blog October 27 2025](/references/0eede7ae-6637-4f1a-b3b8-425d585025d8)]</sup>","source":"USER","associated_group_id":"9ee62ffd-0e04-4684-a1fe-dbefdebebf92","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"8d5d5f5e-d771-435b-ab7b-1386200390fb","name":"Qilin Ransomware Group","description":"<sup>[[Sophos News December 07 2025](/references/d74c88c0-25fe-419a-bf69-1603d1b3a597)]</sup>","source":"USER","associated_group_id":"66f8eeeb-f50e-4383-9df5-f7afd9963302","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"4ca7cf96-dd10-5c14-987d-21173986b2d3","name":"GOLD FEATHER","description":"<sup>[[BushidoToken Qilin RaaS JUN 2024](https://app.tidalcyber.com/references/a0fda9ef-31d3-529b-a0f2-342ac6fa23cd)]</sup>","source":"MITRE","associated_group_id":"68185934-aaf0-5123-b94b-f98e1446ed01","owner_id":null,"owner_name":null}],"tags":[{"id":"a0a90595-3e73-4e8d-a941-dcf99ff10dfb","tag":"3bea3bae-800f-4fc1-9bfe-db87b4b9b365"},{"id":"48569cda-3d97-49e3-928c-adad91187868","tag":"d92fd4ee-09aa-4a32-9058-cd23f0c6238a"},{"id":"27df7660-5ef6-4c61-af0b-c82621322a9d","tag":"c9c73000-30a5-4a16-8c8b-79169f9c24aa"},{"id":"82e27776-a7b7-442b-8a53-85c597807f6a","tag":"291c006e-f77a-4c9c-ae7e-084974c0e1eb"},{"id":"16ed1a8d-9b29-482c-b7f7-e5fd9928a1db","tag":"82009876-294a-4e06-8cfc-3236a429bda4"},{"id":"b11fba16-6650-4a89-8599-934df548761d","tag":"b802443a-37b2-4c38-addd-75e4efb1defd"},{"id":"c8b70547-97c1-405c-b07b-b717c76538e6","tag":"2e5f6e4a-4579-46f7-9997-6923180815dd"},{"id":"01c104e5-42ef-4cd1-bb13-64420d3ae8e7","tag":"0094c0cb-29f2-4d61-a62a-fb3b3ef3d9a0"},{"id":"087bdf16-f634-4f63-8ce7-30f896f69f2c","tag":"33d22eff-59a1-47e0-b9eb-615dee314595"},{"id":"44d82689-dc13-467e-89d4-cee0d1059e3b","tag":"15b77e5c-2285-434d-9719-73c14beba8bd"},{"id":"0e22c66b-bb36-4763-aa66-6795fb0b8d31","tag":"dac201ad-a6f6-44d3-89b4-957414336eed"},{"id":"90803e53-fa6a-41e5-a1f2-6dcc3ef689ec","tag":"abff87bf-5c28-489b-8fe6-e1fc74abb70a"},{"id":"dc75d320-4675-4fab-98c2-f21f61925268","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"e21d373c-db30-4b28-bc53-ca089c61304a","tag":"562e535e-19f5-4d6c-81ed-ce2aec544f09"},{"id":"b5da7269-1cc3-4af4-a93d-d9941b8c8423","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"c878b835-e5b7-453a-95d2-cff0698ab200","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"271cfdb6-e918-4a86-9289-c6a4d6b99ce4","name":"Water Gamayun","source":"Tidal Cyber","group_attack_id":"G3157","created":"2025-12-10T14:14:12.341693Z","modified":"2025-12-10T14:14:12.341696Z","tidal_id":"494cd1ae-8193-5098-9767-50aa4850736c","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"84afb13a-2dd7-48a8-9610-1b99950eb5c3","name":"Larva-208","description":"<sup>[[Trend Micro Water Gamayun March 28 2025](/references/feaae1f3-fccc-491a-bd07-7ecaea2cb813)]</sup>","source":"USER","associated_group_id":"7316aa18-d4e9-45ae-9887-5e83b9667981","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"6b2d05f4-5365-467f-a525-3994c28c1d58","name":"EncryptHub","description":"<sup>[[Trend Micro Water Gamayun March 28 2025](/references/feaae1f3-fccc-491a-bd07-7ecaea2cb813)]</sup>","source":"USER","associated_group_id":"cbcd3cfc-4509-4bfc-b8c9-7618da908c15","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"e49d4227-c87b-4338-a941-778628e0b037","tag":"61085b71-eb19-46d8-a9e6-1ab9d2f3c08d"},{"id":"cd19162f-a7f6-4606-bbd5-dcc5e0a78c10","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"79deeaf3-a925-48a2-afa8-8a21c4bf87c2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5e289ad4-7e4a-4ce4-bf6c-876ef98186cb","name":"Water Kurita","source":"Tidal Cyber","group_attack_id":"G3151","created":"2025-12-10T14:14:11.447083Z","modified":"2025-12-10T14:14:11.447087Z","tidal_id":"a7bea729-7a2b-5b70-9542-c9898bd652cc","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"24a01ddf-a18f-4abd-bb1d-a8f35e4cd687","name":"Lumma Stealer Operators","description":"<sup>[[Trend Micro November 13 2025](/references/42e2f322-f311-4d96-9f07-9d4130c83cab)]</sup>","source":"USER","associated_group_id":"5675c7dd-edd6-4800-be07-b4ffd77b79b8","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"32157465-64b3-4175-9cc1-aef88c38158e","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"218c170b-d716-405f-b6a2-bd87fd92a931","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"196b033c-94d9-40a1-9d82-d17a69192273","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"cbf5dc44-dafc-4cd5-9695-dc47d39e8b78","name":"Water Saci","source":"Tidal Cyber","group_attack_id":"G3158","created":"2025-12-10T14:14:12.520625Z","modified":"2025-12-10T14:14:12.520628Z","tidal_id":"8b978017-730d-5e94-9fa3-417fcad64ec2","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"}],"observed_sector":[{"id":"9c085125-b0d8-4539-a125-42182f0c4290","name":"Banks"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"}],"associated_groups":[],"tags":[{"id":"a400e53b-d263-4335-93d6-0143d32140d8","tag":"3b73c532-ccfc-4d66-9830-ab76ef1bc47a"},{"id":"dfc45e77-199e-46f4-aa13-41ee8d09c536","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"},{"id":"8f04c6fc-54b0-47a0-9aed-9a03f8dd1872","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"e7daebf2-d56c-4318-800a-0ee0cb5548b2","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"e396b406-57df-4260-bb75-b337ff726785","name":"Weaxor ransomware operators","source":"Tidal Cyber","group_attack_id":"G3187","created":"2025-12-29T17:40:15.570406Z","modified":"2025-12-29T17:40:15.570409Z","tidal_id":"e8b0bf51-44a2-5a11-a667-a0c24ab5e3e9","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[],"observed_sector":[],"associated_groups":[{"id":"6a06949e-30b7-46fd-8008-de370dc72f68","name":"Mallox ransomware operators","description":"<sup>[[None December 16 2025](/references/77a0f06e-b16f-4d3d-998e-0af3e1789624)]</sup>","source":"USER","associated_group_id":"a1529496-6876-4999-adbe-04c18b98186c","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"b6032ff9-186e-4b4d-a12a-6bd4e493a649","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"d2ae05e7-3dcb-475a-9ee4-c610d7d3c237","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"f0943620-7bbb-4239-8ed3-c541c36baaa1","name":"Whitefly","source":"MITRE","group_attack_id":"G0107","created":"2020-05-26T16:55:09.674000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"4257c5f0-6e0d-515a-a2c0-fd1f37c7e8ea","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"}],"observed_sector":[{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[],"tags":[],"owner_name":null},{"id":"eeb69751-8c22-4a5f-8da2-239cc7d7746c","name":"Windigo","source":"MITRE","group_attack_id":"G0124","created":"2021-02-10T19:57:38.042000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"835daf8e-512d-5d71-91b2-f9d8a8ac9467","country":[],"observed_motivation":[],"observed_country":[],"observed_sector":[],"associated_groups":[],"tags":[],"owner_name":null},{"id":"4e880d01-313a-4926-8470-78c48824aa82","name":"Windshift","source":"MITRE","group_attack_id":"G0112","created":"2020-06-25T17:16:39.168000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"8d46b445-298f-589d-8139-0e884a263b75","country":[],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"15372177-9e2a-40d0-b4bb-c60c95d4b9ce","name":"Infrastructure"}],"associated_groups":[{"id":"79b3abef-e42b-40c7-958d-cea379561a78","name":"Bahamut","description":"<sup>[[SANS Windshift August 2018](https://app.tidalcyber.com/references/97eac0f2-d528-4f7c-8425-7531eae4fc39)]</sup>","source":"MITRE","associated_group_id":"9e192d35-5371-4e21-bc63-62e10a8a5a44","owner_id":null,"owner_name":null},{"id":"9362cad9-31cd-4caf-8908-2c55648c4c64","name":"Bahamut","description":"<sup>[[SANS Windshift August 2018](https://app.tidalcyber.com/references/97eac0f2-d528-4f7c-8425-7531eae4fc39)]</sup>","source":"Mobile","associated_group_id":"9e192d35-5371-4e21-bc63-62e10a8a5a44","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"6932662a-53a7-4e43-877f-6e940e2d744b","name":"Winnti Group","source":"MITRE","group_attack_id":"G0044","created":"2017-05-31T21:32:08.682000Z","modified":"2022-04-15T16:27:20.897000Z","tidal_id":"a1e042bb-af4e-50ce-8513-4e27d2ad4f50","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"a75cd250-ffba-4620-910c-73246841f60a","name":"Philippines","country_name":"Philippines","country_code":"PH"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"f10272e2-b028-4a32-85e7-22ab2b84efa5","name":"Sri Lanka","country_name":"Sri Lanka","country_code":"LK"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"f03febaf-4080-4607-96d5-d8926cc8d56b","name":"Viet Nam","country_name":"Vietnam","country_code":"VN"}],"observed_sector":[{"id":"2f196645-fbd2-4712-92fa-e6f6297e7f32","name":"Entertainment"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"}],"associated_groups":[{"id":"41383e12-fe22-46d3-8537-581863272d40","name":"Winnti","description":"<sup>[[web.archive.org October 18 2022](/references/da8f4fd8-aaa1-4ba9-97e3-13bee02c97f5)]</sup>","source":"USER","associated_group_id":"f07ea688-0e71-4594-a80d-7aa01af8c9a4","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"cd7e1e48-b13a-4124-ad7b-e3c82f563b4c","name":"Blackfly","description":"<sup>[[Symantec Suckfly March 2016](https://app.tidalcyber.com/references/8711c175-e405-4cb0-8c86-8aaa471e5573)]</sup>","source":"MITRE","associated_group_id":"453f7dbf-bde7-4cf3-af5d-a6ac10335980","owner_id":null,"owner_name":null}],"tags":[{"id":"5a9399e0-6553-4b0f-8367-315052b177fe","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"413f5abe-14b1-4baf-b8ca-81e56c01608c","tag":"fe28cf32-a15c-44cf-892c-faa0360d6109"}],"owner_name":null},{"id":"f18800ea-04fc-5a3a-8905-d3bbc460794f","name":"Winter Vivern","source":"MITRE","group_attack_id":"G1035","created":"2024-10-31T16:28:10.798797Z","modified":"2024-10-31T16:28:10.798800Z","tidal_id":"f18800ea-04fc-5a3a-8905-d3bbc460794f","country":[],"observed_motivation":[],"observed_country":[{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"a2d8b90a-d131-5c8f-87a3-88a7de950234","name":"TA473","description":"<sup>[[Proofpoint WinterVivern 2023](https://app.tidalcyber.com/references/45f638af-ad10-566e-9e4d-49385a79022f)]</sup>","source":"MITRE","associated_group_id":"c7b81ceb-2529-51e0-81a2-993f302083c0","owner_id":null,"owner_name":null},{"id":"a93e8dfe-1905-5acf-965a-d9b7009ccdeb","name":"UAC-0114","description":"<sup>[[CERT-UA WinterVivern 2023](https://app.tidalcyber.com/references/d82e5170-b9be-5a60-a2a1-8df658740639)]</sup>","source":"MITRE","associated_group_id":"c39d3232-7143-5acc-932a-503d2254f0bf","owner_id":null,"owner_name":null}],"tags":[],"owner_name":null},{"id":"73da066d-b25f-45ba-862b-1a69228c6baa","name":"WIRTE","source":"MITRE","group_attack_id":"G0090","created":"2019-05-24T17:02:44.226000Z","modified":"2022-04-15T19:50:19.478000Z","tidal_id":"9a4d8778-da1c-50c5-932b-5086afe9c32f","country":[{"id":"5237c9b3-b0d1-4979-98d9-8ff0decd3d16","name":"Palestine, State of","country_name":"Palestine","country_code":"PS"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"0dd96844-1405-4b7f-b41f-77039a4142e4","name":"Egypt","country_name":"Egypt","country_code":"EG"},{"id":"114a42ca-7d85-417a-82c7-db9654800fab","name":"Jordan","country_name":"Jordan","country_code":"JO"},{"id":"c68d37f3-2bed-4684-9fc6-c77f786f8c82","name":"Morocco","country_name":"Morocco","country_code":"MA"},{"id":"252115d5-b120-4db5-846d-829ac4ebfc54","name":"Oman","country_name":"Oman","country_code":"OM"},{"id":"5237c9b3-b0d1-4979-98d9-8ff0decd3d16","name":"Palestine, State of","country_name":"Palestine","country_code":"PS"}],"observed_sector":[{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"}],"associated_groups":[{"id":"1befca91-cb42-4179-8fd4-de5ad3fb76e7","name":"Ashen Lepus","description":"<sup>[[Unit 42 December 11 2025](/references/be18bd4b-38de-4be3-a67b-ec20f7070c3b)]</sup>","source":"USER","associated_group_id":"3e80ffde-8f72-49b0-8879-069f663a6da9","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[],"owner_name":null},{"id":"0b431229-036f-4157-a1da-ff16dfc095f8","name":"Wizard Spider","source":"MITRE","group_attack_id":"G0102","created":"2020-05-12T18:15:29.396000Z","modified":"2021-10-14T17:27:41.194000Z","tidal_id":"36b653a7-6299-5c48-9688-6e3f2deaea13","country":[{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"}],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"},{"id":"6c81c742-07a2-4540-8873-7b2fac9ec47e","name":"Organizational Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"6081d7f5-318b-47d4-bebe-eda4cd16d578","name":"Dominican Republic","country_name":"Dominican Republic","country_code":"DO"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"31c65320-3202-49b5-8cf8-7fde846076d5","name":"New Zealand","country_name":"New Zealand","country_code":"NZ"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"d2cb2d6c-6674-4cde-b754-ddb348bb9534","name":"Singapore","country_name":"Singapore","country_code":"SG"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"d4b7e10b-d4bc-46f9-947a-7608ef504b80","name":"Taiwan, Province of China","country_name":"Taiwan","country_code":"TW"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"484c48f7-e9a1-430d-aa75-ea53e3ffafa9","name":"Automotive"},{"id":"7de96a8d-d61d-445e-91e0-ed1aaa22f36b","name":"Chemical"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"246c5dee-505f-4e16-8d11-9e4c52fd5b04","name":"Legal"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"bb59169c-0850-4eb8-a55a-1a2be0e28940","name":"NGOs"},{"id":"4baff548-eeaa-45a8-b436-2ffdec370962","name":"Non Profit"},{"id":"7dd443d2-b391-4fc6-b043-6a11414c6b40","name":"Pharmaceuticals"},{"id":"8b8ee0ec-e4c6-4450-8467-ed5132624938","name":"Retail"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"},{"id":"38644489-11c2-475d-9a03-faa26d7d1d6e","name":"Utilities"}],"associated_groups":[{"id":"1c33c01b-e230-495e-9dc2-6b0208684b74","name":"TEMP.MixMaster","description":"<sup>[[FireEye Ryuk and Trickbot January 2019](https://app.tidalcyber.com/references/b29dc755-f1f0-4206-9ecf-29257a1909ee)]</sup>","source":"MITRE","associated_group_id":"1a9f2244-d35f-45d1-8f53-d1421498006d","owner_id":null,"owner_name":null},{"id":"dc48b784-08b8-5af5-8b4f-995a02fee090","name":"DEV-0193","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"931b9188-3a62-5ab4-a223-180530ec9587","owner_id":null,"owner_name":null},{"id":"17d304e9-9794-48a5-8297-7543199aa80f","name":"UNC1878","description":"<sup>[[FireEye KEGTAP SINGLEMALT October 2020](https://app.tidalcyber.com/references/59162ffd-cb95-4757-bb1e-0c2a4ad5c083)]</sup>","source":"MITRE","associated_group_id":"e0313186-a5f5-4bb0-94a0-b2b5d496bbc6","owner_id":null,"owner_name":null},{"id":"77d687c7-fe01-5fd5-9fa5-8c346f92b9d2","name":"FIN12","description":"<sup>[[Mandiant FIN12 Oct 2021](https://app.tidalcyber.com/references/4514d7cc-b999-5711-a398-d90e5d3570f2)]</sup>","source":"MITRE","associated_group_id":"91e61805-508f-536c-8e8e-89a5a24ae511","owner_id":null,"owner_name":null},{"id":"e2e61a31-7c55-5633-9b2b-4a67595f3903","name":"Periwinkle Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"c049da64-915b-58ee-abf1-9d485159d2e0","owner_id":null,"owner_name":null},{"id":"40656576-ae67-4adf-8478-586f7a8180d7","name":"Grim Spider","description":"<sup>[[CrowdStrike Ryuk January 2019](https://app.tidalcyber.com/references/df471757-2ce0-48a7-922f-a84c57704914)]</sup><sup>[[CrowdStrike Grim Spider May 2019](https://app.tidalcyber.com/references/103f2b78-81ed-4096-a67a-dedaffd67e9b)]</sup>","source":"MITRE","associated_group_id":"2924354f-bbaa-4c1b-8af0-a78976b1eff2","owner_id":null,"owner_name":null},{"id":"b59c07e6-61eb-5c06-8816-a6606c4767a2","name":"GOLD BLACKBURN","description":"<sup>[[Secureworks Gold Blackburn Mar 2022](https://app.tidalcyber.com/references/b6b27fa9-488c-5b6d-8e12-fe8371846cd3)]</sup>","source":"MITRE","associated_group_id":"c521ebb3-4303-5fef-a1fb-bd0e9f6a79a7","owner_id":null,"owner_name":null},{"id":"be36bc98-f462-53fb-9097-80e7a2dec21b","name":"ITG23","description":"<sup>[[IBM X-Force ITG23 Oct 2021](https://app.tidalcyber.com/references/d796e773-7335-549f-a79b-a2961f85a8ec)]</sup>","source":"MITRE","associated_group_id":"e03d13ed-35ac-59e3-afa0-b06cdf5eb534","owner_id":null,"owner_name":null},{"id":"c30914fb-4223-47d0-94b8-5619904d1c3b","name":"UNC1878","description":"<sup>[[FireEye KEGTAP SINGLEMALT October 2020](https://app.tidalcyber.com/references/59162ffd-cb95-4757-bb1e-0c2a4ad5c083)]</sup>","source":"ICS","associated_group_id":"e0313186-a5f5-4bb0-94a0-b2b5d496bbc6","owner_id":null,"owner_name":null},{"id":"d670329a-b019-4617-bc80-7502cb914a65","name":"Grim Spider","description":"<sup>[[CrowdStrike Ryuk January 2019](https://app.tidalcyber.com/references/df471757-2ce0-48a7-922f-a84c57704914)]</sup><sup>[[CrowdStrike Grim Spider May 2019](https://app.tidalcyber.com/references/103f2b78-81ed-4096-a67a-dedaffd67e9b)]</sup>","source":"ICS","associated_group_id":"2924354f-bbaa-4c1b-8af0-a78976b1eff2","owner_id":null,"owner_name":null},{"id":"dff25396-304f-48eb-9955-47b3fb509f3f","name":"FIN12","description":"<sup>[[Mandiant FIN12 Oct 2021](https://app.tidalcyber.com/references/4514d7cc-b999-5711-a398-d90e5d3570f2)]</sup>","source":"ICS","associated_group_id":"91e61805-508f-536c-8e8e-89a5a24ae511","owner_id":null,"owner_name":null},{"id":"3e1200eb-a1a0-4ea6-8e87-c562764898a1","name":"DEV-0193","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"931b9188-3a62-5ab4-a223-180530ec9587","owner_id":null,"owner_name":null},{"id":"1a05f8f6-6b9b-4528-aacf-9af729bbad66","name":"TEMP.MixMaster","description":"<sup>[[FireEye Ryuk and Trickbot January 2019](https://app.tidalcyber.com/references/b29dc755-f1f0-4206-9ecf-29257a1909ee)]</sup>","source":"ICS","associated_group_id":"1a9f2244-d35f-45d1-8f53-d1421498006d","owner_id":null,"owner_name":null},{"id":"810ab528-ac46-4f5d-96bf-e478a42f7d06","name":"GOLD BLACKBURN","description":"<sup>[[Secureworks Gold Blackburn Mar 2022](https://app.tidalcyber.com/references/b6b27fa9-488c-5b6d-8e12-fe8371846cd3)]</sup>","source":"ICS","associated_group_id":"c521ebb3-4303-5fef-a1fb-bd0e9f6a79a7","owner_id":null,"owner_name":null},{"id":"1ff6b391-c528-4fe5-95be-752d36040535","name":"ITG23","description":"<sup>[[IBM X-Force ITG23 Oct 2021](https://app.tidalcyber.com/references/d796e773-7335-549f-a79b-a2961f85a8ec)]</sup>","source":"ICS","associated_group_id":"e03d13ed-35ac-59e3-afa0-b06cdf5eb534","owner_id":null,"owner_name":null},{"id":"cd2bc443-59eb-4315-9e38-5b7191f0008b","name":"Periwinkle Tempest","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"ICS","associated_group_id":"c049da64-915b-58ee-abf1-9d485159d2e0","owner_id":null,"owner_name":null}],"tags":[{"id":"46536b72-f372-4add-89fe-56a2ef396fe2","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"718a7d28-b55b-41a7-a070-feaffe49ebb4","tag":"7e7b0c67-bb85-4996-a289-da0e792d7172"}],"owner_name":null},{"id":"cffbafea-5cc9-4bb1-96d4-c65f9ca3cef0","name":"World Leaks","source":"Tidal Cyber","group_attack_id":"G3115","created":"2025-07-15T16:15:45.980691Z","modified":"2025-07-15T16:15:45.980693Z","tidal_id":"982849da-e105-57d8-b61c-455631afafff","country":[],"observed_motivation":[{"id":"a2229c05-df7b-4fce-89b4-b8bc3a52649b","name":"Financial Gain"}],"observed_country":[{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"64ea441c-5748-4d63-acb6-89989fcb19c1","name":"Cameroon","country_name":"Cameroon","country_code":"CM"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"ea677886-b0b0-4ca2-a3b7-591f77da821c","name":"Romania","country_name":"Romania","country_code":"RO"},{"id":"da9f06f0-a7bf-4951-9127-e192ab66b5c3","name":"Serbia","country_name":"Serbia","country_code":"RS"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"041e9540-b8e0-424e-82f1-71b0b695e720","name":"Healthcare"},{"id":"9b84faff-4ffd-4a48-9786-af69d990e0e7","name":"Hospitality Leisure"},{"id":"176eed46-b081-45db-abf7-090ae1c5cc30","name":"Manufacturing"},{"id":"dd0183a5-68b2-4ea7-98e0-7ff17fe064e3","name":"Technology"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"},{"id":"2b88fa3b-fb3b-446a-afe3-147aa4973e6e","name":"Transportation"}],"associated_groups":[],"tags":[{"id":"30e4c34f-43ce-49d7-9342-1a6bc8d78d37","tag":"5e7433ad-a894-4489-93bc-41e90da90019"},{"id":"cb96bf4b-48c0-433b-9077-d62b6af0467b","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"91aeb3ad-503e-45b9-a4c0-04781c7de295","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"5e34409e-2f55-4384-b519-80747d02394c","name":"ZIRCONIUM","source":"MITRE","group_attack_id":"G0128","created":"2021-03-24T15:48:17.731000Z","modified":"2022-04-25T14:00:00.188000Z","tidal_id":"0a3304a5-7792-5e19-bb87-f4715a6936a0","country":[{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"}],"observed_motivation":[{"id":"3cd8185a-c98a-4283-94e9-62806f622b54","name":"Cyber Espionage"}],"observed_country":[{"id":"c9c04955-35e3-4b0d-a1bd-e725db490713","name":"Belarus","country_name":"Belarus","country_code":"BY"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"6195ab08-5020-439d-a89f-783a35013ceb","name":"Finland","country_name":"Finland","country_code":"FI"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"e51823d6-1e6c-47bc-9660-40bbec65fb42","name":"Mongolia","country_name":"Mongolia","country_code":"MN"},{"id":"3ccae51f-e75a-4584-bc47-173bc4a8e45d","name":"Norway","country_name":"Norway","country_code":"NO"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"d0daeace-8fe5-47df-ac4e-8b72c3e53c60","name":"Aerospace"},{"id":"cb007cd6-7648-4b88-bfd0-4dbd113577a0","name":"Construction"},{"id":"e195bc85-3c1e-433f-a0ab-85475499c471","name":"Defense"},{"id":"78d3c255-7170-454e-8e05-51c44a120047","name":"Education"},{"id":"4309be41-04d5-4dad-bb31-517fe0adb4d2","name":"Financial Services"},{"id":"2ebf9ff2-ac85-455c-8cd9-821a7f0044a5","name":"Government"},{"id":"c3a065ee-0654-4bf7-bc17-2f73b6f16151","name":"High Tech"},{"id":"102e12dc-0273-416b-a6d4-1926769287fa","name":"Insurance"},{"id":"8b4d40b8-a2af-4855-8af5-9d656bc02019","name":"Media"},{"id":"ca306f03-8d12-456f-b38d-8a320fbed8f3","name":"Telecommunications"}],"associated_groups":[{"id":"dfb489dd-7b04-4d5a-b3ad-a1e801ade5ca","name":"APT31","description":"<sup>[[Check Point APT31 February 2021](https://app.tidalcyber.com/references/84ac99ef-106f-44e9-97f0-3eda90570932)]</sup>","source":"MITRE","associated_group_id":"f17739da-dd35-4e1e-ab48-e27d9cd08caf","owner_id":null,"owner_name":null},{"id":"c58837e6-57ae-52fa-a8f1-7c7ce037590c","name":"Violet Typhoon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](https://app.tidalcyber.com/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"MITRE","associated_group_id":"a522a109-8a9c-5af4-85dc-5f90851869bc","owner_id":null,"owner_name":null},{"id":"a3967db3-150f-4242-865f-c75753c84c14","name":"JUDGMENT PANDA","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"b48d8c84-3521-4ab7-ab6b-565d67295adc","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"f7d2c1a4-fc4f-439a-a11f-821465de1f75","name":"Chameleon","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"41899368-3608-4d55-b98d-cf9925dbcb51","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"e69bec93-01ec-44aa-a10e-a3bfa20b155c","name":"WebFans","description":"<sup>[[Microsoft Threat Actor Naming July 2023](/references/78a8137d-694e-533d-aed3-6bd48fc0cd4a)]</sup>","source":"Tidal Cyber","associated_group_id":"5c7a8767-d6c5-4151-97cf-0c83c00147d3","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"1419e6ed-df90-4f61-893a-4aac31d96f58","tag":"a98d7a43-f227-478e-81de-e7299639a355"},{"id":"5e57df91-22be-4bff-b1fd-45c73e5526c0","tag":"8490bce5-3ac4-4285-8ec5-bd79a4670492"},{"id":"b195c18c-ab6f-485f-92c7-67743431e32c","tag":"c8ee7c0d-8a65-4c86-b0fa-8d5430788cff"},{"id":"c4831fea-fcf5-4cf3-87b5-3217aa3851fe","tag":"15f2277a-a17e-4d85-8acd-480bf84f16b4"},{"id":"68ef3043-2aef-45e8-b617-2f0676ca6443","tag":"b20e7912-6a8d-46e3-8e13-9a3fc4813852"}],"owner_name":null},{"id":"d2fd3da1-e49c-4273-9add-3d15afc3b837","name":"Zloader Threat Actors","source":"Tidal Cyber","group_attack_id":"G3034","created":"2024-06-13T20:12:17.820945Z","modified":"2024-06-13T20:12:17.820948Z","tidal_id":"72681819-a399-5067-b9c6-f8d1a99c8555","country":[],"observed_motivation":[],"observed_country":[{"id":"58c609ec-9f15-49f5-b0e3-4c79a040794e","name":"Afghanistan","country_name":"Afghanistan","country_code":"AF"},{"id":"3dc3dc11-758d-4cf4-8283-cee97434768c","name":"Argentina","country_name":"Argentina","country_code":"AR"},{"id":"0893a19a-70a4-4733-a8f3-f7510d2582a3","name":"Australia","country_name":"Australia","country_code":"AU"},{"id":"d7a58340-e020-4dc8-a1b1-6c68c952902f","name":"Austria","country_name":"Austria","country_code":"AT"},{"id":"ad129403-1f1e-4f66-9532-063ac64d5048","name":"Belgium","country_name":"Belgium","country_code":"BE"},{"id":"273189e4-d127-45ab-a787-b0e31fd8be3a","name":"Brazil","country_name":"Brazil","country_code":"BR"},{"id":"43a9a69b-2462-4b3e-86e2-ee148ad4af5a","name":"Canada","country_name":"Canada","country_code":"CA"},{"id":"00caf2b4-c240-4812-be06-7dd9d17ca73c","name":"Chile","country_name":"Chile","country_code":"CL"},{"id":"969590ac-4fe8-48fb-8787-9de4ed554b9d","name":"China","country_name":"China","country_code":"CN"},{"id":"7bc43640-8bca-4ebc-8f69-fc0fe716eb44","name":"Colombia","country_name":"Colombia","country_code":"CO"},{"id":"8af7cb07-edaa-4b5c-a1f0-bc171151e6b4","name":"Croatia","country_name":"Croatia","country_code":"HR"},{"id":"a34b1b15-709f-4ea9-9c92-11040a826095","name":"Czechia","country_name":"Czechia","country_code":"CZ"},{"id":"667b299b-b956-4192-b1be-d074e08513d5","name":"Ecuador","country_name":"Ecuador","country_code":"EC"},{"id":"6195ab08-5020-439d-a89f-783a35013ceb","name":"Finland","country_name":"Finland","country_code":"FI"},{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"83ed4573-54ed-4a3f-80c8-9ac5acd7024c","name":"French Guiana","country_name":"French Guiana","country_code":"GF"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"005b5c57-ecff-4cfb-8011-cd2a38a4ebbd","name":"Ghana","country_name":"Ghana","country_code":"GH"},{"id":"07578934-334f-4a04-b0c0-7157b1257617","name":"Greece","country_name":"Greece","country_code":"GR"},{"id":"fa93ef79-53cc-4f24-ad0f-e48b069cdd25","name":"Hungary","country_name":"Hungary","country_code":"HU"},{"id":"91212b5d-7c47-4bf5-92df-bed3b45f2bfd","name":"India","country_name":"India","country_code":"IN"},{"id":"50df9cbb-eba2-4f59-8988-7b590f890475","name":"Indonesia","country_name":"Indonesia","country_code":"ID"},{"id":"33fd1af5-4d9d-40aa-bce6-68e6611bf049","name":"Ireland","country_name":"Ireland","country_code":"IE"},{"id":"24d58b3b-b809-472b-8e54-92bc6b23f017","name":"Israel","country_name":"Israel","country_code":"IL"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"c20c8d24-0ea1-4052-bc9c-02a6d549a1f0","name":"Japan","country_name":"Japan","country_code":"JP"},{"id":"0a242fea-514a-4215-b1bf-11bd2983e2a1","name":"Korea, Republic of","country_name":"Republic of Korea","country_code":"KR"},{"id":"98370f2b-ad21-4e40-aeb8-4d6be0600cbd","name":"Kuwait","country_name":"Kuwait","country_code":"KW"},{"id":"822a186a-4d53-4460-9fc6-c0ed590b3e9f","name":"Mexico","country_name":"Mexico","country_code":"MX"},{"id":"1aa066f0-fa4e-4c47-bb8b-fd789755aa16","name":"Netherlands","country_name":"Netherlands","country_code":"NL"},{"id":"7262e23f-a627-4191-a167-8dd7aab81bb0","name":"Nigeria","country_name":"Nigeria","country_code":"NG"},{"id":"e4630a2b-2e0c-486b-a56d-ddc549d8e121","name":"Pakistan","country_name":"Pakistan","country_code":"PK"},{"id":"0b73cb16-bf89-4d16-a032-ed1fbfbb676b","name":"Peru","country_name":"Peru","country_code":"PE"},{"id":"6aab3e07-731a-4252-8dea-bf42346c1d53","name":"Poland","country_name":"Poland","country_code":"PL"},{"id":"15920079-9121-4e77-b2bc-6dd53ef0d608","name":"Russian Federation","country_name":"Russia","country_code":"RU"},{"id":"e5bde9f2-6b63-4216-b3c0-d978c09a8215","name":"Rwanda","country_name":"Rwanda","country_code":"RW"},{"id":"442bc8c0-60aa-4449-ae18-880b8e10ac3d","name":"Saudi Arabia","country_name":"Saudi Arabia","country_code":"SA"},{"id":"13f7f63b-040b-49ff-938f-e48d0b490a1a","name":"Sierra Leone","country_name":"Sierra Leone","country_code":"SL"},{"id":"1cdaf0b5-6ad2-4321-8145-7fccb5bbd59f","name":"Slovakia","country_name":"Slovakia","country_code":"SK"},{"id":"5201271b-f5aa-414a-aa43-ad37f02cd62d","name":"South Africa","country_name":"South Africa","country_code":"ZA"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"17da9c1b-e0fc-4d77-af5f-6e8b705b36b1","name":"Sweden","country_name":"Sweden","country_code":"SE"},{"id":"f85e66c8-48db-4d39-8146-19a76885a20e","name":"Switzerland","country_name":"Switzerland","country_code":"CH"},{"id":"c0c650ca-35fc-4e3c-8015-114a4210ce35","name":"Thailand","country_name":"Thailand","country_code":"TH"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"d89cfe3c-895e-4b14-a16c-fb27a2358745","name":"United Arab Emirates","country_name":"United Arab Emirates","country_code":"AE"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"},{"id":"856c10c6-a475-4bbf-8f1d-1e06ccff8f2e","name":"Yemen","country_name":"Yemen","country_code":"YE"}],"observed_sector":[],"associated_groups":[],"tags":[{"id":"efa0b9e9-e721-49b5-b420-2796fd028a23","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"8d2fc5e3-9669-4551-8a1a-86f70c8bc7ac","tag":"39357cc1-dbb1-49e4-9fe0-ff24032b94d5"},{"id":"964bfb87-f427-41b9-b8aa-1861adb46b32","tag":"f8669b82-2194-49a9-8e20-92e7f9ab0a6f"},{"id":"902b6751-4079-4a87-90a4-0ff92062ec0c","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"},{"id":"34358e71-38c5-44e3-8467-6c84ab9eba4a","name":"Z-Pentest","source":"Tidal Cyber","group_attack_id":"G3169","created":"2025-12-17T14:18:05.988605Z","modified":"2025-12-17T14:18:05.988609Z","tidal_id":"5871c5d4-0ec7-5939-9f4a-2b3c6cbc30f2","country":[],"observed_motivation":[{"id":"b0d7507a-5195-4e1e-8e4e-a35ab4849405","name":"Disruption"},{"id":"86e9e0a2-e838-41ec-9156-beab5c9b261b","name":"Ideology"}],"observed_country":[{"id":"efcec8fe-c228-49c3-b42c-d027b767cfb3","name":"France","country_name":"France","country_code":"FR"},{"id":"424c0f11-5f38-4b2a-b138-91cff96e5f53","name":"Germany","country_name":"Germany","country_code":"DE"},{"id":"7e4ab834-c3a2-4aa5-9dea-ba7b626cd14e","name":"Italy","country_name":"Italy","country_code":"IT"},{"id":"85f9ced7-2067-4b0f-9680-d8a3a9a32bc6","name":"Spain","country_name":"Spain","country_code":"ES"},{"id":"7542d903-5b9b-4b44-afa9-9d5dec54ecfa","name":"Ukraine","country_name":"Ukraine","country_code":"UA"},{"id":"84c4a720-447d-4e03-9c31-eda50a550ba4","name":"United Kingdom","country_name":"United Kingdom","country_code":"GB"},{"id":"450b8724-b013-4b53-86ee-2e0d3ba786ea","name":"United States","country_name":"United States","country_code":"US"}],"observed_sector":[{"id":"bd2d4ae2-4466-47b5-9b17-20518aca8447","name":"Agriculture"},{"id":"b86a9658-70cf-4aa3-a51b-8ea55ddb2b8f","name":"Energy"},{"id":"64c8c2f6-c911-4fc4-9a0d-b3ed751e8581","name":"Water"}],"associated_groups":[{"id":"d7f9308c-58b7-4ae9-ac2d-c77953c65842","name":"Z-Pentest Alliance","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"470ccc4b-9154-42ea-8470-5d8efb2de86d","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"3659cc5a-17c7-4f76-8ed5-ff3090d70b49","name":"Z-Pentest Beograd","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"6d0b92ec-1fd6-4276-be13-655e2b73e8a7","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"},{"id":"9b220754-fafa-49a9-9f4b-034c344c1f5f","name":"Z-Alliance","description":"<sup>[[Cybersecurity and Infrastructure Security Agency CISA December 09 2025](/references/ad9ca269-46d2-4de4-b65e-21602724df82)]</sup>","source":"USER","associated_group_id":"f15e7e54-e225-43d1-98f4-f85512edd376","owner_id":"bebdd211-52f4-4abc-94ff-b3a7df904561","owner_name":"TidalCyberIan"}],"tags":[{"id":"4c4f68a5-029e-46ed-93df-13ce09bbee91","tag":"61cdbb28-cbfd-498b-9ab1-1f14337f9524"},{"id":"7cb90b92-ef4f-48f5-8f8d-8ca6f67beb90","tag":"e551ae97-d1b4-484e-9267-89f33829ec2c"},{"id":"1a61ff52-b25f-4aca-8c1d-5e3d92ed096f","tag":"15787198-6c8b-4f79-bf50-258d55072fee"},{"id":"5f8bfa87-7745-4235-abbd-639d99fb66e3","tag":"af5e9be5-b86e-47af-91dd-966a5e34a186"},{"id":"ba16e249-34f7-4af0-b92d-8428734704d8","tag":"758c3085-2f79-40a8-ab95-f8a684737927"},{"id":"9784b77c-6526-479c-b3e8-494ebdccd6f7","tag":"2185ed93-7e1c-4553-9452-c8411b5dca93"},{"id":"c58046b0-365b-4643-b634-241e7eaa1b14","tag":"cc4ea215-87ce-4351-9579-cf527caf5992"},{"id":"113afda5-7403-47e7-b4b0-236a09cf3bdd","tag":"1dc8fd1e-0737-405a-98a1-111dd557f1b5"},{"id":"fd9656c4-b9d0-4efc-b28c-755e7a24c583","tag":"35e694ec-5133-46e3-b7e1-5831867c3b55"},{"id":"814a73db-de11-4191-92f4-2626150d7a99","tag":"3ed3f7a6-b446-4fbc-a433-ff1d63c0e647"},{"id":"e8d36fd0-1fbd-4a3d-adaf-4930b70a39d6","tag":"a159c91c-5258-49ea-af7d-e803008d97d3"},{"id":"9e74cf9c-09d9-46db-bfa5-9e4652e05277","tag":"c6e1f516-1a18-4ff9-b563-e6ac8103b104"},{"id":"1717dab2-4149-4019-bcfb-3351644d0c3a","tag":"2feda37d-5579-4102-a073-aa02e82cb49f"}],"owner_name":"TidalCyberIan"}]}