Brandon Karpf
Intel
Threat-actor profiles, written by an operator.
Each one written from primary sources, vetted against MITRE ATT&CK, scored on the Admiralty rating, and carrying explicit confidence labels on every claim. The library stays small on purpose.
Nation-State
Active campaignAPT28
High capability
Primary target set
Logistics, defense industrial base, government, telecommunications, technology services
From 5 June 2026 to 20 October 2026 the daily brief logged 4 observations of APT28 and rated it red on 2 days. Main aims: espionage. Main places: Romania, Russia and Spain.
Nation-State
Active campaignAPT44
High capability
Primary target set
Energy, telecommunications, government, defense industrial base, transportation, water, critical manufacturing
From 5 June 2026 to 14 October 2026 the daily brief logged 8 observations of APT44 and rated it red on 7 days. Main sectors: government, energy and food and agriculture. Main places: Ukraine, Germany and the Czech Republic.
Nation-State
Active campaignAPT29
High capability
Primary target set
Government, diplomatic entities, think tanks, technology providers, defense industrial base, higher education
From 5 June 2026 to 12 September 2026 the daily brief logged 2 observations of APT29 and rated it red on 2 days. Main aims: espionage. Main places: the United States.
Nation-State
Active campaignLazarus Group
High capability
Primary target set
Cryptocurrency exchanges, DeFi protocols, blockchain developers, defense industrial base, healthcare
From 5 June 2026 to 1 October 2026 the daily brief logged 25 observations of Lazarus Group and rated it red on 10 days. Main aims: financial gain and mixed aims. Main sectors: cryptocurrency, information technology and financial services.
Nation-State
Active campaignHandala Hack
High capability
Primary target set
Healthcare, defense, telecommunications, government, energy, financial services, manufacturing
From 5 June 2026 to 25 June 2026 the daily brief logged 3 observations of Handala Hack and rated it red on 3 days. Main aims: hacktivism and destruction. Main places: the United States and Israel.
Nation-State
Active campaignMuddyWater
Moderate capability
Primary target set
Government, telecommunications, defense, energy, critical infrastructure
The daily brief records observations only from 5 June 2026. It holds no observation count for 12 April 2026 to 30 May 2026. It rated MuddyWater red on 2 days.
Nation-State
Active campaignSalt Typhoon
High capability
Primary target set
Telecommunications, government, ISPs, universities, defense industrial base
From 5 June 2026 to 26 September 2026 the daily brief logged 27 observations of Salt Typhoon and rated it red on 10 days. Main aims: espionage. Main sectors: communications, government and critical manufacturing. Main places: the United States, worldwide and Argentina.
Cybercrime
Active campaignShinyHunters
High capability
Primary target set
Telecommunications, SaaS/cloud platforms, higher education, hospitality and gaming, fintech, food service and retail
From 5 June 2026 to 20 October 2026 the daily brief logged 33 observations of ShinyHunters and rated it red on 35 days. Main aims: financial gain. Main sectors: communications, government and education. Main places: the United States, worldwide and Europe.
Cybercrime
Active campaignTeamPCP
High capability
Primary target set
Open-source security tooling, CI/CD pipelines, cloud-native infrastructure, AI/ML platforms
From 5 June 2026 to 6 August 2026 the daily brief logged 8 observations of TeamPCP and rated it red on 22 days. Main aims: financial gain, espionage and mixed aims. Main sectors: information technology. Main places: the United States and worldwide.
Nation-State
Active campaignVolt Typhoon
High capability
Primary target set
Telecommunications, energy, water and wastewater, transportation systems, government facilities
From 5 June 2026 to 4 August 2026 the daily brief logged 12 observations of Volt Typhoon and rated it red on 4 days. Main aims: espionage and destruction. Main sectors: energy, water and communications. Main places: the United States, Guam and Singapore.
Nation-State
New intelUNC6508
High capability
Primary target set
Academic, medical, and military research institutions (North America)
GTIG + Mandiant disclosed (Jun 2026) a PRC-nexus cluster that sat undetected >1 year in North American research networks. Compromised public-facing REDCap servers with custom INFINITERED PHP malware; exfiltrated via an abused Workspace mail-compliance rule to attacker Gmail.
What is and is not on this page
I am working on additional profiles. They will land here when the source confidence and the analytical clarity match the bar set by the three already published. If you are tracking a specific actor and want to know whether a profile is in the queue, the contact form is the way to ask.
How the library is built
Every profile carries source attribution per the Admiralty rating system used by intelligence professionals. Each major claim carries a confidence label, enforced by the Zod schema in this site's content layer. MITRE ATT&CK group URL accompanies each profile. The Diamond Model, capability scoring, victimology, and TTP mapping follow standard CTI practice. The writing is mine. I do not republish vendor blog posts.
Brandon writes the profiles personally. See /work for the operator background →