Brandon Karpf
Threat actors
Browse the library
Filter by region, category, or recent update. Each profile opens in full: Diamond Model, capability scoring, victimology, TTPs, IOCs, sources.
| Name | Type | Attribution | Capability | Status | Last Updated |
|---|---|---|---|---|---|
| APT28 | Nation-State | Russian GRU 85th Main Special Service Center (Unit 26165) | high | 🔴 | 20 Oct 26 |
| APT44 | Nation-State | Russian GRU Unit 74455 (Main Centre for Special Technologies / GTsST) | high | 🔴 | 20 Oct 26 |
| APT29 | Nation-State | Russian Foreign Intelligence Service (SVR) | high | 🔴 | 20 Oct 26 |
| Lazarus Group | Nation-State | DPRK Reconnaissance General Bureau, 3rd Bureau | high | 🔴 | 20 Oct 26 |
| Handala Hack | Nation-State | Iran Ministry of Intelligence and Security (MOIS) | high | 🔴 | 20 Oct 26 |
| MuddyWater | Nation-State | Iranian Ministry of Intelligence and Security (MOIS) | moderate | 🔴 | 20 Oct 26 |
| Salt Typhoon | Nation-State | PRC Ministry of State Security | high | 🔴 | 20 Oct 26 |
| ShinyHunters | Cybercrime | Loose criminal collective; overlaps with Scattered Spider and LAPSUS$ under the Scattered Lapsus$ Hunters (SLSH) banner | high | 🔴 | 20 Oct 26 |
| TeamPCP | Cybercrime | Self-described loose-knit collective; no confirmed state nexus; spokesperson handle T00001B | high | 🔴 | 20 Oct 26 |
| Volt Typhoon | Nation-State | PRC state-sponsored; assessed PLA / MSS nexus (specific unit not publicly attributed) | high | 🔴 | 20 Oct 26 |
| UNC6508 | Nation-State | PRC-nexus (specific sponsoring unit unconfirmed) | high | 🔴 | 21 Jun 26 |
Nation-State: PRC
- 🔴 Salt Typhoon · 20 Oct 26
- 🔴 Volt Typhoon · 20 Oct 26
- 🔴 UNC6508 · 21 Jun 26
Nation-State: Iran
- 🔴 Handala Hack · 20 Oct 26
- 🔴 MuddyWater · 20 Oct 26
Nation-State: DPRK
- 🔴 Lazarus Group · 20 Oct 26
Cybercriminal / Ransomware
- 🔴 ShinyHunters · 20 Oct 26
- 🔴 TeamPCP · 20 Oct 26
- 20 Oct 26 APT28
From 5 June 2026 to 20 October 2026 the daily brief logged 4 observations of APT28 and rated it red on 2 days. Main aims: espionage. Main places: Romania, Russia and Spain.
- 20 Oct 26 APT44
From 5 June 2026 to 14 October 2026 the daily brief logged 8 observations of APT44 and rated it red on 7 days. Main sectors: government, energy and food and agriculture. Main places: Ukraine, Germany and the Czech Republic.
- 20 Oct 26 APT29
From 5 June 2026 to 12 September 2026 the daily brief logged 2 observations of APT29 and rated it red on 2 days. Main aims: espionage. Main places: the United States.
- 20 Oct 26 Lazarus Group
From 5 June 2026 to 1 October 2026 the daily brief logged 25 observations of Lazarus Group and rated it red on 10 days. Main aims: financial gain and mixed aims. Main sectors: cryptocurrency, information technology and financial services.
- 20 Oct 26 Handala Hack
From 5 June 2026 to 25 June 2026 the daily brief logged 3 observations of Handala Hack and rated it red on 3 days. Main aims: hacktivism and destruction. Main places: the United States and Israel.
- 20 Oct 26 MuddyWater
The daily brief records observations only from 5 June 2026. It holds no observation count for 12 April 2026 to 30 May 2026. It rated MuddyWater red on 2 days.
- 20 Oct 26 Salt Typhoon
From 5 June 2026 to 26 September 2026 the daily brief logged 27 observations of Salt Typhoon and rated it red on 10 days. Main aims: espionage. Main sectors: communications, government and critical manufacturing. Main places: the United States, worldwide and Argentina.
- 20 Oct 26 ShinyHunters
From 5 June 2026 to 20 October 2026 the daily brief logged 33 observations of ShinyHunters and rated it red on 35 days. Main aims: financial gain. Main sectors: communications, government and education. Main places: the United States, worldwide and Europe.
- 20 Oct 26 TeamPCP
From 5 June 2026 to 6 August 2026 the daily brief logged 8 observations of TeamPCP and rated it red on 22 days. Main aims: financial gain, espionage and mixed aims. Main sectors: information technology. Main places: the United States and worldwide.
- 20 Oct 26 Volt Typhoon
From 5 June 2026 to 4 August 2026 the daily brief logged 12 observations of Volt Typhoon and rated it red on 4 days. Main aims: espionage and destruction. Main sectors: energy, water and communications. Main places: the United States, Guam and Singapore.
- 21 Jun 26 UNC6508
GTIG + Mandiant disclosed (Jun 2026) a PRC-nexus cluster that sat undetected >1 year in North American research networks. Compromised public-facing REDCap servers with custom INFINITERED PHP malware; exfiltrated via an abused Workspace mail-compliance rule to attacker Gmail.