APT
ATLAS
Atlas
Actors
145
Names
507
Sectors
40
⌘K
▸
sign in
Atlas
Actors
145
Names
507
Sectors
40
LOADING
Actors
/
Nation-state / APT
/
Asia
APT34
G0049
APT
IR · Iran
AKA
Crambus · IRN2 · ITG13 · EUROPIUM · OilRig · ATK40 · Earth Winona · Chrysene
Microsoft
:
Hazel Sandstorm
CrowdStrike
:
HELIX KITTEN
Secureworks
:
COBALT GYPSY
Proofpoint
:
TA452
MITRE
:
G0049
Targets
21
Sectors
12
Threat types
1
GIRs mapped
0/480
Active since
2014
Explore in atlas
Save actor
Share
Export
STIX 2.1
ATT&CK Navigator
Also tracked as
6 vendor names · 8 other aliases
Open Rosetta Stone
CrowdStrike
HELIX KITTEN
Mandiant
APT34
Microsoft
Hazel Sandstorm
MITRE
G0049
Proofpoint
TA452
Secureworks
COBALT GYPSY
UNATTRIBUTED ALIASES
Crambus
IRN2
ITG13
EUROPIUM
OilRig
ATK40
Earth Winona
Chrysene
Victimology
Geographic footprint · 21 countries
Export STIX
origin · Iran
targeted countries · 21
ASIA ·
13
United Arab Emirates
·
Azerbaijan
·
Bahrain
·
Israel
·
Iraq
·
Jordan
·
Kuwait
·
Lebanon
·
Qatar
·
Saudi Arabia
·
Syria
·
Türkiye
·
Yemen
OCEANIA ·
1
Australia
AMERICAS ·
2
Colombia
·
United States
AFRICA ·
3
Egypt
·
Mauritius
·
South Africa
EUROPE ·
2
France
·
United Kingdom
Sectors targeted
12 of 40
Government
100 actors
Defense
72 actors
Financial Services
73 actors
Technology
60 actors
Telecom
71 actors
Energy / Utilities
58 actors
Oil and Gas
21 actors
Education & Research
62 actors
Manufacturing (man)
49 actors
Media & Journalism
48 actors
Chemicals
20 actors
Private Sector (generic)
29 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
ESP · Espionage
MITRE ATT&CK · 55 techniques
Initial Access
· 4
T1195
Supply Chain Compromise
T1566.001
Spearphishing Attachment
T1566.002
Spearphishing Link
T1566.003
Spearphishing via Service
Execution
· 8
T1047
Windows Management Instrumentation
Persistence
· 2
T1137.004
Outlook Home Page
Privilege Escalation
· 1
T1068
Exploitation for Privilege Escalation
Credential Access
· 8
T1003.001
LSASS Memory
Discovery
· 10
T1007
System Service Discovery
T1012
Query Registry
Lateral Movement
· 2
T1021.001
Remote Desktop Protocol
T1021.004
SSH
Collection
· 5
T1005
Data from Local System
T1025
Data from Removable Media
T1113
Screen Capture
Exfiltration
· 1
T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol
Command And Control
· 6
T1008
Fallback Channels
T1071.001
Web Protocols
T1071.004
DNS
Defense Impairment
· 1
T1112
Modify Registry
Stealth
· 7
T1036
Masquerading
T1036.005
Match Legitimate Resource Name or Location
T1070.004
File Deletion
GIR mappings
0 / 480 requirements mapped
Open matrix
No GIRs mapped yet for this actor.
References
No supporting references have been recorded for this profile. Treat uncited claims as unverified.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
55 techniques · layer format 4.5
Related actors
By origin and actor type
Agrius
nation-state
Iran · 2 targets · since 2020
AppleJeus
nation-state
North Korea · 25 targets · since 2018
APT1
nation-state
China · 17 targets · since 2006
APT10
nation-state
China · 19 targets · since 2009
APT12
nation-state
China · 11 targets · since 2009
APT14
nation-state
China · 15 targets · since —
T1053.005
Scheduled Task
T1059
Command and Scripting Interpreter
T1059.001
PowerShell
T1059.003
Windows Command Shell
T1059.005
Visual Basic
T1203
Exploitation for Client Execution
T1204.001
Malicious Link
T1543.003
Windows Service
T1003.004
LSA Secrets
T1003.005
Cached Domain Credentials
T1110
Brute Force
T1552.001
Credentials In Files
T1555
Credentials from Password Stores
T1555.003
Credentials from Web Browsers
T1555.004
Windows Credential Manager
T1016
System Network Configuration Discovery
T1033
System Owner/User Discovery
T1046
Network Service Discovery
T1049
System Network Connections Discovery
T1057
Process Discovery
T1069.001
Local Groups
T1120
Peripheral Device Discovery
T1201
Password Policy Discovery
T1115
Clipboard Data
T1119
Automated Collection
T1105
Ingress Tool Transfer
T1219
Remote Access Tools
T1573.002
Asymmetric Cryptography
T1078
Valid Accounts
T1078.002
Domain Accounts
T1140
Deobfuscate/Decode Files or Information
T1218.001
Compiled HTML File