APT
ATLAS
Atlas
Actors
145
Names
507
Sectors
40
⌘K
▸
sign in
Atlas
Actors
145
Names
507
Sectors
40
LOADING
Actors
/
Cybercrime
/
Europe
FIN11
G0092
CRIME
RU · Russia
AKA
Hive0065 · ATK103 · SectorJ04 · Dudear · Chimborazo
Microsoft
:
Lace Tempest
Proofpoint
:
TA505
CrowdStrike
:
GRACEFUL SPIDER
MITRE
:
G0092
Targets
25
Sectors
15
Threat types
2
GIRs mapped
0/480
Active since
2017
Explore in atlas
Save actor
Share
Export
STIX 2.1
ATT&CK Navigator
Also tracked as
5 vendor names · 5 other aliases
Open Rosetta Stone
CrowdStrike
GRACEFUL SPIDER
Mandiant
FIN11
Microsoft
Lace Tempest
MITRE
G0092
Proofpoint
TA505
UNATTRIBUTED ALIASES
Hive0065
ATK103
SectorJ04
Dudear
Chimborazo
Victimology
Geographic footprint · 25 countries
Export STIX
origin · Russia
targeted countries · 25
AMERICAS ·
7
Argentina
·
Bermuda
·
Brazil
·
Chile
·
Colombia
·
Guatemala
·
Mexico
EUROPE ·
13
Austria
·
Belgium
·
Germany
·
Denmark
·
Finland
·
France
·
United Kingdom
·
Hungary
·
Luxembourg
·
Latvia
·
Netherlands
·
Poland
·
Portugal
ASIA ·
5
Israel
·
India
·
South Korea
·
Malaysia
·
Thailand
Sectors targeted
15 of 40
Government
100 actors
Financial Services
73 actors
Pharmaceutical
26 actors
Telecom
71 actors
Retail & Hospitality
32 actors
NGOs & Dissidents
56 actors
Energy / Utilities
58 actors
Education & Research
62 actors
Manufacturing (man)
49 actors
Logistics
21 actors
Hospitality
32 actors
Chemicals
20 actors
Consumer Goods / Electronics
19 actors
Agriculture & Food
18 actors
Maritime
24 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
FIN · Financial Fraud
RAN · Ransomware
MITRE ATT&CK · 22 techniques
Initial Access
· 2
T1566.001
Spearphishing Attachment
T1566.002
Spearphishing Link
Execution
· 6
T1059.001
PowerShell
T1059.003
Credential Access
· 2
T1552.001
Credentials In Files
Impact
· 1
T1486
Data Encrypted for Impact
Command And Control
· 2
T1071.001
Web Protocols
Defense Impairment
· 2
T1112
Modify Registry
Stealth
· 7
T1027.002
Software Packing
GIR mappings
0 / 480 requirements mapped
Open matrix
No GIRs mapped yet for this actor.
References
No supporting references have been recorded for this profile. Treat uncited claims as unverified.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
22 techniques · layer format 4.5
Related actors
By origin and actor type
APT28
nation-state
Russia · 25 targets · since 2007
APT29
nation-state
Russia · 25 targets · since 2008
APT44
nation-state
Russia · 25 targets · since 2009
DEV-0537
cybercrime
unattributed · 7 targets · since 2021
Ember Bear
nation-state
Russia · 16 targets · since 2020
Evil Corp
cybercrime
Russia · 11 targets · since 2007
Windows Command Shell
T1059.005
Visual Basic
T1059.007
JavaScript
T1106
Native API
T1204.001
Malicious Link
T1555.003
Credentials from Web Browsers
T1105
Ingress Tool Transfer
T1685
Disable or Modify Tools
T1027.010
Command Obfuscation
T1055.001
Dynamic-link Library Injection
T1078.002
Domain Accounts
T1140
Deobfuscate/Decode Files or Information
T1218.007
Msiexec
T1218.011
Rundll32