Actors/Nation-state / APT/Unattributed

TEMP.Reaper

APT?? · Unattributed

AKA Group 123 · Reaper · APT37 · ScarCruft

CrowdStrike: RICOCHET COLLIEMicrosoft: Ruby Sleet

Targets5

Sectors11

Threat types1

GIRs mapped0/480

Active since—

Explore in atlas

Also tracked as

3 vendor names · 4 other aliases

Open Rosetta Stone

CrowdStrike

RICOCHET COLLIE

Mandiant

TEMP.Reaper

Microsoft

Ruby Sleet

UNATTRIBUTED ALIASESGroup 123ReaperAPT37ScarCruft

Victimology

Geographic footprint · 5 countries

Export STIX

origin · unattributedtargeted countries · 5

ASIA · 3

Hong Kong · South Korea · Vietnam

EUROPE · 1

Russia

AMERICAS · 1

United States

Sectors targeted

11 of 40

Government100 actors Defense72 actors Financial Services73 actors Retail & Hospitality32 actors NGOs & Dissidents56 actors Education & Research62 actors Manufacturing (man)49 actors Media & Journalism48 actors Logistics21 actors Food and Beverage9 actors Dissidents (as targets)16 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 0 techniques

No TTPs mapped yet.

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer0 techniques · layer format 4.5

Related actors

By origin and actor type