Threat Actor Groups Guide: APTs, Ransomware Gangs and Naming

The same intrusion set can appear under five or more names, so defenders who track threat actors by label alone end up with duplicated, conflicting or misleading intelligence. APT28, Fancy Bear, Forest Blizzard and Sofacy are associated names for one cluster, while "Lazarus" is used by some researchers as an umbrella for several North Korean units. This guide explains how vendors and MITRE ATT&CK name groups, gives reference tables of state-linked, criminal and hacktivist groups with their ATT&CK Group IDs, and shows how to turn group intelligence into detections and tests. It is for threat intelligence analysts, detection engineers and security leaders. Group facts come from ATT&CK v20 entries and national advisories; where ATT&CK states no sponsor, none is claimed.

Key takeaways

• A group is an activity cluster, not a confirmed organisation. ATT&CK defines groups as "activity clusters that are tracked by a common name in the security community" and warns that it does not represent associated names "as exact overlaps".
• Vendor names encode a claim. Microsoft's Typhoon means China and Tempest means financially motivated; CrowdStrike's BEAR means Russia and SPIDER means criminal. Read the name as that vendor's attribution.
• Use the ATT&CK Group ID as your join key. Map every vendor alias to one Gxxxx ID in your threat intelligence platform so reports about Midnight Blizzard, Cozy Bear and APT29 land on one profile (G0016).
• Prioritise behaviours shared by your relevant groups. In ATT&CK v20, 49 groups are mapped to T1078 Valid Accounts and 79 to T1566.001 Spearphishing Attachment, so a few controls cover many actors.
• Identity is the common thread. Volt Typhoon "primarily relies on valid credentials for persistence", and Scattered Spider talked help desks into resetting passwords and MFA tokens.

What a threat actor group is

An advanced persistent threat (APT) is an actor, usually state-linked, that pursues targets over long periods and adapts when blocked. Criminal groups can be as persistent, so the useful distinction is motivation: espionage, pre-positioning, destruction, theft, extortion or political messaging.

• Cluster first, name later: analysts group intrusions by shared infrastructure, tooling and tradecraft. Mandiant calls immature clusters UNC ("uncategorized") groups, "a cluster of cyber intrusion activity ... that we are not yet ready to give a classification such as APT or FIN". Clusters "can grow, merge with, or break off from other clusters", and the road from UNC to an APT or FIN group "typically takes years".
• Groups versus campaigns: ATT&CK tracks around 180 groups (G IDs) and, separately, campaigns (C IDs): bounded sets of intrusions with first and last seen dates, sometimes attributed to a group and sometimes not.
• Groups versus software: malware families (S IDs) are often shared; several groups have used Carbanak malware, so ATT&CK tracks FIN7 and Carbanak separately. See the Malware Guide.
• Personas: some state actors publish under hacktivist-style names; ATT&CK lists HomeLand Justice and Handala Hack as personas of VOID MANTICORE.

How threat actor naming schemes work

Older Microsoft reports use chemical-element names (STRONTIUM for APT28, ZINC for Lazarus Group, HAFNIUM). Microsoft publishes a JSON and Excel alias mapping and a KQL helper, GetThreatActorAlias("ZINC"), that resolves current, previous and other vendors' names. In ATT&CK alias lists, KITTEN names appear on Iran-linked groups, CHOLLIMA on North Korean groups, and IRON, BRONZE, COBALT, NICKEL and GOLD prefixes on Russia-, China-, Iran-, North Korea-linked and criminal groups respectively.

State-linked groups: reference tables

Sponsor and focus are as stated in each ATT&CK entry. "Also tracked as" is a selection of associated names, not exact equivalents.

Russia-linked

China-linked

North Korea and Iran

Other state-linked and regional groups in ATT&CK: APT32 (G0050, OceanLotus, Canvas Cyclone; suspected Vietnam), Dark Caracal (G0070; Lebanese General Directorate of General Security), SideCopy (G1008; Pakistan) and Gorgon Group (G0078; Pakistan-linked, criminal and targeted), Darkhotel (G0012; suspected South Korea, hotel networks) and Higaisa (G0126; suspected South Korean origins), APT-C-36 (G0099, Blind Eagle; suspected South American), and Molerats (G0021, Gaza Cybergang) with its subgroup WIRTE (G0090).

Financially motivated groups and ransomware crews

Also in ATT&CK: TA2541 (G1018), FIN10 (G0051), SilverTerrier (G0083, Nigerian), Malteiro (G1026, Mispadu), GCMAN (G0036) and DarkVishnya (G0105) against banks, Poseidon Group (G0033), Windigo (G0124, Ebury botnet) and Blue Mockingbird (G0108, Monero mining). See the Ransomware Prevention Guide.

Hacktivists and personas

CrowdStrike names hacktivists JACKALs. Treat their claims as unverified: CISA notes that "several of these claimed compromises of critical infrastructure organizations in Israel are false" for CyberAv3ngers (G1027), yet the same persona compromised at least 75 Unitronics PLC devices in the US, reached over default TCP port 20256 with default or no passwords. Ajax Security Team (G0130) moved from defacement to espionage by 2014.

Other names tracked

China-linked per ATT&CK: APT12 (G0005), APT16 (G0023), APT17 (G0025), APT19 (G0073), APT30 (G0013), admin@338 (G0018), Aoqin Dragon (G1007), BlackTech (G0098), Elderwood (G0066), IndigoZebra (G0136), LuminousMoth (G1014), Mofang (G0103), Moafee (G0002), PittyTiger (G0011), RedEcho (G1042), Suckfly (G0039), Tonto Team (G0131). Iran-linked: Leafminer (G0077), CopyKittens (G0052); Group5 (G0043) is only a suspected nexus. Russian-speaking: Nomadic Octopus (G0133), RedCurl (G1039). No sponsor stated: APT18 (G0026), BackdoorDiplomacy (G0135), BlackOasis (G0063), DarkHydrus (G0079), DragonOK (G0017), Equation (G0020, Equation Group), Ferocious Kitten (G0137), Gallmaker (G0084), LazyScripter (G0140), Metador (G1013), MoustachedBouncer (G1019), Orangeworm (G0071), PROMETHIUM (G0056), Scarlet Mimic (G0029), Sowbug (G0054), Threat Group-1314 (G0028), Thrip (G0076), ToddyCat (G1022), Tropic Trooper (G0081), Whitefly (G0107), Windshift (G0112) and APT-C-23 (G1028).

Named campaigns in ATT&CK

Where identity fits

Many headline groups do not break in; they sign in. Identity techniques in ATT&CK v20:

CISA reports Volt Typhoon kept footholds "for at least five years" and repeatedly dumped domain credential databases; the NCSC says Star Blizzard used EvilGinx to capture credentials and session cookies, mostly from personal webmail. The Storm-0501 hybrid cloud attacks show criminal crews abusing directory sync identities in the same way.

Using group intelligence for defence

MITRE's Center for Threat-Informed Defense defines threat-informed defence as "the systematic application of a deep understanding of adversary tradecraft and technology", combining intelligence, defensive measures, and testing and evaluation. It focuses on behaviour because behaviour "is more stable over time" than indicators.

1. Build a relevance shortlist: pick 5 to 15 groups whose stated targeting matches your sector, geography and technology, using ATT&CK and national advisories, not news volume. See the Threat Intelligence Guide.
2. Create a crosswalk: record every vendor alias against the Gxxxx ID, the source and the confidence. Never merge two IDs because one vendor treats them as one.
3. Layer the techniques: in ATT&CK Navigator, create one layer per group, combine them and score each technique by how many shortlisted groups use it.
4. Compare with coverage: build a second layer of validated detections and prevention controls. Gaps on high-score techniques become the backlog. See the Detection Engineering Guide.
5. Pilot new detections safely: run new analytics in log-only or alert-to-queue mode for two to four weeks, tune, then promote. Roll back by disabling the rule version, not by deleting it, so tuning history survives.
6. Test against emulation plans: the CTID Adversary Emulation Library publishes full plans for APT29, FIN6, FIN7, menuPass, OceanLotus (APT32), OilRig, Sandworm, Turla, Carbanak, Blind Eagle and Wizard Spider, plus micro plans. MITRE states they are to be used only with "appropriate prior, explicit authorization". Start with micro plans in a lab or pilot ring, then run full plans as purple team exercises.
7. Refresh quarterly: ATT&CK releases add, revoke and merge groups.

Choosing an approach

• Behaviour-first versus actor-first: most organisations should prioritise techniques shared across many groups (90 groups use T1105 Ingress Tool Transfer, 86 use T1059.001 PowerShell). Track individual actors closely only when evidence shows they target your sector, as Volt Typhoon targets water utilities.
• Small organisations: adopt national advisory mitigations and track three to five groups; a formal actor programme rarely pays off.
• Large organisations: keep the crosswalk in a threat intelligence platform, run quarterly emulation and report coverage per priority group.

Attribution caveats

• Overlaps are partial: ATT&CK states that organisations' definitions "may partially overlap" and "may disagree on specific activity". Salt Typhoon's entry lists RedMike and GhostEmperor as activity that resembles it, not as aliases.
• Umbrella names hide units: ATT&CK notes that North Korean group definitions overlap significantly and some researchers report all of it as Lazarus Group.
• Labels lag evidence: Microsoft's Storm-#### and Mandiant's UNC names mark immature clusters; Mandiant warns that "UNC churn can get messy".
• Motive can mislead: Cinnamon Tempest sits in Microsoft's financially motivated family, yet ATT&CK suggests it may serve espionage; APT41 mixes both.
• Confidence words matter: joint advisories use calibrated language such as "almost certainly". Quote it rather than upgrading it.

Detection, measurement and framework mapping

• Priority coverage: share of shortlisted groups' techniques with a validated detection or prevention control.
• Advisory-to-hunt time: days from a national advisory on a relevant group to a completed hunt.
• Emulation detection rate: emulation steps detected, and mean time to detect, per exercise.
• Crosswalk completeness: share of intelligence reports in your platform resolved to an ATT&CK Group ID.
• Identity exposure: admin accounts without phishing-resistant MFA or with standing domain admin rights.

Common failure patterns

• Treating aliases as identical: merging two vendors' clusters imports activity the actor never did and corrupts prioritisation.
• Chasing indicators: blocking published IP addresses misses actors that live off the land and proxy through compromised routers, as Volt Typhoon and the ORB networks behind SPACEHOP and FLORAHOX do.
• Ignoring identity paths: APT29 reached executive mailboxes through a legacy test tenant and an OAuth app in the Microsoft Midnight Blizzard breach; no malware detection would have stopped it.
• Underrating social engineering: the MGM Resorts breach began with a help desk call, and the ShinyHunters Salesforce campaign used phone calls and malicious connected apps. See the Account Recovery and Help Desk Security Guide.
• Assuming telecom and network gear is out of scope: the Salt Typhoon telecom intrusions relied on network device secrets; NCSC New Zealand's alert on the joint advisory says these actors "often modify routers to maintain persistent, long-term access".
• Believing persona claims: hacktivist personas exaggerate and state services hide behind them. Verify impact first.

Practitioner checklist

• Maintain an alias crosswalk keyed on ATT&CK Group IDs, with source and confidence for every mapping.
• Shortlist groups whose documented targeting matches your sector, region and technology; review quarterly.
• Build Navigator layers per priority group plus a coverage layer, and track the gap.
• Enforce phishing-resistant MFA and separate admin accounts first; T1078 is shared by 49 groups.
• Harden help desk password and MFA resets against Scattered Spider-style calls.
• Pilot new group-driven detections in log-only mode, then promote with version control and a rollback path.
• Run authorised emulation from the CTID library, starting with micro plans.
• Report attribution with the source's confidence words and treat persona claims as unverified.

Standards and references

• MITRE ATT&CK: Groups
• Microsoft Learn: How Microsoft names threat actors
• CISA: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
• NCSC: Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns
• CISA and FBI: Scattered Spider (AA23-320A)
• MITRE Center for Threat-Informed Defense: Adversary Emulation Library
• Google Cloud (Mandiant): DebUNCing Attribution: How Mandiant Tracks Uncategorized Threat Actors
• CrowdStrike: Naming Adversaries and Why It Matters to Your Security Team

Related NHI Mgmt Group resources: Threat Intelligence Guide · Detection Engineering Guide · Ransomware Prevention Guide · Malware Guide · Incident Response Guide