{"id":617,"date":"2026-07-29T22:31:21","date_gmt":"2026-07-29T22:31:21","guid":{"rendered":"https:\/\/cyberasia.io\/?page_id=617"},"modified":"2026-08-05T07:57:13","modified_gmt":"2026-08-05T07:57:13","slug":"threat-actors","status":"publish","type":"page","link":"https:\/\/cyberasia.io\/threat-actors\/","title":{"rendered":"Threat Actors"},"content":{"rendered":"<div class=\"wp-block-group terminal-container\">\n<div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<h1 class=\"wp-block-heading\">[.\/actors] Threat Intelligence Reports<\/h1>\n<p class=\"wp-block-paragraph\">Below is the consolidated index of documented threat actors and our published intelligence reports covering their recent campaigns and TTPs.<\/p>\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n<h2 class=\"wp-block-heading\">1. 313 Team<\/h2>\n<p class=\"wp-block-paragraph\">A hacktivist group known for conducting politically motivated defacements and DDoS attacks, often supporting Islamic causes.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/313-team-ddos-attack-saudi-airport\/\">313 Team DDoS Attack: 1 Massive Cyber Strike on Saudi Airport<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/microsoft-365-ddos-attack-iraqi-313-team-claims-massive-cloud-disruption\/\">Microsoft 365 DDoS Attack: Iraqi &#8216;313 Team&#8217; Claims Massive Cloud Disruption<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">2. APT41<\/h2>\n<p class=\"wp-block-paragraph\">A prolific Chinese state-sponsored cyber threat group known for conducting state-backed cyber espionage and financially motivated operations.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-intelligence\/earth-longzhi-and-the-byovd-threat-bypassing-windows-kernel-security-in-southeast-asia\/\">Earth Longzhi and the BYOVD Threat: Bypassing Windows Kernel Security in Southeast Asia<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">3. coinbasecartel<\/h2>\n<p class=\"wp-block-paragraph\">A ransomware syndicate focused on exfiltrating sensitive corporate and healthcare data, extorting victims for cryptocurrency payments.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ransomware\/coinbasecartel-ransomware-mim-fertility-patient-data\/\">coinbasecartel Ransomware Hits MIM Fertility: Patient Data at Risk<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">4. Cozy Bear (APT29)<\/h2>\n<p class=\"wp-block-paragraph\">A highly sophisticated Russian state-sponsored espionage group known for high-profile supply chain attacks and intelligence gathering.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-espionage\/laundry-bear-apt-exploit-russian-hackers-target-western-defense-2\/\">Laundry Bear APT Exploit: Russian Hackers Target Western Defense<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">5. Cyber Team Indonesia<\/h2>\n<p class=\"wp-block-paragraph\">Hacktivist group claiming international data leaks and targeting foreign digital infrastructure.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/hacktivism\/cyber-team-indonesia-claims-data-leak-targeting-france\/\">Cyber Team Indonesia Claims Data Leak Targeting France<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/data-breaches\/cyber-team-indonesia-claims-leak-of-200000-alleged-icmr-records\/\">Cyber Team Indonesia Claims Leak of 200,000 Alleged ICMR Records<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">6. CyberAv3ngers<\/h2>\n<p class=\"wp-block-paragraph\">An Iran-aligned hacktivist group targeting critical infrastructure, particularly water and energy sectors in Israel and the US.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/us-water-systems-cyberattacks-30-facilities-disrupted-in-minnesota-2\/\">US Water Systems Cyberattacks: 30 Facilities Disrupted in Minnesota<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/us-water-systems-cyberattacks-30-facilities-disrupted-in-minnesota\/\">US Water Systems Cyberattacks: 30 Facilities Disrupted in Minnesota<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">7. Dark Storm Team<\/h2>\n<p class=\"wp-block-paragraph\">Hacktivist collective targeting government institutions and critical infrastructure, utilizing distributed denial-of-service (DDoS) as their primary vector of attack.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/dark-storm-team-romania-cyberattack-government\/\">Dark Storm Team Romania Cyberattack: Government Institutions Targeted<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/darkstorm-ddos-romania-port-attack\/\">Pro-Russian Hacktivists, DarkStorm Team Claim DDoS Attacks on Romanian Port Systems<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">8. Deadlock Ransomware<\/h2>\n<p class=\"wp-block-paragraph\">A financially motivated ransomware operation targeting enterprise engineering and manufacturing firms.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ransomware\/deadlock-ransomware-tesco-engineer-thailand-august-2026\/\">Deadlock Ransomware Claims Attack on Thai Engineering Firm Tesco Engineer Co.<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">9. Dewata Blackhat<\/h2>\n<p class=\"wp-block-paragraph\">An Indonesian hacktivist group involved in website defacements and data leaks targeting regional governments.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/data-breaches\/indonesian-hacktivists-claim-data-breach-of-russian-retail-giant-m-video\/\">Indonesian Hacktivists Claim Data Breach of Russian Retail Giant M.video<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/data-breaches\/indonesian-hacktivists-target-russian-state-employment-portal-in-massive-data-leak\/\">Indonesian Hacktivists Target Russian State Employment Portal in Massive Data Leak<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/data-breaches\/sri-rakum-school-for-the-blind-targeted-in-data-leak-by-dewata-blackhat\/\">Sri Rakum School for the Blind Targeted in Data Leak by Dewata Blackhat<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/data-breaches\/conexus-mobile-alliance-target-of-data-leak-by-dewata-blackhat-hacktivist-group\/\">Conexus Mobile Alliance Target of Data Leak by Dewata Blackhat Hacktivist Group<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">10. DragonForce Ransomware<\/h2>\n<p class=\"wp-block-paragraph\">A financially motivated ransomware gang known for utilizing double extortion tactics against large enterprises.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ransomware\/dragonforce-ransomware-attack-hoc-global-solutions-claimed-in-canada\/\">DragonForce Ransomware Attack: HOC Global Solutions Claimed in Canada<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">11. FEMBOYSec<\/h2>\n<p class=\"wp-block-paragraph\">Hacktivist collective claiming responsibility for unauthorized data breaches and public leaks.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/hacktivism\/femboysec-intelligence-agency-leaks-vietnam-health-data\/\">FEMBOYSec Claims Data Breach and Leak<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-intelligence\/femboy-hacktivists-spread-pornography-after-bizarre-isis-data-breach\/\">Femboy Hacktivists Spread Pornography After Bizarre global extremist network Data Breach<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/database-leak\/femboy-intelligence-agency-claims-massive-breach-of-isis-terrorist-data\/\">Femboy Intelligence Agency Claims Massive Breach of global extremist network extremist threat actor Data<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">12. Garuda Kernel Error System<\/h2>\n<p class=\"wp-block-paragraph\">Hacktivist cell responsible for coordinated DDoS attacks against European infrastructure.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/garuda-kernel-error-system-claims-france-ddos-attacks\/\">Garuda Kernel Error System Claims France DDoS Attacks<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">13. HANDALA<\/h2>\n<p class=\"wp-block-paragraph\">A pro-Palestinian hacktivist group targeting Israeli critical infrastructure and telecommunications with disruptive wiper malware and DDoS attacks.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/who-is-handala\/\">Who is HANDALA?<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/iran-cyber-offensive-overwhelming-israels-digital-infrastructure-in-2026\/\">Iran Cyber Offensive: Overwhelming Israel&#8217;s Digital Infrastructure in 2026<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-intelligence\/under-digital-siege-israel-faces-4800-cyber-attacks-monthly-amid-regional-escalation\/\">Under Digital Siege: Israel Faces 4,800 Cyber Attacks Monthly Amid Regional Escalation<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">14. INC Ransomware<\/h2>\n<p class=\"wp-block-paragraph\">Ransomware operation known for exploiting zero-day vulnerabilities in enterprise edge infrastructure.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ransomware\/inc-ransomware-sonicwall-sma1000-zero-day-cve-2026-15409\/\">INC Ransomware Exploits Critical SonicWall SMA 1000 Zero-Days CVE-2026-15409 and CVE-2026-15410<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">15. INDOHAXSEC<\/h2>\n<p class=\"wp-block-paragraph\">An Indonesian hacktivist collective engaging in politically motivated defacements and data leaks.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/defacement\/indohaxsec-hacker-claims-attack-on-beecloud-critical-threat-to-israeli-cloud-infrastructure-2026-threat-advisory\/\">IndoHaxSec Hacker Claims Attack on BeeCloud: Critical Threat to Israeli Cloud Infrastructure ,  2026 Threat Advisory<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">16. Infrastructure Destruction Squad<\/h2>\n<p class=\"wp-block-paragraph\">Initial access brokers selling network access to critical infrastructure on the dark web.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/infrastructure-destruction-squad-sells-saudi-access-for-2000-dark-web-scam-or-real-threat\/\">Infrastructure Destruction Squad Sells Saudi Access for $2000: Dark Web Scam or Real Threat?<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">17. JADEPUFFER<\/h2>\n<p class=\"wp-block-paragraph\">The first documented fully autonomous AI ransomware agent capable of independent vulnerability discovery, exploitation, and encryption without human oversight.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ransomware\/jadepuffer-ai-ransomware-autonomous-cyber-attack\/\">JADEPUFFER AI Ransomware: 1st Autonomous Cyber Attack<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">18. JundAlNabi<\/h2>\n<p class=\"wp-block-paragraph\">Threat group involved in compromising health and hygiene portals and government databases.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/blog\/jundalnabi-pitb-data-breach-punjab-health\/\">JundAlNabi PITB Data Breach: Punjab Health and Hygiene Portal Compromised<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">19. KARAWANG ERROR SYSTEM<\/h2>\n<p class=\"wp-block-paragraph\">Cyber threat group claiming massive data leaks from major e-commerce platforms.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/data-leak\/karawang-error-system-claims-taobao-data-leak\/\">KARAWANG ERROR SYSTEM Claims Massive Data Leak Allegedly Targeting Taobao Users<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">20. Laundry Bear APT<\/h2>\n<p class=\"wp-block-paragraph\">State-sponsored or highly sophisticated APT group targeting Western defense and intelligence sectors.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-espionage\/laundry-bear-apt-exploit-russian-hackers-target-western-defense\/\">Laundry Bear APT Exploit: Russian Hackers Target Western Defense<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">21. Lazarus Group<\/h2>\n<p class=\"wp-block-paragraph\">A notorious North Korean state-sponsored threat group responsible for massive financial heists, cryptocurrency theft, and disruptive cyber espionage.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-actors\/lazarus-group-on-the-move-north-korean-hackers-shift-7-9m-in-stolen-bitcoin-3\/\">Lazarus Group On The Move: North Korean Hackers Shift $7.9M in Stolen Bitcoin<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">22. LunarisSec<\/h2>\n<p class=\"wp-block-paragraph\">A cyber extortion and hacktivist group known for targeting corporate networks and leaking sensitive operational data.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/vulnerability\/hacktivist-group-lunarissec-threatens-eu-over-chat-control-law\/\">Hacktivist Group LunarisSec Threatens EU Over &#8220;Chat Control&#8221; Law<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">23. N1ghtSp1d3rz<\/h2>\n<p class=\"wp-block-paragraph\">Hacktivist group specializing in mass-defacement and breaches of Middle Eastern government websites.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/hacktivism\/n1ghtsp1d3rz-iran-hack-claim-300-websites\/\">N1ghtSp1d3rz Claims to Hack Over 300 Iranian Government Websites<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">24. NoName057(16)<\/h2>\n<p class=\"wp-block-paragraph\">Pro-Russian hacktivist group notorious for conducting widespread DDoS attacks against government agencies and critical infrastructure in countries supporting Ukraine.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/noname05716-romania-ddos-polaris-m-holding\/\">NoName057(16) Romania DDoS: Pro-Russian Hacktivists Target Waste Management Infrastructure<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/noname057-takes-down-romanian-resources-opromania\/\">NoName057(16) Claims DDoS Attack Campaign<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cctv-compromised\/noname057-opromania-cctv-hack-iot-breach\/\">NoName057(16) OpRomania CCTV Hack: Pro-Russian Hacktivists Target Retail IoT<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/hacktivism\/noname05716-targets-romanian-port-infrastructure-and-logistics-under-opromania-banner\/\">NoName057(16) Targets Romanian Port Infrastructure and Logistics Under OpRomania Banner<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/opromania-noname05716-expands-ddos-campaign-against-romanian-infrastructure\/\">#OpRomania: NoName057(16) Expands DDoS Campaign Against Romanian Infrastructure<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-actors\/opromania-z-pentest-alliance-breaches-smart-heating-systems-in-romanian-homes\/\">#OpRomania: Z-Pentest Alliance Breaches Smart Heating Systems in Romanian Homes<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-actors\/opromania-noname05716-breaches-industrial-hydraulic-press-systems\/\">#OpRomania: NoName057(16) Breaches Industrial Hydraulic Press Systems<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/darkstorm-ddos-romania-port-attack\/\">Pro-Russian Hacktivists, DarkStorm Team Claim DDoS Attacks on Romanian Port Systems<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/noname05716-resumes-opromania-ddos-attacks-target-shipping-and-logistics-sector\/\">NoName057(16) Resumes #OpRomania: DDoS Attacks Target Shipping and Logistics Sector<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/noname05716-targets-romania-claims-breach-of-rcn-solutions-hmi-at-major-glass-factory\/\">NoName057(16) Targets Romania: Claims Breach of RCN Solutions HMI at Major Glass Factory<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/noname057-strikes-raja-sa-water-supply-portals-opromania-ddos\/\">NoName057(16) Strikes RAJA S.A. Water Supply Portals in #OpRomania DDoS Attack<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">25. OilRig<\/h2>\n<p class=\"wp-block-paragraph\">An Iranian state-sponsored threat actor focused on cyber espionage against Middle Eastern governments and telecommunications.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-intelligence\/inside-apt34-saudi-arabia-attacks-ttps-and-mitigations\/\">Inside APT34 Saudi Arabia Attacks: TTPs and Mitigations<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">26. Qilin<\/h2>\n<p class=\"wp-block-paragraph\">A ransomware-as-a-service (RaaS) operation known for aggressive double extortion tactics targeting healthcare, education, and critical infrastructure.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ransomware\/qilins-double-extortion-why-backups-cannot-save-you-anymore\/\">Qilin&#8217;s Double Extortion: Why Backups Cannot Save You Anymore<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">27. RansomHouse<\/h2>\n<p class=\"wp-block-paragraph\">Cyber extortion group known for disrupting global supply chains and corporate networks.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/blog\/nichirei-corp-cyberattack-ransomhouse\/\">Nichirei Corp Cyberattack: RansomHouse Disrupts Food Supply Chain<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">28. RipperSec<\/h2>\n<p class=\"wp-block-paragraph\">Documented cyber threat actor tracked by CyberAsia intelligence.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/rippersec-ddos-israel-tourism-portal\/\">RipperSec DDoS Israel: National Tourism Portal Knocked Offline in #OpZionistV2<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/rippersec-the-comrades-group-attack-the-korea-times-is-south-korea-involved-in-genocide-in-palestine\/\">RipperSec &amp; The Comrade&#8217;s Group Attack The Korea Times: Is South Korea Involved in Genocide in Palestine?<\/a> (Aug 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/south-korea-cyber-attacks-surge-19-5-how-generative-ai-and-supply-chain-breaches-are-fueling-the-crisis\/\">South Korea Cyber Attacks Surge 19.5%: How Generative AI and Supply Chain Breaches Are Fueling the Crisis<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/rippersec-launch-attack-against-network-school-due-ties-with-israeli\/\">RipperSec Launch Attack Against Network School Due Ties With Israeli<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/ddos\/israeli-lgbtq-and-cyber-conference-sites-hit-by-widespread-outages\/\">Israeli LGBTQ and Cyber Conference Sites Hit by Widespread Outages<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">29. Sandworm<\/h2>\n<p class=\"wp-block-paragraph\">A highly destructive Russian military cyber unit responsible for catastrophic attacks on the Ukrainian power grid and the NotPetya wiper.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/global-cyber-news\/googles-solution-to-hacker-name-confusion-yet-another-naming-system\/\">Google\u2019s solution to hacker name confusion? Yet another naming system<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/global-cyber-news\/malware-is-targeting-ai-tools-in-software-development-environments\/\">Malware is targeting AI tools in software development environments<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">30. Scattered Spider<\/h2>\n<p class=\"wp-block-paragraph\">A financially motivated cybercriminal syndicate notorious for sophisticated social engineering and SIM swapping to breach large Western enterprises.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-espionage\/scattered-spider-hacker-arrested-in-finland-extradited-to-the-fbi-2\/\">Scattered Spider Hacker Arrested in Finland Extradited to the FBI<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-espionage\/scattered-spider-hacker-arrested-in-finland-extradited-to-the-fbi\/\">Scattered Spider Hacker Arrested in Finland Extradited to the FBI<\/a> (Jul 2026)<\/li>\n<li><a href=\"https:\/\/cyberasia.io\/article\/global-cyber-news\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\">Scattered Spider Hackers Plead Guilty on Day 1 of Trial<\/a> (Jun 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">31. ShinyHunters<\/h2>\n<p class=\"wp-block-paragraph\">A prominent cybercriminal group specializing in massive corporate data breaches and selling stolen databases on underground forums.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/threat-intelligence\/identity-centric-attacks-2026-mega-breaches-us-australia\/\">Identity-Centric Attacks: Inside the 2026 Mega-Breaches Hitting US and Australian Critical Infrastructure<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">32. TELESHIM and MIXEDKEY<\/h2>\n<p class=\"wp-block-paragraph\">East Asian threat actors utilizing messaging platforms for cyber espionage and intelligence gathering.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/teleshim-and-mixedkey-east-asian-threat-actors-using-telegram-to-spy-on-the-middle-east\/\">TELESHIM and MIXEDKEY: East Asian Threat Actors Using Telegram to Spy on the Middle East<\/a> (Jul 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">33. GUNRA<\/h2>\n<p class=\"wp-block-paragraph\">A ransomware group operating a dark web leak site where they extort victims by threatening to publish stolen corporate data. Their targets typically include high-revenue manufacturing entities.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/gunra-ransomware-worldtube-breach\/\">GUNRA Ransomware Hits Worldtube: What Defenders Need to Know<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">34. Nullsec Nigeria<\/h2>\n<p class=\"wp-block-paragraph\">A hacktivist\/extortion group known for making fabricated or exaggerated data breach claims on Telegram, often using recycled or irrelevant data to build false reputation.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/cyber-threats\/nullsec-nigeria-banned-fake-china-university-breach\/\">Nullsec Nigeria Banned Within 24 Hours of Fake China University Breach<\/a> (Aug 2026)<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">35. Cyber Team Indonesia<\/h2>\n<p class=\"wp-block-paragraph\">A hacktivist coalition from Indonesia targeting e-commerce and generic domains, often using geopolitical narratives like Palestine solidarity as a smokescreen to promote localized campaigns such as #OpIndo and anti-corruption messages.<\/p>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyberasia.io\/article\/defacement\/cyber-team-indonesia-ecommerce-opindo-corruption-protest\/\">Cyber Team Indonesia Defaces E-Commerce Site Under #OpIndo to Protest Corruption<\/a> (Aug 2026)<\/li>\n<\/ul>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>[.\/actors] Threat Intelligence Reports Below is the consolidated index of documented threat actors and our published intelligence reports covering their recent campaigns and TTPs. 1. 313 Team A hacktivist group known for conducting politically motivated defacements and DDoS attacks, often supporting Islamic causes. 313 Team DDoS Attack: 1 Massive Cyber Strike on Saudi Airport (Jul [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-threat-actors.php","meta":{"footnotes":""},"class_list":["post-617","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/pages\/617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/comments?post=617"}],"version-history":[{"count":13,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/pages\/617\/revisions"}],"predecessor-version":[{"id":1366,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/pages\/617\/revisions\/1366"}],"wp:attachment":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media?parent=617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}