Threat Groups & Cyber Syndicates
Adversary collectives formally attributed in United States federal court indictments, CISA alerts, and allied intelligence statements.
Key Facts
- 16 cybercrime syndicates and state-sponsored APT groups cataloged.
- Attribution derived strictly from sworn federal indictments, CISA advisories, and Treasury sanctions.
- Cross-referenced with MITRE ATT&CK Group IDs and known forensic aliases.
APT28
Aliases: Fancy Bear, Sofacy, Sednit, STRONTIUM, Unit 26165
Attribution: U.S. Department of Justice Indictment (D.D.C.)
REvil / Sodinokibi
Aliases: Sodinokibi, Gold Southfield
Attribution: U.S. Department of Justice (N.D. Tex.) & Europol Operation GoldDust
Sandworm Team
Aliases: Telebots, Voodoo Bear, Iron Viking, Unit 74455, BlackEnergy Group
Attribution: U.S. Department of Justice Indictment (W.D. Pa.) & CISA
APT29
Aliases: Cozy Bear, Nobelium, Midnight Blizzard, The Dukes, SVR
Attribution: CISA Advisory AA20-352A & White House Statement
LockBit Ransomware Group
Aliases: LockBit 2.0, LockBit 3.0, LockBit Black, LockBit Green
Attribution: U.S. Department of Justice (D.N.J.) & NCA Operation Cronos
Volt Typhoon
Aliases: BRONZE SILHOUETTE, Vanguard Panda, Insidious Taurus
Attribution: CISA, FBI, NSA Joint Cybersecurity Advisory
Lazarus Group
Aliases: HIDDEN COBRA, Guardians of Peace, Zinc, APT38, Labyrinth Chollima
Attribution: U.S. Department of Justice Indictment (C.D. Cal.)
Evil Corp
Aliases: Indiktor, Dridex Gang
Attribution: U.S. Department of Justice (W.D. Pa.) & OFAC Sanctions
FIN7
Aliases: Carbanak Group, Navigator Group, ELBRUS
Attribution: U.S. Department of Justice Indictments (W.D. Wash.)
DarkSide
Aliases: BlackMatter, ALPHV Affiliate
Attribution: CISA Advisory AA21-131A & DOJ Forfeiture Actions
ALPHV / BlackCat
Aliases: BlackCat, Noberus
Attribution: DOJ Takedown & CISA Joint Advisory AA23-353A
Wizard Spider
Aliases: Trickbot Group, Conti, UNC1878, Grim Spider
Attribution: U.S. Department of Justice Indictment (N.D. Ohio)
PLA Unit 61398
Aliases: APT1, Comment Crew, TG-8223
Attribution: U.S. Department of Justice Indictment (W.D. Pa., May 2014)
IRGC Cyber-Electronic Command
Aliases: CyberAv3ngers, Shahid Shoushtari, Cotton Sandstorm
Attribution: U.S. Department of Justice (W.D. Pa.) & CISA Advisory AA23-335A
Salt Typhoon
Aliases: GhostEmperor, FamousSparrow
Attribution: CISA & FBI Joint Statement on Telecommunications Infiltration
CL0P
Aliases: TA505, FIN11, Lace Tempest
Attribution: CISA Advisory AA23-158A (MOVEit Campaign)