Phishing

The MITRE ATT&CK framework is a globally accessible, continuously updated knowledge base that catalogs the tactics, techniques, and procedures (TTPs) used by cyber adversaries, based on real-world observations. ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. Developed by the MITRE Corporation in 2013, its primary purpose is to help organizations model, detect, prevent, and respond to cybersecurity threats by understanding how attackers operate—not just what artifacts they leave behind.

UNC5174 is a Chinese state-sponsored threat actor, widely assessed by multiple cybersecurity firms—including Mandiant, Sysdig, and HivePro—as operating on behalf of the Chinese government, potentially as a contractor for agencies such as the Ministry of State Security. The group is noted for its sophisticated cyber espionage operations and has been active since at least 2023.

APT28, also known as Fancy Bear, Sofacy, Forest Blizzard, and several other aliases, is a Russian state-sponsored cyber espionage group attributed to the GRU’s 85th Main Special Service Center (military unit 26165). Active since at least 2004, APT28 is recognized for its advanced cyber operations targeting governments, military, defense, technology, logistics, and media sectors worldwide.

APT37 is a North Korean state-sponsored cyber espionage group active since at least 2012, also known by aliases such as ScarCruft, Reaper, and Group123. The group primarily targets South Korea but has expanded operations to Japan, Vietnam, Russia, the Middle East, and other regions. APT37 is believed to operate under North Korea’s Ministry of State Security and is known for targeting government, defense, technology, telecommunications, and academic sectors.

APT35 is an Iranian state-sponsored cyber espionage group, also known by aliases such as Charming Kitten, Phosphorus, Newscaster, Magic Hound, Mint Sandstorm, and others. The group is believed to be affiliated with the Islamic Revolutionary Guard Corps (IRGC) and has been active since at least 2014. APT35 is known for conducting long-term, resource-intensive operations aimed at collecting strategic intelligence and supporting Iranian geopolitical interests.