RTT | Red Team Tools and Techniques

AD
admin@338
12
admin@338admin@338 is a China-based cyber threat group. It has previously used newsworthy even

AG
Agrius
22
Agrius · Pink Sandstorm · AMERICIUM +2Agrius is an Iranian threat actor active since 2020 notable for a series of ransomwar

AS
Ajax Security Team
6
Ajax Security Team · Operation Woolen-Goldfish · AjaxTM +3Ajax Security Team is a group that has been active since at least 2010 and believed t

AK
Akira
17
Akira · GOLD SAHARA · PUNK SPIDER +1Akira is a ransomware variant and ransomware deployment entity active since at least

AL
ALLANITE
4
ALLANITE · Palmetto FusionALLANITE is a suspected Russian cyber espionage group, that has primarily targeted th

AN
Andariel
12
Andariel · Silent Chollima · PLUTONIUM +1Andariel is a North Korean state-sponsored threat group that has been active since at

AD
Aoqin Dragon
9
Aoqin DragonAoqin Dragon is a suspected Chinese cyber espionage threat group that has been active

AP
AppleJeus
2
AppleJeus · Gleaming Pisces · Citrine Sleet +2AppleJeus is a North Korean state-sponsored threat group attributed to the Reconnaiss

AP
APT-C-23
0
APT-C-23 · Mantis · Arid Viper +5APT-C-23 is a threat group that has been active since at least 2014.(Citation: symant

AP
APT-C-36
38
APT-C-36 · Blind Eagle · TAG-144 +2APT-C-36 is a suspected South American threat group that has engaged in espionage and

AP
APT1
23
APT1 · Comment Crew · Comment Group +1APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the Peop

AP
APT12
5
APT12 · IXESHE · DynCalc +2APT12 is a threat group that has been attributed to China. The group has targeted a v

AP
APT16
1
APT16APT16 is a China-based threat group that has launched spearphishing campaigns targeti

AP
APT17
2
APT17 · Deputy DogAPT17 is a China-based threat group that has conducted network intrusions against U.S

AP
APT18
12
APT18 · TG-0416 · Dynamite Panda +1APT18 is a threat group that has operated since at least 2009 and has targeted a rang

AP
APT19
21
APT19 · Codoso · C0d0so0 +2APT19 is a Chinese-based threat group that has targeted a variety of industries, incl

AP
APT28
93
APT28 · IRON TWILIGHT · SNAKEMACKEREL +13APT28 is a threat group that has been attributed to Russia's General Staff Main Intel

AP
APT29
66
APT29 · IRON RITUAL · IRON HEMLOCK +12APT29 is threat group that has been attributed to Russia's Foreign Intelligence Servi

AP
APT3
44
APT3 · Gothic Panda · Pirpi +4APT3 is a China-based threat group that researchers have attributed to China's Minist

AP
APT30
2
APT30APT30 is a threat group suspected to be associated with the Chinese government. While

AP
APT32
78
APT32 · SeaLotus · OceanLotus +3APT32 is a suspected Vietnam-based threat group that has been active since at least 2

AP
APT33
31
APT33 · HOLMIUM · Elfin +1APT33 is a suspected Iranian threat group that has carried out operations since at le

AP
APT37
29
APT37 · InkySquid · ScarCruft +4APT37 is a North Korean state-sponsored cyber espionage group that has been active si

AP
APT38
56
APT38 · NICKEL GLADSTONE · BeagleBoyz +4APT38 is a North Korean state-sponsored threat group that specializes in financial cy

AP
APT39
53
APT39 · ITG07 · Chafer +1APT39 is one of several names for cyber espionage activity conducted by the Iranian M

AP
APT41
82
APT41 · Wicked Panda · Brass Typhoon +1APT41 is a threat group that researchers have assessed as Chinese state-sponsored esp

AP
APT42
32
APT42APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveill

AP
APT5
29
APT5 · Mulberry Typhoon · MANGANESE +3APT5 is a China-based espionage actor that has been active since at least 2007 primar

AP
Aquatic Panda
35
Aquatic PandaAquatic Panda is a suspected China-based threat group with a dual mission of intellig

AX
Axiom
16
Axiom · Group 72Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, d

BA
BackdoorDiplomacy
15
BackdoorDiplomacyBackdoorDiplomacy is a cyber espionage threat group that has been active since at lea

BI
BITTER
16
BITTER · T-APT-17BITTER is a suspected South Asian cyber espionage threat group that has been active s

BL
BlackByte
48
BlackByte · HecamedeBlackByte is a ransomware threat actor operating since at least 2021. BlackByte is as

BL
BlackOasis
1
BlackOasisBlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamm

BL
BlackTech
14
BlackTech · PalmerwormBlackTech is a suspected Chinese cyber espionage group that has primarily targeted or

BM
Blue Mockingbird
22
Blue MockingbirdBlue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mi

BG
Bouncing Golf
1
Bouncing GolfBouncing Golf is a cyberespionage campaign targeting Middle Eastern countries.(Citati

BB
BRONZE BUTLER
40
BRONZE BUTLER · REDBALDKNIGHT · TickBRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been ac

CA
Carbanak
9
Carbanak · AnunakCarbanak is a cybercriminal group that has used Carbanak malware to target financial

CH
Chimera
59
ChimeraChimera is a suspected China-based threat group that has been active since at least 2

CT
Cinnamon Tempest
19
Cinnamon Tempest · DEV-0401 · Emperor Dragonfly +1Cinnamon Tempest is a China-based threat group that has been active since at least 20

CL
Cleaver
5
Cleaver · Threat Group 2889 · TG-2889Cleaver is a threat group that has been attributed to Iranian actors and is responsib

CG
Cobalt Group
34
Cobalt Group · GOLD KINGSWOOD · Cobalt Gang +1Cobalt Group is a financially motivated threat group that has primarily targeted fina

CO
Confucius
19
Confucius · Confucius APTConfucius is a cyber espionage group that has primarily targeted military personnel,

CI
Contagious Interview
54
Contagious Interview · DeceptiveDevelopment · Gwisin Gang +4Contagious Interview is a North Korea–aligned threat group active since 2023. The gro

CO
CopyKittens
8
CopyKittensCopyKittens is an Iranian cyber espionage group that has been operating since at leas

CU
CURIUM
19
CURIUM · Crimson Sandstorm · TA456 +2CURIUM is an Iranian threat group, first reported in September 2019 and active since

CY
CyberAv3ngers
0
CyberAv3ngers · Soldiers of SolomanThe CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corp

DA
Daggerfly
17
Daggerfly · Evasive Panda · BRONZE HIGHLANDDaggerfly is a People's Republic of China-linked APT entity active since at least 201

DC
Dark Caracal
12
Dark CaracalDark Caracal is threat group that has been attributed to the Lebanese General Directo

DA
Darkhotel
24
Darkhotel · DUBNIUM · Zigzag HailDarkhotel is a suspected South Korean threat group that has targeted victims primaril

DA
DarkHydrus
7
DarkHydrusDarkHydrus is a threat group that has targeted government agencies and educational in

DA
DarkVishnya
10
DarkVishnyaDarkVishnya is a financially motivated threat actor targeting financial institutions

DP
Deep Panda
10
Deep Panda · Shell Crew · WebMasters +3Deep Panda is a suspected Chinese threat group known to target many industries, inclu

DR
Dragonfly
56
Dragonfly · TEMP.Isotope · DYMALLOY +7Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Sec

DR
DragonOK
0
DragonOKDragonOK is a threat group that has targeted Japanese organizations with phishing ema

EL
Earth Lusca
44
Earth Lusca · TAG-22 · Charcoal Typhoon +2Earth Lusca is a suspected China-based cyber espionage group that has been active sin

EL
Elderwood
9
Elderwood · Elderwood Gang · Beijing Group +1Elderwood is a suspected Chinese cyber espionage group that was reportedly responsibl

EB
Ember Bear
47
Ember Bear · UNC2589 · Bleeding Bear +4Ember Bear is a Russian state-sponsored cyber espionage group that has been active si

EQ
Equation
4
EquationEquation is a sophisticated threat group that employs multiple remote access tools. T

EV
Evilnum
11
EvilnumEvilnum is a financially motivated threat group that has been active since at least 2

EL
EXOTIC LILY
15
EXOTIC LILYEXOTIC LILY is a financially motivated group that has been closely linked with Wizard

FK
Ferocious Kitten
6
Ferocious KittenFerocious Kitten is a threat group that has primarily targeted Persian-speaking indiv

FI
FIN10
11
FIN10FIN10 is a financially motivated threat group that has targeted organizations in Nort

FI
FIN13
53
FIN13 · Elephant BeetleFIN13 is a financially motivated cyber threat group that has targeted the financial,

FI
FIN4
12
FIN4FIN4 is a financially-motivated threat group that has targeted confidential informati

FI
FIN5
11
FIN5FIN5 is a financially motivated threat group that has targeted personally identifiabl

FI
FIN6
40
FIN6 · Magecart Group 6 · ITG08 +3FIN6 is a cyber crime group that has stolen payment card data and sold it for profit

FI
FIN7
67
FIN7 · GOLD NIAGARA · ITG14 +3FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 ha

FI
FIN8
36
FIN8 · SyssphinxFIN8 is a financially motivated threat group that has been active since at least Janu

FK
Fox Kitten
41
Fox Kitten · UNC757 · Parisite +3Fox Kitten is threat actor with a suspected nexus to the Iranian government that has

GA
GALLIUM
31
GALLIUM · Granite TyphoonGALLIUM is a cyberespionage group that has been active since at least 2012, primarily

GA
Gallmaker
6
GallmakerGallmaker is a cyberespionage group that has targeted victims in the Middle East and

GG
Gamaredon Group
70
Gamaredon Group · IRON TILDEN · Primitive Bear +6Gamaredon Group is a suspected Russian cyber espionage group that has targeted milita

GC
GCMAN
2
GCMANGCMAN is a threat group that focuses on targeting banks for the purpose of transferri

GS
GOLD SOUTHFIELD
9
GOLD SOUTHFIELD · Pinchy SpiderGOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 th

GG
Gorgon Group
16
Gorgon GroupGorgon Group is a threat group consisting of members who are suspected to be Pakistan

GR
Group5
4
Group5Group5 is a threat group with a suspected Iranian nexus, though this attribution is n

HA
HAFNIUM
44
HAFNIUM · Operation Exchange Marauder · Silk TyphoonHAFNIUM is a likely state-sponsored cyber espionage group operating out of China that

HE
HEXANE
36
HEXANE · Lyceum · Siamesekitten +1HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunicati

HI
Higaisa
28
HigaisaHigaisa is a threat group suspected to have South Korean origins. Higaisa has targete

IR
INC Ransom
25
INC Ransom · GOLD IONICINC Ransom is a ransomware and data extortion threat group associated with the deploy

IN
Inception
22
Inception · Inception Framework · Cloud AtlasInception is a cyber espionage group active since at least 2014. The group has target

IN
IndigoZebra
7
IndigoZebraIndigoZebra is a suspected Chinese cyber espionage group that has been targeting Cent

IS
Indrik Spider
33
Indrik Spider · Evil Corp · Manatee Tempest +2Indrik Spider is a Russia-based cybercriminal group that has been active since at lea

KE
Ke3chang
46
Ke3chang · APT15 · Mirage +6Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has

KI
Kimsuky
130
Kimsuky · Black Banshee · Velvet Chollima +7Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group

LA
LAPSUS$
43
LAPSUS$ · DEV-0537 · Strawberry TempestLAPSUS$ is cyber criminal threat group that has been active since at least mid-2021.

LG
Lazarus Group
93
Lazarus Group · Labyrinth Chollima · HIDDEN COBRA +4Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the

LA
LazyScripter
20
LazyScripterLazyScripter is threat group that has mainly targeted the airlines industry since at

LE
Leafminer
17
Leafminer · RaspiteLeafminer is an Iranian threat group that has targeted government organizations and b

LE
Leviathan
50
Leviathan · MUDCARP · Kryptonite Panda +6Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed

LB
Lotus Blossom
21
Lotus Blossom · DRAGONFISH · Spring Dragon +4Lotus Blossom is a long-standing threat group largely targeting various entities in A

LU
LuminousMoth
28
LuminousMothLuminousMoth is a Chinese-speaking cyber espionage group that has been active since a

MA
Machete
11
Machete · APT-C-43 · El MacheteMachete is a suspected Spanish-speaking cyber espionage group that has been active si

MH
Magic Hound
78
Magic Hound · TA453 · COBALT ILLUSION +6Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-in

MA
Malteiro
12
MalteiroMalteiro is a financially motivated criminal group that is likely based in Brazil and

MG
Medusa Group
57
Medusa GroupMedusa Group has been active since at least 2021 and was initially operated as a clos

ME
menuPass
46
menuPass · Cicada · POTASSIUM +6menuPass is a threat group that has been active since at least 2006. Individual membe

ME
Metador
9
MetadorMetador is a suspected cyber espionage group that was first reported in September 202

MI
MirrorFace
43
MirrorFace · Earth KashaMirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believe

MO
Moafee
1
MoafeeMoafee is a threat group that appears to operate from the Guandong Province of China.

MO
Mofang
6
MofangMofang is a likely China-based cyber espionage group, named for its frequent practice

MO
Molerats
16
Molerats · Operation Molerats · Gaza CybergangMolerats is an Arabic-speaking, politically-motivated threat group that has been oper

MS
Moonstone Sleet
30
Moonstone Sleet · Storm-1789Moonstone Sleet is a North Korean-linked threat actor executing both financially moti

MS
Moses Staff
12
Moses Staff · DEV-0500 · Marigold SandstormMoses Staff is a suspected Iranian threat group that has primarily targeted Israeli c

MO
MoustachedBouncer
8
MoustachedBouncerMoustachedBouncer is a cyberespionage group that has been active since at least 2014

MU
MuddyWater
68
MuddyWater · Earth Vetala · MERCURY +6MuddyWater is a cyber espionage group assessed to be a subordinate element within Ira

MP
Mustang Panda
85
Mustang Panda · TA416 · RedDelta +13Mustang Panda is a China-based cyber espionage threat actor that has been conducting

MT
Mustard Tempest
12
Mustard Tempest · DEV-0206 · TA569 +2Mustard Tempest is an initial access broker that has operated the SocGholish distribu

NA
Naikon
14
NaikonNaikon is assessed to be a state-sponsored cyber espionage group attributed to the Ch

NE
NEODYMIUM
0
NEODYMIUMNEODYMIUM is an activity group that conducted a campaign in May 2016 and has heavily

NO
Nomadic Octopus
7
Nomadic Octopus · DustSquadNomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily

OI
OilRig
76
OilRig · COBALT GYPSY · IRN2 +9OilRig is a suspected Iranian threat group that has targeted Middle Eastern and inter

OR
Orangeworm
2
OrangewormOrangeworm is a group that has targeted organizations in the healthcare sector in the

PA
Patchwork
41
Patchwork · Hangover Group · Dropping Elephant +3Patchwork is a cyber espionage group that was first observed in December 2015. While

PI
PittyTiger
2
PittyTigerPittyTiger is a threat group believed to operate out of China that uses multiple diff

PL
PLATINUM
11
PLATINUMPLATINUM is an activity group that has targeted victims since at least 2009. The grou

PL
Play
26
PlayPlay is a ransomware group that has been active since at least 2022 deploying Playcr

PO
POLONIUM
7
POLONIUM · Plaid RainPOLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations,

PG
Poseidon Group
8
Poseidon GroupPoseidon Group is a Portuguese-speaking threat group that has been active since at le

PR
PROMETHIUM
11
PROMETHIUM · StrongPityPROMETHIUM is an activity group focused on espionage that has been active since at le

PP
Putter Panda
4
Putter Panda · APT2 · MSUpdaterPutter Panda is a Chinese threat group that has been attributed to Unit 61486 of the

RA
Rancor
9
RancorRancor is a threat group that has led targeted campaigns against the South East Asia

RE
RedCurl
41
RedCurlRedCurl is a threat actor active since 2018 notable for corporate espionage targeting

RE
RedEcho
5
RedEchoRedEcho is a People’s Republic of China-related threat actor associated with long-run

RO
Rocke
36
RockeRocke is an alleged Chinese-speaking adversary whose primary objective appeared to be

RT
RTM
7
RTMRTM is a cybercriminal group that has been active since at least 2015 and is primaril

SB
Saint Bear
18
Saint Bear · Storm-0587 · TA471 +2Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeti

ST
Salt Typhoon
14
Salt TyphoonSalt Typhoon is a People's Republic of China (PRC) state-backed actor that has been a

ST
Sandworm Team
79
Sandworm Team · ELECTRUM · Telebots +8Sandworm Team is a destructive threat group that has been attributed to Russia's Gene

SM
Scarlet Mimic
1
Scarlet MimicScarlet Mimic is a threat group that has targeted minority rights activists. This gro

SS
Scattered Spider
64
Scattered Spider · Roasted 0ktapus · Octo Tempest +2Scattered Spider is a native English-speaking cybercriminal group active since at lea

ST
Sea Turtle
27
Sea Turtle · Teal Kurma · Marbled Dust +2Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing esp

SH
ShinyHunters
46
ShinyHunters · UNC6240 · Bling LibraShinyHunters is a cyber criminal collective that has been active since at least 2019

SI
SideCopy
16
SideCopySideCopy is a Pakistani threat group that has primarily targeted South Asian countrie

SI
Sidewinder
30
Sidewinder · T-APT-04 · RattlesnakeSidewinder is a suspected Indian threat actor group that has been active since at lea

SI
Silence
28
Silence · Whisper SpiderSilence is a financially motivated threat actor targeting financial institutions in d

SL
Silent Librarian
13
Silent Librarian · TA407 · COBALT DICKENSSilent Librarian is a group that has targeted research and proprietary data at univer

SI
SilverTerrier
4
SilverTerrierSilverTerrier is a Nigerian threat group that has been seen active since 2014. Silver

SO
Sowbug
9
SowbugSowbug is a threat group that has conducted targeted attacks against organizations in

SB
Star Blizzard
20
Star Blizzard · SEABORGIUM · Callisto Group +2Star Blizzard is a cyber espionage and influence group originating in Russia that has

SF
Stealth Falcon
16
Stealth FalconStealth Falcon is a threat group that has conducted targeted spyware attacks against

ST
Storm-0501
42
Storm-0501Storm-0501 is a financially motivated cyber criminal group that uses commodity and op

ST
Storm-1811
31
Storm-1811Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deploym

ST
Strider
3
Strider · ProjectSauronStrider is a threat group that has been active since at least 2011 and has targeted v

SU
Suckfly
5
SuckflySuckfly is a China-based threat group that has been active since at least 2014. (Cita

TA
TA2541
28
TA2541TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, tran

TA
TA459
5
TA459TA459 is a threat group believed to operate out of China that has targeted countries

TA
TA505
34
TA505 · Hive0065 · Spandex Tempest +1TA505 is a cyber criminal group that has been active since at least 2014. TA505 is kn

TA
TA551
14
TA551 · GOLD CABIN · ShathakTA551 is a financially-motivated threat group that has been active since at least 201

TA
TA577
6
TA577TA577 is an initial access broker (IAB) that has distributed QakBot and Pikabot, and

TA
TA578
4
TA578TA578 is a threat actor that has used contact forms and email to initiate communicati

TE
TeamPCP
36
TeamPCP · PCPCat · ShellForce +3TeamPCP is a financially-motivated, cloud-native threat group that has been active si

TE
TeamTNT
56
TeamTNTTeamTNT is a threat group that has primarily targeted cloud and containerized environ

TE
TEMP.Veles
0
TEMP.Veles · XENOTIMETEMP.Veles is a Russia-based threat group that has targeted critical infrastructure.

TW
The White Company
7
The White CompanyThe White Company is a likely state-sponsored threat actor with advanced capabilities

TG
Threat Group-1314
4
Threat Group-1314 · TG-1314Threat Group-1314 is an unattributed threat group that has used compromised credentia

TG
Threat Group-3390
57
Threat Group-3390 · Earth Smilodon · TG-3390 +6Threat Group-3390 is a Chinese threat group that has extensively used strategic Web c

TH
Thrip
4
ThripThrip is an espionage group that has targeted satellite communications, telecoms, and

TO
ToddyCat
25
ToddyCatToddyCat is a sophisticated threat group that has been active since at least 2020 usi

TT
Tonto Team
15
Tonto Team · Earth Akhlut · BRONZE HUNTLEY +2Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that h

TT
Transparent Tribe
14
Transparent Tribe · COPPER FIELDSTONE · APT36 +2Transparent Tribe is a suspected Pakistan-based threat group that has been active sin

TT
Tropic Trooper
40
Tropic Trooper · Pirate Panda · KeyBoyTropic Trooper is an unaffiliated threat group that has led targeted campaigns agains

TU
Turla
68
Turla · IRON HUNTER · Group 88 +7Turla is a cyber espionage threat group that has been attributed to Russia's Federal

UN
UNC3886
49
UNC3886UNC3886 is a China-nexus cyberespionage group that has been active since at least 202

UN
UNC788
1
UNC788UNC788 is a group of hackers from Iran that has targeted people in the Middle East.(C

VA
Velvet Ant
22
Velvet AntVelvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated

VM
VOID MANTICORE
63
VOID MANTICORE · COBALT MYSTIQUE · Handala Hack +5VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of

VC
Volatile Cedar
5
Volatile Cedar · Lebanese CedarVolatile Cedar is a Lebanese threat group that has targeted individuals, companies, a

VT
Volt Typhoon
81
Volt Typhoon · BRONZE SILHOUETTE · Vanguard Panda +5Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has bee

WG
Water Galura
3
Water Galura · GOLD FEATHERWater Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle

WH
Whitefly
9
WhiteflyWhitefly is a cyber espionage group that has been operating since at least 2017. The

WI
Windigo
7
WindigoThe Windigo group has been operating since at least 2011, compromising thousands of L

WI
Windshift
19
Windshift · BahamutWindshift is a threat group that has been active since at least 2017, targeting speci

WG
Winnti Group
6
Winnti Group · BlackflyWinnti Group is a threat group with Chinese origins that has been active since at lea

WV
Winter Vivern
27
Winter Vivern · TA473 · UAC-0114Winter Vivern is a group linked to Russian and Belorussian interests active since at

WI
WIRTE
26
WIRTE · Ashen LepusWIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Ga

WS
Wizard Spider
64
Wizard Spider · UNC1878 · TEMP.MixMaster +8Wizard Spider is a Russia-based financially motivated threat group originally known f

ZI
ZIRCONIUM
29
ZIRCONIUM · APT31 · Violet TyphoonZIRCONIUM is a threat group operating out of China, active since at least 2017, that

Select an APT from the list to view its details.