Actors by country of origin

GRU military intelligence unit behind the 2016 DNC hack, WADA and OPCW intrusions, and sustained targeting of NATO logistics.

GRU · Unit 26165

Russia's SVR foreign intelligence service. Executed the SolarWinds supply-chain compromise and remains the benchmark for patient, cloud-native espionage.

The only actor to have caused blackouts with malware — twice. GRU Unit 74455, responsible for NotPetya, Industroyer, and the Ukrainian grid attacks.

GRU · Unit 74455

FSB Centre 16. The oldest continuously active espionage group on record — known for hijacking satellite links and stealing other nations' operations outright.

FSB · Centre 16

FSB officers operating from occupied Crimea, publicly named by Ukraine's security service. Enormous volume, minimal sophistication, relentlessly focused on Ukraine.

FSB · 18th Centre / Crimean directorate

FSB Centre 16's energy-sector programme. Spent a decade inside Western electric utilities collecting engineering data — access, not effect.

FSB · Centre 16

FSB Centre 18 credential phishing against academics, journalists, NGOs, and former intelligence officials — with hack-and-leak as the follow-through.

FSB · Centre 18

Pre-positioning inside U.S. critical infrastructure with no collection payoff — access held for five years for use in a future conflict.

Compromised the core of U.S. telecommunications — including the lawful intercept systems used for court-ordered wiretaps.

State espionage by day, cybercrime by night. Indicted operators ran MSS-aligned intrusions and personal money-making schemes from the same infrastructure.

Ran the ProxyLogon mass exploitation that web-shelled tens of thousands of Exchange servers, then pivoted to attacking the IT supply chain.

Operation Cloud Hopper — compromised managed service providers to reach their clients' networks, turning outsourced IT into a single point of failure.

Ministry of State Security (MSS) · Huaying Haitai Science and Technology Development Co. (front company)

MSS Hainan bureau running maritime and naval technology collection — and among the fastest actors at weaponising new vulnerabilities.

Ministry of State Security (MSS) · Hainan Xiandun Technology Development Co. (front company)

The highest-volume Chinese espionage operation against Europe and Southeast Asia — and the subject of an FBI operation that deleted its malware from 4,258 U.S. computers.

MSS Hubei bureau targeting politicians, election infrastructure, and dissidents — sanctioned by both the U.S. and U.K. in March 2024.

Ministry of State Security (MSS) · Wuhan Xiaoruizhi Science and Technology Company (front company)

PLA Unit 61398. The first threat group ever publicly attributed to a specific military unit — the report that created the modern threat intelligence industry.

People's Liberation Army · Unit 61398

IRGC-linked social engineering specialists. Will spend weeks impersonating a journalist or academic before ever sending a link.

Islamic Revolutionary Guard Corps (IRGC) · IRGC-affiliated contractors, including Emennet Pasargad and Mahak Rayan Afraz

MOIS operation against Gulf energy and government. Had its source code and operator identities leaked on Telegram — then kept operating.

Iran's Ministry of Intelligence, named as such by U.S. Cyber Command. Runs espionage almost entirely on legitimate remote-management software.

Aerospace and petrochemical collection with a destructive edge — linked to the Shamoon wiper attacks that destroyed 30,000 Saudi Aramco workstations.

IRGC cyber unit operating under a hacktivist persona. Defaced water-utility PLCs across the U.S. by exploiting a default password.

IRGC · IRGC-CEC

The only state actor whose primary mission is theft. Stole $1.5 billion from a single exchange in 2025 — the largest heist in history, of any kind.

RGB · Lab 110 / 3rd Bureau

The bank-robbery specialists. Attempted $1.1 billion in theft from financial institutions, and destroys the evidence on the way out.

RGB · Bluenoroff / financial operations element

DPRK's policy-intelligence collectors. Impersonate journalists and academics to reach the small community of people who shape North Korea policy.

RGB · Assessed within the RGB structure

Prolific browser zero-day developer, focused on South Korean targets and North Korean defectors.

Steals defence and nuclear technology, then funds the operation with ransomware against hospitals. An indicted RGB officer remains at large.

RGB · 3rd Bureau (Andariel / Onyx Sleet)

Vietnamese collection against foreign firms operating in-country, regional neighbours, and dissidents abroad — with unusually elaborate web infrastructure.

Pakistani collection aimed almost exclusively at Indian military and government targets, increasingly through Android implants.

One of the highest-volume phishing operations in Asia, aimed at Pakistani and Chinese government targets — and increasingly at maritime shipping.

Belarusian military intelligence running information operations — compromises real journalists' accounts to publish fabricated stories under their bylines.

Caused physical damage to a steel mill and published the CCTV footage. Operates under a hacktivist persona with capability no hacktivist has.

Native English-speaking teenagers who talk their way past help desks. No exploits, no zero-days — just a convincing phone call.

Abandoned encryption for pure data-theft extortion. Its MOVEit campaign hit 2,700+ organisations from a single vulnerability.

The most prolific ransomware-as-a-service operation ever run — until law enforcement seized its infrastructure and used its own leak site to publish the takedown.

Ran a fake security company that hired real penetration testers who did not know they were committing crimes. Stole over $1 billion.