index
Advanced persistent threats profiled from public sources. Filter by attributed country, motivation, sector or region, or show only groups with documented activity in Latin America.
Showing 8 of 8 groups
Blind Eagle · BlindEagle · TAG-144
Group that MITRE describes as a suspected South American actor, active since at least 2018, combining espionage and financial fraud against government, banking, energy and other sectors in Colombia, Ecuador and the rest of Latin America.
Fancy Bear · Forest Blizzard · STRONTIUM
Cyberespionage group attributed by the U.S. and the UK to Unit 26165 of Russia's GRU (85th GTsSS), active since at least 2004 against governments, defense, logistics and political organizations.
Cozy Bear · Midnight Blizzard · NOBELIUM
Cyberespionage group attributed by the U.S. and the UK to Russia's Foreign Intelligence Service (SVR), active since at least 2008; responsible for the SolarWinds compromise and for persistent intrusions into cloud and identity environments.
APT41 · Wicked Panda · Brass Typhoon
Chinese group that combines state-sponsored espionage with operations for personal profit, active since at least 2012 against healthcare, telecommunications, technology, government and the video game industry.
Velvet Chollima · Emerald Sleet · THALLIUM
North Korean cyberespionage group active since at least 2012, focused on foreign policy, national security and nuclear issues on the Korean Peninsula, that targets governments, think tanks, academia and defense through spearphishing and social engineering.
Labyrinth Chollima · Diamond Sleet · ZINC
North Korean state-sponsored group attributed to the Reconnaissance General Bureau (RGB), active since at least 2009, that combines espionage, sabotage and financial theft against banking, crypto assets and defense, with documented cases in Latin America.
Seedworm · TEMP.Zagros · Static Kitten
Cyberespionage group that the FBI, CISA, US Cyber Command and the UK's NCSC identify as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). Active since at least 2017 against governments, telecommunications, energy and finance.
Sandworm Team · APT44 · FROZENBARENTS
Sabotage and espionage unit attributed to Russia's GRU Unit 74455, active since at least 2009 and responsible for the blackouts in Ukraine and for NotPetya, one of the most destructive cyberattacks on record.