Maljean/dataset huggingface dataset:
Targeting of Iranian reformists
Date: 2021-08-04
Affiliations: Charming Kitten, Phosphorous
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Reformist politicians in Iran

Iranian-linked threat actor Charming Kitten deployed Android malware and WhatsApp exploits to spy on reformist politicians within the country. The Android malware, known as LittleLooter, was especially sophisticated and was able to record almost all actions taken on a compromised device.
Targeting of Polish dissidents with Pegasus spyware
Date: 2021-12-23
Affiliations: Believed to be the work of the Polish government.
Sponsor: Poland
Type: Espionage
Category: Civil society
Victims: Ewa Wrzosek, Krzysztof Brezja, and Roman Giertych

The Polish government is accused of installing the NSO Group's Pegasus spyware onto the mobile phones of several opposition politicians. Senator Krzysztof Brezja, one of the most prominent victims of the attack, has accused the government of using stolen text messages in attack advertisements directed against him in the 2019 presidential race.
APT 36
Date: 2020-03-16
Affiliations: Also known as Mythic Leopard, Transparent Tribe, TMP.Lapis, ProjectM, C-Major, and SideCopy.
Sponsor: Pakistan
Victims: India

Pakistani government-aligned threat actor that has used fake coronavirus health information to phish targets.
Disruption of operations at Shahid Rajaee Port
Date: 2020-05-19
Affiliations: Israel
Sponsor: Israel
Type: Sabotage
Category: Private sector
Victims: Shahid Rajaee Port in Iran

Israel retaliated against Iran for targeting of Israeli water treatment and sewage facilities by launching a cyberattack against Iran’s Shahid Rajaee Port, disrupting its operations.
Response: Confirmation   https://www.jpost.com/breaking-news/cyber-attack-targets-iranian-port-near-strait-of-hormuz-627616
Targeting of UN officials
Date: 2020-08-28
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: UN officials, including those affiliated with the UN Security Council

North Korean hackers launched a spear-phishing campaign that disguised malware as UN security alerts and interview requests. At least twenty-eight UN officials, eleven of whom represented six members of the UN Security Council, were targeted.
Targeting of Japanese companies and global subsidiaries
Date: 2020-11-17
Affiliations: APT 10
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japan-linked companies and managed service providers abroad

APT 10 used a wide range of tools, many publicly available, to infect Japanese companies and their global subsidiaries with malware for reconnaissance purposes.
Targeting of Ukraine with coronavirus phishing emails
Date: 2020-03-13
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Ukrainian citizens

The Russian hackers Hades (aka APT 28) targeted Ukraine with coronavirus-themed phishing emails. At the same time, viral disinformation about the virus spread in Ukraine, causing riots.
Targeting of email servers using Exim mail transfer agent
Date: 2020-05-28
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Espionage
Category: Private sector, Government, Military, Civil society
Victims: Exim mail server users

Hackers from Sandworm exploited a zero-day vulnerability in Exim mail transfer agent software, which runs on email servers around the world, granting them the ability to remotely execute commands on the compromised servers.
Response: Denouncement   https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/2196511/exim-mail-transfer-agent-actively-exploited-by-russian-gru-cyber-actors/
Targeting of the Norwegian parliament’s email system
Date: 2020-10-13
Affiliations: Government of Russia
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Norwegian politicians and parliament employees

Russian hackers compromised email accounts of Norwegian politicians and parliament employees. The intrusion occurred months after Norway warned that “Russia shows increased willingness and ability to use a wide range of instruments to achieve its political goals.”
Response: Confirmation   https://www.regjeringen.no/en/aktuelt/datainnbruddet-i-stortinget/id2770135/
Targeting of thirty-six Al Jazeera employees’ iPhones
Date: 2020-12-20
Affiliations: Saudi and Emirati governments
Sponsor: Saudi Arabia, United Arab Emirates
Type: Espionage
Category: Private sector
Victims: Al Jazeera employees

Government operators from Saudi Arabia and the United Arab Emirates used Pegasus, spyware developed by NSO Group, to compromise the iPhones of thirty-six employees of the Doha-based Al Jazeera news agency.
Targeting of U.S. government employees
Date: 2020-01-30
Affiliations: APT 34
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: U.S. government employees and possibly Westat employees

The Iranian state-backed hackers sent out sophisticated spear-phishing lures imitating Westat, a research services company, in hopes of compromising U.S. government employees and networks. They could have also intended to compromise actual Westat employees.
Targeting of government bodies in Australia and Southeast Asia
Date: 2020-05-07
Affiliations: APT 30
Sponsor: China
Type: Espionage
Category: Government, Private sector

Using a new exploit named Aria-body, APT 30 attempted to compromise networks belonging to governments and state-owned companies in Australia and Southeast Asia.
Targeting of entities focusing on Taiwan
Date: 2020-08-08
Affiliations: Believed to be the work of the Chinese government. 
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Government agencies, Private sector companies, Think tanks

Hackers targeted various entities involved in Taiwan-related issues with spear-phishing emails containing Taidoor, a remote-access trojan (RAT) designed to maintain a presence on victim networks for use in later network exploitation.
Targeting of U.S. military and defense computer networks
Date: 2020-10-20
Affiliations: Government of China
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: U.S. military and defense computer networks

Chinese hackers used publicly known vulnerabilities to infiltrate military and defense networks containing sensitive intellectual property, state secrets, and other information.
Response: Confirmation   https://www.aha.org/system/files/media/file/2020/10/nsa-warns-chinese-state-sponsored-malicious-cyber-actors-exploiting-25-cves-10-20-20.PDF
Phishing with fake coronavirus health advisory
Date: 2020-03-16
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Victims: Likely Indian government or civil society targets based on past targeting.

The Pakistani government–aligned threat actor APT 36 used a fake coronavirus health advisory to phish its targets and deliver a RAT.
Targeting of CPC Corporation
Date: 2020-05-05
Affiliations: Winnti Umbrella
Sponsor: China
Type: Sabotage
Category: Private sector
Victims: CPC Corporation

China-linked Winnti Umbrella launched a ransomware attack against Taiwan’s state oil company, CPC Corporation, causing its website to go offline for one day.
Response: Confirmation   https://www.cyberscoop.com/cpc-ransomware-winnti-taiwan-china/
Targeting of U.S. political campaigns, advocacy groups, and political consultancies
Date: 2020-09-10
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government, Civil society
Victims: Organizations and individuals associated with U.S. politics

Russian hackers attempted to steal log-in credentials primarily belonging to more than two hundred political campaigns, advocacy groups, parties, and consultants.
Targeting of companies involved in vaccine development
Date: 2020-11-27
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Companies involved in vaccine development including Johnson & Johnson and Novavax in the United States; AstraZeneca in the United Kingdom; and Genexine, Shin Poong Pharmaceutical Co., and Celltrion in South Korea

North Korean hackers targeted at least six companies involved in the development of a COVID-19 vaccine. Masquerading as recruiters on WhatsApp and LinkedIn, the hackers used documents containing fake job descriptions to install malware on computers belonging to company staff.
Disclosure by Japanese firms of breaches between 2015 and 2018
Date: 2020-02-06
Affiliations: Unknown, suspected Bronze Butler.
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japanese defense contractors

The Japanese defense contractors Pasco and Kobe Steel disclosed security breaches that happened between 2015 and 2016 and in May 2018. Kobe steel supplies submarine parts to the Japan Self-Defense Forces and Pasco provides satellite data. Nikkei suspects that Bronze Butler could have been involved.
Targeting of Australian government agencies and private companies
Date: 2020-06-19
Affiliations: Government of China
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Australian government agencies and private companies

Hackers believed by Australian officials to be operating on behalf of China targeted Australian government agencies and companies through a known exploit in Microsoft Sharepoint.
Response: Denouncement   https://www.9news.com.au/national/cyber-attack-australia-scott-morrison-government-private-sector-breach-of-security/e621ae47-f810-4fa7-9c11-3caa3b09f4dc
Targeting of entities in India, Kazakhstan, Kyrgyzstan, Malaysia, Russia, and Ukraine
Date: 2020-10-01
Affiliations: Government of China
Sponsor: China
Type: Espionage
Victims: Entities in India, Kazakhstan, Kyrgyzstan, Malaysia, Russia, and Ukraine

Chinese hackers distributed SlothfulMedia malware, which modifies files and logs keystrokes. Specific targets have yet to be disclosed.
Infection of computer systems belonging to universities in Hong Kong
Date: 2020-01-31
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Universities in Hong Kong

The Winnti Umbrella, a Chinese government-backed threat actor, installed malware on computer systems at two universities in Hong Kong during protests. Three other universities in Hong Kong could have been simultaneously targeted.
Attack on Israeli water utilities
Date: 2020-05-07
Affiliations: Iranian government
Sponsor: Iran (Islamic Republic of)
Type: Sabotage
Category: Private sector
Victims: Israeli water utilities

Iranian hackers sought to cripple computers that control water flow and wastewater treatment for two rural districts in Israel. Israeli officials reported that the attack was quickly detected and defeated, preventing harm to water supplies.
Response: Hack Back   https://www.timesofisrael.com/cyberattack-on-port-suggests-israeli-tit-for-tat-strategy-shows-iran-vulnerable/
Targeting of United Kingdom trade minister’s email account
Date: 2020-08-03
Affiliations: Believed to be the work of the Russian government. 
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: UK Trade Minister

Hackers accessed the account of former United Kingdom (UK) Trade Minister Liam Fox, between July 12 and October 21 2019, stealing six tranches of documents detailing British trade negotiations with the United States. Hackers then released the documents as part of a Russian disinformation campaign targeting the 2019 UK general election.
Targeting of U.S. government networks
Date: 2020-10-22
Affiliations: Energetic Bear
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: U.S. computer networks

Russian hackers used publicly known networking gear vulnerabilities to steal data from U.S. state, local, territorial, and aviation computer networks. The Cybersecurity and Infrastructure Security Agency and the FBI reported that the stolen information included network configurations and vendor lists and that the hackers potentially had access to election information.
Response: Confirmation   https://us-cert.cisa.gov/ncas/alerts/aa20-296a
Global phishing campaign against industrial, government, and civil society targets
Date: 2020-03-20
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Private sector, Government, Civil society, Military
Victims: Targets across sectors and throughout the world, but especially defense sector and the United Arab Emirates.

The Russian threat actor APT 28 used phishing campaigns to steal credentials from organizations across the world, in government, private sector, and civil society. They also searched the internet for vulnerable webmail servers.
Zirconium
Date: 2020-09-10
Affiliations: Also known as APT 31 and Judgement Panda.
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Individuals associated with the U.S. election

Responsible for targeting email accounts belonging to former Vice President Joe Biden’s campaign staff and for attempting to discern whether accounts belonging to members of the international affairs community are active.
Targeting of vaccine researchers with fake job opportunities
Date: 2020-11-13
Affiliations: Zinc
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Pharmaceutical companies and vaccine researchers in the United States, Canada, France, India, and South Korea

The North Korean threat group Zinc used spear-phishing emails to pose as job recruiters.
Continued targeting of cryptocurrency businesses
Date: 2020-01-08
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Cryptocurrency exchanges

The North Korean hackers renewed attacks against unnamed cryptocurrency businesses to steal cryptocurrency for financial gain.
Targeting of Ukrainian government organizations
Date: 2020-06-11
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian government officials

Hackers sent spear-phishing emails to the accounts of officials in various Ukrainian government organizations. The emails contained attachments that downloaded malware when opened.
Targeting of network technology providers and organizations working with refugees in the Middle East
Date: 2020-10-05
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Private sector
Victims: Network technology providers and organizations working with refugees in the Middle East

Iranian hacking group MuddyWater exploited known Zerologon vulnerabilities to compromise servers used by organizations working with refugees in the Middle East.
Impersonation of journalists to compromise public figures
Date: 2020-01-30
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Government
Victims: Academics, researchers, and dissidents in the United States, Israel, Saudi Arabia, Europe, the UK, and possibly elsewhere.

The Iranian state-backed threat actor Charming Kitten impersonated prominent journalists and sent targets fake interview requests in order to steal their credentials and send them malware.
Pirate Panda
Date: 2020-04-30
Sponsor: China
Victims: Vietnamese government officials

Pirate Panda is believed to be responsible for phishing attacks targeting Vietnamese government officials located near the disputed Paracel Islands in the South China Sea.
Targeting of opposition politicians and religious leaders in Togo
Date: 2020-09-03
Affiliations: Believed to be the work of Togolese security forces. 
Sponsor: Togo
Type: Espionage
Category: Civil society
Victims: Togolese opposition politicians, Togolese religious leaders

Hackers used spyware, developed by Israeli technology firm NSO Group, that exploited a vulnerability in the messaging app WhatsApp to inject spyware onto the phones of opposition politicians and prominent religious leaders in Togo. The hack coincided with pro-reform protests in the country.
Targeting of experts and think tanks in the United States, Japan, and South Korea
Date: 2020-10-27
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector, Civil society
Victims: Experts and think tanks in the United States, Japan, and South Korea

The North Korean threat actor APT Kimsuky targeted think tanks in the United States, Japan, and South Korea working on nuclear policy and sanctions. The hackers used spear-phishing emails and watering-hole attacks to gain access to victims’ networks.
Targeting of the World Health Organization
Date: 2020-03-23
Affiliations: DarkHotel
Sponsor: Korea (Republic of)
Type: Espionage
Category: Civil society
Victims: World Health Organization

DarkHotel, an advanced actor possibly associated with the South Korean government, attempted to phish World Health Organization employees.
Targeting of South Asia telecommunication providers
Date: 2020-05-19
Affiliations: Greenbug
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Telecommunication providers in South Asia

The Greenbug group used off-the-shelf tools and living-off-the-land techniques to gain access to South Asian telecommunication providers’ database servers.
Targeting of former Vice President Joe Biden’s campaign staff and U.S. international affairs community
Date: 2020-09-10
Affiliations: Zirconium
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Individuals associated with the U.S. election

Responsible for targeting non-campaign email accounts belonging to former Vice President Biden’s election campaign staff. Also responsible for using web bugs to determine whether accounts belonging to academics and important figures in the international affairs community are active.
Targeting of vaccine researchers with spear-phishing emails
Date: 2020-11-13
Affiliations: Cerium
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Pharmaceutical companies and vaccine researchers in the United States, Canada, France, India, and South Korea

The North Korean threat group Cerium masqueraded as World Health Organization representatives in spear-phishing emails to victims.
Targeting of Hong Kong citizens with mobile malware
Date: 2020-03-24
Affiliations: Lotus Blossom
Sponsor: China
Type: Espionage
Category: Civil society, Private sector
Victims: Hong Kong citizens with iPhones

The Chinese threat actor Lotus Blossom used watering holes on fake news sites to deploy iOS exploits against Hong Kong citizens.
Targeting of universities in the United States, Canada, Denmark, the Netherlands, Singapore, Sweden, and the United Kingdom
Date: 2020-10-14
Affiliations: Cobalt Dickens
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Universities in the United States, Denmark, the Netherlands, Singapore, Sweden, and the United Kingdom

Iranian hackers attempted to steal intellectual property and research documents using phishing emails and websites to obtain student and staff credentials.
Targeting of Malaysian government officials
Date: 2020-02-07
Affiliations: APT 40
Sponsor: China
Type: Espionage
Category: Government
Victims: Malaysian government officials

APT 40, a threat actor believed to be associated with the Chinese government, allegedly targeted Malaysian government officials with highly targeted spear-phishing attacks in order to install malware and steal confidential documents from government networks.
Response: Confirmation   https://www.zdnet.com/article/malaysia-warns-of-chinese-hacking-campaign-targeting-government-projects/
Phishing of Vietnamese government officials
Date: 2020-04-30
Affiliations: Pirate Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Vietnamese government officials

The Chinese-linked threat actor Pirate Panda sent phishing emails to Vietnamese government officials located in Da Nang, Vietnam.
Fox Kitten
Date: 2020-02-16
Affiliations: Also known as Parasite
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: U.S. government agencies, U.S. companies

Responsible for targeting unpatched network equipment belonging to U.S. government agencies and private companies.
Targeting of Think20 Summit and Munich Security Conference attendees
Date: 2020-10-28
Affiliations: APT 35
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Think20 Summit and Munich Security Conference attendees

Iranian hackers posing as conference organizers sent fraudulent invitations linking to credential-harvesting pages to government officials, policy experts, and academics expected to attend the Think20 Summit and the Munich Security Conference.
Targeting of over seventy-five organizations
Date: 2020-03-25
Affiliations: APT 41
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Multiple entities across the world.

The Chinese threat actor APT 41 attempted to exploit three vulnerabilities at over seventy-five organizations across sectors and countries. This was one of the most widespread attacks by a Chinese threat actor in years.
Targeting of Asian videogame companies
Date: 2020-05-21
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Video game companies in Asia, including Taiwan and South Korea

Hackers leveraged a backdoor to compromise Taiwanese and South Korean video game companies’ systems.
Targeting of the Donald J. Trump presidential campaign
Date: 2020-09-10
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Civil society
Victims: Individuals associated with the U.S. government or upcoming election

Iranian hackers attempted to log into accounts associated with the Trump administration and campaign staff.
Infection of French and Vietnamese companies and government agencies with crypto-mining malware
Date: 2020-11-30
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Financial Theft
Category: Private sector, Government
Victims: French and Vietnamese companies and government agencies

Vietnamese hackers installed Monero crypto-mining malware on victim computers in July and August 2020, possibly aiming to generate revenue from their broader espionage operations and mitigate detection by masking intrusions as low-priority threats. Crypto-mining malware is rarely affiliated with nation-state actors.
Konni Group
Date: 2020-01-23
Sponsor: Korea (Democratic People's Republic of)

Attempted to trick employees of unnamed U.S. government agency to install malware on their computers via a spearphishing campaign.
U.S. Cyber Command
Date: 2020-08-11
Sponsor: United States of America
Type: Sabotage
Category: Government
Victims: Russia

Responsible for orchestrating and executing various operations to protect the United States and its interests, including steps to disrupt the Internet Research Agency and the Trickbot botnet.
Targeting of Israeli organizations with ransomware
Date: 2020-10-16
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Israeli organizations

Iranian hackers used the PowGoop downloader, delivered through phishing emails, and publicly known Microsoft Exchange server vulnerabilities to deliver Thanos ransomware.
Intensified attacks against Ukrainian national security targets
Date: 2020-02-05
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Sabotage
Category: Government
Victims: Ukrainian national security targets

The Russia-aligned threat actor Gamaredon intensified its efforts to compromise Ukrainian defense and intelligence targets. The attacks include both cyberespionage and attempted sabotage of physical assets.
Distribution of malware through Google Play store
Date: 2020-04-28
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Victims: Google Play Store

The Vietnam-linked threat group uploaded malware-infected apps to the Google Play store to trick users into downloading them onto their phones.