Maljean/dataset huggingface dataset:
UNC1151
Date: 2021-04-28
Affiliations: Belarus, Ghostwriter.
Sponsor: Belarus
Type: Espionage
Category: Government
Victims: The communications systems of east European governments

UNC1151 has been identified as the group orchestrating a long-running espionage campaign, known as Ghostwriter, across various east European countries focused on compromising governments’ communications systems and gathering data that can be used in ongoing information warfare campaigns.
MalKamak
Date: 2021-10-06
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Aerospace and telecommunication companies across the United States, Russia, the Middle East, and Europe

MalKamak was first discovered conducting a long-term espionage campaign against aerospace and telecommunication companies using Dropbox servers to stealthily exfiltrate data.
Targeting of international gambling firms
Date: 2021-01-06
Affiliations: Emissary Panda
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Online gambling firms

Chinese threat actor Emissary Panda locked the servers of five gambling firms marketing to Chinese nationals, requesting $100 million in ransom payment. The victim companies reported that no payment was made.
Targeting of U.S. oil and gas companies
Date: 2021-07-20
Affiliations: Comment Crew
Sponsor: China
Type: Espionage
Category: Private sector
Victims: U.S. oil and gas companies

The U.S. Cybersecurity and Infrastructure Security Agency released the indicators of compromise for a series of attacks on U.S. oil and gas companies, which lasted from 2011 to 2013. The agency confirmed that at least twenty companies had been compromised and that the depth of the intrusions was not entirely clear.
Targeting of telecommunication companies in Asia and the Middle East
Date: 2021-12-14
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Victims: Telecommunication companies in Asia and the Middle East

Iran launched an espionage campaign directed against telecommunication companies throughout Asia and the Middle East. The attacks could have been aimed at inserting malware into the supply chain, although the exact purpose is unclear.
Targeting of cryptocurrency exchanges and financial service companies
Date: 2021-02-17
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector, Civil society
Victims: Cryptocurrency trading firms, various individuals, and financial services institutions

North Korean APT Lazarus Group disseminated cryptocurrency trading applications outfitted with the AppleJeus malware. AppleJeus was used to steal cryptocurrency from unsuspecting victims in over thirty countries in 2020.
Targeting of cloud computing servers in brute force attacks
Date: 2021-06-06
Affiliations: Fancy Bear, APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Cloud and enterprise computing companies and government agencies that use their services

Russian hackers targeted various enterprise and cloud computing companies across the world with brute force attacks in attempts to gain access.
Response: Confirmation   https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/2677750/nsa-partners-release-cybersecurity-advisory-on-brute-force-global-cyber-campaign/#:~:text=The%20National%20Security%20Agency%20(NSA,intelligence%20against%20U.S.%…
Targeting of Israeli software supply chain
Date: 2021-08-18
Affiliations: Siamesekitten, Lyceum
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Israeli software companies

An Iranian threat actor is believed to be responsible for using fake job offers to gain access to the email systems of major Israeli software companies. After gaining access to a system, the threat actor would install a backdoor to gain further information from the company's system or to launch phishing attacks.
Targeting of the Parliament of Western Australia
Date: 2021-03-04
Affiliations: Chinese government
Sponsor: China
Type: Espionage
Category: Government
Victims: Western Australia’s parliamentary email network

Chinese hackers exploited a Microsoft vulnerability to target the Parliament of Western Australia’s email server.
Targeting of Philippine dissident websites
Date: 2021-07-01
Affiliations: Philippine Army
Sponsor: The Philippines
Type: Denial of service
Category: Civil society
Victims: Two Philippine opposition news outlets, Bulatlat and Altermidya

Units in the Philippine Army are believed to be behind a series of DDoS attacks launched against two opposition websites, Bulatlat and Altermidya. The attacks brought the websites down for a few hours but did not cause any lasting damage.
Response: Denial   https://therecord.media/investigation-links-ddos-attack-on-filipino-media-outlets-to-government-agencies/?web_view=true
IronHusky
Date: 2021-10-12
Affiliations: MysterySnail
Sponsor: China
Type: Espionage
Category: Private sector
Victims: IT companies, diplomatic missions, and defense contractors in the United States.

IronHusky was detected using a Windows zero-day to launch a remote access Trojan dubbed MysterySnail.  Command and control infrastructure IronHusky use has been active since at least 2012.
Targeting of SolarWinds
Date: 2021-02-02
Affiliations: Believed to be the work of the Chinese government
Sponsor: China
Type: Espionage
Category: Government
Victims: U.S. Department of Agriculture’s National Finance Center

Suspected Chinese hackers breached SolarWinds software, potentially accessing payroll information for hundreds of thousands of federal employees. Details about specific actors and the scale of the breach remain unknown.
Targeting of Ukrainian elected officials by Russian-sponsored hackers
Date: 2021-04-19
Affiliations: Primitive Bear, Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian officials

From January 2021 to at least March 2021, Gamaredon, a group associated with Russian intelligence agencies, sent malicious documents to several high-ranking Ukranian officials. The objectives of this spear-phishing campaign are still unclear.
Targeting of French corporations using compromised Wi-Fi routers
Date: 2021-07-21
Affiliations: Judgement Panda, APT 31
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Home router systems in France

A Chinese threat actor operated a long-term campaign to break into home Wi-Fi routers and launch reconnaissance attacks against French companies and organizations.
Targeting of Asian airline
Date: 2021-12-15
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: An unidentified Asian airline

An Iranian threat actor was found using a backdoor against an Asian airline in the summer of 2021. The attackers used Slack as the command and control hub for the backdoor they had inserted, the first observation of the use of the workplace messaging application in such a way by a state-sponsored actor.
Targeting of Dutch data center
Date: 2021-02-18
Affiliations: Prince of Persia
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Iranian political dissidents in the Netherlands, Germany, India, and Sweden

Iranian-backed hackers compromised a server in a Dutch data center to spy on Iranian dissidents.
Targeting of Ukrainian agencies in Russian spear-phishing campaign
Date: 2021-06-07
Affiliations: Russian Federation
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian secret service and other government agencies

Russian hackers targeted Ukrainian officials in a series of spear-phishing attacks to gain access to government servers for espionage purposes.
Response: Confirmation   https://ssu.gov.ua/novyny/sbu-zablokuvala-masovu-kiberataku-spetssluzhb-rf-na-kompiuterni-merezhi-ukrainskykh-orhaniv-vlady
Siamesekitten
Date: 2021-08-18
Affiliations: Also known as Lyceum. The group has also been connected to OilRig.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Israeli software companies

Siamesekitten was first detected using fake job postings and applications to phish software engineers in Israel. The attacker's goal appeared to be to escalate access once it had compromised the initial networks and to launch phishing attacks against other individuals and organizations. The malware toolkit used in Siamesekitten's attacks is geared towards reconnaissance.
Targeting of Middle Eastern and Azerbaijani organizations
Date: 2021-03-05
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Organizations in Azerbaijan, Israel, Saudi Arabia, and the United Arab Emirates

Iran-linked hackers used spear-phishing emails to distribute malware to organizations in the Middle East and Azerbaijan.
Targeting of the Afghan National Security Council
Date: 2021-07-01
Affiliations: IndigoZebra
Sponsor: China
Type: Espionage
Category: Government
Victims: Afghan National Security Council

A Chinese threat actor targeted the Afghan National Security Council with spear-phishing attacks. The attackers pretended to be from the Administrative Office of the President of Afghanistan to get victims to download a dropper.
Targeting of major aerospace companies in the United States, Russia, Europe, and the Middle East
Date: 2021-10-06
Affiliations: MalKamak
Sponsor: Iran (Islamic Republic of)
Category: Private sector
Victims: Aerospace and telecommunication companies across the United States, Russia, Europe, and the Middle East.

An Iranian-linked threat actor dubbed MalKamak used a remote access Trojan (RAT) known as ShellClient to target aerospace and telecommunication companies. The RAT employed had been in development since at least 2018 and piggybacked off of Dropbox servers.
Targeting of South Sudanese citizens
Date: 2021-02-02
Affiliations: South Sudanese government
Sponsor: South Sudan
Type: Espionage
Category: Civil society
Victims: South Sudanese citizens

The South Sudanese government acquired surveillance capabilities from Israeli company Verint Systems between 2015 and 2017 to spy on South Sudanese citizens, according to a report by Amnesty International.
Targeting of Japanese businesses and research groups
Date: 2021-04-19
Affiliations: Tick
Sponsor: China
Type: Espionage
Category: Private sector, Civil society
Victims: Over two hundred Japanese businesses and research institutes

A Chinese-sponsored threat actor known as Tick is believed to have breached hundreds of businesses and research institutes in Japan, including the Japanese Aerospace Exploration Agency. The threat actor is believed to have gained access to the businesses through a compromised rental server.
Response: Confirmation   https://www.japantimes.co.jp/news/2021/04/20/national/chinese-military-japan-cyberattacks/
Targeting of Southeast Asian telecommunication companies
Date: 2021-08-03
Affiliations: Naikon, APT 30, Deadringer
Sponsor: China
Type: Espionage
Category: Private sector, Civil society, Government
Victims: Southeast Asian telecommunication companies and their customers

The Chinese threat actor Naikon was detected targeting countries in Southeast Asia in a malware campaign that likely ended in early 2021. The attackers likely used access to the networks of telecommunication companies to launch further attacks against corporations and governments who used the companies’ telecommunication services.
Targeting of Israeli companies and government agencies
Date: 2021-12-16
Affiliations: Charming Kitten 
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector, Government
Victims: Israeli companies and government agencies

An Iranian-linked threat actor was detected exploiting a new vulnerability in the open-source Log4j software to attack at least seven Israeli companies and government agencies.
Targeting of Ukrainian web servers
Date: 2021-02-22
Affiliations: Russian government
Sponsor: Russian Federation
Type: Denial of service
Category: Government
Victims: Security Service of Ukraine and other government websites

Russian threat actors targeted vulnerable web servers of multiple Ukrainian security and defense organizations with a virus that added them to a botnet used to carry out distributed denial of service attacks.
Response: Confirmation   https://www.rnbo.gov.ua/en/Diialnist/4820.html
Targeting of Russian government agencies
Date: 2021-06-08
Affiliations: TA428, Wekby, Dynamite Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Russian government officials

Chinese-linked hacking group TA428 is believed to be responsible for a series of attacks on the Russian government in late 2020. The goal of the attackers was to penetrate officials' emails and classified networks and steal information.
Targeting of U.S. computer retail business
Date: 2021-08-24
Affiliations: Winnti Umbrella, SparklingGoblin
Sponsor: China
Type: Espionage
Category: Private sector
Victims: An unidentified U.S. computer retailer

Winnti Umbrella was found to have repurposed a backdoor, known as Crosswalk, to infiltrate the systems of a computer retailer in the United States.
Targeting of Linux endpoints and servers
Date: 2021-03-11
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Linux servers and endpoints

Chinese threat actors used a new sophisticated backdoor called RedXOR to target Linux endpoints and servers.
IndigoZebra
Date: 2021-07-01
Sponsor: China
Type: Espionage
Category: Government
Victims: Organizations in Afghanistan, Krygzstan, and Uzbekistan.

IndigoZebra has been observed targeting Afghanistan and former Soviet republics, including Krygzstan and Uzbekistan.
Targeting of REvil
Date: 2021-10-18
Affiliations: NSA, U.S. Cyber Command, FBI, and partner agencies in several unknown countries. 
Sponsor: United States
Type: Data destruction
Category: Civil society
Victims: REvil, DarkSide ransomware operators and affiliates.

The FBI, U.S. Cyber Command, and allied governments took down the Tor servers of the ransomware gang REvil.
Targeting of Qatari royal family
Date: 2021-02-06
Affiliations: Emirati government
Sponsor: United Arab Emirates
Type: Espionage
Category: Government
Victims: Devices belonging to Qatar’s royal family

The United Arab Emirates, using hackers contracted through CyberPoint, intercepted emails between former First Lady Michelle Obama and Her Highness Sheikha Moza bint Nasser of Qatar. The operation took place in 2015 but remained unreported until February 2021.
Targeting of U.S. federal agencies via PulseSecure VPN
Date: 2021-04-20
Affiliations: APT 5
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: U.S. government agencies and contractors

Five U.S. federal agencies were targeted in a Chinese espionage operation, along with several defense contractors and financial institutions in the country. The hackers made use of zero-day vulnerabilities in the PulseSecure VPN system to gain access to the different organizations' systems.
Response: Confirmation   https://www.cisa.gov/uscert/ncas/alerts/aa21-110a
Targeting of Southeast Asian telecommunication companies
Date: 2021-08-03
Affiliations: Soft Cell, GALLIUM, Deadringer
Sponsor: China
Type: Espionage
Category: Civil society, Private sector, Government
Victims: Southeast Asian telecommunication companies and their customers.

In a series of attacks starting in 2017, Chinese threat actors are believed to have compromised telecommunication firms across Southeast Asia. The breaches were designed to extract data from the companies' servers and were likely used to launch more targeted spear-phishing attacks.
Targeting of the United Nations' human rights investigator in Yemen
Date: 2021-12-20
Affiliations: Believed to be the work of the Saudi Arabian government.
Sponsor: Saudi Arabia
Type: Espionage
Category: Civil society
Victims: Kamel Jendoubi

Saudi Arabia was accused of using Pegasus spyware to break into the mobile phone of Kamel Jendoubi, the lead investigator for the United Nations examining allegations of war crimes in Yemen’s ongoing civil war.
Targeting of Ukrainian government document management system
Date: 2021-02-24
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian government’s document management system

Russian threat actor Gamaredon targeted users of the Ukrainian government’s document management system, the System of Electronic Interaction of Executive Bodies (SEIEB), with malware-encrypted documents.
Response: Confirmation   http://rnbo.gov.ua/en/Diialnist/4823.html
Targeting of Dutch police in the investigation of flight MH17 shootdown
Date: 2021-06-09
Affiliations: Cozy Bear, APT29
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: The Netherlands' National Police Corps

The Dutch police units investigating the destruction of Malaysia Airlines Flight 17 over Ukraine in 2014 were hacked sometime in 2017 by groups associated with the Russian intelligence services.
Targeting of Microsoft Exchange and MySQL servers
Date: 2021-09-09
Affiliations: Winnti Umbrella, Grayfly
Sponsor: China
Type: Espionage
Category: Private sector, Civil society
Victims: U.S. universities and media companies

A Chinese threat actor that had been launching attacks using the novel backdoor technique SideWalk for several months is associated with the Chinese threat actor Winnti Umbrella. The attacks targeted businesses and academic institutions in the United States.
Targeting of classified government data in Ukraine
Date: 2021-03-16
Affiliations: Russian government
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: “The highest institutions of state power in Ukraine”

Unnamed Russian threat actors attempted a large-scale cyber operation to obtain classified government data. However, Ukrainian authorities prevented a breach.
Targeting of prospective engineers and programmers
Date: 2021-07-06
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Engineers in the United States and Europe

Lazarus Group was accused of sending phishing emails pretending to be from major engineering firms to engineers looking for work. The engineers were prompted to download malicious Microsoft Word documents.
Targeting of U.S. and Australian critical infrastructure
Date: 2021-11-17
Affiliations: Believed to be the work of the Islamic Republic of Iran's government
Sponsor: Iran (Islamic Republic of)
Type: Financial Theft
Category: Private sector, Civil society
Victims: Critical infrastructure across the United States and Australia.

Iranian hackers have been penetrating networks in both the United States and Australia with ransomware, either to disrupt critical infrastructure or turn a profit.
Targeting of United Arab Emirates government employees
Date: 2021-02-10
Affiliations: Static Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: United Arab Emirates government agencies and likely the broader Middle East

Iranian threat actor Static Kitten used malicious executables and URLs that impersonated Kuwait’s Ministry of Foreign Affairs to install remote management tool ScreenConnect onto Emirati government computers. The primary objective of the campaign was likely data theft.
Targeting of Russian submarine designer
Date: 2021-04-30
Affiliations: Tonto Team or TA428
Sponsor: China
Type: Espionage
Category: Military
Victims: Russian nuclear submarine engineering group

Chinese-linked hackers targeted the general director of a Russian nuclear submarine design company with a spear-phishing email designed to share a malicious link.
Targeting of the United States, Belarus, Canada, Mongolia, and Russia in an espionage operation
Date: 2021-08-03
Affiliations: APT 31, Judgement Panda
Sponsor: China
Type: Espionage
Category: Civil society, Private sector, Government
Victims: Government agencies in the United States, Belarus, Canada, Mongolia, and Russia

APT 31 was detected using a new remote access Trojan horse in more than ten attacks throughout the first half of 2021 to target governmental groups in Russia and several other countries.
Targeting of Jamal Khashoggi's wife, Hanan Elatr
Date: 2021-12-21
Affiliations: Believed to be the work of the Saudi Arabian government.
Sponsor: United Arab Emirates
Type: Espionage
Category: Civil society
Victims: Hanan Elatr

The widow of Saudi dissident Jamal Khashoggi, who was assassinated by the Saudi Arabian government in 2018, was targeted by the NSO Group's Pegasus malware at the request of the United Arab Emirates. The malware was allegedly installed while Elatr was detained at the Dubai airport.
Targeting of human rights activists in Vietnam
Date: 2021-02-24
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Civil society
Victims: Vietnamese human rights activists

Ocean Lotus used spyware to target two human rights defenders and VOICE, a nonprofit human rights organization.
Targeting of major companies and government organizations in seven countries
Date: 2021-06-16
Affiliations: PLA Unit 69010, RedFoxTrot
Sponsor: China
Type: Espionage
Category: Private sector, Government, Military
Victims: Aerospace, mining, research, telecommunications, government, and military organizations in Afghanistan, India, Kazakhstan, Kyrgyzstan, Pakistan, Tajikistan, and Uzbekistan.

A Chinese threat actor was detected running a cyber espionage campaign since at least 2014 in Afghanistan, India, Kazakhstan, Kyrgyzstan, Pakistan, Tajikistan, and Uzbekistan. Attackers compromised numerous companies in a variety of industries, along with government and military systems.
Targeting of Indonesian intelligence agencies
Date: 2021-09-10
Affiliations: Mustang Panda, Bronze President
Sponsor: China
Type: Espionage
Category: Military
Victims: Indonesian intelligence agencies

A Chinese threat actor had access to servers used to store Indonesian intelligence records for at least five months in the spring and summer of 2021.
Response: Denial   https://www.securityweek.com/indonesia-says-no-evidence-alleged-chinese-intel-hack?web_view=true
Targeting of telecommunications companies’ employees
Date: 2021-03-16
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Private sector
Victims: People working in telecommunications companies in Southeast Asia, Europe, and the United States

The Chinese APT Mustang Panda phished telecommunications companies’ employees by sending them malicious domains masquerading as Huawei’s career site.
Targeting of Republican National Committee
Date: 2021-07-06
Affiliations: Cozy Bear, APT 29
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Republican National Committee

Cozy Bear, a group of Russian-sponsored hackers, were accused of breaking into the U.S. Republican National Committee's computer systems. How much access the group obtained or what information they were able to remove is unknown
Targeting of Chinese cybersecurity researchers.
Date: 2021-11-22
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Military
Victims: Chinese hacking groups

The North Korean cyber gang Lazarus Group was accused of attempting to breach Chinese cyber espionage groups' systems in 2020 in an effort to exploit zero-days and other vulnerabilities. The effort is likely related to an earlier North Korean attempt to attack cybersecurity researchers in the United States and Eastern Europe.
Targeting of government authorities in Pakistan and Kashmir
Date: 2021-02-11
Affiliations: Confucius
Sponsor: India
Type: Espionage
Category: Government, Military
Victims: Electoral officials in Kashmir and authorities linked to Pakistan’s nuclear agencies and military

Indian APT Confucius used novel android spyware Hornbill and SunBird to scrape call logs and WhatsApp messages of government authorities in Pakistan and Kashmir.
Targeting of Indian military and defense organizations
Date: 2021-05-13
Affiliations: APT 36, Mythic Leopard
Sponsor: Pakistan
Type: Espionage
Category: Military
Victims: Indian military service members

A Pakistani-sponsored threat actor used watering-hole attacks to target Indian military personnel.