Maljean/dataset huggingface dataset:
Targeting of Montenegrin government infrastructure
Date: 2022-08-25
Affiliations: Believed to be the work of the government of the Russian Federation.
Sponsor: Russian Federation
Type: Data destruction
Category: Government
Victims: Montenegrin government systems, including immigration systems

Montenegro accused the Russian government of launching a widespread cyberattack against computer systems. The attack lasted several days and severely harmed several vital industries, including electricity and water systems, transportation networks, and online portals for state services. The U.S. embassy issued a warning to travelers in the country that immigration systems run by the Montenegrin government could have been affected by the hack.
Response: Denouncement   https://www.bleepingcomputer.com/news/security/montenegro-says-russian-cyberattacks-threaten-key-state-functions/
Targeting of non-fungible token (NFT) owners
Date: 2022-12-24
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: NFT owners and NFT storage services

Lazarus Group targeted the owners of non-fungible tokens in a phishing campaign. The phishing sites allowed Lazarus to drain victims' accounts of both NFTs and cryptocurrencies.
 
Response: Unknown
Targeting of journalists in El Salvador
Date: 2022-01-12
Affiliations: Believed to be the work of El Salvador's government.
Sponsor: El Salvador
Type: Espionage
Victims: Journalists and nongovernmental organizations in El Salvador

The Salvadoran government used NSO Group's Pegasus spyware to break into the phones of more than thirty five people. Among those targeted were at least twenty reporters investigating the government's ongoing negotiations with the criminal gang MS-13.
Targeting of European diplomatic entities, research entities, and internet service providers
Date: 2022-03-07
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Search entities, internet service providers (ISPs), and European diplomatic missions mostly located in East and Southeast Asia.

The Chinese-linked threat actor Mustang Panda targeted European diplomatic entities with malicious files containing geopolitical themes, including a file titled “Situation at the EU borders with Ukraine.zip.” The hackers used a European diplomat’s compromised email address to send the malware-laced emails to other countries’ diplomatic offices.
Targeting of a defense and cybersecurity organization in the Baltics
Date: 2022-05-03
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: A defense and cybersecurity organization in the Baltics

Russian threat actor Turla targeted defense and cybersecurity organizations in the Baltic states. Turla sent emails to targets, each with unique links that led victims to download a malicious file.
Targeting of high-profile individuals at European embassies
Date: 2022-07-19
Affiliations: The Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: European embassies

The Dukes sent out phishing emails to targets at European embassies to gain access to sensitive information.
Response: Unknown
Targeting of Iranian citizens
Date: 2022-10-20
Affiliations: Prince of Persia
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Iranian citizens

Iranian state-sponsored hacking group Prince of Persia targeted Iranian citizens for mobile surveillance by masking malware as an application that translates documents from English to Persian.
Response: Unknown
Targeting of Ukrainian organizations and Western government entity
Date: 2022-01-29
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government, Civil society
Victims: Government, military, nongovernment organizations, judiciary, law enforcement, and nonprofit groups in Ukraine

Russian threat actor Gamaredon used spear-phishing emails and malware to target Ukrainian emergency response, security, and aid distribution organizations. In addition, Gamaredon presumably targeted a Western government entity in Ukraine.
Targeting of Indian government and military officials
Date: 2022-03-29
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Government, Military
Victims: Indian government and military officials

The threat actor APT36 targeted Indian government and military organizations with three malicious implants, including CrimsonRAT. APT36 used fake domains that mimicked legitimate government, military, and defense organizations in order to deliver malicious payloads.
Targeting of telecommunications providers across the United States, Asia, and the Middle East
Date: 2022-05-07
Affiliations: Red Menshen
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Telecommunications providers, government systems, postal and logistic system, and others in the United States, Hong Kong, India, Myanmar, South Korea, Turkey, and Vietnam

Chinese threat actor Red Menshen used a custom backdoor dubbed BPFDoor to target telecommunications providers, government systems, postal and logistic systems, and others in the United States, Hong Kong, India, Myanmar, South Korea, Turkey, and Vietnam. Red Menshen moved laterally across Windows systems, sending commands via a virtual private server that were administered by compromised Taiwanese routers.
Targeting of Israeli organizations using SysAid
Date: 2022-08-25
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Organizations in Israel running the SysAid IT management system

MuddyWater discovered a new way to utilize the Log4Shell vulnerability in attacks. The group used the Log4Shell bug in SysAid software, a commonly used IT management and help-desk tool, to access the networks of Israeli organizations.
Response: Unknown
Targeting of U.S. COVID relief funds
Date: 2022-12-05
Affiliations: APT 41
Sponsor: China
Type: Financial Theft
Category: Government
Victims: The U.S.Small Business Administration

APT 41 targeted the U.S. Small Business Administration and stole at least $20 million in U.S. COVID relief benefits allocated to businesses in several different U.S. states.
 
Response: Denouncement   https://www.nbcnews.com/tech/security/chinese-hackers-covid-fraud-millions-rcna59636
Targeting of Ukrainian banks and defense ministry
Date: 2022-02-16
Affiliations: Believed to be the work of Russia's government
Sponsor: Russian Federation
Type: Denial of service
Category: Government, Private sector
Victims: Ukrainian banks and defense ministry

Russia targeted the Ukrainian defense ministry website and multiple banks with a DDoS attack, taking their sites offline and halting ATM service in some cases. Ukraine, the United States, and the United Kingdom attributed the attack to Russia, which denied the accusations. 
Response: Confirmation   https://www.reuters.com/technology/recent-ukraine-outage-caused-by-modest-cyberattack-data-shows-2022-02-17/
Targeting of Axie Infinity’s Ronin Network
Date: 2022-04-14
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Users of decentralized finance platform Ronin Network

The North Korea–linked Lazarus Group stole more than $600 million worth of cryptocurrency from the Axie Infinity video game. The hackers infiltrated Ronin Network, a decentralized finance platform used to earn and pay for in-game items with cryptocurrency. Lazarus then used a cryptocurrency mixer, Tornado Cash, to launder a portion of the stolen funds to avoid tracing and asset freezes. In response, the U.S. Treasury’s Office of Foreign Assets Control implemented sanctions against the Lazarus Group.
Response: Sanctions   https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220414
Targeting of media stations such as newspapers and radio stations in Ukraine
Date: 2022-06-09
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Ukrainian media stations

The Computer Emergency Response Team of Ukraine (CERT-UA) warned that Sandworm was exploiting the newly discovered Follina vulnerability in Microsoft Office to attack media organizations in the country.
Response: Confirmation   https://securityaffairs.co/wordpress/132227/apt/cert-ua-sandworm-follina-rce.html
Targeting of an Asian IT provider
Date: 2022-09-15
Affiliations: Space Pirates
Sponsor: China
Type: Espionage
Category: Private sector
Victims: An IT provider operating in multiple Asian countries.

Cybersecurity researchers identified a new campaign run by a Webworm, a Chinese cyber-espionage group. The campaign is in its early stages and appears to use publicly available malware to breach systems and steal information.
Response: Unknown
Targeting of Asian government agencies and certificate authorities
Date: 2022-11-15
Affiliations: Thrip
Sponsor: China
Type: Espionage
Category: Government
Victims: Asian government agencies and one certificate authority

Chinese-affiliated APT Thrip compromised a digital certificate authority in an Asian country. Thrip likely used the certificates to sign malware used to target government agencies for the last six months.
Response: Unknown
Targeting of Ukrainian government websites
Date: 2022-01-16
Affiliations: UNC1151 
Sponsor: Belarus
Type: Defacement
Category: Government
Victims: Over seventy Ukrainian government websites

The Ukrainian government accused Russia of defacing several government websites. Ukraine claimed that the cyberattack was intended as a false flag, as it utilized malware from an external ransomware group in an attempt to obfuscate attribution. The move came as Ukraine and Russia were locked in a state of heightened conflict, with the Ukrainian government accusing Russia of mounting a far larger campaign to place wipers on Ukrainian government systems that could be activated in the event of an invasion.
Targeting of Bahraini activists with Pegasus spyware
Date: 2022-02-18
Affiliations: Believed to be the work of Bahrain's government
Sponsor: Bahrain
Type: Espionage
Category: Civil society
Victims: Bahraini activists, including a lawyer, an online journalist, and a mental health counselor

The Bahraini government used NSO Group’s Pegasus spyware to surveil the iPhones of at least three Bahraini activists. The NSO Group denied knowledge of the abuse.
Targeting of technology and manufacturing companies in Asia, Europe, and North America
Date: 2022-05-04
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Technology and manufacturing companies in Asia, Europe, and North America.

Chinese APT Winnti Umbrella targeted technology and manufacturing companies across Asia, Europe, and North America in a sophisticated cyber espionage campaign that began in 2019. Winnti used a novel strain of malware to exfiltrate the victims’ intellectual property, including documents, blueprints, diagrams, formulas, and manufacturing-related proprietary data.
Targeting of the Belgian Federal Public Service Interior by Chinese threat actors
Date: 2022-07-18
Affiliations: Emissary Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Belgian Federal Public Service Interior

Chinese threat actors targeted the Belgian Federal Public Service Interior as part of a wide-ranging cyber espionage campaign involving multiple threat actors. Belgian authorities condemned the activity.
Response: Denouncement   https://diplomatie.belgium.be/en/news/declaration-minister-foreign-affairs-malicious-cyber-activities
Targeting of Sri Lankan government
Date: 2022-10-12
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Government
Victims: Sri Lankan government entities

Researchers found that Chinese-sponsored hacking group Winnti stole documents from the Sri Lankan government and remotely accessed software from August to October 2022.
Response: Unknown
Targeting of German companies
Date: 2022-01-26
Affiliations: Emissary Panda
Sponsor: China
Type: Espionage
Category: Private sector
Victims: German companies

The Chinese group Emissary Panda installed malware inside the corporate networks of German companies. The actor may have attempted to steal business secrets and intellectual property, target customers, and use its access to the companies’ networks to conduct a supply chain attack. 
Response: Confirmation   https://www.verfassungsschutz.de/SharedDocs/kurzmeldungen/DE/2022/2022-01-26-cyberbrief.html
Targeting of Hungary's foreign ministry networks
Date: 2022-03-29
Affiliations: Believed to be the work of Russia's government
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Hungary's foreign ministry networks

Hackers from the Russian Federal Security Service (FSB) and military intelligence agency, GRU, conducted a lengthy espionage campaign targeting Hungary’s foreign ministry networks. The initial infection was delivered via attachments in phishing emails and spread through the internal network, compromising more than 150 sites of more than 90 Hungarian foreign missions.
Targeting of Ukrainian organizations in phishing campaign
Date: 2022-05-06
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian organizations

APT 28 sent phishing emails masquerading as the Computer Emergency Response Team of Ukraine (CERT-UA) with the subject line "Cyberattack.” The email included a malware-laced attachment enabling APT 28 to gather and steal data.
Response: Confirmation   https://cert.gov.ua/article/40106
Targeting of South Korean diplomats, professors, and researchers
Date: 2022-08-25
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government, Civil society
Victims: Six professors at different universities in South Korea, three think tank researchers, the former South Korean ambassador to the UN, a prominent diplomat in the South Korean government, and a representative on the Research Council for North Korea

Kimsuky was found launching spear-phishing attacks against numerous current and former South Korean diplomats and prominent foreign policy academics in South Korea.
Response: Unknown
Targeting of activists at Human Rights Watch, journalists, and politicians
Date: 2022-12-05
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Human rights activists and journalists

Iran-affiliated threat actor Charming Kitten conducted a social-engineering and credential-phishing campaign targeting two Human Rights Watch staff members and at least eighteen other high-profile activists, journalists, researchers, academics, diplomats, and politicians working on Middle East issues in 2022.
 
Response: Confirmation   https://www.hrw.org/news/2022/12/05/iran-state-backed-hacking-activists-journalists-politicians
Targeting of American defense contractors
Date: 2022-02-16
Affiliations: Believed to be the work of Russia's government
Sponsor: Russian Federation
Type: Espionage
Category: Government, Private sector
Victims: American defense contractors

For at least two years spanning from January 2020 through February 2022, Russian state-sponsored threat actors targeted American cleared defense contractors (CDCs) to acquire and exfiltrate sensitive data and export-controlled technology. These CDCs were contracted by the Department of Defense (DoD) and the U.S. Intelligence Community in areas including command and control, intelligence, surveillance, and weapon development. Threat actors used brute force techniques to collect credentials and sent spear-phishing emails embedded with malicious links. 
Response: Confirmation   https://www.cisa.gov/uscert/ncas/alerts/aa22-047a
Targeting of South Korean chemical sector organizations
Date: 2022-04-14
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: South Korean chemical sector organizations

In an extension of its Operation Dream Job campaign, North Korea’s Lazarus Group targeted individuals working at chemical sector organizations in South Korea. Lazarus used fake job-themed lures to bait victims into opening a malicious link and downloading malware used for cyber espionage.
Response: Unknown
Targeting of Indian activists
Date: 2022-06-16
Affiliations: ModifiedElephant, Pune Police
Sponsor: India
Type: Sabotage
Category: Civil society
Victims: Human rights activists in Pune, India

The Pune police department has been tied to a hacking campaign known as Modified Elephant. The Modified Elephant hackers are believed to have fabricated evidence of criminal wrongdoing before the arrest and trial of human rights activists known as the Bhima Koregaon 16.
Space Pirates
Date: 2022-09-15
Affiliations: Also known as Space Pirates
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: A multinational IT organization, and corporations and organizations in Georgia, Mongolia, and Russia

Researchers identified a Chinese cyber-espionage group that has exchanged tools with Winnti Umbrella, APT 27, and Mustang Panda. The group has been observed using repurposed, publicly available malware in espionage campaigns throughout Asia since at least early 2022. The group could also be moonlighting as criminal hackers, as they have been observed attacking Chinese companies after typical work hours.
Targeting of cryptocurrency start-ups
Date: 2022-01-15
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Cryptocurrency start-ups and exchanges

BlueNoroff, an offshoot of the North Korean threat actor Lazarus Group, mounted a long-running campaign against cryptocurrency firms and exchanges in a bid to steal cryptocurrency.
Targeting   of entities   in Turkey   and the   Arabian   Peninsula
Date: 2022-03-10
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: Entities in Turkey and the Arabian Peninsula

MuddyWater conducted a campaign targeting entities in Turkey and the Arabian Peninsula with malicious files used to deliver a remote access Trojan called SloughRAT to victim’s computers. These attacks, though distinct, are related to the January 2022 MuddyWater campaign targeting the Turkish government, leading experts to conclude that this Iranian APT is comprised of multiple teams operating independently.
Targeting of diplomatic organizations in the Americas, Asia, and Europe
Date: 2022-04-28
Affiliations: The Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Diplomatic organizations in the Americas, Asia, and Europe

Russian threat actor APT 29 targeted diplomatic entities with spear- phishing emails disguised as embassy administrative notices, which were sent from compromised email addresses of other diplomatic entities. The campaign used services such as Trello, Firebase, and Dropbox for command and control. Once the hackers infiltrated the target system, they established long-term access and collected sensitive diplomatic and foreign policy information.
Targeting of Mexican journalists and human rights defenders
Date: 2022-10-02
Affiliations: Believed to be the work of the Mexican government
Sponsor: Mexico
Type: Espionage
Category: Civil society
Victims: Mexican journalists and human rights advocates

The Mexican government is reported to have used Pegasus spyware to conduct mobile surveillance operations against journalists and a human rights advocate between 2019 and 2022.
Response: Unknown
Targeting of Turkish government organizations
Date: 2022-01-31
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: Turkish government entities

The Iranian threat actor MuddyWater sent malicious PDFs and Microsoft Office documents posing as the Turkish Health and Interior Ministries. The campaign targeted government entities including the Scientific and Technological Research Council of Turkey (TUBITAK).
Targeting of Ukrainian organizations
Date: 2022-04-05
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government, Civil society
Victims: Ukrainian government and civil society organizations

Russian threat actor Gamaredon targeted Ukrainian organizations in a phishing campaign. The hackers sent malicious emails with lures related to the Russia-Ukraine conflict, including attachments labeled “Information on war criminals of the Russian Federation” and “Necessary_military_assistance.” The emails contained malware that allowed Russian operators to conduct espionage.
Response: Confirmation   https://cert.gov.ua/article/39138
Targeting of Jordanian government
Date: 2022-05-10
Affiliations: APT 34
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: Government officials at Jordan’s foreign ministry

Iranian threat actor APT 34 targeted Jordanian officials with the novel backdoor Saitama, which abuses the domain name system (DNS) protocol for command and control communications. Masquerading as the Government of Jordan, APT 34 sent an email via Microsoft Outlook with a malicious Excel document that contained the Saitama backdoor to other officials in the Jordanian government.
Targeting of St. Petersburg Economic Forum
Date: 2022-06-17
Affiliations: Ukrainian IT Army
Sponsor: Ukraine
Type: Sabotage
Category: Civil society
Victims: The computer systems of the St. Petersburg Economic Forum

The Ukrainian IT Army attacked the systems of the St. Petersburg Economic Forum in advance of Russian leader Vladimir Putin’s speech, delaying it for over an hour.
Response: Unknown
Targeting of the Burmese government and passport storage systems
Date: 2022-12-05
Affiliations: Mustang Panda
Sponsor: Myanmar
Type: Espionage
Category: Government, Civil society
Victims: Burmese government agencies, and individuals who traveled to and within Myanmar

Researchers discovered a compromised server being used by Mustang Panda as a temporary storage point for exfiltrated data, including recordings, webmail dumps, and scans of passports from American, Asian, and European citizens and diplomats applying for Burmese visas.
 
Response: Unknown
Targeting of Taiwanese financial institutions
Date: 2022-02-21
Affiliations: APT 10
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Taiwan’s financial sector

The Chinese threat actor APT10 used a vulnerability in a web interface to install a version of the Quasar remote access Trojan. The attack was initially overlooked because of the focus on a credential stuffing attack, where hackers use mass amounts of previously stolen information to try to break into a system, seemingly conducted by APT10 to secure access to trading accounts and make transactions on the Hong Kong stock market. The credential stuffing was used by APT10 as a smokescreen for its larger operation.
Targeting of UK government officials
Date: 2022-04-18
Affiliations: Believed to be the work of the United Arab Emirates government
Sponsor: United Arab Emirates
Type: Espionage
Category: Government
Victims: UK government officials, including the office of Prime Minister Boris Johnson

A United Arab Emirates–sponsored operator targeted networks belonging to the UK prime minister’s office and the Foreign and Commonwealth Office with Pegasus spyware. Multiple intrusions occurred in both 2020 and 2021.
Targeting of Middle Eastern countries
Date: 2022-06-21
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: Middle Eastern governments

Since the last quarter of 2020, MuddyWater has maintained a campaign targeting countries in the Middle East. Samples of attacks were gathered from November 2020 to January 2022, but given the more recent samples found, this campaign could be currently active.