Maljean/dataset huggingface dataset:
Targeting of South Korean institutions
Date: 2023-04-25
Affiliations: Tonto Team
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society, Government
Victims: South Korean education, construction, diplomatic, and political institutions

Chinese actor Tonto Team targeted South Korean education, construction, diplomatic, and political institutions with a malicious file related to anti-malware products.
Response: Unknown
Targeting of Ukrainian government agencies in phishing attack
Date: 2023-06-16
Affiliations: Ghostwriter
Sponsor: Russian Federation
Type: Espionage
Category: Government, Military
Victims: Agencies in the Ukrainian government who collaborate with National Defense University of Ukraine

GhostWriter launched phishing attacks against Ukrainian government agencies. The group used malicious documents purporting to be a report from an expert at the National Defense University of Ukraine.
Response: Confirmation   https://cert.gov.ua/article/4905718
Targeting of the Technion, the Israeli Institute of Technology
Date: 2023-03-07
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Financial Theft
Category: Civil society
Victims: Technion, Israeli Institute of Technology

Iranian threat actor MuddyWater launched a ransomware attack against the Technion in February 2023, forcing the school to delay its final exams by several days.
Response: Unknown
Targeting of PaperCut MF and NG print management servers by an Islamic Revolutionary Guard Corps–affiliated actor
Date: 2023-05-08
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Financial Theft
Category: Private sector
Victims: Organizations using PaperCut MF and NG print management servers

Charming Kitten targeted vulnerabilities in PaperCut MF and NG print management servers with ransomware.
Response: Unknown
SideWinder
Date: 2023-02-15
Affiliations: Believed to be affiliated with the Indian government.
Sponsor: India
Type: Espionage
Category: Government, Military
Victims: Government and military organizations in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka.

SideWinder is an Indian threat actor that has been active since at least 2012. The group primarily operates espionage campaigns but has been observed launching attacks that appear financially motivated.
Response: Unknown
Targeting of Russian iPhone users
Date: 2023-06-01
Affiliations: Attributed by Russian security services to the U.S. National Security Agency 
Sponsor: United States
Type: Espionage
Category: Government, Private sector
Victims: Members of the Russian government and employees of the cybersecurity company Kaspersky

Russian security services accused the U.S. National Security Agency of planting malware on thousands of Apple devices throughout the country. Researchers at Kaspersky also said that executives at their company were targeted as part of the campaign, although they did not attribute it to any country.
Response: Unknown
Targeting of Ukrainian government authorities
Date: 2023-02-01
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian government organizations and critical infrastructure facilities, as well as defense, security, and law enforcement agencies

Gamaredon, a Russian threat actor group, targeted Ukrainian government authorities. The group used spear-phishing emails to gain initial access and deployed surveillance malware on affected systems.
Response: Confirmation   https://scpc.gov.ua/api/docs/19b0a96e-8c31-44bf-863e-cd3e0b651f22/19b0a96e-8c31-44bf-863e-cd3e0b651f22.pdf
Targeting of high-profile government, aviation, energy, telecoms and banking-sector entities in the Middle East and North Africa
Date: 2023-04-27
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector, Civil society
Victims: High-profile government, aviation, energy, telecommunications companies and banking-sector entities in Armenia, Azerbaijan, Bahrain, Canada, Egypt, Israel, Jordan, Kuwait, Malaysia, Saudi Arabia, Syria, Turkey, and the United Arab Emirates

MuddyWater ran a phishing campaign that likely began in July 2021 against high-profile government, aviation, banking-sector, energy, and telecommunications entities in the Middle East and North Africa.
Response: Unknown
Targeting of Ukrainian email servers
Date: 2023-06-16
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government, Military
Victims: Agencies in the Ukrainian government and military who operate Roundcube email servers

APT 28, a Russian threat actor, used spear-phishing lures to gain a hold on Ukrainian government and military email servers and then attempted to expand access to the broader email network. The campaign has been active since at least November 2021.
Response: Unknown
Targeting of Mexican journalists and human rights advocates
Date: 2023-03-07
Affiliations: Believed to be the work of a Mexican intelligence agency.
Sponsor: Mexico
Type: Espionage
Victims: Three journalists and Raymundo Ramos, a human rights advocate in Mexico

Documents leaked from the Mexican government detail how the Military Intelligence Center, a department within Mexico’s intelligence agency, deployed spyware against three Mexican journalists and Raymundo Ramos, a human rights advocate in the country, between 2019 and 2021.
Response: Unknown
Targeting of PaperCut MF and NG print management servers by a Ministry of Intelligence and Security–affiliated actor
Date: 2023-05-08
Affiliations: MuddyWater
Sponsor: Iran (Islamic Republic of)
Type: Financial Theft
Category: Private sector
Victims: Organizations using PaperCut MF and NG print management servers

MuddyWater targeted vulnerabilities in PaperCut MF and NG print management servers with ransomware.
Response: Unknown
Targeting of organizations of strategic interest to the Chinese government
Date: 2023-03-30
Affiliations: WInnti Umbrella
Sponsor: China
Type: Espionage
Category: Government, Civil society, Private sector
Victims: Aviation, automotive, education, government, media, information technology, and religious organizations

Winnti Umbrella, a Chinese state-sponsored threat actor, is continuing to target organizations of interest to the Chinese government (including government, media, and information technology organizations). The group was using Keyplug, a Linux version of the custom modular backdoor, to gain access to victims’ networks, exfiltrating information in line with espionage operations.
Response: Unknown
Targeting of Taiwanese government and critical infrastructure operators
Date: 2023-06-02
Affiliations: Emissary Panda
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Taiwanese government agencies and critical infrastructure providers

Threat researchers discovered command-and-control infrastructure used by Emissary Panda to coordinate a campaign against Taiwanese government entities and critical infrastructure providers.
Response: Unknown
Targeting of an Indian medical research organization and technology and energy sectors
Date: 2023-02-02
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector, Civil society
Victims: An Indian medical research organization, technology manufacturer, and university

Lazarus Group targeted an Indian health-care organization, a technology manufacturer, and the chemical engineering department of a leading research university. The campaign’s goal appeared to be collecting intelligence on major Indian industries.
 
Response: Unknown
Targeting of manufacturing and real-estate sectors in India and telecommunications companies in Bulgaria and Pakistan
Date: 2023-04-27
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector, Civil society
Victims: Manufacturing and real-estate sectors in India and telecommunications companies in Bulgaria and Pakistan

A Lazarus Group campaign, active from early 2020 until January 2023, leveraged a backdoored UltraVNC client against manufacturing and real-estate sectors in India and telecommunications companies in Pakistan and Bulgaria. The goal of the operation, whose scope extends beyond Bulgaria, India, and Pakistan, appears to be intelligence collection.
Response: Unknown
Targeting of government organizations in Eastern Europe and Western Asia
Date: 2023-06-14
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Government and civil-society groups in the United States, Estonia, Finland, Greece, Japan, Latvia, Taiwan, and Turkey

Mustang Panda targeted government and civil-society networks in at least nine countries— including the United States, Greece, Japan, and the United Kingdom—with several new malware droppers. 
Response: Unknown
Targeting of infrastructure projects in Indonesia, Thailand, and Vietnam
Date: 2023-03-08
Affiliations: Believed to be the work of the Chinese government
Sponsor: China
Type: Espionage
Category: Government
Victims: Infrastructure projects in Indonesia, Thailand, and Vietnam

A Chinese threat actor was detected targeting the strategic infrastructure projects of government organizations in Indonesia, Thailand, and Vietnam. Active since late 2022, the campaign uses spear-fishing emails for initial access and deploys the Soul malware framework once inside the network.
Response: Unknown
Targeting of Pakistani government officials and networks in Turkey
Date: 2023-05-08
Affiliations: SideWinder
Sponsor: India
Type: Espionage
Category: Government
Victims: Pakistani government officials and computers in Turkey

SideWinder, an Indian APT, distributed spear-phishing lures to various Pakistani government officials. The lures were primarily related to the Pakistani military or U.S.-Pakistan relations. After the initial campaign against Pakistan was detected, the group used the same group of command-and-control servers to launch payloads in Turkey. The group’s targets in Turkey remain unclear.
Response: Unknown
Targeting of Ukrainian organizations with old cybercrime malware
Date: 2023-01-05
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Ukrainian organizations

A Russian threat actor, Turla, used defunct command and control website domains to reactivate dormant backdoors installed before 2013 by criminal hackers. Turla then downloaded new information-stealing malware on the infected networks to identify whether they would be valuable for espionage.
Response: Unknown
Targeting of experts in North Korea policy issues
Date: 2023-04-05
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government, Civil society, Private sector
Victims: Government and military personnel, think tanks, policymakers, academics, and researchers in South Korea and the United States

In a recent phishing campaign, North Korean threat actor Kimsuky posed as media outlets and think tanks and requested interviews or information about North Korea. The emails contained malicious links redirecting to fake login pages that harvested user credentials.
Response: Unknown
Targeting of Islamic State group militants in Iraq
Date: 2023-06-04
Affiliations: Australian Signals Directorate
Sponsor: Australia
Type: Sabotage
Category: Military
Victims: Islamic State militants operating around the city of Mosul

In 2016, Australian operators deployed the tool Light Bolt against Islamic State militants in coordination with an offensive to retake Mosul, Iraq. Light Bolt was designed to deny Islamic State militants internet access and was used to disrupt communications in coordination with ground forces attempting to retake Mosul. 
Response: Unknown
Targeting of Scottish National Party member of Parliament (MP)
Date: 2023-02-08
Affiliations: Calisto
Sponsor: Russian Federation
Type: Doxing
Category: Government
Victims: Stewart McDonald, a Scottish National Party MP and staff member

Russia-backed threat actor Calisto is believed to be behind a spear-phishing attack on the email accounts of Stewart McDonald, a Scottish National Party MP, and a member of his staff. McDonald said he worried the Russian government planned to leak the emails it stole, although as of March 28, 2023, none have been made public.
Response: Denouncement   https://www.theguardian.com/politics/2023/feb/08/scottish-mp-stewart-mcdonald-emails-hacked-russia-linked-group
Targeting Linux systems in Nepal and South Africa
Date: 2023-04-28
Affiliations: Gallium
Sponsor: China
Type: Espionage
Category: Civil society, Government, Private sector
Victims: Finance, government, and telecommunications organizations across Africa, Europe, and Southeast Asia

Chinese threat actor Gallium is using a new variant of the PingPull malware to target the Linux systems of finance, government, and telecommunications organizations across Africa, Europe, and Southeast Asia.
Response: Unknown
Targeting of European diplomatic entities
Date: 2023-03-15
Affiliations: The Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: European diplomatic entities and information systems

Russian threat group the Dukes ran a spear-phishing campaign against diplomatic entities and systems that were transmitting sensitive information about regional politics, aiding Ukrainian citizens fleeing the country, and helping the government of Ukraine.
Response: Unknown
Targeting of government networks with Snake malware
Date: 2023-05-09
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government, Military, Private sector, Civil society
Victims: Organizations in over fifty countries, including the United States, Australia, Russia, and members of the European Union

The FBI said it had disrupted a malware network, Snake, run by Turla, a unit within Russia’s Federal Security Service (FSB). Snake had been operational for almost twenty years and had been placed on computers in over fifty countries, including the United States and Russia. The U.S. operation disabled Turla’s Snake malware using a tool that propagated itself across the network of devices compromised by Snake and prompted the FSB’s malware to overwrite its own vital components.
Response: Hack Back   https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-snake-malware-network-controlled
Calisto
Date: 2023-01-06
Affiliations: Also known as Cold River, Seaborgium, TA446, TAG-53
Sponsor: Russian Federation
Type: Espionage
Category: Private sector, Civil society, Government
Victims: Politicians and organizations in the United States, United Kingdom, and Europe.

Calisto is a Russian government-affiliated threat actor. The group uses spear-phishing tactics to compromise individual email accounts for espionage purposes. The group has also been known to leak stolen emails as part of information-warfare efforts.
Response: Confirmation   https://www.ncsc.gov.uk/news/spear-phishing-campaigns-targets-of-interest
Targeting of Indian education sector
Date: 2023-04-13
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Civil society
Victims: Educational institutions and students in India

Pakistani state-backed group APT 36 targeted entities in the Indian education sector with education-themed documents that contained Crimson RAT malware.
Response: Unknown
Targeting of analysts of North Korean affairs
Date: 2023-06-06
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Researchers focused on North Korean affairs

Kimsuky used social engineering techniques to deploy ReconShark malware against former South Korean government officials and researchers focused on North Korean affairs. The group focused on expanding access to affected systems and stealing subscriptions to the North Korea-focused news website NKNews.
Response: Unknown
Targeting of dissidents and opposition political candidates in Ghana
Date: 2022-01-20
Affiliations: Believed to be the work of Ghana's government
Sponsor: Ghana
Type: Espionage
Category: Civil society
Victims: Political dissidents and opposition leaders in Ghana

The Israeli spyware firm NSO Group sold Pegasus spyware to the government of Ghana, which used the tools to spy on political opponents and dissidents. Ghana's intelligence agency launched an investigation into the spyware allegations. NSO Group has claimed that although Ghana bought the spyware, it was never actually used in the country. 
Response: Denial   https://www.haaretz.com/israel-news/tech-news/nso-ghana-op-exposed-never-before-seen-pegasus-spyware-footage-workers-passports-1.10553725
Targeting of Ukrainian state entities
Date: 2022-03-07
Affiliations: UNC1151
Sponsor: Belarus
Type: Espionage
Category: Government
Victims: Ukrainian state entities

The Belarusian threat actor UNC1151 targeted multiple Ukrainian government agencies with a backdoor called MicroBackdoor. The malware was delivered via phishing emails that included a bait image and files containing malicious code. The backdoor and loader were created in January 2022, before Russia’s invasion of Ukraine.
Targeting of Russian and Belarusian websites
Date: 2022-05-04
Affiliations: Ukrainian IT Army
Sponsor: Ukraine
Type: Denial of service
Category: Government, Private sector, Civil society
Victims: Russian and Belarusian websites were targeted, including those belonging to government, military, media, finance, energy, retail, mining, manufacturing, chemicals, production, technology, advertisements, agriculture, transportation, and political parties.

Ukraine’s IT Army compromised Docker Engine honeypots in an attempt to execute distributed denial-of-service (DDoS) attacks against Russian and Belarusian websites.
Targeting of the Belgian Federal Public Service Interior in Chinese espionage campaign
Date: 2022-07-18
Affiliations: Zirconium
Sponsor: China
Type: Espionage
Category: Government
Victims: Belgian Federal Public Service Interior

Chinese threat actors targeted the Belgian Federal Public Service Interior as part of a wide-ranging cyberespionage campaign involving multiple threat actors. Belgian authorities condemned the activity.
Response: Denouncement   https://diplomatie.belgium.be/en/news/declaration-minister-foreign-affairs-malicious-cyber-activities
Targeting of Ukrainian government agencies
Date: 2022-08-11
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian government agencies

The Computer Emergency Response Team of Ukraine found that Gamaredon had been breaking into Ukrainian government email accounts.
 
Response: Confirmation
Targeting of Palestinian entities and activists
Date: 2022-02-02
Affiliations: APT-C-23
Type: Espionage
Category: Civil society

The Hamas-linked threat actor APT-C-23 used malware embedded in politically themed decoy files and documents to install backdoors on the systems of targeted Palestinian individuals and organizations.
Targeting of government agencies in the European Union
Date: 2022-04-05
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Government agencies of EU member states

Russian threat actor Gamaredon targeted Ukrainian organizations in a phishing campaign. The hackers sent malicious emails with lures related to the Russia-Ukraine conflict, including attachments labeled “Information on war criminals of the Russian Federation” and “Necessary_military_assistance.” The emails contained malware which allowed Russian operators to conduct espionage.
Response: Confirmation   https://cert.gov.ua/article/39086
Targeting of Rostec
Date: 2022-05-19
Affiliations: Believed to be the work of the Chinese government
Sponsor: China
Type: Espionage
Category: Government
Victims: Two research institutes run by Rostec

A Chinese threat actor targeted two research institutes run by Rostec, a major Russian state-owned defense conglomerate. The attackers used spear-phishing lures to plant malware and steal data on Russian radar and electronic warfare capabilities.
Targeting of Albanian government
Date: 2022-08-04
Affiliations: Believed to be the work of the Iranian government
Sponsor: Iran (Islamic Republic of)
Type: Data destruction
Category: Government
Victims: Albanian government networks

Iranian threat actors targeted Albanian government networks with ransomware. The attack appears to have been motivated by Albania’s hosting a conference for the People’s Mojahedin Organization of Iran, a group previously listed as a terrorist organization by the European Union (EU) and United States and dedicated to opposing the Iranian regime.
Response: Denouncement   https://twitter.com/JasonMBrodsky/status/1567465232083165184?s=20&amp;t=nJqgodp_ASXIZWex6LR3Ig
Targeting of users of cryptocurrency applications
Date: 2022-12-03
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Cryptocurrency applications

North Korean hacking group Lazarus created a fake brand called BloxHolder to spread fake cryptocurrency apps that would infect users with AppleJeus malware to steal money and cryptocurrency. The campaign was active from June to at least October 2022.
 
Response: Unknown
Targeting of VMWare Horizon servers with Log4Shell vulnerability
Date: 2022-02-18
Affiliations: APT 35
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: VMware Horizon servers

The Iranian threat actor APT 35 leveraged the Log4Shell vulnerability to run malicious PowerShell commands, deploy backdoors, steal credentials, and move laterally through systems.
Targeting of cryptocurrency company employees
Date: 2022-04-19
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Cryptocurrency company employees

North Korean hackers targeted cryptocurrency company employees in a phishing campaign to access systems and make fraudulent trades. Lazarus sent mass emails with job offers embedded with malicious links. When victims clicked, their devices downloaded TraderTraitor malware, which enabled the hackers to execute commands and infiltrate company networks to make fraudulent blockchain transactions.
Response: Confirmation   https://www.cisa.gov/uscert/ncas/alerts/aa22-108a
Targeting of individual suspects in serious criminal investigations within Canada
Date: 2022-06-29
Affiliations: Believed to be the work of the Canadian government
Sponsor: Canada
Type: Espionage
Category: Civil society
Victims: Individual suspects within Canadian police investigations.

The Royal Canadian Mounted Police (RCMP) has confirmed that it uses spyware to infiltrate the mobile devices of suspects in highly sensitive criminal and national security investigations. From 2018 to 2020, the RCMP said it used spyware in ten investigations.
Targeting of Ukrainian government agencies in espionage campaign
Date: 2022-09-15
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian government agencies

Gamaredon, a Russian threat actor, was found using newly developed malware to steal information from Ukrainian government agencies. The malware was distributed through a phishing campaign.
Response: Unknown
Targeting of U.S. National Laboratories
Date: 2022-12-06
Affiliations: Calisto
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Scientists at the Brookhaven National Laboratory

In July 2022, Calisto targeted scientists at the Brookhaven National Laboratory with a fake login page to steal credentials. The hackers appear to have used the harvested credentials to access documents related to counter-proliferation and nuclear accountability in Russia and other states.
Response: Unknown
Targeting of Israeli activist
Date: 2022-01-20
Affiliations: Believed to be the work of Israel's government.
Sponsor: Israel
Type: Espionage
Category: Civil society
Victims: An activist in Israel

The Israeli government used the NSO Group's spyware tool Pegasus to spy on an Israeli activist. The authorities allegedly catalogued his activity on a dating site for use as future leverage. 
Response: Denial   https://www.calcalistech.com/ctech/articles/0%2C7340%2CL-3927606%2C00.html