Maljean/dataset huggingface dataset:
Targeting of foreign ministries
Date: 2018-02-28
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government

A threat actor targeted a foreign ministry in Europe and in North America using spear-phishing techniques for the purpose of espionage.
Operation Parliament
Date: 2018-04-12
Type: Espionage
Category: Government, Civil society
Victims: Palestine, Egypt, Jordan, United Arab Emirates, Saudi Arabia, Djibouti, Qatar, Chile, Lebonon, Somalia, Iraq, Morocco, Syria, India, Iran, Canada, United States, United Kingdom, Germany, Israel, Afghanistan, Serbia, Russia, Oman, Kuwait, South Korea, Denmark

This threat actor uses spear-phishing techniques to target parliaments, government ministries, academics, and media organizations, primarily in the Middle East, for the purpose of espionage.
Targeting of Japanese companies
Date: 2018-04-22
Affiliations: Believed to be the work of APT 10
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japan

This threat actor targets Japanese media and defense companies for espionage purposes.
APT 35
Date: 2018-01-01
Affiliations: Also known as Phosphoros and Newscaster Team
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: United States

This threat actor, whose activities date back to 2014, conducts long-term operations to collect strategic intelligence. They target U.S. and Middle Eastern defense, diplomatic, and government personnel, as well as private industries, including media, energy, business services, and telecommunications.
Operation GhostSecret
Date: 2018-04-24
Affiliations: Believed to be the work of the Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: United States, United Kingdom, India, Thailand, Guatemala, Germany, France, Canada, Brazil, China, Bangladesh, Thailand, Hong Kong, Japan, Australia,

A threat actor targets critical infrastructure and organizations in the entertainment, finance, health-care, education, and telecommunications sectors.
Chrysene
Date: 2018-05-17
Affiliations: Believed to be linked to the compromise of Saudi Aramco, malware Shamoon 2.0, and the OilRig threat actor
Type: Espionage
Category: Private sector
Victims: Iraq, Pakistan, Israel, United Kingdom

This threat actor targets organizations involved in oil, gas, and electricity production, primarily in the Gulf region, for espionage purposes. According to one cybersecurity company, the threat actor “compromises a target machine and passes it off to another threat actor for further exploitation.”
Global bank attacks
Date: 2018-10-03
Affiliations: Suspected to be the work of the Lazarus Group.
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: United States, Mexico, Chile, Brazil, Uruguay, Poland, Turkey, Bangladesh, Malaysia, Vietnam, Russia, Phillipines, Taiwan

A North Korean group is believed to have stolen hundreds of millions of dollars by infiltrating the computer systems of banks around the world since 2014.
Compromise of Managed Service Providers and technology companies
Date: 2018-12-20
Affiliations: China's Tianjin State Security Bureau
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Networks and clients of Hewlett Packard Enterprise, IBM, Fujitsu, Tata Consultancy Services, NTT Data, Dimension Data, Computer Sciences Corporation, and DXC Technology

The threat actor compromised eight technology service providers, including Hewlett Packard Enterprise and IBM (their cloud services in particular were targeted), to steal commercial secrets from over forty-five client technology companies. The victims include Swedish telecom giant Ericsson, U.S. Navy shipbuilder Huntington Ingalls Industries, and travel reservation system Sabre.
Response: Criminal charges   https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion
Targeting of AMC Theatres
Date: 2018-09-06
Affiliations: Believed to be the work of Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: AMC Theatres

A threat actor targeted U.S. movie theater chain AMC Theatres in 2014 using spear-phishing techniques. The U.S. Department of Justice alleges that the incident was related to the chain's screenings of The Interview, a movie depicting the assassination of North Korean leader Kim Jong-un.
Response: Criminal charges   https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and
Compromise of the EU's diplomatic communication network
Date: 2018-12-18
Affiliations: Suspected to be the work of Chinese military hackers.
Sponsor: China
Type: Espionage
Category: Government
Victims: European Union, United Nations, American Federation of Labor and Congress of Industrial Organizations

Hackers have infiltrated the EU’s diplomatic communication network for years, using phishing attacks to steal sensitive documents related to trade negotiations and meetings with foreign leaders.
Targeting of a European defense agency
Date: 2018-03-15
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government

A threat actor targeted a European defense agency with a spear-phishing email, which only deploys a payload if the victim opens an email attachment and scrolls to page 3.
Compromise of Cambodian election organizations
Date: 2018-07-10
Affiliations: Believed to be the work of Leviathan
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Cambodia

A threat actor compromises opposition parties, as well as organizations charged with overseeing the 2018 Cambodian elections, for espionage purposes.
Targeting of the Organization for the Prohibition of Chemical Weapons
Date: 2018-10-04
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Organization for the Prohibition of Chemical Weapons

A threat actor, believed to be Russian military intelligence, targeted the office of the Organization for the Prohibition of Chemical Weapons in The Hague with a view of compromising its Wi-Fi network for espionage purposes. Dutch authorities were able to foil the operation, and in a joint press conference with UK officials publicly identified four suspected Russian intelligence officers involved. The United States, Australia, Canada, and New Zealand issued statements denouncing Russia's cyber operations.
Response: Denouncement   https://english.defensie.nl/latest/news/2018/10/04/netherlands-defence-intelligence-and-security-service-disrupts-russian-cyber-operation-targeting-opcw
Winnti Umbrella
Date: 2018-05-03
Affiliations: Believed to be associated with the Axiom, APT 17, and Mirage threat actors. Believed to share the same tools and infrastructure as the threat actors that carried out Operation Aurora, the 2015 targeting of video game companies, the 2015 targeting of the Thai government, and the 2017 targeting of Chinese-language news websites
Sponsor: China
Type: Espionage
Category: Private sector
Victims: United States, United Kingdom, Japan, South Korea, China, Hong Kong, Universities in Hong Kong

This threat actor targets software companies and political organizations in the United States, China, Japan, and South Korea. It primarily acts to support cyber operations conducted by other threat actors affiliated with Chinese intelligence services.
Covellite
Date: 2018-05-31
Affiliations: Believed to use similar tools as the Lazarus Group
Type: Espionage
Category: Private sector
Victims: United States

This threat actor compromises the networks of companies involved in electric power, specifically looking for intellectual property and information about the companies’ operations.
Targeting of Austal
Date: 2018-11-02
Affiliations: Unknown
Category: Private sector
Victims: Austal Ltd

Austal, a major Australian defense contractor and shipbuilder, was targeted in a data breach. Hackers gained access to ship designs and personnel contact information.
Targeting of international sports federations
Date: 2018-01-12
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: European Ice Hockey Federation, International Ski Federation, International Biathlon Union, International Bobsleigh and Skeleton Federation, International Luge Federation

A threat actor targeted international sports organizations in Western Europe in the run-up to the International Olympic Committee’s banning Russian athletes from participating in the 2018 Winter Olympics in South Korea.
Compromise of a U.S. Navy contractor
Date: 2018-06-08
Sponsor: China
Type: Espionage
Category: Private sector
Victims: United States

A threat actor compromises the networks of a contractor for the U.S. Navy, exfiltrating 614 gigabytes of sensitive information, including data related to a new U.S. anti-ship missile and submarine communications systems.
Targeting of Mammoth Screen
Date: 2018-09-06
Affiliations: Believed to be the work of Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Mammoth Screen

A threat actor targeted Mammoth Screen, a UK production company that produced Opposite Number, a television drama set in North Korea.
Attack on Italian oil firm Saipem
Date: 2018-12-20
Affiliations: Possibly linked to an Iran-based group that uses the Shamoon virus to target oil and gas entities with a connection to Saudi Arabia.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Saipem

An attack on the Italian oil firm Saipem targeted servers based in India, Kuwait, Saudi Arabia, Scotland, and the United Arab Emirates. Hackers used a variant of the Shamoon virus.
Targeting of global financial organizations and bitcoin users
Date: 2018-02-12
Affiliations: Believed to be the work of the Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector

A threat actor targeted financial organizations and bitcoin users, for the purpose of identifying individuals with bitcoin wallets.
Mythic Leopard
Date: 2018-05-18
Affiliations: Also known as Transparent Tribe and C-Major
Sponsor: Pakistan
Type: Espionage
Category: Government, Private sector
Victims: India

This threat actor uses social engineering and spear phishing to target military and defense organizations in India, for the purpose of espionage.
Compromise of the U.S. Anti-Doping Agency
Date: 2018-10-04
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Doxing
Category: Civil society
Victims: U.S. Anti-Doping Agency

A threat actor compromised the U.S. Anti-Doping Agency. Seven of the individuals alleged to be behind this incident, believed to be Russian military intelligence (known as GRU), were indicted by the U.S. Justice Department.
Response: Criminal charges   https://www.justice.gov/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and
Dymalloy
Date: 2018-06-14
Affiliations: Believed to be linked to Crouching Yeti
Type: Espionage
Category: Private sector
Victims: Turkey,

This threat actor targets industrial control systems in Turkey, Europe, and North America.
Compromise of Ukrainian government
Date: 2018-11-20
Affiliations: Believed to be the work of Gamaredon.
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukraine

A Russian actor tied to Russia’s Federal Security Service (FSB) targeted Ukrainian government agencies with a backdoor attacker called Pterodo before and during Russia’s seizure of Ukrainian vessels.
Targeting of U.S. energy and other critical infrastructure sectors
Date: 2018-03-15
Affiliations: Believed to be linked to the Crouching Yeti threat actor
Sponsor: Russian Federation
Type: Espionage
Category: Private sector, Government
Victims: United States

A threat actor that the U.S. government believes to be sponsored by the Russian government, targets entities in the U.S. energy, nuclear power, water, aviation, and critical manufacturing sectors. According to the Department of Homeland Security, this activity has been ongoing since at least 2014.
Response: Sanctions   https://home.treasury.gov/news/press-releases/sm0410
Targeting of U.S. defense contractors
Date: 2018-09-06
Affiliations: Believed to be the work of Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: United States

A threat actor targeted the networks of Lockheed Martin, a U.S. defense contractor. It is one of the developers of the Terminal High Altitude Area Defense (THAAD) system installed in South Korea.
Response: Criminal charges   https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and
Compromise of South Korean resettlement agency
Date: 2018-12-28
Affiliations: Suspected to be the work of North Korean authorities.
Sponsor: Korea (Democratic People's Republic of)
Type: Doxing
Category: Government, Civil society
Victims: South Korea

The personal information of nearly one thousand North Koreans who defected to South Korea was leaked after unknown hackers gained access to the database of South Korea’s resettlement agency.
Targeting of consulates and embassies in Eastern Europe
Date: 2018-01-09
Affiliations: Believed to be the work of Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government

A threat actor targeted consulates and embassies in Eastern Europe for the purpose of espionage.
Mustang Panda
Date: 2018-06-15
Affiliations: Also known as Bronze President and HoneyMyte. Also known as RedDelta.
Sponsor: China
Type: Espionage
Category: Civil society
Victims: United States

This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes.
Compromise of the Court of Arbitration for Sport
Date: 2018-10-04
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Doxing
Category: Civil society
Victims: Court of Arbitration for Sport

A threat actor compromised the Court of Arbitration for Sport. Seven of the individuals alleged to be behind this incident, believed to be Russian military intelligence (known as GRU), were indicted by the U.S. Justice Department.
Jiangsu Province Ministry of State Security (JSSD)
Date: 2018-11-05
Affiliations: Linked to Turbine Panda and China's Ministry of State Security
Sponsor: China
Type: Espionage
Category: Private sector

This threat actor, headquartered in Nanjing, China, is a provincial foreign intelligence arm of China's Ministry of State Security. Its activities include domestic counterintelligence, nonmilitary foreign intelligence, and political and domestic security. From at least January 2010, this threat actor has targeted U.S. and European commercial airliners for the purpose of stealing trade secrets. Several intelligence officers have been charged and indicted by the U.S. Department of Justice.
Targeting of a chemical plant in Ukraine
Date: 2018-07-11
Affiliations: Believed to be the work of the same threat actors behind the alleged Russian compromise of networking equipment
Sponsor: Russian Federation
Type: Sabotage
Category: Private sector
Victims: Ukraine

A threat actor used a tool called VPNFilter to target a chemical plant in eastern Ukraine that provides chlorine to water- and sewage-treatment plants in that country. Ukraine’s intelligence service claims to have thwarted the incident.
Targeting of Mexican journalists’ mobile devices
Date: 2018-11-27
Affiliations: Believed to be the work of the Mexican government.
Sponsor: Mexico
Type: Espionage
Category: Civil society
Victims: Mexican journalists

The Mexican government is suspected of using spyware to infiltrate journalists’ messages.
Targeting of individuals of interest to the government of Lebanon
Date: 2018-01-18
Sponsor: Lebanon
Type: Espionage
Category: Military, Civil society
Victims: United States, Canada, Germany, Lebanon, France

A threat actor used a tool, Dark Caracal, to target military personnel, activists, journalists, and lawyers for espionage purposes.
Compromise of a diplomatic entity in Qatar
Date: 2018-06-07
Type: Espionage
Category: Government
Victims: Qatar

A threat actor uses a zero-day vulnerability in Adobe Flash software to compromise a diplomatic target in Qatar.
Targeting of the personal email accounts of U.S. Senators and staff
Date: 2018-09-19
Type: Espionage
Category: Government
Victims: United States

A threat actor targeted the personal email accounts of U.S. senators and staffers, according to Senator Ron Wyden (D-OR) and an unnamed technology company.
Compromise of Australian National University
Date: 2018-07-06
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Australia

A threat actor has compromised the network of Australian National University for espionage purposes.
Compromise of the Canadian Centre for Ethics in Sport
Date: 2018-10-04
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Doxing
Category: Civil society
Victims: Canadian Centre for Ethics in Sport

A threat actor compromised the Canadian Centre for Ethics in Sport. Seven of the individuals alleged to be behind this incident, believed to be Russian military intelligence (known as GRU), were indicted by the U.S. Justice Department. Canada issued a statement attributing the incident to Russian military intelligence.
Response: Denouncement   https://www.canada.ca/en/global-affairs/news/2018/10/canada-identifies-malicious-cyber-activity-by-russia.html
Targeting of emails of German lawmakers, military officials, and embassy staff
Date: 2018-11-29
Affiliations: Believed to be the work of Russian hacker group Snake.
Sponsor: Russian Federation
Type: Doxing
Category: Government, Civil society
Victims: Germany

German security officials detected a cyberattack, believed to be by the Russian group Snake, on the email accounts of German celebrities, lawmakers, military officials, and staff of several German embassies.
Compromise of U.S. electric utility control rooms
Date: 2018-07-23
Affiliations: Believed to be the work of Russian state-sponsored group Dragonfly, also known as Energetic Bear
Sponsor: Russian Federation
Type: Sabotage
Category: Private sector
Victims: United States

A threat actor compromised air-gapped, or isolated, networks owned by U.S. electric utility companies by penetrating the networks of trusted vendors.
Response: Confirmation   https://www.wsj.com/articles/russian-hackers-reach-u-s-utility-control-rooms-homeland-security-officials-say-1532388110
Iron Tiger
Date: 2018-02-01
Type: Espionage
Category: Government, Private sector
Victims: United States, Canada, Australia, Japan, China, Republic of Korea, Taiwan, Thailand, Russia, India, Israel, Iran

This threat actor targets governments as well as technology, education, and telecommunications companies primarily in Asia and the United States, for the purpose of espionage.
Targeting of financial and chemical organizations in Europe
Date: 2018-06-19
Affiliations: Believed to be the work of the same actors behind the compromise of the 2018 Winter Olympics
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Russia, France, The Netherlands, Switzerland, Germany, Ukraine

A threat actor uses a tool, called Olympics Destroyer, to target financial organizations in Russia and biological and chemical laboratories in Ukraine and other countries in Europe.
Poison Ivy
Date: 2018-09-21
Type: Espionage
Category: Government, Private sector
Victims: China

This threat actor targets government and private-sector entities in the defense, maritime, and science and technology sectors in China for espionage purposes. It is particularly interested in information related to cross–Taiwan Strait and U.S.-Sino relations.
HenBox
Date: 2018-03-13
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Uighurs

This threat actor targets Uighurs—a minority ethnic group located primarily in northwestern China—and devices from Chinese mobile phone manufacturer Xiaomi, for espionage purposes.
Compromise of FIFA
Date: 2018-10-04
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Federation Internationale de Football Association (FIFA)

A threat actor compromised the Federation Internationale de Football Association (FIFA). Seven of the individuals alleged to be behind this incident, believed to be Russian military intelligence (known as GRU), were indicted by the U.S. Justice Department.
Targeting of the office of U.S. Senator Claire McCaskill
Date: 2018-07-26
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: United States

The office of U.S. Senator Claire McCaskill (D-MO) announced that it was targeted by Russian state-sponsored cyber actors, following a report of the incident in the Daily Beast.
Compromise of Marriott International
Date: 2018-11-30
Affiliations: Suspected to be the work of Chinese operatives working for the Ministry of State Security.
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Marriott International Inc

Marriott reported a massive data breach that affected up to five hundred million customers in its Starwood hotels reservation system. U.S. private investigators believe China is behind the hack.
Compromise of the Dukes
Date: 2018-01-25
Sponsor: Netherlands
Type: Espionage
Category: Government
Victims: Russian Federation

A threat actor successfully compromised the networks of the Dukes, gaining visibility into the Dukes’ targeting methods and operations. This compromise allegedly helped the U.S. intelligence community to attribute the 2016 compromise of the Democratic National Committee and other entities to Russian state-sponsored actors.
Targeting of chemical research and media organizations in Germany
Date: 2018-07-12
Affiliations: Believed to be the work of Sandworm.
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Germany

A threat actor targets German media companies and organizations involved in chemical weapons research, for the purpose of espionage.
Cobalt Dickens
Date: 2018-08-24
Affiliations: Also known as the Silent Librarian. Believed to be associated with the Mabna Institute.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Australia, Canada, China, Israel, Japan, Switzerland, Turkey, United Kingdom, United States

This threat actor targets universities around the world for espionage purposes.
UK targeting of the Islamic State group
Date: 2018-04-12
Affiliations: Believed to be associated with the U.S. targeting of the Islamic State Group.
Sponsor: United Kingdom
Type: Sabotage
Category: Civil society
Victims: Islamic State Group

The United Kingdom’s Government Communications Headquarters director announced that, along with the UK Ministry of Defense, it had conducted a “major offensive cyber campaign” directed at the Islamic State, with the purpose of disrupting the group’s ability to recruit and coordinate. The UK campaign mirrors a previous one announced by the U.S. government in 2016.
Targeting of Westinghouse Electric Corporation
Date: 2018-10-04
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Westinghouse Electric Company

A threat actor targeted Westinghouse Electric Company, a nuclear power developer, for espionage purposes. One of the individuals alleged to be behind this incident, believed to be Russian military intelligence (known as GRU), was indicted by the U.S. Justice Department.
Response: Criminal charges   https://www.justice.gov/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and