Maljean/dataset huggingface dataset:
Nodaria
Date: 2023-02-08
Affiliations: Also known as UAC-0056, Ember Bear, and Cadet Blizzard.
Sponsor: Russian Federation
Type: Data destruction
Category: Government, Private sector
Victims: Organizations in Georgia, Kyrgyzstan, and Ukraine

Nodaria is a Russia-linked threat actor. It has been active since March 2021 and is primarily linked to attacks against Ukraine, including the January 2022 WhisperGate wiper attacks. The group likely also targeted organizations in Georgia and Kyrgyzstan. 
Response: Unknown
Targeting of Ukrainian government bodies
Date: 2023-04-30
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian government organizations using the Windows operating system

Russian group APT 28 aimed a spear-phishing campaign at Ukrainian government organizations, advertising fake Windows Update guides in order to collect intelligence on government activities.
Response: Confirmation
Targeting of high-value customers of an East Asian data-loss prevention company
Date: 2023-03-15
Affiliations: Bronze Butler
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Two customers of an East Asian data-loss prevention company

Tick, a Chinese intelligence-aligned actor, compromised an internal update to the servers of a data-loss prevention company in order to deliver malware within the network. Tick packaged its malware as part of legitimate installers so that the malware was eventually executed on computers of the company’s customers. 
Response: Unknown
Targeting of South Korean hospital network
Date: 2023-05-10
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Seoul National University Hospital

Kimsuky attacked the networks of Seoul National University Hospital in 2021 and stole personal data from over eight hundred thousand current and former patients and employees. Two years later, South Korean police attributed the attack to North Korea.
Response: Confirmation   https://www.police.go.kr/user/bbs/BD_selectBbs.do?q_bbsCode=1002&amp;q_bbscttSn=20230510144333019&amp;q_tab=&amp;q_searchKeyTy=&amp;q_searchVal=&amp;q_rowPerPage=10&amp;q_currPage=1&amp;q_sortName=&amp;q_sortOrder=
Targeting of European government agencies and diplomats
Date: 2023-04-13
Affiliations: The Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Government agencies and diplomats associated with NATO and the European Union

Russian threat actor the Dukes ran a phishing campaign posing as various European embassies and sending fake Google Calendar invites that redirected those who clicked on the invite to malicious documents. The operation’s goal appears to be to steal documents related to the Ukraine war.
Response: Confirmation   https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services
Targeting of Vietnamese agriculture business
Date: 2023-06-09
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Private sector
Victims: An unnamed Vietnamese agricultural business

Ocean Lotus used a novel backdoor as part of an attack on a Vietnamese agricultural company. The attacks were launched to steal information and were likely part of a bigger campaign by Ocean Lotus against large businesses in Vietnam
Response: Unknown
Targeting of telecommunications and media firms in Vietnam
Date: 2023-02-13
Affiliations: Goblin Panda
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Vietnamese organizations in the information technology, media, and telecommunications sectors

China-backed threat actor Goblin Panda has been observed using lure documents with embedded malicious macros. The group deployed three major variants of ShellFang, a custom shellcode loader, against the telecommunications and media sectors in Vietnam throughout 2022.
Response: Unknown
Targeting of military personnel in South Asia
Date: 2023-05-03
Affiliations: Believed to be the work of the Pakistani government
Sponsor: Pakistan
Type: Espionage
Category: Military
Victims: Military personnel in India and the Pakistani Air Force

An unnamed state-linked Pakistani threat group used fake apps and websites to compromise and spy on the personal devices of military personnel in India and the Pakistani Air Force.
Response: Unknown
Targeting of U.S. federal civilian agency
Date: 2023-03-15
Affiliations: Hafnium
Sponsor: China
Type: Espionage
Category: Government
Victims: U.S. federal agency

Chinese threat actor Hafnium attacked an unnamed U.S. government civilian agency from August to January 2023. Hafnium exploited a known vulnerability in software in the agency’s Microsoft Internet Information Services (IIS) web server.
Response: Unknown
Targeting of cryptocurrency exchanges in DangerousPassword campaign
Date: 2023-05-12
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Cryptocurrency exchanges in Japan and other countries

BlueNoroff, a subcluster of the threat actor Lazarus Group, sent malicious shortcut files to cryptocurrency exchanges as part of an expansion of its DangerousPassword campaign. The malware was distributed both over email and through LinkedIn messages.
Response: Confirmation   https://blogs.jpcert.or.jp/en/2023/05/dangerouspassword.html
Targeting of a Taiwanese media organization
Date: 2023-04-17
Affiliations: APT 41
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Taiwanese media organization

The Chinese threat actor APT 41 targeted a Taiwanese media company with a phishing campaign that abused the Google command-and-control red teaming tool in order to steal data from victims.
Response: Unknown
Targeting of South Korean professors, dissidents, and human rights advocates
Date: 2023-06-12
Affiliations: APT 37
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Professors, human rights advocates, and North Korean defectors

APT 37, a North Korean hacking group, distributed information-stealing malware through Ably, a South Korean data-transfer and messaging application. The malware could be used to steal information from the victim’s computer and to record video and audio and exfiltrate it.
Response: Unknown
Targeting of Indian two-factor authentication tool Kavach
Date: 2023-02-21
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Government
Victims: Kavach, a two-factor authentication system used by Indian government agencies

Pakistani threat actor APT 36 targeted Indian government entities with a spear-phishing campaign that used a new version of ReverseRAT malware. The attacks aimed to compromise Kavach, a two-factor authentication system the Indian government used to secure its systems.
Response: Unknown
Targeting of military personnel and activists in Southeast Asia
Date: 2023-05-03
Affiliations: Patchwork
Sponsor: India
Type: Espionage
Category: Military, Civil society
Victims: Military personnel and minority rights activists in Bangladesh, China, India, Pakistan, Sri Lanka, and Tibet

Patchwork, an Indian state-sponsored threat actor, used social engineering and spear-phishing lures to target military personnel and activists in Bangladesh, China, India, Pakistan, Sri Lanka, and Tibet.
Response: Unknown
Targeting of Indian government’s premier defense technology research agency
Date: 2023-03-23
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Government
Victims: India’s Defense Research and Development Organization

The Pakistani cyberespionage group APT 36 targeted workers at India’s Defense Research and Development Organization with the goal of stealing sensitive military secrets. The group used spear phishing for initial entry with emails that alleged they contained research material about military technologies sent as attachments, but which actually contained malware.
Response: Unknown
Targeting of Ukrainian civil-society groups
Date: 2023-05-17
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Ukrainian civil-society organizations

APT 28 targeted Ukrainian civil-society groups using a combination of phishing techniques and compromised Ubiquiti Wi-Fi routers. The phishing emails impersonated documents from a Ukrainian defense think tank, the Center for Defense Strategies.
Response: Unknown
Targeting of users of Kakao
Date: 2023-01-13
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Users of the Kakao chat application in South Korea

Kimsuky, a North Korean threat actor, ran a phishing campaign that distributed fake login pages for the popular South Korean messaging app Kakao. Kimsuky likely aimed to steal victims’ passwords; whether the campaign specifically targeted any users is unclear.
Response: Unknown
Targeting of Indian government agencies
Date: 2023-04-19
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Government
Victims: Linux users working for Indian government agencies

The Pakistani threat actor APT 36 used a two-factor authentication tool to deliver a new backdoor called Poseidon to Linux users working for Indian government agencies.
Response: Unknown
Targeting of Atomic Wallet cryptocurrency users
Date: 2023-06-13
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Atomic Wallet users

North Korean hackers stole over $100 million in cryptocurrency from over five thousand cryptocurrency wallets run by a company called Atomic Wallet.
Response: Unknown
Targeting of Ukrainian government websites using two-year-old backdoors
Date: 2023-02-23
Affiliations: Nodaria
Sponsor: Russian Federation
Type: Defacement
Category: Government
Victims: Ukrainian government websites

Ukraine’s Computer Emergency Response Team said that Russian state hackers, Nodaria, breached multiple government websites using backdoors placed as far back as December 2021. The hackers used the backdoors to modify content on the affected websites, although what content was modified is unclear.
Response: Confirmation   https://cert.gov.ua/article/3947787
Targeting of the Ukrainian public sector
Date: 2023-05-04
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Data destruction
Category: Government
Victims: Ukraine’s public networks

The Russian threat group Sandworm was observed destroying data on Ukrainian state networks using a malicious script, RoarBat. Sandworm gained initial access to the networks by compromising VPN accounts that lacked two-factor authentication.
Response: Confirmation
Targeting of Middle Eastern telecommunications providers
Date: 2023-03-23
Affiliations: Gallium
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Middle Eastern telecommunications companies

The Chinese state actor Gallium targeted Middle Eastern telecommunications companies in a prolonged spear-phishing campaign dubbed Operation Soft Cell. After gaining access, attackers have been observed stealing credentials, performing general reconnaissance, and exfiltrating data.
Response: Unknown
Targeting of users of Israeli shipping and logistics websites
Date: 2023-05-23
Affiliations: Believed to be the work of the Iranian government
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Digital Ocean, uPress, and Bezeq International

An Iranian threat actor perpetrated a watering hole attack using eight Israeli websites. The websites belonged to companies from the shipping, logistics, and financial services industries.
Response: Unknown
Targeting of the Iranian government
Date: 2023-01-18
Affiliations: Mirage
Sponsor: China
Type: Espionage
Category: Government
Victims: The Iranian government

Mirage, a Chinese threat actor, deployed a new backdoor, dubbed Turian, against the Iranian government in 2022. What agencies in the Iranian government were compromised, or what information Mirage found, is unclear.
Response: Unknown
Targeting of human rights groups and activists related to human rights advocacy in North Korea
Date: 2023-04-20
Affiliations: Believed to be the work of the North Korean government
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Human rights groups and activists focused on North Korea

An APT group with similarities to Kimusky compromised legitimate business websites to target human rights groups and activists in North Korea.
Response: Unknown
Targeting of users of Naver
Date: 2023-06-15
Affiliations: Believed to be the work of the North Korean government
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Users of the Naver web portal and search engine

North Korean hackers set up a fake website designed to look like the South Korean web portal and search engine Naver, according to a report by the South Korean National Intelligence Service.
Response: Confirmation   https://www.reuters.com/world/asia-pacific/north-korean-hackers-create-fake-web-portal-souths-spy-agency-says-2023-06-15/
Targeting of Asian conglomerate in the materials sector
Date: 2023-02-28
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: An unidentified Asian conglomerate in the materials sector

Chinese APT Winnti Umbrella has been targeting multiple subsidiaries of an Asian conglomerate in the materials and composites sector using open-source malware. The group likely tried to steal intellectual property.
Response: Unknown
Targeting of minority groups in Iran
Date: 2023-05-04
Affiliations: Believed to be the work of the Iranian government
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Minority groups in Iran

The Iranian government is using BoldSpy malware to surveil minority groups in the country and monitor arms, alcohol, and drugs trafficking. The Law Enforcement Command of the Islamic Republic of Iran likely installs the malware, probably using physical access to victim devices it obtains during targets’ detention.
Response: Unknown
Targeting with spyware of Meta employee who holds U.S. and Greek citizenship
Date: 2023-03-20
Affiliations: Believed to be the work of the Greek intelligence service
Sponsor: Greece
Type: Espionage
Category: Private sector
Victims: Artemis Seaford, a Meta employee

Greece’s national intelligence service installed Predator spyware onto the phone of a Meta employee in the country, Artemis Seaford, in September 2021 and operated the malware for at least two months. Why Seaford was targeted is unclear, and the Greek authorities have said they will launch an investigation into the hack.
Response: Unknown
Volt Typhoon
Date: 2023-05-24
Affiliations: Affiliated with the Chinese government.
Sponsor: China
Type: Espionage
Category: Government, Military, Private sector
Victims: U.S. Navy systems and critical infrastructure networks

U.S. government agencies and Microsoft detected activity on critical infrastructure in the United States and Guam by a new Chinese threat actor dubbed Volt Typhoon. The attacks were primarily designed to gather information on U.S. critical infrastructure and military capabilities, but Microsoft and the agencies said the attacks could be preparation for a future attack on U.S. critical infrastructure. Also known as Vanguard Panda.
Response: Confirmation   https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
Targeting of Harmony cryptocurrency bridge
Date: 2023-01-23
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Harmony Bridge cryptocurrency platform

Lazarus Group stole nearly $100 million in cryptocurrency from the platform Harmony Bridge in June 2022. The FBI formally attributed the hack to Lazarus in January 2023 after the hackers attempted to launder nearly $60 million through cryptocurrency mixers and a series of wallets.`
Response: Confirmation   https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft
Targeting of Mac users at financial institutions
Date: 2023-04-24
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Financial technology firms and their employees who use the Mac operating system

BlueNoroff, a subgroup of North Korea’s Lazarus Group, was observed using a new Mac operating-system malware family, dubbed RustBucket, in recent attacks on Mac machines. Based on the lures used, BlueNoroff likely targeted the financial technology sector with the malware. RustBucket can be used to gather system information and allows the attacker to perform various actions on infected machines.
Response: Unknown
Targeting of organizations using Barracuda email security gateway devices
Date: 2023-06-15
Affiliations: Believed to be the work of the Chinese government
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Users of the Barracuda email security gateway, including trade offices and academic research organizations in Taiwan and Hong Kong

A Chinese threat actor compromised Barracuda brand email security gateway systems and used access to infiltrate networks attached to the Barracuda products. Once the campaign was detected, the attackers rapidly expanded their persistence on compromised systems, leading Barracuda to tell affected customers to destroy their devices due to the potential for continued compromise.
Response: Unknown
Targeting of Belgian member of Parliament
Date: 2023-03-01
Affiliations: Zirconium
Sponsor: China
Type: Espionage
Category: Government
Victims: Samuel Cogolati, Belgian MP

Chinese actor Zirconium targeted a Belgian MP, Samuel Cogolati, with a spear-phishing attack. The attack came soon after Cogolati authored a resolution condemning the crimes against humanity committed against Uyghur Muslims in China’s Xinjiang region.
Response: Denouncement   https://www.ft.com/content/5c32261c-b1a6-488e-9002-0ca9e0c8ff1b
Targeting of the staff of Korea Risk Group, as well as organizations in the United States, Asia, and Europe
Date: 2023-05-04
Affiliations: Kimsuky
Sponsor: Korea (Republic of)
Type: Espionage
Category: Private sector, Civil society
Victims: Korea Risk Group and individuals and organizations in the United States, Asia, and Europe

Kimusky deployed ReconShark malware against phishing targets, including the staff of the information and analysis firm Korea Risk Group, and organizations and individuals in the United States, Asia, and Europe, including think tanks, research universities, and government entities.
Response: Unknown
Targeting of 3CXDesktopApp customers and crypto firms
Date: 2023-03-30
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Software company 3CX and users of its equipment

Suspected members of the North Korean Lazarus Group targeted customers of the voice and video conferencing software 3CXDesktopApp in a financially motivated supply-chain attack during March 2023. The infected infrastructure was spread primarily across European countries, with additional victims in South Africa, the United Kingdom, and North America. In addition to being targeted with an info-stealer, some victims—most of whom were cryptocurrency firms in Brazil, France, Germany, and Italy—were also infected with a second-stage payload.
Response: Unknown
Targeting of telecommunications equipment in Guam
Date: 2023-05-24
Affiliations: Volt Typhoon
Sponsor: China
Type: Espionage
Category: Government, Military, Private sector
Victims: Military networks in Guam and critical infrastructure networks in the United States

Volt Typhoon is a threat actor that has been active since 2021 and targets various organizations, including educational institutions, information technology companies, military networks, and transportation groups for the purposes of espionage. The group primarily targets high-value victims and maintains persistent access through “living off the land” techniques and hands-on activity.
Response: Denouncement   https://www.nytimes.com/2023/05/24/us/politics/china-guam-malware-cyber-microsoft.html
Targeting of Hive ransomware group
Date: 2023-01-26
Affiliations: U.S. Department of Justice, FBI
Sponsor: United States
Type: Data destruction
Category: Private sector
Victims: Hive ransomware group

The U.S. Department of Justice ran a months-long disruption campaign against the Hive ransomware group. During this time, the FBI infiltrated the group’s servers and stole decryption keys, which they distributed to victims, preventing $130 million in ransom payouts.
Response: Unknown
Targeting of U.S. critical infrastructure and civil-society groups
Date: 2023-04-18
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector, Civil society
Victims: U.S. activists, journalists, the defense industrial base, political dissidents, and government employees

Iranian state-sponsored actor Charming Kitten has been linked to attacks on the U.S. critical infrastructure from 2021 to mid-2022. Those attacks weaponized n-day vulnerabilities on a number of targets, including activists, journalists, the defense industrial base, political dissidents, and U.S. government employees.
Response: Unknown
Targeting of the Indian defense sector
Date: 2023-06-15
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Military, Private sector
Victims: Organizations associated with the Indian defense sector

SideCopy, a Pakistani threat actor, used phishing lures against research institutes and companies associated with the Indian defense sector. The phishing lures used in the case were meant to emulate important documents in the Indian defense procurement process.
Response: Unknown
Targeting East Asian and Southeast Asian health-care, manufacturing, technology, and government organizations
Date: 2023-05-05
Affiliations: APT 41
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: East Asian and Southeast Asian health-care, manufacturing, technology, and government organizations.

In its latest campaign, APT 41 targeted East Asian and Southeast Asian health-care, manufacturing, technology, and government organizations, attacking via installed Windows Defender in the target environment.
Response: Unknown
Targeting of military and government networks in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka
Date: 2023-02-15
Affiliations: SideWinder
Sponsor: India
Type: Espionage
Category: Government, Military
Victims: Government organizations and others in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka

Threat researchers gained access to a portion of SideWinder’s infrastructure and used that access to determine its targets between June and November 2021. They found that SideWinder had targeted thirteen victims in Afghanistan, one in Bhutan, ten in Myanmar, twenty-nine in Nepal, and six in Sri Lanka. Most were government officials or offices. They likely do not represent the full array of SideWinder’s targets.
Response: Unknown
Targeting of Kenyan government
Date: 2023-05-25
Affiliations: Believed to be the work of the Chinese government
Sponsor: China
Type: Espionage
Category: Government
Victims: Kenyan government ministries, especially those with financial information

Chinese hackers targeted several ministries within Kenya’s government for several years. The hacks were primarily to gain information on Kenya’s ability to repay its debts associated with projects funded under China’s Belt and Road Initiative.
Response: Denial   https://www.reuters.com/world/africa/chinese-hackers-attacked-kenyan-government-debt-strains-grew-2023-05-24/
Targeting of Ukrainian national news agency, Ukrinform
Date: 2023-01-27
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Data destruction
Category: Government
Victims: Ukrinform

The Russian threat group Sandworm used a new Golang-based data wiper, SwiftSlicer, to violate the integrity and accessibility of information within the network of Ukrainian news agency Ukrinform.
Response: Confirmation   https://cert.gov.ua/article/3718487