Maljean/dataset huggingface dataset:
Equation Group
Date: 2015-02-16
Affiliations: Also known as Tilded Team, it is associated with Flame, Stuxnet, Regin, Gauss, and Duqu.
Sponsor: United States
Type: Espionage
Category: Government, Military
Victims: Iran, Russia, Pakistan, Afghanistan, India, China, Syria, Mali, Lebanon, Yemen, Algeria, United Arab Emirates, Kenya, United Kingdom, Libya

In 2015, Moscow-based Kaspersky Lab published a report on the Equation Group, a threat actor active since 2001 [PDF]. It was responsible for infecting approximately five hundred systems in at least forty-two countries. The malware used by Equation Group had the ability to reprogram hard drives and then self-destruct, which made the operations effectively invisible and indestructible. Targeted systems ranged from the private to the public sector, from energy departments to military operations to media outlets.

The tools and scope of the Equation Group suggest that it is one of the most sophisticated threat actors operating in cyberspace. Many believe that Equation Group is a state-sponsored entity, such as the U.S. National Security Agency or a joint effort between it and its Five Eyes allies.
Compromise of a Pentagon legacy system
Date: 2015-06-04
Affiliations: Suspected to be the work of the Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Military
Victims: Pentagon

A threat actor compromised a legacy unclassified network at the Department of Defense.
Response: Denouncement   http://www.defense.gov/News/Transcripts/Transcript-View/Article/607043
Compromise at the Office of Personnel Management
Date: 2015-07-10
Affiliations: Suspected to be the work of Deep Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Office of Personnel Management

A threat actor compromised the networks of the U.S. Office of Personnel Management, exposing the data of at least 22.1 million people who have applied for a U.S. security clearance.
Response: Unknown   http://www.nytimes.com/2015/08/01/world/asia/us-decides-to-retaliate-against-chinas-hacking.html?_r=0
Hellsing
Date: 2015-04-15
Affiliations: Possibly uses the same infrastructure as Mirage
Sponsor: China
Type: Espionage
Category: Government
Victims: Malaysia, Philippines, India, Indonesia, United States

This threat actor uses spear-phishing techniques to compromise diplomatic targets in Southeast Asia, India, and the United States. It also seems to have targeted the APT 30.
Compromise of an unclassified network associated with the U.S. Joint Chiefs of Staff
Date: 2015-07-28
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Military
Victims: Joint Chiefs of Staff

A threat actor compromised an unclassified network used by the U.S. Joint Chiefs of Staff for espionage purposes.
Compromise of United Airlines
Date: 2015-07-29
Affiliations: Suspected to be the work of Deep Panda
Sponsor: China
Type: Espionage
Category: Private sector
Victims: United Airlines

A threat actor compromised the network of United Airlines for espionage purposes, gaining access to flight manifests.
Targeting of Ukrainian law enforcement and government officials
Date: 2015-03-13
Sponsor: Russian Federation
Type: Espionage
Category: Military, Government
Victims: Ukraine

A threat actor attempted to compromise Ukrainian officials in government and law enforcement for espionage purposes. Ukrainian intelligence claims this was done in support of Russian-backed military activities in eastern Ukraine.
Response: Denouncement   http://www.sbu.gov.ua/sbu/control/en/publish/article?art_id=138949&amp;cat_id=35317
Compromise of the Seoul subway system
Date: 2015-10-05
Affiliations: Believed to be the work of the same actors behind Dark Seoul and possibly linked to Onion Dog
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: Seoul Subway System

A threat actor compromised networks associated with Seoul's subway system.
Response: Denouncement   http://www.koreaherald.com/view.php?ud=20151005001125
Disruption of GitHub
Date: 2015-03-27
Sponsor: China
Type: Denial of service
Category: Private sector
Victims: GitHub

A threat actor launched a denial of service attack against GitHub to prevent access to internet content banned in China, such as the New York Times. The incident was the first in which threat actors, believed to be associated with the government of China, used a tool dubbed the Great Cannon.
Compromise of the Permanent Court of Arbitration's website
Date: 2015-10-16
Sponsor: China
Type: Espionage
Category: Government
Victims: Permanent Court of Arbitration

A threat actor compromised the website of the Permanent Course of Arbitration for espionage purposes, intending to compromise visitors to the website.
Compromise of unclassified White House networks
Date: 2015-04-07
Affiliations: Suspected to be the work of the Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: White House, U.S Department of State

Threat actors compromised unclassified White House networks using access from compromised networks at the State Department.
Compromise of South Korean government computers (2015)
Date: 2015-10-20
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: Members of the National Assembly

A threat actor compromised government networks affiliated with members of the South Korean parliament. The threat actor also attempted to compromise the Foreign Ministry, Defense Ministry, and the Blue House.
Response: Denouncement   http://www.upi.com/Top_News/World-News/2015/10/20/Spy-agency-North-Korea-hackers-stole-sensitive-South-Korean-data/9041445353950/
Blue Termite
Date: 2015-08-20
Affiliations: This threat actor is believed to have been responsible for the Japan Pension Service incident. It is also known as Emdivi and Cloudy Omega.
Type: Espionage
Category: Government, Private sector
Victims: Japan

This threat actor targets Japanese entities in the government, manufacturing, finance, space, education, food, and medical sectors for espionage purposes.
Attempted compromise of the Dutch organization investigating the crash of flight MH17
Date: 2015-10-22
Affiliations: Possibly attributed to APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Dutch Safety Board

A threat actor attempted to compromise the networks of the Dutch Safety Board, the group charged with investigating the crash of Malaysia Airlines Flight 17, which crashed in Ukraine.
Compromise of networks in the Saudi government ministries
Date: 2015-05-21
Affiliations: Believed to be the work of Saffron Rose
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Military
Victims: Ministry of Foreign Affairs, Ministry of the Interior, Ministry of Defense

A threat actor compromised the networks of several Saudi government ministries for the purposes of espionage and doxing.
Compromise of social media accounts of State Department officials
Date: 2015-11-24
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: U.S. Department of State

A threat actor compromised social media accounts of junior State Department staff to launch spear-phishing campaigns for espionage purposes.
Network compromise at the Australian Bureau of Meteorology
Date: 2015-12-01
Sponsor: China
Type: Espionage
Category: Government
Victims: Bureau of Meteorology

A threat actor compromised the networks of Australia's Bureau of Meteorology for espionage purposes.
Compromise of the Japanese pension system
Date: 2015-06-01
Affiliations: Linked to Blue Termite
Type: Espionage
Category: Government
Victims: Japan Pension Service

A threat actor compromised the networks of the Japan Pension Service and gained access to the pension records of over 1.25 million individuals.
Charming Kitten
Date: 2014-05-28
Affiliations: Also known as Charming Kitten, APT 35, Newscaster, Ajax Security Team, Phosphorus, Group 83, TA453, and Cobalt Illusion. Possibly linked to Rocket Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Military
Victims: U.S. government/defense sector websites, Israel, United Kingdom, Saudi Arabia, Iraq, Individuals associated with the U.S. government or 2020 presidential election

This threat actor uses watering hole attacks and fake profiles to lure targets from the U.S. government for espionage purposes. Also believed to target scholars who study Iran, human rights organizations, and the media. At least one cybersecurity company claims that Behzah Mesri, who was indicted by the U.S. Department of Justice for compromising the networks of HBO, was a member of this threat actor group
DragonOK
Date: 2014-09-10
Affiliations: Uses similar tools as Moafee and Rancor, possibly indicating a link between the threat actors
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japan, Taiwan, Russia

This threat actor targets high-tech and manufacturing companies, primarily from Japan, for the purpose of acquiring trade secrets. In 2017, cybersecurity firms released evidence pointing to the threat actor expanding its targets to Russian and Tibetan interests.
Compromise of U.S. Transportation Command Contractors
Date: 2014-09-17
Sponsor: China
Type: Espionage
Category: Military, Private sector
Victims: Contractors of U.S. Transportation Command

A threat actor successfully compromises the networks of contractors for U.S. Transportation Command (TRANSCOM), a military command assigned with moving U.S. military personnel and assets around the world. 
Response: Denouncement   https://www.armed-services.senate.gov/press-releases/sasc-investigation-finds-chinese-intrusions-into-key-defense-contractors
Moafee
Date: 2014-09-10
Affiliations: Uses similar tools as DragonOK, possibly indicating a link between the two
Sponsor: China
Type: Espionage
Category: Private sector
Victims: United States

This threat actor targets militaries and governments interested in the South China Sea, including the U.S. defense industrial base.
Lotus Blossom
Date: 2014-07-28
Affiliations: Also known as Spring Dragon and Eslie
Sponsor: China
Type: Espionage
Category: Military, Government
Victims: Japan, Hong Kong, Taiwan, Philippines, Indonesia, Vietnam

This threat actor compromises government and military targets in Hong Kong, Japan, Taiwan, Vietnam, the Philippines, and Indonesia for espionage purposes.
Compromise of Sony Pictures Entertainment
Date: 2014-12-03
Affiliations: Believed to be the work of the Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Doxing
Category: Private sector
Victims: Sony Pictures Entertainment

Threat actors compromised the networks of Sony Pictures Entertainment, destroyed data, and publicly released employee emails. The United States attributed the incident to North Korea, which is believed to have staged the attack to prevent Sony from releasing the film The Interview, which depicts an assassination plot against North Korean leader Kim Jong-un.

The compromise of Sony Pictures was the first cyber incident to be formally condemned by a U.S. president. The incident also prompted the United States to sanction certain North Korean individuals and organizations, denying them access to U.S. financial institutions.

In September 2018, the U.S. Department of Justice announced criminal charges alleging that North Korean entities were responsible for this incident.
Response: Sanctions   https://www.whitehouse.gov/the-press-office/2015/01/02/executive-order-imposing-additional-sanctions-respect-north-korea
Crouching Yeti
Date: 2014-07-31
Affiliations: Also known as Energetic Bear, Dragonfly, Group 24, and Koala Team. Possibly associated with Allanite and Dymalloy. Believed to be behind the targeting of critical infrastructure entities in the United States and Germany, prompting both countries to issue technical alerts
Sponsor: Russian Federation
Type: Espionage
Category: Private sector, Government
Victims: United States, Spain, Japan, Germany, France, Italy, Turkey, Ireland, Poland, China, Russia, Ukraine, United Kingdom, Greece

Also known as Bromine. This threat actor targets companies in the education, energy, construction, information technology, and pharmaceutical sectors for the purposes of espionage. It uses malware tailored to target industrial control systems.
Turla
Date: 2014-08-07
Affiliations: Turla is also known as Snake, Venomous Bear, Uroburos, Group 88, Waterbug, and Turla Team. Estonian intelligence services associate this group with the Russian federal security service (FSB). Turla is associated with Agent.btz and believed to be behind the RUAG espionage incident, an attempted compromise of the Swiss defense ministry, the targeting of diplomatic missions in Eastern Europe, the targeting of South Korean actors prior to the meeting of U.S. President Donald J. Trump and North Korean leader Kim Jong-un, and the compromise of the German and Finnish foreign ministries. 
Sponsor: Russian Federation
Type: Espionage
Category: Government, Military
Victims: France, Russia, Belarus, Romania, United States, Netherlands, Kazakhstan, Saudi Arabia, Iran, Poland, Germany, Uzbekistan, Tajikistan, India, Iraq, Austria, Armenia

This threat actor targets governments, militaries, and research organizations for espionage purposes.
Axiom
Date: 2014-09-24
Affiliations: Believed to be closely linked to, though distinct from, Winnti.
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: United States, United Kingdom, Germany, Netherlands, Belgium, Switzerland, Italy, Russia, China, Japan, Indonesia

This threat actor compromises a range of actors of espionage purposes, namely government agencies in Asia and the West, circuit manufacturers, networking equipment manufacturers, internet companies, software vendors, journalists, nongovernmental organizations, law firms, telecommunication firms, venture capitalists, and academic institutions.
Sandworm
Date: 2014-11-03
Affiliations: Also known as Voodoo Bear, and Electrum. Believed to be responsible for the 2008 DDoS attacks in Georgia and the 2015 Ukraine power grid outage. Code used by this threat actor was also found in the alleged Russian compromise of networking equipment. There is possible overlap between Black Energy and the threat actor behind the compromise of the 2018 Winter Olympics.
Sponsor: Russian Federation
Type: Espionage
Category: Private sector, Government
Victims: Russia, Ukraine, Poland, Lithuania, Belarus, Azerbaijan, Kyrgyzstan, Kazakhstan, Iran, Israel, Georgia

This threat actor targets industrial control systems, using a tool called Black Energy, associated with electricity and power generation for espionage, denial of service, and data destruction purposes. Some believe that the threat actor is linked to the 2015 compromise of the Ukrainian electrical grid and a distributed denial of service prior to the Russian invasion of Georgia. 

In 2018, Germany’s domestic intelligence agency released a technical alert about this threat actor, and the United Kingdom attributed the actor to Russian military intelligence.

In May 2020, the NSA publicly accused the group of targeting email servers worldwide.
APT 18
Date: 2014-09-02
Affiliations: Also known as Dynamite Panda, TG-0416, and TA428
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: United States

This threat actor targets human rights groups, government entities, and companies in the pharmaceutical, medical, industrial, and information technology sectors.
Compromise of Community Health Systems
Date: 2014-09-08
Affiliations: Believed to be the work of APT 18
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Community Health Systems

Community Health Systems, a large hospital group in the United States, announced that its computer networks  were compromised, leading to the exfiltration of Social Security numbers and other personal information of approximately 4.5 million people to China.
Compromise of the Sands Casino
Date: 2014-12-12
Sponsor: Iran (Islamic Republic of)
Type: Data destruction
Category: Private sector
Victims: Las Vegas Sands Corporation

Threat actors launched a denial of service attack and wiped data from the computer networks at the Sands Casino in Las Vegas.
Response: Denouncement   http://www.bloomberg.com/news/articles/2015-02-26/iran-behind-cyber-attack-on-adelson-s-sands-corp-clapper-says
Indictment of PLA officers
Date: 2014-05-19
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Westinghouse, Solar World, U.S. Steel, ATI, USW, Alcoa

In May 2014, the U.S. Department of Justice indicted five members of the People’s Liberation Army (PLA) Unit 61398, a Chinese army unit dedicated to cyber espionage. According to the Department of Justice, Unit 61398 compromised U.S. corporate networks for trade information potentially useful to Chinese state-owned enterprises.

The PLA indictments were the most direct confrontation to date between Washington and Beijing regarding Chinese government sponsorship of hacking groups. It was the first time that the U.S. Department of Justice indicted state-sponsored actors, and was part of a broader effort by the United States to halt China’s cyber industrial espionage programs and define an international norm against cyber espionage for commercial gain.
Response: Criminal charges   https://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor
Putter Panda
Date: 2014-06-10
Affiliations: Also known as APT 2, PLA Unit 61486, and TG-6952
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: U.S. satellite and aerospace sector

This threat actor targets firms in the technology (communications, space, aerospace), research, defense, and government sectors in the United States for espionage purposes. The tools and infrastructure it uses overlap with PLA Unit 61398.
Attack on a German steel plant
Date: 2014-12-22
Type: Sabotage
Category: Private sector
Victims: Unnamed German steel mill

A threat actor compromised an unnamed steel mill by accessing the plant's business network and working its way into production networks and the systems controlling plant equipment. The compromise causes one of plant's furnaces to shut down.
Compromise of Boeing
Date: 2014-07-12
Sponsor: China
Type: Espionage
Category: Private sector
Victims: United States

Su Bin, a Chinese national, pleaded guilty to hacking Boeing and other U.S. defense contractors for the purpose of passing confidential information to the People's Liberation Army.
Response: Criminal charges   https://www.justice.gov/opa/pr/chinese-national-pleads-guilty-conspiring-hack-us-defense-contractors-systems-steal-sensitive
Compromise of Canada's National Research Council
Date: 2014-07-29
Sponsor: China
Type: Espionage
Category: Government
Victims: National Research Council

A threat actor compromised the networks of Canada's National Research Council and exfiltrated data for espionage purposes. The government of Canada confirmed that Chinese state-sponsored actors were responsible.
Response: Denouncement   http://news.gc.ca/web/article-en.do?nid=871449
Compromise of U.S. Investigations Services
Date: 2014-08-06
Affiliations: Related to the compromise at the Office of Personnel Management
Sponsor: China
Type: Espionage
Category: Private sector
Victims: USIS

The contractor responsible for security clearance at the U.S. Department of Homeland Security had their networks hacked and employee information was compromised.
Fake Occupy Central apps
Date: 2014-09-17
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Pro-democracy occupy central activists

Threat actor targeted pro-democracy activists by enticing them to download and install malware-laden Android apps, allowing the threat actors to remotely track and record conversations on compromised phones.
Machete
Date: 2014-08-20
Type: Espionage
Category: Military, Government
Victims: Venezuela, Ecuador, Colombia, Russia, Brazil, Peru, Cuba, Spain, Sweden, China, Germany, United States, Belgium, France, Malaysia

This threat actor targets military, government entities, and telecommunications providers, primarily in Latin America, for the purpose of espionage.
Compromise of iCloud in China
Date: 2014-10-21
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Apple iCloud in China

A threat actor compromised Apple's iCloud service in China and intercepted user names and passwords of targeted iCloud users.
APT 12
Date: 2014-09-03
Affiliations: Also known as IXESHE, Numbered Panda, and Group 22
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: Japan, Taiwan

This threat actor targets organizations in Japan, Taiwan, and elsewhere in East Asia—including electronics manufacturers and telecommunications companies—for espionage purposes.
Compromise of the U.S. State Department
Date: 2014-10-28
Affiliations: Believed to be the work of the Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: U.S. Department of State

A threat actor compromised the unclassified network of the State Department for espionage purposes.
Careto
Date: 2014-02-10
Affiliations: Also known as Mask and Ugly Face
Sponsor: Spain
Type: Espionage
Category: Government, Private sector
Victims: Morocco, Brazil, United Kingdom, France, Spain, Switzerland, Libya, United States, Iran, Venezuela, South Africa, Germany, Poland, Tunisia

This threat actor targets governments, diplomatic missions, private companies in the energy sector, and academics for espionage purposes.
Compromise of the U.S. Postal Service
Date: 2014-11-09
Sponsor: China
Type: Espionage
Category: Government
Victims: U.S. Postal Service

A threat actor compromised the networks of the U.S. Postal Service and gained access to employee data.
Snowglobe
Date: 2014-03-21
Affiliations: Animal Farm
Sponsor: France
Type: Espionage
Category: Government, Private sector
Victims: Syria, Iran, Malaysia, United States, China, Turkey, Netherlands, Germany, United Kingdom, Russia, Algeria, Ivory Coast, Spain, Norway, Greece

A threat actor, confirmed to be the French government, that targets governments, companies, media organizations, military contractors, and humanitarian organizations.
Compromise of the U.S. National Oceanic and Atmospheric Administration
Date: 2014-11-12
Sponsor: China
Type: Espionage
Category: Government
Victims: National Oceanic and Atmospheric Agency

Threat actors accessed weather network data
Regin
Date: 2014-11-24
Affiliations: Believed to be the work of the Equation Group
Sponsor: United Kingdom, United States
Type: Espionage
Category: Government, Private sector
Victims: Algeria, Afghanistan, Belgium, Brazil, Fiji, Germany, Iran, India, Indonesia, Kiribati, Malaysia, Pakistan, Syria, Russia

A threat actor, using a tool dubbed Regin, compromised telecommunications networks and collected information about how those networks operate to facilitate espionage on other targets such as governments, financial institutions, and academics.
Saffron Rose
Date: 2014-05-12
Affiliations: Also known as Flying Kitten, Sayad, Ajax Security Team, and Group 26
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Military, Civil society
Victims: United States, Iranian internet activists

This threat actor is focused on espionage and targets companies within the U.S. defense industrial base and Iranians who use anticensorship technology.
Attempted compromise of Ukrainian email accounts
Date: 2014-12-09
Sponsor: Russian Federation
Type: Espionage
Category: Government, Military
Victims: Ukraine

A threat actor attempted to compromise email accounts in Ukraine for espionage purposes.
Response: Denouncement   http://www.sbu.gov.ua/sbu/control/en/publish/article?art_id=138949&amp;cat_id=35317