Maljean/dataset huggingface dataset:
Targeting of U.S. companies and government agencies
Date: 2020-08-10
Affiliations: Fox Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: U.S. government agencies, U.S. companies

Iranian hackers attacked high-end networking equipment with recently reported vulnerabilities that had not yet been patched, providing a “beachhead” for peer hacking groups.
Targeting of Vietnamese and Southeast Asian internet users
Date: 2020-11-06
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Civil society
Victims: Internet users in Vietnam and Southeast Asia

The Vietnamese threat actor APT Ocean Lotus created Vietnamese-language news websites with articles that installed malware, loaded a web profiling framework, or redirected users to phishing pages.
Targeting of North Koreans and North Korea–focused professionals
Date: 2020-03-26
Affiliations: DarkHotel
Sponsor: Korea (Republic of)
Type: Espionage
Category: Government
Victims: North Koreans and North Korean–focused professionals

DarkHotel, a South Korea–linked threat actor, used five zero-days in a single campaign targeting North Koreans, demonstrating an unusual level of sophistication.
Targeting of ministries of foreign affairs and a national parliament in Central Asia and Eastern Europe
Date: 2020-05-26
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Central Asian and Eastern European ministries of foreign affairs and parliament

Hackers used a remote access trojan (RAT), ComRAT v4, to exfiltrate sensitive documents from Central Asian and Eastern European government computers.
Pioneer Kitten
Date: 2020-08-31
Affiliations: Also known as Parasite, UNC757, and Fox Kitten.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Private sector, Government
Victims: Iranian expats and dissidents, North American and Israeli organizations

Responsible for gathering sensitive and private information relevant to Iran. In addition to stalking Iranian expats and dissidents, Pioneer Kitten has targeted North American and Israeli technology, government, defense, and healthcare organizations. Pioneer Kitten is unlikely to be an official part of the Iranian government, and is more likely contracted to act on its behalf.
Targeting of Apple MacOS users
Date: 2020-11-27
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Private sector, Civil society
Victims: Apple MacOS users, likely foreign but working in Vietnam

Vietnamese hackers sent phishing emails containing zip files disguised as Microsoft Word documents to install malware on computers running Apple’s MacOS.
Attack on Austrian foreign ministry
Date: 2020-02-13
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Austrian Foreign Ministry

The suspected Russian hackers conducted a weeks-long attack on Austria’s foreign ministry.
Response: Confirmation   https://www.theregister.co.uk/2020/02/14/austria_foreign_ministry_hack_turla_group_allegs/
Spear-phishing campaign against unnamed U.S. government agency
Date: 2020-01-23
Affiliations: Konni Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: Employees of the U.S. government

The suspected North Korean threat actor Konni Group attempted to trick employees of an unnamed U.S. government agency to install malware on their computers via a spear-phishing campaign.
Australian Signals Directorate
Date: 2020-04-06
Sponsor: Australia
Type: Data destruction
Category: Private sector

Responsible for attacking infrastructure that cyber criminals abroad were using to target Australians during the COVID-19 pandemic.
Targeting of Russian aerospace and defense companies
Date: 2020-10-19
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Russian aerospace and defense companies

North Korean hackers used spear-phishing emails and social media messages in hopes of stealing credentials related to Russian aerospace and defense companies.
Catfishing of Israeli soldiers
Date: 2020-02-16
Affiliations: APT-C-23
Sponsor: Palestine, State of
Type: Espionage
Category: Military
Victims: Israeli Defense Forces (IDF) soldiers

The Hamas-associated threat actor APT-C-23 targeted Israeli soldiers by pretending to be women looking for romantic partners. Duped soldiers were then enticed to download apps that contained spyware onto their phones.
Response: Hack Back   https://www.bleepingcomputer.com/news/security/hacker-group-catfishes-israeli-soldiers-into-installing-mobile-rat/
Targeting of defense companies in Israel and the Middle East
Date: 2020-08-14
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government, Private sector
Victims: Defense companies

Responsible for using social engineering and lofty job postings to coax employees into downloading malware that ultimately stole classified data.
KillSomeOne
Date: 2020-11-04
Sponsor: China
Category: Civil society
Victims: Nongovernmental organizations in Myanmar

A Chinese actor that uses DLL side-loading to install malware on targeted systems.
Tracking of Saudi Arabian citizens in the United States
Date: 2020-03-29
Affiliations: Government of Saudi Arabia
Sponsor: Saudi Arabia
Type: Espionage
Category: Private sector
Victims: Saudi Arabian citizens in the Untied States

The Saudi Arabian government used flaws in the global Signaling System 7 (SS7) to track Saudis in the United States by sending requests through Saudi phone companies.
Targeting of global financial institutions
Date: 2020-05-12
Affiliations: Hidden Cobra
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Global financial institutions

Hidden Cobra used a variety of malware tools to hack into and steal money from banks, cryptocurrency exchanges, and ATMs.
Response: Denouncement   https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133a
Targeting of Iranian expats and dissidents
Date: 2020-09-18
Affiliations: Pioneer Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Iranian expats and dissidents

Iranian hackers stole personal documents and two-factor authentication codes from SMS messages, recorded phones’ surroundings, and used Telegram phishing accounts to target Iranian expats and dissidents.
Targeting of unnamed European foreign ministry
Date: 2020-12-02
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government

The Russian threat actor Turla used specialized malware called Crutch to exfiltrate documents belonging to an unidentified European foreign ministry.
Targeting of Burisma
Date: 2020-01-13
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Burisma

The alleged Russian actors hacked Burisma, a Ukrainian gas company whose board Joe Biden’s son sat on. President Trump had previously pressed Ukraine to open an investigation into Biden and Burisma, which led to his impeachment.
Targeting of  New York Times journalist Ben Hubbard
Date: 2020-01-28
Affiliations: KINGDOM
Sponsor: Saudi Arabia
Type: Espionage
Category: Civil society
Victims: Ben Hubbard

The Saudi hackers KINGDOM launched a phishing attack to attempt to trick  journalist Ben Hubbard into installing NSO Group’s Pegasus malware onto his phone. Hubbard does not recall clicking on the infected link sent to him via text message and it is unknown if his phone was infected.
Targeting of Israeli water management facilities
Date: 2020-07-17
Affiliations: Believed to be the work of the Iranian government.
Sponsor: Iran (Islamic Republic of)
Type: Sabotage
Category: Government
Victims: Israel

Hackers targeted two water pumps in Galilee and Mateh Yehuda. No real-world effects were reported as a result of the hacking operation. Israel's government stated that no data had been stolen.
Response: Confirmation   https://www.ynet.co.il/article/rJrCqmAkw
Targeting of Vietnamese dissidents, human rights workers, journalists, and private companies in Germany
Date: 2020-10-08
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Civil society, Private sector
Victims: Dissidents, human rights workers, journalists, and private companies in Germany

Vietnamese hackers spied on dissidents, human rights workers, and journalists using malware installed through spear-phishing campaigns. The hackers are also suspected of stealing sensitive data from BMW.
Targeting of Arabic speakers with COVID-19–related apps
Date: 2020-04-15
Affiliations: Syrian Electronic Army
Sponsor: Syrian Arab Republic
Type: Espionage
Category: Civil society
Victims: Arabic speakers in Syria and surrounding region

The Syrian Electronic Army distributed numerous COVID-19–themed Android mobile apps to Arabic-speaking users.
BlackTech
Date: 2020-08-19
Sponsor: China
Type: Espionage
Category: Government
Victims: Taiwanese government agencies and email accounts

Responsible for targeting governments in Asia, particularly in Taiwan but also in Hong Kong and Japan. They used Taidoor malware to steal information from Taiwanese government agencies and official email accounts.
Targeting of nongovernmental organizations in Myanmar
Date: 2020-11-04
Affiliations: KilllSomeOne
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Nongovernmental organizations in Myanmar

Chinese hackers used DLL side-loading to install malware on nongovernmental organizations’ systems in Myanmar.
Targeting of companies in the United States, Israel, Saudi Arabia, and elsewhere
Date: 2020-02-16
Affiliations: APT 34, possibly APT 33/APT 39.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Private companies in numerous countries

The Iranian threat actors targeted dozens of companies in the United States, Israel, Saudi Arabia, and elsewhere. They exploited VPNs for initial access and breached additional companies via supply chain attacks.
Targeting of Poland’s War Studies University
Date: 2020-04-23
Affiliations: Russia
Sponsor: Russian Federation
Type: Defacement
Category: Government, Military
Victims: Poland’s War Studies University

Hackers breached Poland’s War Studies University’s website and posted a fake letter from the university’s commander, urging Polish soldiers “to fight against the American occupation.”
Response: Denouncement   https://www.gov.pl/web/sluzby-specjalne/atak-dezinformacyjny-na-polske
Targeting of U.S. government agency networks
Date: 2020-11-14
Affiliations: Believed to be the work of the Chinese government. 
Sponsor: China
Type: Espionage
Category: Government
Victims: U.S. government networks

Chinese hackers scanned networks in search of virtual private network (VPN) and email server vulnerabilities with the aim of exfiltrating data.
Response: Confirmation   https://us-cert.cisa.gov/ncas/alerts/aa20-258a
Targeting of SolarWinds customers
Date: 2020-12-09
Affiliations: Cozy Bear, APT 29
Sponsor: Russian Federation
Type: Espionage
Category: Government, Private sector, Military
Victims: More than eighteen thousand SolarWinds customers

The Russian APT group Cozy Bear inserted malware into a service that pushes software updates for SolarWinds’ Orion platform, which is used across countless U.S. government agencies and Fortune 500 firms. FireEye was the first to reveal that it had fallen victim to the intrusion and later presented evidence that the Orion platform was compromised as far back as March 2020.
Response: Sanctions   https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/
Compromise of Bapco
Date: 2020-01-08
Affiliations: APT 34
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Bapco

The Iranian state-backed hackers installed malware on the network of Bapco, Bahrain’s national oil producer. The malware, called Dustman, used a wiper functionality, but experts suspect this could have been meant to erase itself after being discovered.
Storm Cloud
Date: 2020-03-31
Affiliations: NOTE: Some Moonlight Maze tooling has also been referred to as “Storm Cloud.” There is no known connection.
Sponsor: China

Performed highly targeted watering-hole attacks on visitors to Tibetan websites.
Targeting of Vatican City computer networks
Date: 2020-07-28
Affiliations: Mustang Panda
Sponsor: China
Category: Government, Civil society
Victims: Vatican City, Pontifical Institute for Foreign Missions, Hong Kong Study Mission to China

Hackers conducted an espionage campaign against Vatican City beginning in May 2020. In one instance, embedded malware was sent using the email of the Vatican Secretary of State. Hackers were likely trying to gain information on the Vatican’s negotiating position prior to high-level talks between the Catholic Church and Beijing in September 2020 regarding a provisional agreement concerning the appointment of Catholic bishops in China. 
Response: Unknown   https://www.ynet.co.il/article/rJrCqmAkw
Targeting of TrickBot computer networks
Date: 2020-10-09
Affiliations: U.S. Cyber Command
Sponsor: United States
Type: Sabotage
Category: Civil society
Victims: Computers on the TrickBot network, which is controlled by Russian hackers

U.S. hackers targeted the Russian botnet Trickbot, known for spreading the Ryuk ransomware, in preparation for the 2020 U.S. presidential election.
Targeting of Japan, Russia, and South Korean entities
Date: 2020-03-05
Affiliations: Tonto Team
Sponsor: China
Type: Espionage
Category: Civil society, Private sector, Government
Victims: Japanese, Russian, and South Korean civil society, private sector, and government entities.

The Chinese government–aligned APT Tonto Team used Bisonal malware for over ten years in various campaigns against entities in Japan, Russia, and South Korea.
Operations against actors targeting Australians during COVID-19 pandemic
Date: 2020-04-06
Affiliations: Australian Signals Directorate
Sponsor: Australia
Type: Data destruction
Category: Private sector
Victims: Infrastructure used by foreign-based cybercriminals

The Australian government launched cyberattacks disabling infrastructure used by foreign-based cybercriminals targeting Australians during the coronavirus pandemic.
Targeting of Taiwanese government agencies and officials’ email accounts
Date: 2020-08-19
Affiliations: BlackTech
Sponsor: China
Type: Espionage
Category: Government
Victims: Taiwanese government agencies and officials’ email accounts

Hackers exploited vulnerabilities in at least four Taiwanese tech companies that provided information technology services to the government using the Taidoor malware, allowing them far-reaching access to official systems and accounts since at least 2018.
Response: Confirmation   https://www.reuters.com/article/us-taiwan-cyber-china/taiwan-says-china-behind-cyberattacks-on-government-agencies-emails-idUSKCN25F0JK
Targeting of pharmaceutical companies and vaccine researchers with password spraying
Date: 2020-11-13
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Pharmaceutical companies and vaccine researchers in the United States, Canada, France, India, and South Korea

Russian hackers used password spraying in attempts to access accounts belonging to individuals involved in vaccine development.
Targeting of U.S. grid
Date: 2020-01-09
Affiliations: APT 33
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: The U.S. electrical grid

The Iranian hackers APT 33 targeted the U.S. electric grid with password-spraying attacks, likely in an attempt to gain access. They targeted only the IT side of networks so far and have not proven their ability to access physical systems.
Targeting of Central European aerospace and defense companies
Date: 2020-06-17
Affiliations: Believed to be Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: European aerospace and defense firms

Hackers impersonated recruiters from Collins Aerospace and General Dynamics to lure in employees with enticing job offers, subsequently tricking them into opening malicious files sent via LinkedIn’s private messaging app.
Targeting of U.S. information technology, government, health-care, finance, and media industries
Date: 2020-09-15
Affiliations: Pioneer Kitten
Sponsor: Iran (Islamic Republic of)
Category: Government, Private sector
Victims: U.S. government and private companies

Iranian hackers scanned U.S. government and private networks for virtual private network (VPN) and cloud computing vulnerabilities with the aim of exfiltrating data.
Response: Confirmation   https://us-cert.cisa.gov/ncas/alerts/aa20-259a
Targeting of the African Union
Date: 2020-12-16
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: African Union

The China-affiliated threat actor Mustang Panda stole security footage from the African Union headquarters. Hackers had access to meeting rooms, hallways, and parking lots.
Stolen data on nearly two thousand Mitsubishi employees
Date: 2020-01-20
Affiliations: Bronze Butler
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Mitsubishi Electric employees

The China-linked Bronze Butler threat actor is suspected to have used a zero-day in Trend Micro antivirus to attack Mitsubishi Electric and steal data on thousands of employees. In May 2020, it was disclosed that the breach resulted in the theft of specifications for a hypersonic missile that Japan had been developing to protect disputed territory in the East China Sea.
Targeting of Tibetans via watering-hole attacks
Date: 2020-03-31
Affiliations: Storm Cloud
Sponsor: China
Victims: Tibetans

The Chinese hackers Storm Cloud performed highly targeted watering-hole attacks on visitors to a few Tibetan websites and tried to make them install fake versions of Adobe Flash.
Targeting of Western entities involved in COVID-19 vaccine development
Date: 2020-07-21
Affiliations: Guangdong State Security Department (GSSD) of China’s Ministry of State Security (MSS)
Sponsor: China
Type: Espionage
Category: Private sector, Government, Civil society
Victims: Private Companies, Governments, Nongovernmental Organizations, Individual Dissidents, Clergy, Democratic and Human Rights Activists

Hackers conducted a combination of financially motivated and espionage-driven hacking operations against hundreds of companies, organizations, and research firms based in the United States and other countries, stealing terabytes of information.
Response: Criminal charges   https://www.politico.com/f/?id=00000173-76e6-d36e-abff-7ffe63dc0000
Targeting of U.S. individuals with fake McAfee software installations
Date: 2020-10-16
Affiliations: Zirconium
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Individuals connected to the 2020 U.S. elections

Hackers impersonating McAfee antivirus software emailed links that would download malware from GitHub onto victims’ computers.
Tonto Team
Date: 2020-03-05
Sponsor: China
Victims: Japan, Russian Federation, Republic of Korea

Chinese government-aligned APT that used Bisonal malware for over ten years in various campaigns against entities in Japan, Russia, and South Korea.
Targeting of COVID-19 research organizations
Date: 2020-05-13
Affiliations: Chinese government
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: COVID-19 Research Organizations

Cyber actors affiliated with the Chinese government attempted to identify and illicitly obtain intellectual property and public health data related to vaccines, treatments, and testing from networks and personnel associated with COVID-19–related research.
Targeting of automated teller machines worldwide
Date: 2020-08-26
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Argentina, Brazil, Bangladesh, Bosnia and Herzegovina, Bulgaria, Chile, Costa Rica, Ecuador, Ghana, India, Indonesia, Japan, Jordan, Kenya, Kuwait, Malaysia, Malta, Mexico, Mozambique, Nepal, Nicaragua, Nigeria, Parkistan, Panama, Peru, Philippines, Singapore, South Africa, South Korea, Spain, Taiwan, Tanzania, Togo, Turkey, Uganda, Uruguay, Vietnam, Zambia

Hackers affiliated with the Lazarus Group targeted automated teller machines (ATMs) by manipulating transaction-processing software to initiate fraudulent cash-outs.
Zinc
Date: 2020-11-13
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Pharmaceutical companies and vaccine researchers in the United States, Canada, France, India, and South Korea

Hackers posing as recruiters in spear-phishing emails to steal credentials belonging to individuals involved in vaccine development.
Vicious Panda
Date: 2020-03-12
Sponsor: China
Victims: Mongolia

Conducted coronavirus-related phishing campaign against targets in the Mongolian government.
Targeting of air transportation and government agencies in Kuwait and Saudi Arabia
Date: 2020-05-25
Affiliations: Chafer 
Sponsor: Iran (Islamic Republic of)
Category: Private sector, Government
Victims: Air transportation and government agencies in Kuwait and Saudi Arabia

Dating back to 2018, hackers conducted espionage campaigns against air transportation and government agencies in Kuwait and Saudi Arabia.
Targeting of Azerbaijani government networks
Date: 2020-09-22
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Azerbaijani government networks

Responsible for disguising Zebrocy malware, which creates a persistent backdoor, as North Atlantic Treaty Organization (NATO) training materials. Azerbaijan, which cooperates with NATO, is a suspected target.
Targeting of Mongolian government agencies
Date: 2020-12-09
Affiliations: Emissary Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Mongolian government agencies and a national data center

The Chinese threat actor Emissary Panda compromised Able Desktop chat software used by over 430 Mongolian government agencies and a national data center. The ShadowPad backdoor, previously attributed to a suspected subset of the Winnti Umbrella, was also used.
Spyware sent to Jeff Bezos on WhatsApp
Date: 2020-01-21
Affiliations: Government of Saudi Arabia
Type: Espionage
Category: Private sector, Civil society
Victims: Jeff Bezos

An account belonging to Prince Mohammed bin Salman sent Jeff Bezos spyware masquerading as a video over WhatsApp, which allowed Saudi Arabia to surveil Bezos’ phone from May 2018 until February 2019. The attack could have been related to Bezos’ ownership of the Washington Post, whose columnist Jamal Khashoggi was allegedly killed on bin Salman’s orders.
Targeting of World Health Organization (WHO) Staff Emails
Date: 2020-04-02
Affiliations: Iranian government
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Victims: World Health Organization (WHO)

Hackers sent phishing emails masquerading as Google web services to WHO employees, attempting to gain access to internal information.
Ghostwriter
Date: 2020-07-29
Sponsor: Russian Federation
Category: Government, Private sector
Victims: Websites and NATO-affiliated officials

Believed to be responsible for conducting a hacking and information operations campaign in Eastern Europe. Hackers compromised websites and email accounts and used them to publish fabricated documents pushing anti–North Atlantic Treaty Organization (NATO) narratives. They then donned fake personas of local officials to promote the fabricated documents on social media.
Targeting of Japanese companies involved in COVID-19 vaccine development
Date: 2020-10-19
Affiliations: Government of China
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japanese companies involved in COVID-19 vaccine development

Chinese hackers used phishing emails to deliver malware disguised as new coronavirus information. No data appears to have been successfully exfiltrated.