Maljean/dataset huggingface dataset:
Compromise of websites related to Uighur communities
Date: 2019-09-03
Affiliations: Believed to be the work of at least two unnamed APT groups, including Evil Eye
Sponsor: China
Type: Espionage
Category: Civil society
Victims: China

Multiple threat actors compromised and exploited eleven websites that published news and cultural information related to the Uighur populations in China, particularly the East Turkestan region. The threat actors imitated the domains of Google, the Turkistan Times, and the Uyghur Academy, and used Google applications to gain access to Gmail accounts. Among other sensitive details collected were the hacked devices’ unique identification numbers, phone numbers, locations, central processing unit (CPU) data, and usernames.
Attack on forum of Hong Kong protesters
Date: 2019-12-04
Affiliations: Chinese government
Sponsor: China
Type: Denial of service
Category: Civil society, Private sector
Victims: Hong Kong protesters

China’s government used its “Great Cannon” distributed denial of service (DDOS) system for the first time in two years to attack a forum where Hong Kong residents organized protests.
Chinese intelligence repurposed NSA tools to attack private companies
Date: 2019-05-06
Affiliations: APT 3
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Belgium, Luxembourg, The Philippines, and Vietnam

The threat actor repurposed hacking tools used against them by the U.S. National Security Agency (NSA) to attack private companies in Asia and Europe. These attacks went undetected for two years.
Targeting of European and North American aerospace companies
Date: 2019-10-14
Affiliations: Believed to be the work of Turbine Panda
Sponsor: China
Type: Espionage
Category: Private sector

A threat actor conducted a multiyear espionage effort aimed at the theft of intellectual property from European and North American aerospace companies to further the development of China's C919 aircraft.
Hijacking of Iranian hacking infrastructure
Date: 2019-10-21
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Military, Government, Civil society
Victims: Military, government, scientific organizations, and universities in the Middle East and across the world

The Russian threat actor Turla took over an Iranian espionage operation belonging to Iranian-linked APT 34 (aka Oilrig) and used it to attack a number of targets while masquerading as Iran.
KINGDOM
Date: 2019-10-12
Sponsor: Saudi Arabia
Victims: Saudi Arabian dissidents, , Foreign journalists

This threat actor, believed to be linked to Saudi Arabia, targets Saudi dissidents and foreign journalists with NSO Group's Pegasus malware.
Targeting of enterprise VPN servers from Fortinet and Pulse Secure
Date: 2019-09-05
Affiliations: Believed to be the work of APT 5, also known as Manganese, and several other threat groups.
Sponsor: China
Category: Private sector

Multiple threat actors targeted secure sockets layer (SSL) virtual private network (VPN) servers provided by cybersecurity companies Fortinet and Pulse Secure. It is uncertain whether the attacks were successful.
Bypassing of two-factor authentication
Date: 2019-12-19
Affiliations: APT 20
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Governments and managed service providers in the U.S., Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, and the United Kingdom

A China-aligned attacker bypassed virtual private network (VPN) accounts protected by two-factor authentication to attack governments and managed service providers in a multitude of industries.
Compromise of Amnesty International Hong Kong
Date: 2019-04-15
Affiliations: APTs associated with Beijing
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Amnesty International Hong Kong

This threat actor compromised Amnesty International Hong Kong's system to steal the personal information of supporters.
Targeting of Avast
Date: 2019-10-21
Affiliations: Government of China
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Avast

China-aligned hackers breached Czech-based Avast’s network, aiming to compromise the CCleaner tool, which had previously been compromised in 2017.
DarkUniverse
Date: 2019-11-05
Sponsor: Russian Federation
Category: Private sector, Military

DarkUniverse was a threat group affiliated with Russia that was active for at least eight years, from 2009 until 2017.
Global hijacking of domain name system (DNS)
Date: 2019-01-09
Affiliations: Suspected to be the work of Iranian actors.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: United States, South Korea, Canada, Lebanon , United Arab Emirates

An unknown actor with a connection to Iran hijacked DNS records to target the traffic of governments and telecommunications organizations around the world.
Surveillance of individuals in the United Arab Emirates (UAE) and globally
Date: 2019-12-22
Affiliations: Government of the UAE
Sponsor: United Arab Emirates
Type: Espionage
Category: Civil society
Victims: Millions of individuals in the UAE and globally

ToTok, a popular Emirati messaging app, was revealed to be a mass surveillance tool used by the Emirati government.
Compromise of British infrastructure
Date: 2019-04-02
Affiliations: Iranian Revolutionary Guard
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: British Post Office and local government networks

A threat actor compromised the British Post Office and local government networks, stealing personal data—including email addresses and mobile phone numbers—of thousands of employees.
Response: Confirmation   https://www.mirror.co.uk/news/uk-news/major-cyber-attack-uk-infrastructure-14226055
Targeting of embassies and foreign ministries in Eastern Europe and Central Asia
Date: 2019-08-20
Affiliations: Believed to be the work of Sednit, also known as APT 28, Fancy Bear, and Strontium.
Sponsor: Russian Federation
Category: Government

A threat actor targeted embassies and foreign ministries in Eastern Europe and Central Asia with a phishing campaign that deployed a form of Zebrocy malware on computers, creating backdoors.
Large-scale attacks against Georgia
Date: 2019-10-28
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Sabotage
Category: Government, Private sector, Civil society
Victims: Georgian government, courts, nongovernmental organizations, media, and businesses

Russian group Sandworm carried out large-scale cyberattacks against targets in Georgia.
Compromise of Indian nuclear power plant
Date: 2019-11-12
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: Noncritical devices in an Indian nuclear power plant

Devices on a noncritical administrative network in a nuclear power plant in Tamil Nadu, India, were compromised by DTrack, a remote access Trojan (RAT) associated with the Lazarus Group.
Attempted attack on the Democratic National Convention (DNC) during 2018 elections
Date: 2019-01-18
Affiliations: Suspected to be the work of the Dukes. 
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Democratic National Committee

The DNC alleged it was targeted in an unsuccessful cyberattack eight days after the 2018 elections in an attempted spear-phishing campaign.
Targeting of over sixty universities in multiple countries, including the United States and United Kingdom
Date: 2019-09-11
Affiliations: Believed to be the work of Cobalt Dickens.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Private sector
Victims: United States, United Kingdom, Australia, Canada, Hong Kong, Switzerland

A threat actor launched a phishing operation with spoofed login pages to steal the credentials of users at over sixty universities in the United States, United Kingdom, and elsewhere.
Targeting of industrial control systems
Date: 2019-11-23
Affiliations: APT 33
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Industrial control systems manufacturers, suppliers, and maintainers

Iran-aligned threat actor APT 33 targeted industrial control system manufacturers, suppliers, and maintainers.
Compromise of Bayer Pharmaceuticals
Date: 2019-04-04
Affiliations: Wicked Panda
Sponsor: China
Type: Data destruction
Category: Private sector
Victims: Bayer Pharmaceuticals

A threat actor put malicious software on Bayer's computer system but did not steal any information, as reported by the company.
Targeting of senior members of Tibetan groups
Date: 2019-09-24
Affiliations: Believed to be the work of Poison Carp.
Sponsor: China
Type: Espionage
Category: Civil society, Government
Victims: Tibet

A threat actor aimed to infect mobile phones belonging to senior members of Tibetan groups, including people who worked directly for the Dalai Lama and lawmakers in Tibet's parliament. The threat actor posed as a human rights worker or journalist and contacted victims through WhatsApp. The campaign involved Android browser vulnerabilities and Android and iOS spyware. The tools appeared in similar attacks, discovered in September, carried out against China's Uighur population.
Targeting of Japanese organizations
Date: 2019-10-02
Affiliations: APT 17 and Bronze Butler
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japanese organizations

Two Chinese government threat actors used a number of zero-day vulnerabilities in common Japanese software to target Japanese organizations over the course of several years.
Targeting of German energy technology, chemicals, and consumer goods companies, among others
Date: 2019-07-24
Affiliations: Believed to be the work of Winnti.
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Germany

A threat actor used a Trojan horse to gain remote backdoor access to German energy technology company Siemens, chemical firm BASF, and consumer goods company Henkel. Non-German companies Roche, Lion Air, and Marriott were also targeted.
Targeting of nongovernmental organizations and political and law enforcement agencies in East and South Asia
Date: 2019-12-29
Affiliations: Bronze President
Sponsor: China
Type: Espionage
Category: Government, Civil society

The China-affiliated threat actor Bronze President attacked nongovernmental organizations, political agencies, and law enforcement in Mongolia and India, among other countries.
Cyber espionage by the United Arab Emirates (UAE)
Date: 2019-01-30
Affiliations: Believed to be the work of the UAE government.
Sponsor: United Arab Emirates
Type: Espionage
Category: Government, Civil society
Victims: Qatar, Turkey, Yemen

Former U.S. government intelligence operatives working for the UAE used the spying tool Karma to hack the iPhones of activists, diplomats, and rival foreign leaders.
Targeting of U.S. university and think tank with BabyShark malware
Date: 2019-02-22
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector

A threat actor used the malware BabyShark, which uses infrastructure associated with North Korean campaigns. The malware was delivered in November 2018 via spear-phishing emails written to appear as though they were sent from a nuclear security expert who works as a consultant for the U.S. government. The subject of the emails referenced North Korea's nuclear program.
Targeting of Middle Eastern oil companies
Date: 2019-12-04
Affiliations: APT 34
Sponsor: Iran (Islamic Republic of)
Type: Data destruction
Category: Private sector
Victims: Oil companies in the Middle East

Using a new wiper malware called ZeroCleare, Iranian-linked threat actor APT 34 (aka Oilrig) targeted oil companies in the Middle East.
Operation Soft Cell
Date: 2019-06-25
Affiliations: APT 10
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Global telecommunications companies

This threat actor hacked global telecommunications companies for personal data of government officials, activists, and dissidents of interest to Beijing.
Poison Carp
Date: 2019-09-24
Affiliations: Also known as Evil Eye
Sponsor: China
Type: Espionage
Category: Civil society, Government
Victims: Tibetans , Uighurs

This threat actor has targeted senior members of Tibetan groups by sending malicious links in WhatsApp messages, while posing as nongovernmental organization workers, journalists, or other fake personas.
PKplug
Date: 2019-10-03
Affiliations: China
Sponsor: China

A Chinese-linked threat actor group active in Southeast Asia
Targeting of investigative journalists at Bellingcat
Date: 2019-07-26
Affiliations: Believed to be the work of Fancy Bear.
Sponsor: Russian Federation
Type: Espionage
Category: Private sector

A threat actor conducted a phishing attack on investigative journalists at Bellingcat who have been probing Russian intelligence activities.
Compromise of Kazakh individuals
Date: 2019-11-23
Affiliations: Golden Falcon
Type: Espionage
Category: Government
Victims: Numerous Kazakh government officials and private individuals and some Chinese individuals

The Russian-speaking threat actor Golden Falcon used a combination of purchased and developed tools to compromise numerous individuals in Kazakhstan and a few in China.
Compromise of computer networks associated with the 2018 Pyeongchang Winter Olympics
Date: 2018-02-12
Sponsor: Russian Federation
Type: Sabotage
Category: Civil society
Victims: Republic of Korea

A threat actor, using a tool called Olympic Destroyer, successfully disrupted computer networks associated with the 2018 Winter Olympics in Pyeongchang, South Korea, before the opening ceremony. Among other things, the incident crashed the Wi-Fi network in the Olympic stadium and the press center.
Thrip
Date: 2018-06-19
Affiliations: Also known as Billbug and Lotus Blossom.
Sponsor: China
Type: Espionage
Category: Private sector
Victims: United States

This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense sectors in the United States and Southeast Asia for espionage purposes.
Targeting of Omar Abdulaziz
Date: 2018-10-01
Sponsor: Saudi Arabia
Type: Espionage
Category: Civil society
Victims: Omar Abdulaziz

A threat actor targeted the iPhone of Omar Abdulaziz, a critic of the Kingdom of Saudi Arabia living in Canada, for espionage purposes. The threat actor uses the Pegasus tool, created by the NSO Group.
Compromise of Mongolian government data center
Date: 2018-06-13
Sponsor: China
Type: Espionage
Category: Government
Victims: Mongolia

A threat actor has compromised a government data center in Mongolia. Kaspersky Lab assesses that the threat actor used its access to compromise websites that they will use in subsequent watering-hole attacks.
Targeting of North Korean defectors and journalists
Date: 2018-05-15
Affiliations: Believed to be associated with the Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: South Korea

A threat actor targets North Korean defectors and journalists with an interest in North Korea by compromising their Android devices, for espionage.
Gorgon Group
Date: 2018-08-02
Type: Espionage
Category: Government
Victims: United States, Spain, Russian Federation, United Kingdom

Also known as Aggah. This threat actor targets government entities in the United States and Europe. It also conducts criminal operations.
Targeting of the Parliament of Australia
Date: 2018-12-07
Affiliations: Unknown
Category: Government
Victims: Australia

An attack targeted computer systems in both houses of the Parliament of Australia. The systems of the ruling Liberal-National Coalition Party and Labor, the main opposition party, were compromised, but there is no evidence of electoral interference.
APT 37
Date: 2018-02-20
Affiliations: Also known as Reaper, Group 123, and ScarCruft
Sponsor: Korea (Democratic People's Republic of)
Category: Government, Private sector
Victims: Republic of Korea, Japan, Vietnam

This threat actor uses social engineering techniques to target companies in the chemicals, electronics, manufacturing, aerospace, automotive, and health-care sectors, as well as the South Korean government.
Targeting of German critical infrastructure sectors
Date: 2018-06-07
Affiliations: Believed to be the work of Crouching Yeti
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Germany

A threat actor targeted critical infrastructure entities in the energy, water, and telecommunications sectors, prompting the German government to issue a public alert. In remarks following the alert's release, the head of Germany’s domestic intelligence agency accused Russia of controlling the targeting campaign.
Response: Denouncement   https://www.reuters.com/article/us-germany-cyber-russia/german-intelligence-sees-russia-behind-hack-of-energy-firms-media-report-idUSKBN1JG2X2
Targeting of congressional campaigns for the 2018 U.S. midterm elections
Date: 2018-07-19
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Candidates for the U.S. Congress

A threat actor targets the campaigns of candidates running for Congress in the 2018 U.S. midterm elections.
Alleged Russian compromise of networking equipment
Date: 2018-04-16
Affiliations: Believed to be associated with Sandworm. Also known as VPNFilter.
Sponsor: Russian Federation
Type: Sabotage
Category: Private sector
Victims: Worldwide, United States, United Kingdom, Ukraine

The U.S. Department of Homeland Security and the UK National Cyber Security Centre issued a joint alert warning of a Russian state-sponsored campaign to compromise networking equipment, such as routers and switches, to support their cyber operations. A few weeks later, the FBI took control of a botnet with over five hundred thousand compromised devices and issued a public request that individuals with certain router models restart them.
Response: Sanctions   https://home.treasury.gov/news/press-releases/sm0410
Compromise of an air-gapped German government network
Date: 2018-02-28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Germany

A threat actor compromised the Informationsverbund Berlin-Bonn, a computer network air gapped from the global internet, used by the German chancellery, parliament, Foreign Office, and other government departments based in Bonn, Germany.
Response: Denouncement   https://www.reuters.com/article/us-germany-security/moscow-likely-behind-hack-on-german-govt-spy-chief-says-idUSKBN1HI19D
RedAlpha
Date: 2018-06-26
Affiliations: Believed to use similar infrastructure as the NetTraveler, Icefog, and APT 17 threat actors
Sponsor: China
Type: Espionage
Category: Civil society
Victims: India

This threat actor targets Tibetan organizations based in India, for the purpose of espionage.
Targeting of Yahya Assiri
Date: 2018-08-01
Sponsor: Saudi Arabia
Type: Espionage
Category: Civil society
Victims: Yahya Assiri

A threat actor targeted Yahya Assiri, a critic of the Kingdom of Saudi Arabia and a researcher at Amnesty International, for espionage purposes. The threat actor used the Pegasus tool, created by the NSO Group.
Compromise of SingHealth, a large health-care provider in Singapore
Date: 2018-07-20
Affiliations: Believed to be the work of Whitefly. 
Type: Espionage
Category: Private sector
Victims: SingHealth

A threat actor compromises the networks of SingHealth, the largest health-care provider in Singapore. Personal data of over 1.5 million patients was compromised, including the pharmaceutical prescriptions of 160,000 people.
Targeting of South Korean actors prior to meeting of Donald J. Trump and Kim Jong-un
Date: 2018-06-05
Affiliations: Believed to be the work of TempTick and Turla
Sponsor: China, Russian Federation
Type: Espionage
Category: Government
Victims: South Korea

Two separate threat actors targeted South Korean government organizations prior to the meeting between U.S. President Donald J. Trump and North Korean leader Kim Jong-un, for the purpose of espionage.
Targeting of organizations associated with trade activity with China
Date: 2018-08-16
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: United States, Kenya, Mongolia, Brazil

A threat actor is targeting multiple organizations with trade ties to China, including those connected with China’s Belt and Road Initiative. The actor also targets organizations in advance of officials’ meetings with Chinese trade officials.
APT 39
Date: 2018-12-12
Affiliations: Believed to be connected to the Iranian government.
Sponsor: Iran (Islamic Republic of)
Category: Government, Private sector
Victims: Saudi Arabia, Egypt, Turkey, Iraq, Spain, Norway, Australia, South Korea

This threat actor, operating since November 2014, focuses on the Middle East. It mainly targets the telecommunications industry, and also targets the travel industry and supporting IT firms, and the high-tech industry.
Indictment of officials from the Mabna Institute
Date: 2018-03-28
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Civil society, Private sector
Victims: United States, United Nations, UNICEF, Australia, Canada, China, Denmark, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Singapore, Republic of Korea, Spain, Sweden, Switzerland, Turkey, United Kingdom

The U.S. Department of Justice indicted nine officials from the Mabna Insititute, an Iranian company alleged to have conducted state-sponsored cyber operations on behalf of the Iranian Revolutionary Guards. They are alleged to have compromised the networks of over 144 U.S. universities, 176 universities in over twenty-one other countries, as well as private sector, government, and multilateral entities.
Response: Criminal charges   https://www.justice.gov/opa/pr/nine-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary
Rancor
Date: 2018-06-26
Affiliations: Believed to use similar tools as DragonOK
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Singapore, Cambodia

This threat actor uses spear-phishing techniques to target political organizations in Southeast Asia, for the purpose of espionage.
Compromise of American aerospace companies
Date: 2018-10-30
Affiliations: China's Jiangsu Ministry of State Security
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Aerospace companies based in Arizona, Massachusetts, and Oregon

This threat actor reportedly intruded into American aerospace companies' computer systems to steal intellectual property and business information, including information related to turbofan engines used in commercial aircraft.
Response: Criminal charges   https://www.justice.gov/opa/pr/chinese-intelligence-officers-and-their-recruited-hackers-and-insiders-conspired-steal
TempTick
Date: 2018-06-05
Affiliations: Believed to be responsible for the targeting of South Korean actors prior to the meeting of Donald J. Trump and Kim Jong-un. Affiliated with China’s Ministry of State Security. Also known as Tick.
Sponsor: China
Category: Government, Private sector, Civil society
Victims: South Korea, Japan

Japan announced a formal link between the threat actor Tick and Chinese intelligence, saying that it was responsible for a series of attacks in Japan. Tick has been active since at least 2008 and has primarily targeted Japan and South Korea. This threat actor targets organizations in the finance, defense, aerospace, technology, health-care, and automotive sectors and media organizations in East Asia for the purpose of espionage.
Compromise of the German Foreign Office
Date: 2018-03-16
Affiliations: Believed to be the work of Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Germany

A threat actor has compromised the German Foreign Office, for the purpose of espionage.
Targeting of U.S. Navy contractors
Date: 2018-12-14
Affiliations: Believed to be the work of APT 10.
Sponsor: China
Type: Espionage
Category: Government
Victims: United States

In a series of incidents, Chinese hackers breached U.S. Navy contractors’ systems to steal information including ship maintenance data and missile plans.