Maljean/dataset huggingface dataset:
Targeting of Ukrainian government and information technology (IT) sector systems with WhisperGate malware
Date: 2022-01-15
Affiliations: Nodaria
Sponsor: Russian Federation
Type: Data destruction
Category: Government
Victims: Ukrainian government and IT sector systems

The Russian Army’s Main Intelligence Directorate (the GRU) used WhisperGate wiper malware on Ukrainian systems on January 13, 2022. The wiper masqueraded as ransomware, offering victims the chance to decrypt their data for a fee, while in reality, the malware wiped the system. The wiper was found on systems throughout Ukraine, including the foreign ministry and networks used by the Ukrainian cabinet.
Response: Unknown
Targeting of Belgian Defense Ministry
Date: 2022-07-18
Affiliations: Gallium
Sponsor: China
Type: Espionage
Category: Military
Victims: Belgian Defense Ministry

Chinese threat actors targeted the Belgian Defense Ministry as part of a wide-ranging cyberespionage campaign involving multiple threat actors, which also targeted the Interior Service. Belgian authorities condemned the activity.
Response: Denouncement   https://diplomatie.belgium.be/en/news/declaration-minister-foreign-affairs-malicious-cyber-activities
Targeting of Uyghur populations
Date: 2022-11-10
Affiliations: Mirage
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Members of the Uyghur ethnic group

Chinese-affiliated threat actor APT 15 led a mobile surveillance campaign against Uyghurs in China and abroad using BadBazaar malware masquerading as Android apps. 
Response: Unknown
Targeting of Jordanian activists
Date: 2022-04-05
Affiliations: Believed to be the work of the Jordanian government
Sponsor: Jordan
Type: Espionage
Category: Civil society
Victims: Four Jordanian human rights defenders, lawyers, and journalists

The devices of at least four Jordanian human rights activists, lawyers, and journalists were infected with NSO Group’s Pegasus spyware between August 2019 and December 2021. Two Pegasus operators involved in the incident, named Mansaf and BlackIris, are likely connected to agencies of the Jordanian government.
Targeting of Tibetans living abroad
Date: 2022-06-01
Affiliations: Lucky Cat
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Tibetan organizations and Tibetans living abroad

A Chinese threat actor was found using a zero-day vulnerability, dubbed Follina, in Microsoft Office products to distribute zero-click malware. The attackers used Follina to target Tibetan organizations and Tibetans living abroad with malware.
Targeting of Australian, Malaysian, and European organizations and organizations operating in and around the South China Sea.
Date: 2022-08-30
Affiliations: APT 40
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Australian, Canadian, German, Japanese, Norwegian, Swedish, and Taiwanese organizations involved in wind turbine maintenance and production, as well as Malaysian oil and gas refineries.

APT 40 launched an espionage campaign targeting Australian, European, and Asian organizations involved in maintaining and producing wind turbines in the South China Sea, as well as Malaysian organizations working in the Kasawari gas field.
Response: Unknown
Targeting of Latvian, Lithuanian, and Ukrainian computer systems
Date: 2022-02-23
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Data destruction
Category: Government, Civil society
Victims: Latvian, Lithuanian, and Ukrainian computer systems owned by banks and government contractors, as well as systems used by the defense, aviation, and IT sectors

Russian threat actors targeted computer systems in Latvia, Lithuania, and Ukraine with a wiper dubbed HermeticWiper. The malware was aimed at Windows devices, corrupting systems’ master boot records, displaying signs of ransomware as a decoy, and destroying stored data. This followed another wiper attack aimed at Ukraine in January.
Targeting of journalists reporting on North Korea
Date: 2022-04-21
Affiliations: APT 37
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Journalists and the former director of South Korea’s National Intelligence Service

North Korea–linked threat actor APT 37 targeted journalists with novel Goldbackdoor malware. APT 37 initially used RokRat malware to hack the email account of a former director at South Korea’s National Intelligence Service. The hackers then impersonated the official and targeted South Korean journalists, sending emails laced with Goldbackdoor malware. The malware can be used to steal passwords and documents.
Targeting of UN Interim Force in Lebanon (UNIFIL)
Date: 2022-06-29
Affiliations: Believed to be the work of the Iranian government
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Military
Victims: UN peacekeeping force in Lebanon

The Israeli defense minister has accused Iran and Hezbollah of attempting a cyberattack against the UNIFIL to steal information about its activities within southern Lebanon.
Response: Confirmation   https://www.timesofisrael.com/gantz-says-iran-and-hezbollah-attempted-to-hack-unifil-steal-deployment-infomation/
Targeting of Ukrainian networks via fake telecommunications firms
Date: 2022-09-19
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Espionage
Category: Private sector, Government
Victims: Ukrainian telecommunications infrastructure and other firms

A Russian threat actor masqueraded as a Ukrainian telecommunications firm in order to gain access to other networks in Ukraine, both through spear-phishing and malicious public domains.
Response: Unknown
Targeting of organizations supporting Ukraine
Date: 2022-12-06
Affiliations: Calisto
Sponsor: Russian Federation
Type: Espionage
Category: Civil society, Private sector
Victims: Six private companies in the United States and Eastern Europe and four nongovernmental organizations

As part of a phishing campaign, Calisto targeted NATO-affiliated military and strategic research institutes, a Ukraine-based defense contractor, and former intelligence officials and Russia experts who were working at nongovernmental organizations.
Response: Unknown
Targeting of local Israeli officials
Date: 2022-01-23
Affiliations: Believed to be the work of Israel's government
Sponsor: Israel
Type: Espionage
Category: Government
Victims: Mayors and other local officials in Israel.

The signals intelligence unit of the Israeli police is suspected of using Pegasus spyware to surveil local officials and their families in Israel. The warrantless surveillance conducted with Pegasus was used to inform later prosecutions for bribery, some of which were dismissed in court for lack of evidence. The police attempted to cover up evidence that they had used Pegasus in the investigations. 
Response: Unknown
Targeting of Asus routers
Date: 2022-03-17
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Asus Routers in countries including the United States, Canada, India, Italy, and Russia

Sandworm targeted WatchGuard and ASUS routers with Cyclops Blink malware, an advanced modular botnet. The malware gives Sandworm access to data and files stored on compromised networks. The malware affects devices that do not belong to critical organizations, suggesting that its purpose may be to build infrastructure for later attacks on high-value targets. 
Response: Criminal charges   https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation
Targeting of government network in Vinnytsia, Ukraine
Date: 2022-04-27
Affiliations: APT 28
Sponsor: Russian Federation
Type: Sabotage
Category: Government
Victims: Government network in Vinnytsia

APT 28 conducted phishing campaigns targeting the Ukrainian military and government employees. Strontium succeeded in compromising a government network in Vinnytsia, a city in western Ukraine.
Targeting of European Union (EU) member states
Date: 2022-07-23
Affiliations: APT 37
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: Czech Republic, Poland, and other EU countries

A North Korean advanced persistent threat group used malware known as Konni, a remote-access Trojan, to hack into high-level organizations across the EU.
Response: Unknown
Targeting of Polish and Ukrainian transportation companies
Date: 2022-11-10
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Ukrainian and Polish transportation companies

Russian threat actor Sandworm targeted transportation and logistics organizations in Ukraine and Poland with Prestige ransomware starting in October 2022.
Response: Unknown
Antlion
Date: 2022-02-02
Type: Espionage
Category: Private sector
Victims: Financial departments of Taiwanese private sector companies

Antlion is a Chinese threat actor suspected of targeting organizations in Taiwan using custom backdoors to deploy both custom and off-the-shelf malware. Antlion has conducted extended espionage campaigns against private sector companies.
Targeting of Israeli officials
Date: 2022-04-06
Affiliations: APT-C-23
Sponsor: Palestine, State of
Type: Espionage
Category: Government
Victims: Israeli individuals including a group of high-profile targets working for defense, law enforcement, and emergency services organizations

Hamas-linked actor APT-C-23 targeted Israelis with an espionage campaign to exfiltrate sensitive information from individuals working in law enforcement, the military, and emergency services. The attackers used fabricated Facebook profiles to lure targets to install trojanized direct message applications.
Targeting of Boston Children’s Hospital
Date: 2022-06-01
Affiliations: Believed to be the work of the Iranian government.
Sponsor: Iran (Islamic Republic of)
Type: Financial Theft
Category: Private sector
Victims: Boston Children's Hospital

Iranian government-backed hackers are believed to have launched a ransomware attack against the Boston Children's Hospital in the summer of 2021. The attack was foiled after a partner country shared intelligence with the FBI.
Response: Denouncement   https://www.wsj.com/articles/fbi-chief-blames-iran-for-cyberattack-on-boston-childrens-hospital-11654096382
Targeting of industrial enterprises and public institutions in Central Asia and Eastern Europe
Date: 2022-08-08
Affiliations: APT 18
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Industrial plants, design bureaus, research institutes, and government organizations in Afghanistan, Belarus, Russia, and Ukraine.

Chinese hackers used phishing emails to plant PortDoor malware on the systems of industrial organizations in Afghanistan, Belarus, Russia, and Ukraine. Security researchers detected the hackers exfiltrating data to a server with a Chinese IP address.
Response: Unknown
Targeting of Chinese users with three zero days
Date: 2022-12-02
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Government, Civil society
Victims: Chinese organizations and surveillance companies

Ocean Lotus, a Vietnamese APT, was found deploying three zero days on Chinese networks. The attacks were primarily directed at gaining and expanding access to routers, networks, and cameras in China. Ocean Lotus could have also incorporated some of the compromised devices into its Torii botnet.
 
Response: Unknown
Targeting of Ukrainian and Polish military personnel
Date: 2022-02-25
Affiliations: UNC1151
Sponsor: Belarus, Russian Federation
Type: Espionage
Category: Military
Victims: Ukrainian and Polish military personnel

Belarusian threat actor UNC1151 targeted the private email addresses of Ukrainian soldiers in a phishing attack. UNC1151 hacked the email accounts of military personnel and then leveraged the compromised address books to send further malicious emails, many of which were sent to Polish military personnel. 
Response: Confirmation   https://www.reuters.com/world/europe/ukraine-says-its-military-is-being-targeted-by-belarusian-hackers-2022-02-25/
Targeting of Russian military officials
Date: 2022-04-27
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: Russian officials’ computer systems

Chinese threat actor Mustang Panda targeted Russian government computer systems with PlugX malware. The malware was disguised in a malicious file masquerading as a PDF, which was named after a Russian border guard unit.
Targeting of Hungarian Foreign Ministry networks
Date: 2022-03-29
Affiliations: Believed to be the work of the government of the Russian Federation.
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Hungarian Foreign Ministry

The Federal Security Service and the Russian military intelligence agency have conducted cyberattacks against the Hungarian Foreign Ministry since at least 2012 to retrieve critical information Hungary’s diplomatic relations with the North Atlantic Treaty Organization and the European Union (EU).
Response: Confirmation   https://www.direkt36.hu/en/putyin-hekkerei-is-latjak-a-magyar-kulugy-titkait-az-orban-kormany-evek-ota-nem-birja-elharitani-oket/
Targeting of governments in the Middle East and Africa
Date: 2022-09-29
Affiliations: APT 10
Sponsor: China
Type: Espionage
Category: Government
Victims: Two Middle Eastern countries and one African stock exchange

APT 10 installed web shells on public-facing servers and extracted information from Middle Eastern governments and an African stock exchange.
Response: Unknown
Earth Lusca
Date: 2022-01-17
Sponsor: China
Type: Espionage
Category: Government, Civil society, Private sector
Victims: Academic institutions, government research organizations, religious groups, cryptocurrency exchanges, and other financial and civil society organizations.

Earth Lusca is a threat actor that targets organizations of interest to the Chinese government, including academic institutions, telecommunication companies, religious organizations, and other civil society groups. Earth Lusca's tools closely resemble those used by Winnti Umbrella, but the group appears to operate separately from Winnti. Earth Lusca has also been observed targeting cryptocurrency payment platforms and cryptocurrency exchanges in what are likely financially motivated attacks.
Targeting of Ukrainian state bodies
Date: 2022-03-18
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian state bodies

Russian APT InvisiMole, which has ties to Gamaredon, conducted a phishing campaign targeting Ukrainian organizations with the LoadEdge backdoor. The backdoor allowed Gamaredon to install surveillance software and other malware onto infected systems. 
Response: Confirmation   https://cert.gov.ua/article/37829
Targeting of Ukrainian organizations with CaddyWiper
Date: 2022-03-15
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Sabotage
Category: Government
Victims: Ukrainian critical infrastructure and government systems

Sandworm targeted Ukrainian organizations with CaddyWiper malware, destroying user data hosted on several dozen systems. Evidence suggests Sandworm infiltrated the targets’ networks before installing the wiper.
Targeting of South Korea with multiple spear-phishing campaigns
Date: 2022-07-25
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government, Civil society, Private sector
Victims: South Korean defense, education, medical, and energy companies and government agencies

A North Korean threat actor targeted South Korean government agencies, think tanks, and companies in the defense, education, energy, and medical-care sectors using spear- phishing campaigns to extract confidential information.
Response: Unknown
Targeting of U.S. federal agency
Date: 2022-11-21
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: U.S. Merit Systems Protections Board

Iran-affiliated group Nemesis Kitten targeted an unnamed U.S. federal agency, though suspected to be the U.S. Merit Systems Protections Board, and installed cryptocurrency-mining software into the government agency's network.
Response: Confirmation   https://www.cisa.gov/uscert/ncas/alerts/aa22-320a
Targeting of journalists at News Corp
Date: 2022-02-04
Affiliations: Believed to be the work of China's government.
Sponsor: China
Type: Espionage
Category: Private sector, Civil society
Victims: The email accounts of several journalists working for News Corp headquarters, News Technology Services, Dow Jones, News UK, and the New York Post

A Chinese threat actor hacked the email accounts of journalists employed at American media company News Corp. The attackers aimed to uncover journalists’ sources, as well as drafts of upcoming articles. No consumer or financial data was compromised.
Targeting of organizations in Asia, Europe, and North America
Date: 2022-04-05
Affiliations: APT 10
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Government, legal, religious, and nongovernmental organizations in Asia, Europe, and North America

Chinese threat actor APT 10 used a vulnerability in Microsoft Exchange to gain access to victims’ networks, where the attackers deployed a custom loader and the Sodamaster backdoor. APT 10 also used a custom loader to obtain credentials. The attackers spent up to nine months in victims’ networks.
Targeting of Palauans via an Australian telecommunications company
Date: 2022-06-03
Affiliations: APT 40
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Australian telecommunications networks and a group of Palauan users

Chinese threat actor APT 40 was found using a zero-day in Microsoft Office products, dubbed Follina, as part of a spear-phishing campaign against targets in Palau.
Targeting of Northwestern Polytechnical University
Date: 2022-09-05
Affiliations: National Security Agency, Tailored Access Operations
Sponsor: United States
Type: Espionage
Category: Civil society
Victims: Northwestern Polytechnical University

China accused the U.S. National Security Agency (NSA) of hacking into the networks of Northwestern Polytechnical University, a prominent defense research university in Xi'an, in June 2022. Some researchers expressed doubt at the claims, as the report accused the NSA of using a tool more than ten years old that was leaked more than five years ago.
Response: Denouncement   https://www.bloomberg.com/news/articles/2022-09-05/china-accuses-us-of-repeated-hacks-on-polytechnic-university#xj4y7vzkg
Targeting of Citrix Systems software
Date: 2022-12-05
Affiliations: APT 5
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Users of Citrix Systems' application delivery controller and Gateway endpoint

The U.S. National Security Agency issued a warning that two pieces of software from Citrix Systems, which are commonly used in corporate servers, had major vulnerabilities that were being actively exploited by APT 5.
 
Response: Unknown
Targeting of Moscow Stock Exchange and Sberbank websites
Date: 2022-02-28
Affiliations: Ukrainian IT Army
Sponsor: Ukraine
Type: Denial of service
Category: Private sector
Victims: Moscow Stock Exchange and Sberbank websites

Hackers from Ukraine’s IT Army targeted the websites of the Moscow Stock Exchange and Russian lender Sberbank with a DDoS attack. The incident was planned and conducted through posts on Telegram channels and other social media directing thousands of members to attack specified targets.
Targeting of Catalan separatists
Date: 2022-04-18
Affiliations: Believed to be the work of the Spanish government
Sponsor: Spain
Type: Espionage
Category: Government, Civil society
Victims: The identified victims include the president of the Catalan government, members of the European Parliament, Catalan legislators, and activists

The devices of at least sixty-five pro-independence Catalans were targeted with Pegasus and Candiru spyware. Most of the incidents occurred between 2017 and 2020, amid rising tensions over Catalan separatism and the 2017 Catalan independence referendum. Analysts found evidence on the victims’ devices of “zero-click” exploits, which infect phones and computers even without users clicking on malicious links. Reports indicate Spain’s intelligence service had prior court approval to use the spyware to target Catalan separatists.
Targeting of pro-democracy organizations and activists in Thailand
Date: 2022-07-17
Affiliations: Believed to be the work of the government of Thailand.
Sponsor: Thailand
Type: Espionage
Category: Civil society
Victims: Pro-democracy organizations and activists in Thailand

Pegasus spyware was used to hack the phones of pro-democracy groups and individuals in Thailand.
Response: Unknown
Targeting of medical professionals
Date: 2022-10-04
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Individual in the medical profession

As part of a larger Iranian espionage campaign against medical professionals, TA453 targeted an individual with a spear-phishing lure to gain access to their credentials. The earlier campaign, known as BadBlood, targeted researchers in the United States and Israel, although the location of the researcher targeted in this latest attack remains unclear.
 
Response: Unknown
Targeting of Middle Eastern government institutions in phishing campaign
Date: 2022-01-20
Affiliations: Believed to be the work of Hamas.
Sponsor: Palestine, State of
Type: Espionage
Category: Government
Victims: Government institutions in the Middle East

The Palestinian threat actor Molerats launched a spear-phishing attack by sending malicious documents to government departments across the Middle East. The documents were ostensibly an analysis of the conflict between Israel and Palestine.
Targeting of Ukrainian government officials
Date: 2022-03-24
Affiliations: Believed to be the work of China's government
Sponsor: China
Type: Espionage
Category: Government
Victims: Ukrainian government officials

The Chinese threat actor Scarab targeted Ukrainian government officials with lure documents used to load HeaderTip malware onto target systems. The lure documents mimic releases from the National Police of Ukraine.
Targeting of major Ukrainian broadcasting company
Date: 2022-04-27
Affiliations: Believed to be the work of the Russian government
Sponsor: Russian Federation
Type: Sabotage
Category: Civil society
Victims: Major Ukrainian broadcasting company

Russian threat actors targeted a major broadcasting company with the DesertBlade wiper. This incident followed the Russian military’s announcement that it would destroy Ukrainian disinformation targets.
Targeting of military personnel, government officials, employees of human rights and other nonprofit organizations, and students in Afghanistan, India, Pakistan, Saudi Arabia, and the United Arab Emirates (UAE)
Date: 2022-08-04
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Government, Civil society
Victims: Military personnel, government officials, employees of human rights and other nonprofit organizations, and students in Afghanistan, India, Pakistan, Saudi Arabia, and the UAE

A Pakistani advanced persistent threat actor used emails and social media to target people online and plant malware on their devices.
Response: Unknown
Targeting of Asian and Australian governments and government partners
Date: 2022-11-18
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Asian government agencies— including Japan, Myanmar, the Philippines, and Taiwan— and the Australian government

China-affiliated APT Mustang Panda conducted a spear-fishing campaign against several Asian governments starting in March 2022. Mustang Panda used two new malware families, Toneins and Toneshell, in the campaign.
 
Response: Unknown