Maljean/dataset huggingface dataset:
Stealth Falcon
Date: 2016-05-29
Sponsor: United Arab Emirates
Type: Espionage
Category: Civil society
Victims: United Arab Emirates, United Kingdom

This threat actor targets civil society groups and Emirati journalists, activists, and dissidents.
Compromise of the Democratic National Committee
Date: 2016-06-14
Affiliations: This incident is believed to be the work of APT 28. The Dukes were also found to be in the Democratic National Committee's networks.
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Democratic National Committee, Democratic Congressional Campaign Committee

In June 2016, suspected Russian threat actors were discovered in the networks of the U.S. Democratic National Committee (DNC). Intruders gained access to its research on Republican presidential candidate Donald J. Trump and emails and correspondences among DNC officials. Over the course of the presidential campaign, the threat actors released DNC correspondence through intermediaries such as WikiLeaks, revealing information about infighting among top party officials and leading to the resignation of the DNC chair. The threat actors also went after John Podesta, chairman of Hillary Clinton’s campaign, and released more embarrassing data throughout the summer.

The secretary of homeland security and the director of national intelligence released a joint statement asserting that the protracted cyber espionage campaign was the work of Russian actors. The Barack Obama administration subsequently sanctioned Russian intelligence officials and deported suspected officers working in the United States. The DNC compromise is believed to be part of a larger Russian espionage campaign waged for the purpose of manipulating the electoral systems in Western democracies and undermining faith in the democratic process in the United States, France, Germany, and elsewhere.

In July 2018, the U.S. Department of Justice indicted twelve officials of the Russian military intelligence agency, known as GRU, believed to have been responsible for this incident.

 

In October 2018, the UK government announced that the compromise was the work of Russian military intelligence.
Response: Sanctions   https://obamawhitehouse.archives.gov/the-press-office/2016/12/29/fact-sheet-actions-response-russian-malicious-cyber-activity-and
OilRig
Date: 2016-01-05
Affiliations: Also known as Twisted Kitten and Crambus; possibly related to Magic Hound, APT 34, and Chrysene. Believed to use similar tools and infrastructure as Chafer.  The group has also been connected to SiameseKitten.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Israel, Turkey, Qatar, Kuwait, Saudi Arabia, Lebanon, United States

A threat actor believed to be Iran that targets private-sector and government entities for the purpose of espionage. In October 2019, revealed to have been compromised by Turla. Some operations previously attributed to the group may be Turla false flags.
Targeting of the Islamic State group
Date: 2016-02-28
Affiliations: Believed to be associated with the United Kingdom’s cyber operations against the Islamic State, revealed in 2018.
Sponsor: United States
Type: Sabotage
Category: Civil society
Victims: The Islamic State Group

The United States announced that it would conduct offensive cyber operations against the Islamic State with a view to disrupting its ability to recruit, communicate with, and exercise command and control over its fighters.
A compromise causes a power outage in Kiev, Ukraine
Date: 2016-12-20
Affiliations: Used an evolution of the tools used by Sandworm.
Sponsor: Russian Federation
Type: Sabotage
Category: Private sector
Victims: Ukrenergo

A threat actor compromised computer networks that control an electricity substation in the north of the Ukrainian capital, Kiev, causing a power outage. To accomplish its task, the threat actor used a tool known as CrashOverride.
Spyware linked to Indonesia found in proxy servers in Australia
Date: 2016-01-23
Affiliations: Indonesia
Sponsor: Indonesia
Type: Espionage
Category: Civil society
Victims: Australia

A threat actor used FinFisher, also known as FinSpy, to infect mobile phones and computers and place targets under surveillance. The threat actor, allegedly the Indonesian government, used a proxy server inside the Global Switch Sydney East data center in Ultimo, Australia, to obscure their identity.
Compromise of the World Anti-Doping Agency
Date: 2016-09-13
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: World Anti-Doping Agency

The World Anti-Doping Agency (WADA) confirmed in September 2016 that it had been compromised by suspected Russian threat actors in a data leak of confidential information about forty-one athletes who competed in the Rio Olympic Games. The data revealed drug-test results and medical data pertaining to “therapeutic use exemptions,” situations in which WADA allows athletes to take banned substances if their usage is deemed legitimate.

A group using the Fancy Bear moniker, the same term some security experts assign to a Russian state-sponsored threat actor, claimed responsibility for the compromise. Some commentators viewed the incident as Russian retaliation for a WADA report that detailed Moscow-sanctioned efforts to provide performance-enhancing drugs to Russian athletes during the 2014 Sochi Winter Olympics.

The United States, Australia, Canada, New Zealand, and the United Kingdom issued statements attributing the incident to Russian military intelligence. Separately, the United States issued an indictment against seven alleged Russian military intelligence officials involved in the incident.
Response: Denouncement   https://www.wada-ama.org/en/media/news/2016-09/wada-confirms-attack-by-russian-cyber-espionage-group
Compromise of gaming companies
Date: 2016-10-18
Affiliations: Believed to be the work of Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: China, Taiwan, South Korea, United States, Russia

A threat actor uses a tool called PassCV to target video game companies, stealing digital certificates to use in cyber operations against other targets.
Yahoo breach (2014)
Date: 2016-09-22
Affiliations: Same state sponsor as the 2016 breach
Type: Espionage
Category: Private sector
Victims: Yahoo

A threat actor compromised over approximately five hundred million accounts, giving it access to the names, email addresses, telephone numbers, and dates of birth associated with the accounts. Yahoo discloses that the compromise took place in 2014.
Spear-phishing campaign against Google accounts in 2015
Date: 2016-06-26
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government, Private sector, Civil society
Victims: United States, European Union

A threat actor conducted a spear-phishing campaign against more than 1,800 Google accounts, including those of military and government personnel, journalists, and nongovernmental organizations, for the purpose of espionage.
Lazarus Group
Date: 2016-02-01
Affiliations: Believed to be responsible for Dark Seoul, Ten Days of Rain, the Sony Pictures Entertainment attack, the SWIFT-related bank heists, WannaCry, and Operation GhostSecret. Believed to use the same tools as Covellite. Known to the U.S. government as Hidden Cobra. Also known as BlueNoroff and Temp.Hermit.
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government, Private sector
Victims: South Korea, Sony Pictures Entertainment , United States, Bangladesh Bank, Defense companies in Israel and the Middle East, Global banks, U.S. defense contractors

This threat actor targets and compromises entities primarily in South Korea and South Korean interests for espionage, disruption, and destruction. It has also been known to conduct cyber operations for financial gain, including targeting cryptocurrency exchanges. In 2018, the U.S. Department of Homeland Security issued a malware analysis report on a tool called Typeframe used by the Lazarus Group.

In September 2018, the U.S. Department of Justice criminally charged and sanctioned Park Jin-hyok and Chosun Expo Joint Venture, alleged members of this threat actor.
Response: Sanctions   https://fcw.com/articles/2019/09/13/dprk-cyber-sanctions-johnson.aspx
Unnamed Actor
Date: 2016-04-13
Sponsor: China
Type: Espionage
Category: Civil society, Government
Victims: China, Hong Kong, Taiwan, Myanmar

This threat actor compromises civil society groups the Chinese Communist Party views as hostile to its interests, such as Tibetan, Uyghur, Hong Kong, and Taiwanese activist. The threat actor also targeted the Myanmar electoral commission.
Prince of Persia
Date: 2016-05-02
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: Israel, United States, Denmark, Iran, United Kingdom, Canada, France, Germany, Russia, China, Syria, Saudi Arabia, Sweden, Italy, Bahrain

This threat actor targets governments and businesses of multiple countries, including the United States, Israel, and Denmark.
Compromise of Burmese government websites
Date: 2016-01-12
Type: Espionage
Category: Government, Civil society
Victims: Myanmar

A threat actor compromised Burmese websites in an attempt to compromise visitors to those websites for espionage purposes.
Warning of impending incident on Russian banking network
Date: 2016-12-02
Type: Data destruction
Category: Private sector
Victims: Russia

Russian authorities warned that a foreign intelligence agency was seeking to compromise its banking sector.
Onion Dog
Date: 2016-05-20
Affiliations: Possibly linked to Icefog and the Dark Seoul compromise
Type: Espionage
Category: Government, Private sector
Victims: South Korea

This threat actor targets the South Korean government, transportation, and energy sectors.
Mofang
Date: 2016-06-15
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Myanmar, Canada, United States, Germany, India, South Korea, Singapore

This threat actor compromises government and critical infrastructure entities, primarily in Myanmar, for espionage purposes.
RUAG espionage
Date: 2016-05-23
Affiliations: Believed to be the work of the Turla group
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Switzerland

A threat actor compromised a Swiss defense contractor.
Operation Mermaid
Date: 2016-07-07
Type: Espionage
Category: Government
Victims: Ministry of Foreign Affairs, Iran,

This threat actor is based in the Middle East (possibly Iran) and targets English- and Persian-language organizations. It is alleged to be the same group behind a compromise of the Danish Ministry of Foreign Affairs.
Yahoo breach (2016)
Date: 2016-12-14
Affiliations: Same state sponsor as the 2014 breach
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Yahoo

A threat actor exploited a vulnerability in Yahoo's account log-in process, allowing it to access user accounts without a password. Approximately thirty-two million accounts were affected.
Response: Criminal charges   https://www.justice.gov/opa/pr/us-charges-russian-fsb-officers-and-their-criminal-conspirators-hacking-yahoo-and-millions
Project Sauron
Date: 2016-07-08
Affiliations: Also known as Strider
Sponsor: United States
Type: Espionage
Category: Government, Military
Victims: Russia, Belgium, Sweden, Iran, China, Rwanda

This threat actor compromises targets in the Military, telecommunications, and financial sectors in Belgium, China, Iran, Russia, Sweden, and elsewhere.
Compromise of entities involved in the China-Philippines territorial dispute
Date: 2016-07-12
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Philippines

A threat actor targeted the Department of Justice of the Philippines, the Asia-Pacific Economic Cooperation (APEC), and a major international law firm representing one of the parties in the dispute over the Scarborough Shoal.
Operation Sphinx
Date: 2016-07-21
Type: Espionage
Category: Government, Military
Victims: Egypt, Israel

This threat actor targets government and military organizations in Egypt and Israel for espionage purposes.
Compromise of computer networks associated with diplomats, journalists, and others in South Korea
Date: 2016-08-01
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: South Korea

Threat actors targeted the email accounts of South Korean diplomats, journalists, and security officials.
Response: Denouncement   http://english.yonhapnews.co.kr/news/2016/08/01/0200000000AEN20160801001152315.html
Compromise of a mobile app used by Ukrainian artillery units
Date: 2016-12-22
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Military
Victims: Ukraine Armed Forces

A threat actor compromised a mobile app that Ukrainian artillery units used to assist with targeting. The compromise of the app is believed to have allowed the threat actor to monitor the movements of Ukrainian units in order to facilitate military targeting by Russian-backed rebels in eastern Ukraine.
Response: Denial   http://www.mil.gov.ua/news/2017/01/06/informacziya-po-vtrati-u-zs-ukraini-80-gaubicz-d-30%E2%80%9D-ne-vidpovidae-dijsnosti/
APT 16
Date: 2016-12-16
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japan, Taiwan

This threat actor targets and compromises Japanese and Taiwanese entities in the finance, tech, media, and government sectors.
Targeting of Kazakh dissidents
Date: 2016-08-02
Sponsor: Kazakhstan
Type: Espionage
Category: Civil society
Victims: Kazakh dissidents

Threat actors targeted lawyers and exiled Kazakh dissidents for the purpose of espionage.
Attempted compromise of U.S. think tanks
Date: 2016-11-09
Affiliations: Believed to be the work of the Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Council on Foreign Relations, Brookings Institution

A threat actor attempted to compromise the networks of U.S. think tanks associated with international affairs and national security. The attempts occurred shortly after the U.S. election in 2016.
Compromise of a power grid in eastern Ukraine
Date: 2015-12-23
Affiliations: Possible link to Sandworm.
Sponsor: Russian Federation
Type: Sabotage
Category: Private sector
Victims: Prikarpattiaoblenergo Electric Company

In December 2015, a threat actor compromised power distribution companies in western Ukraine, causing a power outage for more than 230,000 residents. Several control centers were targeted by suspected Russian hackers, who were able to siphon operator credentials and gain access to the power grid for the Ivano-Frankivsk region. The power outage lasted as long as six hours in some areas. During the outage, threat actors also flooded customer services phone lines with calls to prevent customers from reporting the incident.

The compromise of the Ukrainian power grid was an escalation from previous disruptive incidents and the first confirmed cyber operation to successfully take down energy infrastructure. The incident set an ominous precedent for the security of power grids around the world. The electricity distribution system in Ukraine was again targeted in 2016.
Response: Denouncement   http://www.reuters.com/article/us-ukraine-cybersecurity-idUSKCN0VL18E
APT 30
Date: 2015-04-12
Affiliations: Also known as Naikon, PLA Unit 78020, Lotus Panda. Possibly responsible for the JadeRAT tool. 
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: India, Thailand, South Korea, Saudi Arabia, Malaysia, United States, Vietnam, Cambodia, Indonesia, Myanmar, China, Laos, Singapore, Phillipines

This threat actor uses spear-phishing techniques to target government and private sector agencies in the South China Sea region.
Goblin Panda
Date: 2015-06-01
Affiliations: Also known as Earth Zhulong and 1937CN.
Sponsor: China
Category: Government, Private sector
Victims: Vietnam

This threat actor targets government agencies and entities in the defense and energy sectors in Southeast Asia with an interest in issues related to tensions in the South China Sea.
Compromise of Anthem
Date: 2015-02-06
Affiliations: Believed to be the work of Deep Panda
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Anthem

A threat actor compromised a U.S. health insurance company, resulting in compromised personal data on eighty million customers.
Response: Criminal charges   https://www.justice.gov/opa/press-release/file/1161466/download
Gamaredon
Date: 2015-04-28
Affiliations: Also known as the Gamaredon Group and Primitive Bear.
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukraine

A Russian-linked threat group known as Gamaredon uses custom-developed malware in attacks aimed at Ukraine. The group has been active since at least 2013. Also known as Invisimole.
Ocean Lotus
Date: 2015-05-31
Affiliations: Also known as APT 32
Sponsor: Vietnam
Type: Espionage
Category: Government, Private sector, Civil society
Victims: China, United States, Philippines, Germany, Vietnam, Association of Southeast Asian Nations, Cambodia, Laos

This threat actor, known to use watering-hole attacks to compromise victims, targets organizations of interest to the Vietnamese government for espionage purposes. Victims have included human rights organizations, research institutes and maritime construction firms in China, and media organizations. Also believed to have been responsible for disclosing confidential Filipino government documents.
Duqu 2.0
Date: 2015-06-10
Affiliations: Associated with Duqu. Believed to have been the tool used to compromise Kaspersky Labs.
Sponsor: Israel
Type: Espionage
Category: Government, Private sector
Victims: Iran

A threat actor, using a tool dubbed Duqu 2.0, targeted individuals and companies linked to the P5+1 (the five permanent member states of the UN Security Council, plus Germany), which was conducting negotiations on Iran's nuclear program.
Chafer
Date: 2015-12-07
Affiliations: Believed to use similar tools and infrastructure as OilRig
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: Saudi Arabia, United Arab Emirates, Israel, Jordan, Turkey

This threat actor targets organizations in the aerospace, technology, telecommunications, and engineering sectors for the purpose of espionage.
APT 3
Date: 2015-06-23
Affiliations: Also known as UPS, Gothic Panda, Buckeye, and Boyusec
Sponsor: China
Type: Espionage
Category: Private sector
Victims: United States, United Kingdom, Hong Kong

This threat actor targets and compromises entities in the defense, construction, technology, and transportation sectors. Up until 2015, it was primarily focused on U.S. and UK entities, but it shifted to Hong Kong–based targets afterward. The U.S. Department of Justice indicted three members of this threat actor group in November 2017 for compromising the networks of three U.S. companies.
Targeting of Ugandan political opposition members, journalists, and activists
Date: 2015-10-16
Affiliations: The government of Uganda
Sponsor: Uganda
Type: Espionage
Category: Civil society
Victims: Uganda

The government of Uganda, under the Yoweri Museveni administration, used FinFisher, an advanced spyware developed by Gamma Group, to quell political unrest that resulted from allegations of corruption and police brutality after the 2011 general election.
Emissary Panda
Date: 2015-08-05
Affiliations: Also known as TG-3390, APT 27, TEMP.Hippo, LuckyMouse, and Budworm. Believed to have been responsible for the compromise of a Mongolian data center.
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: United States, United Kingdom, France

This threat actor compromises web pages to lure targets for espionage purposes. It focuses on the aerospace, automotive, technology, and energy sectors, primarily in the United States and United Kingdom.
Compromise of TV5 Monde
Date: 2015-04-09
Affiliations: Suspected to be the work of APT 28
Sponsor: Russian Federation
Type: Defacement
Category: Private sector
Victims: TV5 Monde

In May 2015, threat actors compromised French television network TV5 Monde, disrupting broadcasts for three hours and gaining access to the network’s social media accounts. A group allegedly allied with the self-declared Islamic State and calling itself the Cyber Caliphate initially claimed responsibility for the incident. However, later investigations revealed links to Russian hacking group APT 28.

TV5 Monde is an example of a “false flag” operation, whereby a threat actor tries to mask its identity by leaving clues or attributes that would cause the victim to pin the blame on someone else. The threat actors behind TV5 Monde were successful enough in their flagging to lead French authorities to believe the incident was a terrorist attack. It is unknown why Russia would have conducted a false flag operation in France disguising itself as the Islamic State. 

In October 2018, the UK government announced that this incident was the work of Russian military intelligence.
Response: Denouncement   http://www.thelocal.fr/20150409/frances-tv5-monde-isis-cyberattack-charlie-hebdo
Targeting of the government of Thailand
Date: 2015-11-24
Affiliations: Believed to be the work of Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Government
Victims: Thailand

A threat actor used a tool called Bookworm to compromise government agencies in Thailand, for the purpose of espionage.
APT 17
Date: 2015-05-14
Affiliations: Also known as Deputy Dog and Axiom. Believed to be associated with Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: United States

This threat actor targets U.S. government entities, the defense industrial base, law firms, information technology companies, resource extraction companies, and nongovernmental organizations. Ethical hacking group Intrusion Truth doxed three members of this threat actor: two hackers plus the head of four Chinese companies who is also believed to be an officer of the Chinese Ministry of State Security (MSS). The hackers are believed to be operating as contractors for the Jinan bureau of the Chinese MSS, where they carry out on-demand hacking operations.
Rocket Kitten
Date: 2015-11-09
Affiliations: Possibly linked to Saffron Rose
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Military
Victims: Saudi Arabia, Israel, Yemen, Venezuela, Iraq, United Kingdom, Afghanistan, Kuwait, Egypt, United Arab Emirates, Turkey, Syria, Iran, Canada, Jordan

This threat actor targets defense contractors and academic institutions in Israel, European government agencies, and civil society actors. It seeks out material related to diplomacy, defense, security, journalism, and human rights for espionage purposes.
Compromise of the networks at the German parliament (Bundestag)
Date: 2015-05-29
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Bundestag

A threat actor compromised the networks of the German parliament for the purpose of espionage. In May 2020, Germany’s federal prosecutor issued an arrest warrant against Russian citizen Dmitry Badin, who is believed to be a member of Russia’s elite hacking unit, APT 28. Afterward, Germany asked European Union governments to impose the bloc’s first cyber sanctions on Badin.
Response: Denouncement   http://www.reuters.com/article/us-germany-russia-cyber-idUSKCN0Y41FC