Maljean/dataset huggingface dataset:
Targeting of Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline
Date: 2022-02-08
Affiliations: Believed to be the work of Palestine's government
Sponsor: Palestine, State of
Type: Espionage
Victims: Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline

The Palestinian threat actor Molerats targeted Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline with spear-phishing emails containing a remote access Trojan. To avoid detection, Molerats used geofencing and URL redirects to legitimate sites. The hackers masqueraded as the site Quora and also created target-specific lures that it delivered to organizations in the form of Dropbox and WordPress URLs.
Targeting of Ukrainian institutions and U.S. and European foreign policy institutions and think tanks
Date: 2022-04-07
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government, Civil society
Victims: Ukrainian institutions including media organizations and government institutions and think tanks in the United States and the European Union involved in foreign policy

Russian threat actor APT 28 targeted Ukrainian media organizations, government institutions, and foreign policy think tanks in the United States and the European Union with attempts to establish access to victims’ systems, gain tactical information related to the invasion, and exfiltrate other sensitive information. Microsoft assumed control of seven of APT 28’s internet domains used in the attacks, redirecting site traffic to a sinkhole.
Targeting of major telecommunications and network service providers
Date: 2022-06-08
Affiliations: Believed to be the work of the Chinese government
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Public and private telecommunications providers and network service providers in the United States.

Chinese-backed threat actors identified vulnerabilities to gain access to major telecommunication companies and network service providers to access and exfiltrate victim data.
Response: Confirmation   https://www.cisa.gov/uscert/ncas/alerts/aa22-158a
APT 42
Date: 2022-09-07
Affiliations: Iran, APT 35
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Private sector, Government
Victims: Think tanks, Western government officials, journalists, pharmaceutical companies, researchers, former Iranian government officials, Iranians living abroad, and countries such as the United States, Australia, Bulgaria, Iran, Israel, Italy, Malaysia, Norway

APT 42 has a wide variety of targets and typically aims to access the networks of organizations and individuals who oppose the Iranian regime. Some overlap also exists between APT 42 and an Iranian-sponsored ransomware actor, UNC2448.
Response: Unknown
Targeting of Amnesty International Canada
Date: 2022-12-05
Affiliations: Believed to be the work of the Chinese government
 
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Amnesty International Canada

Chinese threat actors compromised the networks of Amnesty International Canada to steal information on Amnesty's investigations into Chinese human rights abuses.
Response: Unknown
Ukrainian IT Army
Date: 2022-02-28
Sponsor: Ukraine
Type: Denial of service
Category: Government, Private sector
Victims: Russian infrastructure and financial services

The Ukrainian IT Army is a threat actor comprised of international and Ukrainian volunteer hackers working in collaboration with officials from Ukraine's defense ministry to target Russian infrastructure and websites. The IT Army is organized through a Telegram channel where new Russian targets are listed for volunteers to attack.
Targeting of Ukrainian, Latvian, and Lithuanian computer systems
Date: 2022-02-23
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Data destruction
Category: Government, Private sector
Victims: Ukrainian, Latvian, and Lithuanian computer systems owned by banks and government contractors, as well as systems used by the defense, aviation, and IT sectors.

Russian threat actors targeted computer systems in Ukraine, Latvia, and Lithuania with a HermeticWiper malware attack. The malware was aimed at Windows devices, corrupting systems’ master boot records, displaying signs of ransomware as a decoy, and destroying stored data.
Targeting of government, military, and energy sectors in Pakistan
Date: 2022-07-13
Affiliations: Confucius
Sponsor: India
Type: Espionage
Category: Government
Victims: The government, military, and energy sectors in Pakistan

An Indian threat actor, Confucius, launched a spear-phishing campaign against military and government officials in Pakistan to steal information.
Response: Unknown
Targeting of Myanmar government agencies
Date: 2022-10-06
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Myanmar government agencies

Mustang Panda launched a watering-hole attack by impersonating Burmese news outlets to gain access to Myanmar's government networks.
 
Response: Unknown
Targeting of transportation companies via UEFI firmware implant
Date: 2022-01-20
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: A transportation company, as well as other targets

The Winnti group is suspected of deploying an advanced Unified Extensible Firmware Interface (UEFI) implant, dubbed Moonbounce, to the systems of a transportation company. Moonbounce is highly targeted and was likely created to access the networks of a small number of institutions and companies.
Targeting of Viasat's satellite broadband service
Date: 2022-03-05
Affiliations: Believed to be the work of Russia's government
Sponsor: Russian Federation
Type: Sabotage
Category: Government, Private sector, Military
Victims: Users of Viasat's satellite broadband service in Eastern and Central Europe

The Russian military intelligence agency, known as GRU, targeted the internet provider Viasat’s satellite modems with a wiper that caused widespread communication outages throughout Ukraine on February 24, the same day Russian forces invaded the country.  The attack caused a loss in military communications at the start of the war and affected other government services. The outage also affected thousands of Viasat customers across Eastern and Central Europe.
Targeting of Ukrainian agricultural firm
Date: 2022-04-27
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Data destruction
Category: Private sector
Victims: Ukrainian agricultural firm

Sandworm targeted a Ukrainian agricultural firm’s network by placing a file encryptor on its network, leaving it vulnerable to future destruction. Assessments indicate Sandworm intended to disrupt grain production and exports.
Targeting of military and public institutions in Afghanistan and several east European countries
Date: 2022-08-07
Affiliations: APT 18
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: Manufacturers of military products and military contractors in Afghanistan and Eastern Europe

The attackers sent phishing emails containing a malicious Microsoft Word document, which installed multiple Backdoors on targeted systems. The group likely used that access to conduct espionage.
Response: Unknown
Targeting of Ukrainian local government organization
Date: 2022-11-26
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Data destruction
Category: Government
Victims: Local government entities throughout Ukraine

Sandworm targeted Ukrainian local government networks in November 2022 with Caddywiper malware, which wipes most data on a system while preserving domain controllers. Researchers speculate this function allows Sandworm to maintain access inside networks after deploying Caddywiper.
Response: Unknown
Targeting of the International Atomic Energy Agency and South Korean defense contractor
Date: 2022-02-08
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: The International Atomic Energy Agency and Korea Aerospace Industries, a South Korean defense contractor

The North Korean threat actor Kimsuky used spear-phishing techniques to masquerade as websites and applications to get victims to input their credentials. The victims included a security officer at the International Atomic Energy Agency.
Targeting of the Indian power grid
Date: 2022-04-06
Affiliations: Believed to be the work of the Chinese government
Type: Espionage
Category: Government, Private sector
Victims: Indian power-grid assets, a national emergency response system, and the Indian subsidiary of a multinational logistics company

A Chinese state-sponsored threat actor targeted Indian power-grid organizations using ShadowPad malware. The actor intruded at least seven times into the networks of Indian State Load Despatch Centres, which oversee operations for grid control and electricity dispatch, particularly in North India. India claimed it had foiled the attack, while China denied it was behind the incident.
Response: Confirmation   https://www.thedefensepost.com/2022/04/08/india-chinese-cyber-attack/
Aoqin Dragon
Date: 2022-06-09
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Government, education, and telecommunication organizations in Southeast Asia and Australia

This Chinese threat actor has operated since 2013 and targets government, education, and telecommunication organizations in Australia and Southeast Asia. Aoqin Dragon seeks initial access primarily through document exploits and fake removable devices such as USB drives.
Targeting of organizations in an Iranian ransomware campaign
Date: 2022-09-07
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Financial Theft
Category: Private sector
Victims: Organizations in the United States and Europe

Charming Kitten launched ransomware attacks against multiple organizations.
Response: Unknown
Targeting of U.S. satellite network
Date: 2022-12-16
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: A U.S. satellite communications company

The U.S. Cybersecurity and Infrastructure Security Agency said Russian cyber operatives had infiltrated the network of a U.S. satellite communications provider. How far the intrusion extended or what kind of information the Russians could have stolen remains unclear.
 
Response: Unknown
Targeting of Russian diplomats in Asia
Date: 2022-01-03
Affiliations: Konni Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: Russian diplomats in Asia

The North Korean threat actor Konni launched a spear-phishing campaign against Russian diplomats in Indonesia. Konni spoofed the email address of the Russian embassy in Serbia to send a fake celebratory email that downloaded a remote access trojan once opened.
Targeting of Ukrainian government websites
Date: 2022-02-23
Affiliations: Believed to be the work of Russia's government
Sponsor: Russian Federation
Type: Denial of service
Category: Government
Victims: The websites of the Ukrainian parliament, Ministry of Foreign Affairs, Council of Ministers, and the Security Service of Ukraine

Hackers for the Russian military intelligence agency, known as GRU, targeted the websites of the Ukrainian parliament, Ministry of Foreign Affairs, Council of Ministers, and the Security Service of Ukraine with a DDoS attack that took the sites offline for two hours. A destructive wiper attack impacting hundreds of machines in Ukraine was reported simultaneously.
Targeting of specialized engineering companies
Date: 2022-04-27
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Specialized engineering companies with customers in the military and energy sectors

North Korean threat actor Lazarus Group targeted a specialized engineering company to steal sensitive intellectual property. The hackers breached the organization’s network by exploiting the Log4j vulnerability, moving laterally to compromise eighteen other computers. The hackers installed a backdoor to steal credentials and exfiltrate sensitive data.
Targeting of U.S. political reporters and White House correspondents
Date: 2022-07-14
Affiliations: Zirconium
Sponsor: China
Type: Espionage
Category: Civil society
Victims: U.S. political reporters and White House correspondents

Since 2021, Zirconium, a Chinese threat actor, has carried out phishing attacks against U.S.-based journalists to uncover sensitive information about U.S. politics.
Response: Unknown
Targeting of Japanese crypto-asset businesses
Date: 2022-10-14
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Japanese cryptocurrency businesses

Lazarus, a North Korean state-sponsored hacking group, conducted several years of phishing attacks aimed at Japanese crypto-asset businesses to steal cryptocurrency.
 
Response: Confirmation
Targeting of German pharmaceutical and technology firms
Date: 2022-01-27
Affiliations: Emissary Panda
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Pharmaceutical and technology companies in Germany

The Chinese group APT27 was detected launching attacks starting in 2021 against German companies. The attacks were primarily directed at technology and pharmaceutical firms. The group stole trade secrets and intellectual property and also aimed to use its access in certain companies to launch spear-phishing attacks against other targets.
Targeting of American news media and IT companies
Date: 2022-03-24
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector, Civil society
Victims: Over 250 individuals working for 10 different news media, domain registrars, web hosting providers, and software vendors

The Lazarus Group used a Google Chrome zero-day to target employees at American news media and IT companies. The Lazarus Group used phishing emails impersonating recruiters at Disney, Google, and Oracle with fake job opportunities, which included malicious links to spoofed Indeed and ZipRecruiter websites. An exploit kit hidden within the websites fingerprinted the target system and collected available client information.
Targeting of a Ukrainian transportation and logistics provider
Date: 2022-04-27
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Data destruction
Category: Private sector
Victims: A Ukrainian transportation and logistics provider

Sandworm targeted the network of a Ukrainian transportation and logistics provider with a destructive attack. The provider is based in western Ukraine, which is also where foreign military and humanitarian assistance enters the country, suggesting an intent to disrupt the movement of Ukrainian supplies to conflict hotspots.
Targeting of various industries with Maui ransomware
Date: 2022-07-06
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Various industries, but primarily public health organizations in the United States

The Lazarus Group used Maui ransomware to target government and civil institutions in order to raise money for the North Korean government.
Response: Denouncement
Targeting of the Pakistani government
Date: 2022-11-23
Affiliations: Patchwork
Sponsor: India
Type: Espionage
Category: Government
Victims: Pakistani government agencies

The threat actors behind Patchwork, an Indian APT, used spear-fishing tactics to install the Badnews backdoor and steal information from Pakistani government agencies.
 
Response: Unknown
ModifiedElephant
Date: 2022-02-09
Sponsor: India
Type: Espionage
Category: Civil society
Victims: Indian human rights activists, human rights defenders, academics, and lawyers

ModifiedElephant is a threat actor that has targeted activists, human rights defenders, journalists, academics, and law professionals in India for at least the past ten years. It primarily targets victims with remote access Trojans delivered through spear-phishing emails containing malicious file attachments. ModifiedElephant planted incriminating digital evidence used by Indian authorities to convict at least one activist of terrorism.
Targeting of Ukrainian power stations
Date: 2022-04-12
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Sabotage
Category: Private sector
Victims: High-voltage electrical substations in Ukraine

Russian-linked Sandworm hackers targeted high-voltage electrical substations in Ukraine. The attackers used a novel variant of Industroyer malware, dubbed Industroyer2, which interacts with control systems that manage the flow of power. The hackers also deployed multiple strains of wiper malware as part of the attack.
Response: Confirmation   https://cert.gov.ua/article/39518
Targeting of telecommunications companies operating in Africa, Europe, and Southeast Asia
Date: 2022-06-13
Affiliations: Gallium
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: Telecommunications companies, financial institutions, and governments operating in Asia, Europe, and Southeast Asia

Gallium, a Chinese APT, is thought to have operated since 2012 and primarily targets telecommunications companies, financial institutions, and governments. The group has previously used advanced, difficult-to-detect malware in its campaigns.
Targeting of government officials in Europe, the Middle East, and South America
Date: 2022-09-08
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Government organizations in Europe, the Middle East, and South America

Mustang Panda targeted government organizations in a phishing campaign. The campaign used PlugX, a frequently implemented Chinese modular malware tool.
Response: Unknown
Targeting of European government trade departments
Date: 2022-12-23
Affiliations: Mustang Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: European government departments focused on trade and migration policy

Chinese operators sent phishing emails disguised as memos on migration and trade policy to several different European governments. The campaign ran from September to November 2022 and utilized a new version of the modular PlugX malware.
 
Response: Unknown
Targeting of Pakistani research institutions
Date: 2022-01-07
Affiliations: Patchwork
Sponsor: India
Type: Espionage
Category: Military, Civil society
Victims: Pakistan's Ministry of Defense, the National Defense University of Islamabad, the University of Veterinary and Anmial Sciences’ Faculty of Bio-Science, the Karachi HEJ Research institute, and Salim Habib University.

An Indian threat actor was found using spear-phishing attacks against Pakistani targets, including the Ministry of Defense and several major research universities in the country. The threat actor had infected its own systems with the remote access trojan deployed in the attacks. This oversight allowed cybersecurity researchers to use the functions of the trojan to spy on the threat actor and understand its attack schemes and networks.
Targeting of American state governments' networks
Date: 2022-03-08
Affiliations: APT 41
Sponsor: China
Type: Espionage
Category: Government
Victims: The networks of at least six U.S. state governments

The Chinese cyber threat group APT41 conducted an extended campaign targeting the networks of at least six U.S. state governments. For over a year, APT41 exploited internet-facing web applications and leveraged a zero-day vulnerability in the USAHerds application used by many state governments, gaining access to the broader networks of state governments.
Targeting of Ukrainian users of Chrome, Edge, and Firefox browsers
Date: 2022-05-03
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Ukrainian users of Chrome, Edge and Firefox browsers

Russian threat actor APT 28 targeted Ukrainian internet users with a new malware variant. The malware was sent to targets via email attachments titled “ua_report.zip.” When executed, the malware enables hackers to steal and exfiltrate cookies and saved passwords from Chrome, Edge, and Firefox browsers.
Targeting of the Ukrainian Azov Regiment
Date: 2022-07-19
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government, Civil society
Victims: Ukrainian Azov Regiment and their supporters

Turla distributed Android-related malware disguised as an app that contributes to distributed denial of service (DDoS) attacks against Russian websites. However, the application did not conduct DDoS attacks and instead provided Turla access to infected systems.
Response: Unknown
Targeting of companies in Hong Kong
Date: 2022-10-18
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Technology and manufacturing companies in Hong Kong

Winnti Umbrella targeted government organizations in Hong Kong with malware to steal sensitive data from victims. The attacks are likely an expansion of Operation CuckooBees, previously documented in May 2022, which targeted businesses' networks in the United States and Europe to steal intellectual property.
 
Response: Unknown
Targeting of Ukrainian telecommunication company's internet service
Date: 2022-03-28
Affiliations: Believed to be the work of Russia's government
Sponsor: Russian Federation
Type: Denial of service
Category: Private sector
Victims: Ukrainian internet service provider Ukrtelecom

Russian hackers targeted Ukrainian telecommunication company Ukrtelecom’s internet service, forcing users offline. Whether the malicious activity was a DDoS attack or a more sophisticated intrusion remains unclear. Service was restored fifteen hours after the initial compromise. 
Response: Confirmation   https://twitter.com/dsszzi/status/1508528209075257347
Red Menshen
Date: 2022-05-07
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Telecommunications providers, government systems, postal and logistic systems, and others in the United States, Hong Kong, India, Myanmar, South Korea, Turkey, and Vietnam

A Chinese threat actor believed to have used a custom backdoor to target telecommunications providers and entities in the government, education, and logistics sectors in the United States, Hong Kong, India, Myanmar, South Korea, Turkey, and Vietnam.
Targeting of Uyghur communities
Date: 2022-11-10
Affiliations: Poison Carp
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Uyghurs both within and outside China

Chinese-affiliated group Poison Carp conducted a mobile surveillance campaign against Uyghurs in China and abroad using Android exploit and malware kit Moonshine. This is the second time Moonshine has reportedly been used; the first was in 2019 to surveil Tibetan activists.
Response: Unknown
Targeting of Australian media outlet
Date: 2022-02-10
Affiliations: Believed to be the work of China's government
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Australian media outlet

Chinese hackers exploited the Log4Shell vulnerability in order to enter the systems of an Australian media outlet and access passwords and data.
Targeting of telecommunication companies, internet service providers, and the data services sector
Date: 2022-04-12
Affiliations: Hafnium
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Telecommunication companies, internet service providers, and the data services sector

Chinese threat actor Hafnium targeted an un-patched zero-day vulnerability in Zoho products to implant a web shell. Hafnium exploited the Windows Task Scheduler to execute hidden scheduled tasks, allowing the malware to avoid detection.
Targeting of high-level U.S. and Israeli officials
Date: 2022-06-14
Affiliations: Siamesekitten, OilRig
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Civil society
Victims: Government officials and Middle Eastern energy and telecommunications organizations

Lyceum, an Iranian threat actor, used a newly developed and customized .NET-based malware that targeted government officials across the Middle East.