Maljean/dataset huggingface dataset:
Operation Aurora
Date: 2010-01-14
Affiliations: Believed to be the work of PLA Unit 61398 with possible assistance from Sneaky Panda. Believed to be associated with Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Google, Adobe, Juniper Networks, Rackspace, Yahoo, Symantec, Northtrop Grumman, Morgan Stanley, Dow Chemical

Operation Aurora was a series of cyberattacks from China that targeted U.S. private sector companies in 2010. The threat actors conducted a phishing campaign that compromised the networks of Yahoo, Adobe, Dow Chemical, Morgan Stanley, Google, and more than two dozen other companies to steal their trade secrets. Google was the only company that confirmed it was a victim and disclosed to the public that the Gmail accounts of certain Chinese human rights activists had been compromised. Google also publicly attributed the incident to China, something companies were reluctant to do for fear of jeopardizing their access to the Chinese market.  

The incident is viewed as a milestone in the recent history of cyber operations because it raised the profile of cyber operations as a tool for industrial espionage. It led Google to cease its operations in China, though it continues to operate a localized version of its search engine in Hong Kong. As a result of the Gmail compromise, Google began notifying users if it believed their accounts had been targeted or compromised by a state-sponsored actor. This practice later spread to other email providers.
Response: Denouncement   http://www.nytimes.com/2010/01/22/world/asia/22diplo.html
APT 5
Date: 2010-03-12
Affiliations: Also known as Manganese
Sponsor: China
Type: Espionage
Category: Civil society

This threat actor targets telecommunications and technology companies, particularly regional telecommunication providers, high-tech manufacturers, firms specializing in technology with military applications, and Asia-based employees of global tech firms. Believed to have been active since at least 2007, this large threat group consists of several subgroups with distinct tactics and infrastructure.
Defacement of Baidu
Date: 2010-01-12
Sponsor: Iran (Islamic Republic of)
Type: Defacement
Category: Private sector
Victims: Baidu

Threat actors disrupted access to Baidu, China's most popular search engine. A group calling itself the Iran Cyber Army, which could be state sponsored, claims credit for the incident.
Compromise of the Indian Prime Minister's Office
Date: 2010-01-14
Sponsor: China
Type: Espionage
Category: Government
Victims: Prime Minister's Office

Threat actors compromised computers in the office of the Indian prime minister.
Response: Denouncement   http://www.thetimes.co.uk/tto/news/world/asia/article2611832.ece
Malware targets Vietnamese users
Date: 2010-03-30
Sponsor: Vietnam
Type: Denial of service
Category: Government
Victims: Vietnamese political activists

Google announced that botnets and malware were targeting computer users in Vietnam with the intention of muting critics of a controversial government-approved plan that allowed a Chinese company to mine there.
Compromise of three Australian mining companies
Date: 2010-04-19
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Rio Tinto, BHP Billiton, Fortescue Metals

A threat actor compromised the computer networks of Rio Tinto, BHP Billiton, and Fortescue Metals and exfiltrated data.
Stuxnet
Date: 2010-07-22
Affiliations: Codenamed “Olympic Games” and believed to be the work of the Equation Group
Sponsor: Israel, United States
Type: Sabotage
Category: Military
Victims: Iran, Indonesia, India, Azerbaijan, Pakistan, Malaysia, United States, Uzbekistan, Russia, United Kingdom, South Korea, Taiwan

Believed to have been developed as a joint operation between U.S. and Israeli intelligence services, the Stuxnet malware compromised industrial control systems at the Natanz nuclear material enrichment facility in Iran. Stuxnet was specifically designed to cause centrifuges to fail while providing readings to their operators that they were running normally. Reports indicate that the United States pursued the Stuxnet operation as a way of degrading Iran’s nuclear weapons program without resorting to an airstrike or an attack by special operation forces.

Stuxnet was the first publicly known instance in which a cyber operation caused physical damage outside of a controlled testing environment. It demonstrated the potential effectiveness and value of a cyber weapon. Many experts and former government officials feared that the attack on Natanz would open the door to other states conducting destructive cyberattacks and Stuxnet would represent, in the words of former Director of the National Security Agency Michael Hayden, a moment when “somebody crossed the Rubicon.” However, nation-states have so far exercised restraint.
Response: Denouncement   http://www.reuters.com/article/us-iran-nuclear-stuxnet-idUSTRE73G0NB20110417
Night Dragon
Date: 2010-01-25
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Marathon Oil, ExxonMobil, ConocoPhillips

A threat actor compromised U.S. oil companies through spear phishing and remote administration tools
Shadow Network
Date: 2010-04-06
Affiliations: Has links to Lucky Cat and GhostNet
Sponsor: China
Type: Espionage
Category: Military, Government
Victims: National Security Council, Ministry of External Affairs, Institute for Defence Studies and Analyses, United Nations

A cyber threat actor that compromised government, business, academic, and other computer network systems, such as the Office of His Holiness the Dalai Lama and the United Nations, for espionage purposes.
Compromise of computers associated with the Joint Strike Fighter program
Date: 2009-04-21
Affiliations: Sneaky Panda is among some of the actors suspected to be behind this incident.
Sponsor: China
Type: Espionage
Category: Military
Victims: U.S. Department of Defense

Computers associated with the U.S. Air Force's Joint Strike Fighter (also known as the F-35 Lightning II) project at Lockheed Martin, also known as the were compromised. The similarities between the F-35 and the Chinese J-20 have fueled speculation that the Chinese government may have been behind the compromise.
Fourth of July incident
Date: 2009-07-08
Sponsor: Korea (Democratic People's Republic of)
Type: Denial of service
Category: Government, Private sector
Victims: South Korea, United States

A series of denial of service incidents affecting at least thirty-five government and commercial websites in South Korea and the United States
Response: Denouncement   http://english.yonhapnews.co.kr/northkorea/2009/10/30/0401000000AEN20091030002200315.HTML
GhostNet
Date: 2009-03-28
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Iran, Bangladesh, India, South Korea, Germany, Pakistan, Taiwan, Thailand, Indonesia, Philippines, Latvia, Portugal, Barbados, China

GhostNet was a large-scale electronic espionage program used to spy on individuals, organizations, and governments. The threat actors breached 1,295 computers in 103 countries over a two-year period, predominately focusing on governments in Southeast Asia. The GhostNet operation was discovered after an investigation into a potential breach of the office of the Dalai Lama in India. Investigators at the University of Toronto’s Citizen Lab confirmed that the threat actors were based in China.

The report about GhostNet was one of the first publicly available in which computer security researchers outlined their methodology and backed up their claims with forensic evidence [PDF], demystifying cyber operations and demonstrating that private actors had significant capabilities to attribute threat actors.
Compromise of the office of Senator Ben Nelson
Date: 2009-03-20
Sponsor: China
Type: Espionage
Category: Government
Victims: Office of Senator Ben Nelson

Threat actors compromised computers associated with Senator Ben Nelson and data was exfiltrated.
Offensive cyber campaign against Georgia
Date: 2008-08-13
Affiliations: Believed to be linked to Sandworm.
Sponsor: Russian Federation
Type: Denial of service
Category: Government
Victims: Georgia

A series of denial of service incidents and defacements of Georgian government and nongovernment websites coincided with Russia’s military operation in the country.
Response: Denouncement   http://uk.reuters.com/article/2008/08/11/us-georgia-ossetia-hackers-idUKLB2050320080811
Targeting of pro-Tibet activist groups
Date: 2008-03-21
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Tibet Support Network, Human Rights in China, Students For a Free Tibet

Attempted compromises of pro-Tibet groups using spear phishing techniques
Compromise of Indian military computers
Date: 2008-05-05
Sponsor: China
Type: Espionage
Category: Military, Government
Victims: Ministry of External Affairs, India National Informatics Centre

A threat actor compromised Indian military computer networks for espionage purposes.
Compromise of U.S. presidential campaigns in 2008
Date: 2008-11-04
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Obama Campaign, McCain Campaign

In 2008, a foreign entity waged cyber espionage operations against the presidential campaigns of Barack Obama and John McCain. Phishing emails sent to top campaign aides delivered malware, allowing threat actors to exfiltrate data from both campaigns. U.S. intelligence officials believe that Chinese threat actors were seeking internal policy papers in order to gain leverage with the winner of the election.

This was the first time that a foreign actor was discovered exfiltrating large quantities of information from a U.S. presidential race for potential use by a foreign government.
Compromise at NASA Kennedy Space Center
Date: 2008-11-19
Sponsor: China
Type: Espionage
Category: Government
Victims: NASA

Malware gathered data from computer networks associated with the Discovery Space Shuttle.
Compromise of NASA network in Washington, DC
Date: 2008-11-19
Sponsor: China
Type: Espionage
Category: Government
Victims: NASA

Spear phishing compromised computers at NASA headquarters
Agent.btz
Date: 2008-11-28
Affiliations: Associated with Turla
Sponsor: Russian Federation
Type: Espionage
Category: Military, Private sector
Victims: United States, Russia, Spain, Italy, Kazakhstan, Germany, Poland, Latvia, Lithuania, United Kingdom, Ukraine

Agent.btz was malicious software designed to steal documents from classified and unclassified U.S. military networks in 2008. A flash drive infected with Agent.btz was reportedly inserted into a laptop at a U.S. military base in the Middle East, and from there the worm spread undetected to U.S. computers at the Department of Defense and in combat zones. Russia is suspected of being behind the incident. Once the compromise was detected, it took fourteen months to remove Agent.btz from the Pentagon’s networks and the incident triggered a departmental ban of USB drives.

Agent.btz was a significant breach of U.S. military systems, and the vulnerabilities it exposed ultimately led to the creation of U.S. Cyber Command, a military command with the mission of defending Department of Defense networks and conducting offensive cyber operations for the U.S. military.
Estonian denial of service incident
Date: 2007-05-16
Sponsor: Russian Federation
Type: Denial of service
Category: Military, Government
Victims: Estonia

In April 2007, Russia-based attackers launched a series of denial of service attacks against Estonian public and private sector organizations in response to the government's removal of a Soviet war monument from downtown Tallinn. For three weeks, threat actors targeted state and commercial websites, ranging from foreign and defense ministries to banks and media outlets, by overloading their bandwidth and flooding their servers with junk traffic, rendering them inaccessible to the public. In order to mitigate the onslaught, Estonia briefly closed its digital borders and blocked all international web traffic.

This series of denial of service operations in Estonia in 2007 was the first time that a foreign actor threatened another nation’s security and political independence primarily through cyber operations.
Response: Denouncement   http://www.csmonitor.com/2007/0517/p99s01-duts.html
Compromise of Chinese government computers
Date: 2007-10-23
Sponsor: Taiwan, United States
Type: Denial of service
Category: Government, Military
Victims: China Aerospace Science & Industry Corporation, National Defense Research Institutes, Military Industrial Labs, Ministry of Foreign Affairs

The Chinese government accused Taiwan's intelligence agency of compromising Chinese government computers.
Targeting of U.S. National Laboratories
Date: 2007-12-07
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Oak Ridge National Laboratory, Los Alamos National Laboratory, Lawrence Livermore National Laboratory, U.S. Department of Energy, National Nuclear Security Administration

Phishing attempts were made at several U.S. Department of Energy National Laboratories, and at least one was successful against the Oak Ridge National Laboratory.
Compromise of National Defense University
Date: 2007-01-12
Sponsor: China
Type: Espionage
Category: Military
Victims: National Defense University

During routine maintenance, the National Defense University discovered malware that gave threat actors persistent access to its network.
Secretary of defense email incident
Date: 2007-06-22
Sponsor: China
Type: Espionage
Category: Military
Victims: U.S. Department of Defense

A DDoS and defacement attack targeted Estonian government websites, news outlets, and financial institutions.
Compromise of German government networks
Date: 2007-08-27
Sponsor: China
Type: Espionage
Category: Government
Victims: German Chancellery, Ministry of Foreign Affairs, Ministry for Economic Affairs and Energy, Ministry of Education and Research

Threat actors compromised computers in the chancellery and in the foreign, economic, and research ministries.
Response: Denouncement   http://www.spiegel.de/international/world/espionage-report-merkel-s-china-visit-marred-by-hacking-allegations-a-502169.html
Compromise of French Defense Ministry website
Date: 2007-09-09
Sponsor: China
Type: Espionage
Category: Military
Victims: French Defence Ministry

A compromise of the French Defense Ministry's website
Attempted compromise of Australian and New Zealand government computers
Date: 2007-09-12
Sponsor: China
Type: Espionage
Category: Government
Victims: Australia, New Zealand

An attempted compromise of government computer systems
Compromise at the Department of Homeland Security
Date: 2007-09-24
Sponsor: China
Type: Espionage
Category: Military
Victims: U.S. Department of Homeland Security

Threat actors exfiltrated unclassified information from Department of Homeland Security (DHS) computers to Chinese servers. Threat actors are believed to have penetrated the DHS network through a U.S. contractor.
Attack on the Syrian Air Force
Date: 2007-10-04
Sponsor: Israel
Type: Denial of service
Category: Military
Victims: Syrian Arab Air Force

A threat actor disrupts Syrian radar and air defense systems, rendering them ineffective and paving the way for an air strike. This was possibly a case of electronic warfare instead of a cyber operation.
Compromise at the State Department
Date: 2006-07-11
Sponsor: China
Type: Espionage
Category: Government
Victims: U.S. Department of State

Threat actors exfiltrated sensitive but unclassified information.
Compromise of the Pentagon’s NIPRNet
Date: 2006-08-17
Sponsor: China
Type: Espionage
Category: Military
Victims: U.S. Department of Defense

Threat actors accessed unclassified information and email and probed the Pentagon network.
Compromise at U.S. Naval War College
Date: 2006-12-04
Sponsor: China
Type: Espionage
Category: Military
Victims: Naval War College

This undefined cyber incident at the U.S. Naval War College led the college to shut down its internal- and external-facing computer networks.
Titan Rain
Date: 2005-08-25
Affiliations: Believed to be partially the work of PLA Unit 61398.
Sponsor: China
Type: Espionage
Category: Military, Government
Victims: U.S. Department of State, U.S. Department of Defense, U.S. Department of Energy, U.S. Department of Homeland Security, NASA, UK Ministry of Defense, UK House of Commons, UK Foreign Office

Titan Rain was a string of cyber operations that compromised a number of agencies within the U.S. and UK government. Chinese state-sponsored actors are suspected of breaching the unclassified networks of the U.S. Departments of State, Homeland Security, and Energy, and UK defense and foreign ministries. Although the attacks were first publicly revealed in 2005, the United States reported that they had been ongoing since at least 2003. The United Kingdom reported that the campaign continued as late as 2007.

Titan Rain was the first instance of state-sponsored espionage from China that was made public, triggering a decades-long effort by the U.S. government to reduce the breadth and scope of Chinese cyber operations against U.S. targets.
Targeting of Russian aerospace and defense conglomerate
Affiliations: Ukrainian IT Army
Sponsor: Ukraine
Type: Denial of service
Category: Military
Victims: Russian aerospace and defense conglomerate Rostec

Hackers targeted the Russian state-owned aerospace and defense conglomerate Rostec with a DDoS attack on its website. The website was taken down briefly before being returned to service. Rostec blamed the incident on Ukrainian "radicals” who are likely part of the IT Army.
Targeting of financial institutions in Taiwan
Affiliations: Antlion
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Taiwanese financial institutions

The Chinese threat actor Antlion targeted financial institutions in Taiwan with a custom backdoor. The hackers stole data from the infected networks in what may have been a larger campaign to gain intelligence on the Taiwanese financial sector.
Targeting of South Korean individuals and organizations with fake Itaewon disaster documents
Affiliations: APT 37
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector, Civil society
Victims: South Korean organizations and individuals

APT 37 was detected using a zero day in the Internet Explorer application as part of a phishing campaign against South Korean users. APT 37 also used a lure document purporting to analyze the stampede that occurred at Itaewon, a neighborhood in Seoul, on October 29, 2022, to entice users to open the phishing document.
 
Response: Unknown
Compromises of government embassies, telecommunications companies, and a Russian oil company
Affiliations: Believed to be the work of MuddyWater.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: Russian Federation, Pakistan, Saudi Arabia, Turkey, North America

A group has attacked 131 victims in thirty organizations since September 2018, including unidentified government embassies, telecommunications firms, and a Russian oil and gas company.
Kimusky
Affiliations: Also known as Thallium and Smoke Screen
Category: Government, Private sector
Victims: France, Slovakia, Stanford University, U.S. Think Tanks, UK Think Tanks

This threat actor targeted foreign ministries and think tanks in Europe and the United States using malware hidden in Microsoft Word documents and antiquated file formats.
Leafminer
Sponsor: Iran (Islamic Republic of)
Category: Private sector, Government
Victims: Egypt, Israel, Saudi Arabia, United Arab Emirates, Bahrain, Iran, Azerbaijan, Afghanistan

This threat actor targets government organizations and entities in the financial, petrochemical, and transportation sectors for espionage purposes.
Allanite
Affiliations: Believed to be responsible for the targeting of employees of companies that operate U.S. power plants. Also believed to be linked to Crouching Yeti
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: United States, United Kingdom

This threat actor targets business and industrial control networks in the power-utility sector, for the purpose of espionage. In 2017, the U.S. Department of Homeland Security warned U.S. critical infrastructure operators about this threat actor and its capabilities.
Targeting of sporting and anti-doping organizations ahead of 2020 Tokyo Olympics
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society, Government
Victims: Sixteen national and international sporting and anti-doping organizations across three continents

Just prior to news reports suggesting that the World Anti-Doping Agency might ban Russian athletes from all international sporting events, APT 28 attacked a number of sporting and anti-doping organizations.
Targeting of U.S. diplomats in Uganda
Affiliations: Believed to be the work of the Ugandan government.
Sponsor: Uganda
Type: Espionage
Category: Government, Civil society
Victims: U.S. diplomats and Ugandan journalists

Uganda was accused of using the spyware Pegasus, which is sold by the Israeli NSO Group, to spy on journalists and U.S. diplomats based in the country. The incident was the first reported instance that NSO Group's tools have been used to surveil U.S. government personnel.
APT 28
Affiliations: Also known as Pawn Storm, Fancy Bear, Sofacy, Tsar Team, Strontium, Sednit, and UNC2452. Estonian and British intelligence services associate this group with Russian military intelligence (GRU). The United States believes that GRU units 26165 and 74455 form a part of this threat actor.
Sponsor: Russian Federation
Category: Government, Military, Private sector
Victims: Georgia, NATO, OSCE, France, Ukraine, United Kingdom, Jordan, Belgium, Germany, United States, Pakistan, Poland, Hungary, Asia Pacific Economic Cooperation, European Commission, World Anti-Doping Agency, International Association of Athletics Federations,

This threat actor is linked to espionage campaigns, high-profile doxing efforts, and disruptive incidents that compromised targets believed to be of interest to the Russian government.
Response: Denouncement   https://www.cisa.gov/uscert/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf
Targeting of Association of Southeast Asian Nations (ASEAN) email servers
Affiliations: Believed to be the work of the Chinese government
Sponsor: China
Type: Espionage
Category: Government
Victims: ASEAN members

Chinese state-sponsored hackers breached the ASEAN email servers in February 2022, stealing over thirty gigabytes of data. That data is believed to contain information about the economic outlook and political conditions of member countries.
Response: Unknown
APT-C-23
Affiliations: Also known as AridViper and Desert Falcon.
Sponsor: Palestine, State of
Victims: Israel Defense Forces

Previously targeted Israeli soldiers by pretending to be women looking for romantic partners.
Targeting of American defense industry
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Military, Private sector
Victims: American defense industry

The North Korean threat actor Lazarus Group leveraged a Windows update to conduct spear-phishing attacks, sending fake job offers from Lockheed Martin. Lazarus has used fake job offers in the past to plant malware on defense industry systems.
Targeting of humanitarian, think tank, and governmental organizations
Affiliations: RedAlpha
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Government organizations, think tanks, and humanitarian organizations reporting on several issues, including Taiwan, Tibet, and Uyghur repression.

Security researchers described a long-running domain-spoofing campaign run by a Chinese-sponsored threat actor aimed at various organizations, with a special interest in Taiwan.
Response: Unknown