Maljean/dataset huggingface dataset:
Operation Cleaver
Date: 2014-12-02
Affiliations: Also known as Cutting Kitten and Group 41
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector, Government
Victims: Canada, China, United Kingdom, France, Germany, India, Israel, United States, Kuwait, Mexico, Pakistan, Qatar, Saudi Arabia, South Korea, Turkey

This threat actor targets governments and private sector entities for espionage and sabotage purposes. It is believed to be responsible for compromising U.S. Navy computers at the Navy Marine Corps Intranet in San Diego, the U.S. energy company Calpine Corporation, Saudi Aramco, Pemex, Qatar Airways, and Korean Air (http://www.reuters.com/article/2014/12/02/us-cybersecurity-iran-idUSKCN…)
Compromise of the Finnish Ministry of Foreign Affairs
Date: 2013-11-01
Affiliations: Believed to be the work of Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ministry for Foreign Affairs

A threat actor compromised Finland’s Ministry of Foreign Affairs for espionage purposes. The threat actor specifically targeted communications between Finland and the European Union.
Patchwork
Date: 2013-05-19
Affiliations: Believed to be responsible for the attempted compromise of U.S. think tanks
Sponsor: India
Type: Espionage
Category: Private sector, Military
Victims: Bangladesh, Sri Lanka, Pakistan

This threat actor targets multiple entities, primarily around India but also in the United States, the Middle East, and China.
admin@338
Date: 2013-10-31
Sponsor: China
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Hong Kong, United States

This threat actor targets prodemocratic activists and organizations in Hong Kong, European and international financial institutions, and a U.S.-based think tank.
Kimsuky
Date: 2013-09-11
Affiliations: Also known as APT 43
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government, Private sector
Victims: Ministry of Unification, Sejong Institute, Korea Institute for Defense Analyses, UN officials, including those affiliated with the UN Security Council

This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes. Also responsible for launching a launching a spear-phishing campaign targeting UN officials, including those affiliated with the UN Security Council.
Response: Denouncement   http://www.reuters.com/article/us-nuclear-southkorea-northkorea-idUSKBN0MD0GR20150317
Mirage
Date: 2013-12-11
Affiliations: Mirage is possibly linked to the Hellsing threat actor. It is also known as Vixen Panda, GREF, APT 15, Playful Dragon, and Playful Taurus. Believed to be associated with Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Government
Victims: European Union, India, United Kingdom

This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.
The Dukes
Date: 2013-02-01
Affiliations: Also known as APT 29, Cozy Bear, Dark Halo, Nobelium, and Cloaked Ursa. Estonian intelligence services associate this group with the Russian Federal Security Service (FSB) and Foreign Intelligence Service (SVR).
Sponsor: Russian Federation
Type: Espionage
Category: Government, Private sector
Victims: United States, Georgia, Brazil, China, Japan, Mexico, New Zealand, South Korea, Turkey, Ukraine, Belgium, Portugal, Romania, Kazakhstan, India

This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of State, Pentagon, and the Joint Chiefs of Staff. The threat actor includes all of the Dukes tool sets, including MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke (aka MiniDionis), and HammerDuke (aka Hammertoss).
Team Spy Crew
Date: 2013-03-20
Sponsor: Russian Federation
Type: Espionage
Category: Government, Private sector
Victims: Hungary, Belarus

This threat actor primarily compromises government entities and human rights activists in Eastern Europe and Central Asia for espionage purposes. It has also compromised private and public sector entities in the Middle East and in Western countries.
Anchor Panda
Date: 2013-03-22
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: United States, Germany, Sweden, United Kingdom, Australia

This threat actor targets government and private sector entities interested in maritime issues in the South China Sea for espionage purposes
NetTraveler
Date: 2013-06-04
Affiliations: Also known as APT 21
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: Mongolia, India, Russia, Kazakhstan, Kyrgyzstan, China, Tajikstan, South Korea, Spain, Germany, United States, Canada, United Kingdom, Chile, Morocco

This threat actor targets computer networks associated with Tibetan and Uighur activists for espionage purposes.
Sykipot
Date: 2013-09-04
Affiliations: Also known as JS Sykipot, Backdoor Sykipot, and Maverick Panda
Sponsor: China
Type: Espionage
Category: Private sector, Military
Victims: United States, United Kingdom, Hong Kong

This threat actor has been targeting the U.S. defense industrial base, telecommunications, computer hardware, government contractors, and aerospace firms since at least 2006. It was also seen targeting "Umbrella revolution" activists.
Compromise of EADS and ThyssenKrupp
Date: 2013-02-25
Sponsor: China
Type: Espionage
Category: Private sector
Victims: European Aeronautic Defense and Space Company (EADS), ThyssenKrupp

Threat actors compromised the networks of European Aeronautic Defense and Space Company (EADS) and ThyssenKrupp, defense contractors with offices in Germany.
Icefog
Date: 2013-09-25
Affiliations: Also known as Dagger Panda and possibly linked to Onion Dog
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: South Korea, Japan, China, United States, Germany

This threat actor targets government institutions, military contractors, maritime and shipbuilding groups, telecommunications operators, and others, primarily in Japan and South Korea.
Compromise of the Indian Defense Research and Development Organization
Date: 2013-03-13
Sponsor: China
Type: Espionage
Category: Military
Victims: Indian Defense Research Organization, Defense Research and Development Lab

A threat actor compromised India's Defense Research and Development Organization for espionage purposes.
Response: Denouncement   http://www.newindianexpress.com/nation/2013/mar/14/chinese-hack-drdo-computers-antony-seeks-report-458371.html
Deep Panda
Date: 2013-01-01
Affiliations: Also known as Shell Crew, Web Masters, APT 19, Kung Fu Kittens, Black Vine, Temp.Avengers, and Group 13
Sponsor: China
Type: Espionage
Category: Private sector, Military
Victims: United States

This threat actor compromises high-tech sector companies, the U.S. defense industrial base, nongovernmental organizations, and state and federal government entities for espionage purposes. It is also suspected of being behind the breaches at Anthem, the U.S. Office of Personnel Management, and United Airlines.
Unresponsive computer networks in South Korea
Date: 2013-05-20
Affiliations: Also known as Operation Troy and Dark Seoul
Sponsor: Korea (Democratic People's Republic of)
Type: Denial of service
Category: Private sector
Victims: South Korea

Threat actors compromised the computer networks of South Korean broadcasters and two banks, making them unresponsive.
Compromise of Australian government agencies
Date: 2013-05-27
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: Australian Security Intelligence Organization, Department of the Prime Minister and Cabinet, Department of Defense, Department of Foreign Affairs, and Trade

Threat actors compromised various Australian government ministries for the purposes of espionage. Threat actors allegedly infiltrated blueprints of the Australian Security Intelligence Organization's new headquarters.
PLA Unit 61398
Date: 2013-02-19
Affiliations: Also known as APT 1, Comment Crew, Comment Panda, TG-8223, Group 3, GIF89a, and Byzantine Candor
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: United States, United Kingdom, Switzerland, Taiwan, Singapore, Canada, Israel, India, France, Norway, Belgium, Luxembourg, United Arab Emirates, South Africa, Japan

U.S. cybersecurity firm Mandiant, later purchased by FireEye, released a report in February 2013 that exposed one of China’s cyber espionage units, Unit 61398. The group, which FireEye called APT 1, is a unit within China’s People’s Liberation Army (PLA) that has been linked to a wide range of cyber operations targeting U.S. private sector entities for espionage purposes. The comprehensive report detailed evidence connecting APT 1 and the PLA, offered insight into APT 1’s operational malware and methodologies, and provided timelines of the espionage it conducted.

FireEye termed Unit 61398 “APT 1” to indicate that the threat actor was an Advanced Persistent Threat, a type of operation in which the goal of the network intrusion is not only to gain access to a server or system, but also to retain ongoing access and engage in protracted cyber operations. The APT 1 report exposed the infrastructure of a cyber threat actor and gave both government and nongovernment organizations insight into the escalating nature of state-sponsored cyber operations.
Response: Criminal charges   https://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor
Compromise of unclassified U.S. Navy network
Date: 2013-09-27
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Military
Victims: U.S. Navy

A threat actor compromised an unclassified U.S. Navy computer network for espionage purposes.
Lucky Cat
Date: 2012-03-30
Affiliations: Has links to the Shadow Network and SabPub. Also known as TA413.
Sponsor: China
Type: Espionage
Category: Civil society, Private sector
Victims: India, Japan

A threat actor targets computer networks associated with Tibetan activists, as well as military research and development, aerospace, engineering, and shipping industries in India and Japan.
Compromise of Saudi Aramco and RasGas
Date: 2012-08-16
Affiliations: Believed to have been partially the work of Chrysene
Sponsor: Iran (Islamic Republic of)
Type: Data destruction
Category: Private sector
Victims: Saudia Arabia Aramco Company

In 2012, threat actors wiped data from approximately thirty-five thousand computers belonging to Saudi Aramco, one of the world’s largest oil companies. Malware called Shamoon stole passwords, wiped data, and prevented computers from rebooting. Hackers calling themselves the "Cutting Sword of Justice" claimed responsibility for the incident, asserting they were retaliating against the al-Saud regime for what the group called widespread crimes against humanity. U.S. intelligence sources have attributed the attack to Iran. Less than two weeks after the Aramco incident, the Qatari gas giant RasGas was also knocked offline by suspected state-sponsored  attackers. 

The Saudi Aramco incident signaled Iran’s growing cyber capabilities and Tehran’s willingness to use them to promote its interests, particularly in its battle of influence in the Middle East with Saudi Arabia. At the time, some countries had the capability to remotely destroy computer data, but there were few publicly known instances of a country using them, and Iran may have been responding to a previous attack against the Iranian Oil Ministry and the National Iranian Oil Company that used a malware called Wiper.
Response: Denouncement   http://www.bloomberg.com/news/articles/2012-12-09/saudi-arabia-says-aramco-cyberattack-came-from-foreign-states
Attempted compromise of the BBC Persian TV service
Date: 2012-03-14
Sponsor: Iran (Islamic Republic of)
Type: Denial of service
Category: Private sector
Victims: BBC Persian TV

A threat actor attempted to jam BBC satellite feeds into Iran and launched a series of automated calls to flood the BBC London office. The incident occurred after the BBC announced a spike in viewership of its Persian TV service.
SabPub
Date: 2012-04-16
Affiliations: A variant of Lucky Cat for Mac computers
Sponsor: China
Type: Espionage
Category: Government
Victims: India, United States, United Kingdom, Spain, France

Malware, believed to be linked to Lucky Cat, that facilitates cyber espionage on activists through spear phishing
Flame
Date: 2012-05-28
Affiliations: This tool is believed to be the work of the Equation Group. The tool Gauss is believed to be based on the Flame platform.
Sponsor: United States, Israel
Type: Data destruction
Category: Military, Private sector
Victims: Iran, Israel, Palestine, Sudan, Syria, Lebanon, Saudi Arabia, Egypt, Hungary, Austria, Russia, United Arab Emirates, France

A threat actor, using a tool called Flame, targeted computers in the Middle East region; the most compromises were in Iran. This compromise gained widespread coverage due to the modular nature of the malware the threat actors used.
Madi
Date: 2012-07-17
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: Iran, Israel, United States, Pakistan

This threat actor compromises engineering firms, government entities, and financial and academic institutions in the United States, Israel, Iran, and Pakistan
Denial of service attacks against U.S. banks in 2012–2013
Date: 2012-09-18
Affiliations: Also known as Operation Ababil
Sponsor: Iran (Islamic Republic of)
Type: Denial of service
Category: Private sector
Victims: Bank of America, Citigroup, Wells Fargo, US Bancorp, PNC, Capital One, Fifth Third Bank, BB&T, HSBC

The websites of Bank of America, JPMorgan Chase, Wells Fargo, and other U.S. financial institutions suffered simultaneous outages due to a coordinated denial of service cyberattack in September 2012. Attackers flooded bank servers with junk traffic, preventing users from online banking. An Iranian group called Izz ad-Din al-Qassam Cyber Fighters initially claimed responsibility for the incident. At the time, the media reported that U.S. intelligence believed the denial of service was in response to U.S. imposed economic sanctions to counter Iran’s nuclear program. Seven Iranian individuals linked to the Islamic Revolutionary Guard Corps were eventually indicted by the U.S. Department of Justice in 2016 for their involvement in the incident. 

The denial of service attacks against U.S. banks is significant for two reasons. First, the size and scale of the attacks led the State Department to seek other countries’ assistance in taking down the compromised computers that were flooding the banks with junk traffic. Second, the attacks would indicate that Iran—if it was in fact using the attacks as retaliation for U.S. financial sanctions—was acting proportionally in its dispute with the United States.
Response: Criminal charges   https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged
Gauss
Date: 2012-08-09
Affiliations: Believed to be based on the Flame platform and possibly the work of the Equation Group
Sponsor: United States, Israel
Type: Espionage
Category: Private sector
Victims: Lebanon, Palestine, Israel, United States, Iran, United Arab Emirates, Qatar, Jordan, Germany , Egypt

A threat actor used a tool called Gauss to target the accounts of several Lebanon-based banks, including BlomBank, ByblosBank, Credit Libanais.
Compromise of Coca-Cola
Date: 2012-11-04
Affiliations: Believed to be the work of PLA Unit 61398
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Coca-Cola

A threat actor compromised Coca-Cola’s network coinciding with the company's attempted acquisition of China Huiyuan Juice Group.
Sneaky Panda
Date: 2012-09-14
Affiliations: Possibly assisted in Operation Aurora, the RSA incident, and the Joint Strike Fighter Program compromise
Sponsor: China
Type: Espionage
Category: Private sector, Civil society
Victims: United States, Hong Kong, Taiwan, Canada, Australia, China, United Kingdom, India, Denmark, Switzerland

This threat actor targets private sector companies in the defense, shipping, aeronautics, arms, and energy sectors, as well as nonprofits and financial firms.
ITSecTeam
Date: 2012-09-18
Sponsor: Iran (Islamic Republic of)
Type: Denial of service
Category: Private sector
Victims: Bank of America, Citigroup, Wells Fargo, US Bancorp, PNC, Capital One, Fifth Third Bank, BB&T, HSBC

One of the threat actors responsible for the denial of service attacks against U.S in 2012–2013. Three individuals associated with the group—believed to be have been working on behalf of Iran’s Islamic Revolutionary Guard Corps—were indicted by the Justice Department in 2016.
Response: Criminal charges   https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged
Compromise of Nortel
Date: 2012-02-14
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Nortel Networks

Threat actors compromised the networks of Nortel, a now-defunct telecommunications equipment provider, over an extended period of time for the purposes of espionage.
Syrian Electronic Army
Date: 2011-01-01
Affiliations: Allosh, Syrian Government 
Sponsor: Syrian Arab Republic
Category: Civil society, Private sector, Military, Government
Victims: Syrian Dissidents, Humanitarian Groups, Western Media Outlets, Associated Press, U.S. government websites, Twitter, PayPal, eBay

A loosely organized collective of Syrian government–affiliated threat actors that has targeted a wide range of entities since 2011.
Denial of service incident against a South Korean bank
Date: 2011-04-18
Sponsor: Korea (Democratic People's Republic of)
Type: Denial of service
Category: Private sector
Victims: National Agricultural Cooperative Federation

South Korean prosecutors allege that North Korean intelligence conducted a denial of service campaign against a South Korean bank, causing millions of customers to be unable to use the bank's credit cards and ATMs for more than a week.
Response: Denouncement   http://www.bbc.com/news/world-asia-pacific-13263888
Duqu
Date: 2011-10-26
Affiliations: This is believed be a tool set used by the Equation Group. It is related to Stuxnet and Flame.
Sponsor: Israel
Type: Espionage
Category: Military
Victims: Iran, Sudan

Threat actors, using a tool dubbed Duqu, targeted industrial control systems in certain countries.
Compromise of Oak Ridge National Laboratory
Date: 2011-04-19
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: Oak Ridge National Laboratory

A compromise at the computer network of Oak Ridge National Laboratory led to the exfiltration of approximately one gigabyte of data and the shutdown of the network.
Shady RAT
Date: 2011-08-03
Affiliations: Believed to be a tool used by PLA Unit 61398
Sponsor: China
Type: Espionage
Category: Government, Military
Victims: United States, Canada, South Korea, Taiwan, Japan, Switzerland, United Kingdom, Indonesia, Vietnam, Singapore, Hong Kong, Germany, India, United Nations, International Olympic Committee

A threat actor targeted government entities (primarily in the United States), defense contractors, think tanks, and companies in the advanced information technology and aerospace industries for espionage purposes using a tool called Shady RAT.
Compromise of a Taiwanese political party
Date: 2011-08-09
Sponsor: China
Type: Espionage
Category: Government
Victims: Democratic Progressive Party

A threat actor compromised the computer network of the Democratic Progressive Party (a political party in Taiwan) and exfiltrated data.
Response: Denouncement   http://www.taipeitimes.com/News/front/archives/2011/08/10/2003510374/1
Compromise of certificate issuer DigiNotar
Date: 2011-09-06
Type: Espionage
Category: Government, Private sector
Victims: DigiNotar

DigiNotar was a Dutch issuer of the digital security certificates [PDF] that authenticate the identities of servers on the internet. This authentication process is essential for online transactions; the certificates allow users to trust that the website they reached is the one they intended and not a decoy that could be used for fraud. An unknown threat actor breached DigiNotar’s network in 2011 and stole authentication certificates to masquerade as other online properties. For example, the threat actors used the certificates to pose as Google and spy on approximately three hundred thousand Iranian Gmail accounts. The fallout from the cyberattack caused DigiNotar to file for bankruptcy, as it was no longer considered a reliable provider for digital security certificates. 

DigiNotar was a certificate issuer for the Dutch government at the time, so the compromise jeopardized the information of Dutch citizens. The breach also revealed the previously hidden insecurities of online trust infrastructure, leading to new certificate authentication standards to better ensure the future protection of online consumers.
Compromise at Mitsubishi Heavy Industries
Date: 2011-09-19
Affiliations: Possibly linked to the Nitro incident
Type: Espionage
Category: Private sector
Victims: Mitsubishi Heavy Industries

A threat actor compromised Mitsubishi Heavy Industries, a Japanese defense contractor, targeting shipyards and research and development facilities.
Nitro attacks
Date: 2011-10-31
Affiliations: Possibly linked to the Mitsubishi Heavy Industries incident.
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: United States, Bangladesh, United Kingdom, Argentina, Singapore, China, Taiwan, Germany, Czech Republic, Hong Kong, India, Netherlands, Finland, South Korea, France

A threat actor targeted defense contractors and private companies involved in research and manufacture of chemicals.
Interference with NASA satellite Landsat 7
Date: 2011-11-09
Sponsor: China
Type: Espionage
Category: Government
Victims: NASA

Recurring interference with a joint NASA-U.S. Geological Survey satellite in 2007 and 2008
Compromise of Canadian government departments
Date: 2011-02-16
Sponsor: China
Type: Espionage
Category: Government
Victims: Treasury Board of Canada, Department of Finance, Defense Research and Development Canada

A threat actor compromised the computer networks of multiple government departments, which led the government to shut down internet access at the affected departments for almost two months.
Interference with NASA satellite Terra (EOS AM-1)
Date: 2011-11-09
Sponsor: China
Type: Espionage
Category: Government
Victims: NASA

Recurring interference with a NASA observation satellite
Compromise of RSA SecureID tokens
Date: 2011-03-19
Affiliations: This incident is believed to be the work of Unit 61398 and at least two other Chinese groups, according to the New York Times. The threat actor Sneaky Panda may also have assisted.
Sponsor: China
Type: Espionage
Category: Private sector
Victims: RSA

Threat actors attacked computer security company RSA and compromised millions of SecureID tokens. Linked to the compromise of data from the U.S. F-35 Joint Strike Fighter program at Lockheed Martin.
Compromise of the U.S. Chamber of Commerce
Date: 2011-12-21
Sponsor: China
Type: Espionage
Category: Government
Victims: U.S. Chamber of Commerce

Threat actors compromised the computer networks of the U.S. Chamber of Commerce
Response: Denouncement   http://venturebeat.com/2011/12/21/china-chamber-of-commerce-hack/
Denial of service incident against South Korean and U.S. targets
Date: 2011-04-09
Affiliations: Believed to be the work of the Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Denial of service
Category: Government, Military
Victims: South Korea, U.S. Forces Korea

Dubbed “Ten Days of Rain,” this attack was a ten-day denial of service campaign that targeted websites associated with the South Korean government and U.S. military forces in South Korea.