Maljean/dataset huggingface dataset:
Watering-hole attacks targeting Armenian government websites
Date: 2020-03-12
Affiliations: Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government, Civil society
Victims: Likely Armenian government officials

The Russian threat actor Turla compromised four Armenian websites, two belonging to the government and two closely related, to use in a strategic web compromise/watering-hole attack.
Targeting of companies in Central Asia
Date: 2020-05-14
Affiliations: Vicious Panda
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: Central Asian Businesses

A group using tools similar to Chinese government–affiliated group Vicious Panda targeted high-profile companies in Central Asia and planting backdoors to gain access to corporate networks. The group is also believed to be behind cyberattacks in Belarus, Mongolia, and Russia.
Targeting of U.S. defense contractors
Date: 2020-08-19
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: U.S. defense contractors

North Korean hackers used fake job postings from leading U.S. defense contractors on LinkedIn to install malicious data-gathering software when clicked.
Cerium
Date: 2020-11-13
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Pharmaceutical companies and vaccine researchers in the United States, Canada, France, India, and South Korea

Hackers posing as World Health Organization officials in spear-phishing emails to steal credentials belonging to individuals involved in vaccine development.
Targeting of the Mongolian government using coronavirus-related lures
Date: 2020-03-12
Affiliations: Vicious Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Government of Mongolia

The suspected Chinese threat actor Vicious Panda conducted a coronavirus-related phishing campaign against targets in the Mongolian government.
Targeting of German critical infrastructure owners
Date: 2020-05-26
Affiliations: Crouching Yeti
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: German critical infrastructure

Hackers used supply chain vulnerabilities to access German critical infrastructure companies’ information technology (IT) systems.
Response: Confirmation   https://www.cyberscoop.com/german-intelligence-memo-berserk-bear-critical-infrastructure/
Penetration of unnamed U.S. federal agency
Date: 2020-09-24
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: U.S. government

Russian hackers used compromised credentials to install malware and ultimately steal files from unnamed U.S. government agency computers.
Response: Confirmation   https://us-cert.cisa.gov/ncas/analysis-reports/ar20-268a
Targeting of South Korean supply chains using stolen security certificates
Date: 2020-11-16
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: South Korean visitors to government and banking websites

The North Korean threat actor Lazarus Group targeted South Korean users of WIZVERA VeraPort software, commonly used by South Korean banking and government websites, by compromising websites with VeraPort support. Using stolen security certificates, hackers installed malware onto victims’ devices when they visited the compromised websites.
Wide-ranging attacks on government organizations and companies across the Middle East and Europe
Date: 2020-01-27
Affiliations: Government of Turkey
Sponsor: Turkey
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Government organizations and companies across the Middle East and Europe

The Turkish hackers attacked at least thirty organizations across the Middle East and Europe, including Cypriot and Greek government email services and the Iraqi government’s national security advisor. Their methods include intercepting internet traffic to victim websites.
Targeting of Wuhan government and China’s Ministry of Emergency Management
Date: 2020-04-22
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Government
Victims: Wuhan government, Chinese Ministry of Emergency Management

Vietnamese hackers sent spear-phishing messages to the Wuhan government and China’s Ministry of Emergency Management.
Targeting of websites in Latvia, Lithuania, and Poland
Date: 2020-07-29
Affiliations: Ghostwriter
Sponsor: Russian Federation
Type: Defacement
Category: Private sector
Victims: Latvia, Lithuania, Poland

Hackers targeted websites and email accounts in Latvia, Lithuania, and Poland to publish fabricated documents pushing anti–North Atlantic Treaty Organization (NATO) narratives consistent with Kremlin talking points.
Targeting of Tokyo Olympics organizers, logistics services, and sponsors
Date: 2020-10-19
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Tokyo Olympics organizers, logistics services, and sponsors

The Russian threat group Sandworm targeted Tokyo Olympics organizers, logistics services, and sponsors through cyber reconnaissance operations.
Targeting of U.S. and European think tanks
Date: 2019-01-31
Affiliations: Believed to be the work of Fancy Bear.
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Center for Strategic and International Studies, German Council on Foreign Relations, The Aspen Institutes in Europe, The German Marshall Fund

Hackers set up fake login pages or sent spoof e-mails to people who work with the think tanks in an attempt to trick them into handing over information, such as passwords.
Autumn Aperture—use of malicious websites to target foreign ministries and other entities
Date: 2019-08-22
Affiliations: Believed to be the work of Kimusky, also known as Thallium and Smoke Screen.
Sponsor: Korea (Democratic People's Republic of)
Category: Government, Private sector
Victims: French Ministry for Europe and European Affairs, Ministry of Foreign and European Affairs of the Slovak Republic, Stanford University, Sina, Foreign ministry of the South African government

A threat actor targeted a number of foreign ministries, a Chinese technology company, Stanford University, think tanks in the United States and the United Kingdom, and other entities that have focused on North Korea's nuclear efforts or the related international sanctions. The threat actor created a network of malicious websites imitating the login portals of targets. This incident is believed to be an extension of the 2018 BabyShark campaign.
Targeting of U.S. manufacturing group
Date: 2019-11-13
Affiliations: Government of China
Sponsor: China
Type: Espionage
Category: Civil society
Victims: National Association of Manufacturers

Chinese government hackers attacked the National Association of Manufacturers to steal information that might be useful in U.S.-China trade negotiations.
Attack on Iranian computer systems
Date: 2019-06-22
Affiliations: U.S. Cyber Command
Sponsor: United States
Type: Sabotage
Category: Military
Victims: Iranian rocket and missile launch systems

U.S. Cyber Command hacked Iranian rocket and missile launch systems in retaliation for the downing of a U.S. drone and attacks on oil tankers in the Strait of Hormuz. Iranian officials said the attack was not successful.
Response: Denouncement   https://www.reuters.com/article/us-mideast-iran-usa-cyber-idUSKCN1TP0B1?utm_campaign=trueAnthem%3A%20Trending%20Content&amp;utm_content=5d10beeeb35fc8000145c351&amp;utm_medium=trueAnthem&amp;utm_source=twitter
Targeting of Czech Foreign Ministry
Date: 2019-08-31
Affiliations: Russian military intelligence agency, known as GRU
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Foreign Ministry of the Czech Republic

A threat actor launched a persistent campaign against the Foreign Ministry of the Czech Republic that lasted several months. This campaign follows previous attacks on the Czech Foreign Ministry in 2018 and 2017.
Attacks in East and Southeast Asia
Date: 2019-10-03
Affiliations: PKplug
Sponsor: China
Type: Espionage

Chinese government threat actor PKplug targeted organizations in East and Southeast Asia.
Targeting of U.S. utility companies
Date: 2019-08-01
Affiliations: Unnamed state-sponsored APT
Type: Espionage
Category: Private sector
Victims: United States

Between July 19 and July 25, 2019, a threat actor sent several spear-phishing emails to three U.S. companies in the utility sector. The emails were sent from a domain impersonating that of the National Council of Examiners for Engineering and Surveying, an authority in the industry. The emails contained Microsoft Word attachments that used macros to install and run a new remote-access Trojan (RAT) called LookBack.
Golden Falcon
Date: 2019-11-23
Affiliations: Also known as DustSquad, Russian-speaking but may be Kazakh.

Threat actor that has targeted Kazakh government officials and private individuals, along with some Chinese individuals.
Targeting of Visma
Date: 2019-02-06
Affiliations: Believed to be the work of APT 10.
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Visma

Hackers used malware from the dark web to target a Norwegian internet service provider. The goal of the attack was to gain access to customers’ intellectual property, strategic plans, and emails.
Autumn Aperture—malware embedded in antiquated file types
Date: 2019-09-11
Affiliations: Believed to be the work of Kimusky, also known as Thallium and Smoke Screen.
Sponsor: Korea (Democratic People's Republic of)
Category: Private sector
Victims: Unnamed U.S.-based entities

A threat actor targeted U.S.-based entities by emailing them malware-laced Microsoft Word documents written by industry experts. The trojanized documents discussed nuclear deterrence, North Korea's nuclear submarine program, and economic sanctions on the North Korean regime. This incident is believed to be an extension of the August Autumn Aperture campaign.
Targeting of Indian space agency
Date: 2019-11-07
Affiliations: The Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: Indian Space Research Organization

North Korean hackers attacked the Indian Space Research Organization as part of a broader assault on India’s government agencies.
Compromise of Yandex
Date: 2019-06-27
Affiliations: Five Eyes
Sponsor: United States, Australia, Canada, New Zealand, United Kingdom
Type: Espionage
Category: Private sector
Victims: Yandex

This threat actor deployed Regin, a rare type of malware, in an attempt to spy on user accounts for Yandex, a Russian search engine and email provider.
Response: Confirmation   https://www.reuters.com/article/us-usa-cyber-yandex-exclusive/exclusive-western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-sources-idUSKCN1TS2SX
Targeting of telecommunications operators in countries through which Uighurs are known to travel
Date: 2019-09-05
Affiliations: Believed to be the work of Chinese state-sponsored hackers.
Sponsor: China
Type: Espionage
Category: Civil society

Multiple threat actors compromised telecoms networks across Central and Southeast Asia. The attacks were part of a wider cyber-espionage campaign targeting diplomats and state officials, and they signal China's ability and intent to track the movements of Uighurs along a number of transit routes that they use to escape state persecution.
Attack on U.S. presidential campaign government officials, journalists, and prominent expatriate Iranians
Date: 2019-10-04
Affiliations: Phosphorus
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Government
Victims: A U.S. presidential campaign, government officials, journalists, and prominent expatriate Iranians

Iranian threat actor Phosphorus attacked 241 email accounts associated with a U.S. presidential campaign government officials, and journalists, and prominent expatriate Iranians.
Targeting of Internet of Things (IoT) devices used by Microsoft customers
Date: 2019-08-05
Affiliations: Believed to be the work of Strontium, also known as APT 28 and Fancy Bear.
Sponsor: Russian Federation
Category: Private sector

The threat actor exploited office devices’ weak, outdated security to access the networks of several Microsoft customers and infiltrate accounts with more privileges.
Targeting of Ukrainian government entities
Date: 2019-11-25
Affiliations: Gamaredon
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukrainian government entities

Gamaredon, a Russian-speaking APT, targeted Ukrainian government entities from September to November 2019.
U.S. Cyber Command offensive attack of Russian troll farm
Date: 2019-02-27
Affiliations: U.S. Cyber Command
Sponsor: United States
Type: Denial of service
Category: Government
Victims: Russia

In November 2018, the U.S. Cyber Command launched an offensive campaign to combat a Russian troll operation known for using disinformation tactics.
Targeting of Egyptian dissidents
Date: 2019-10-03
Affiliations: Government of Egypt
Sponsor: Egypt
Type: Espionage
Category: Civil society
Victims: Egyptian journalists, academics, lawyers, opposition politicians, and human rights activists

The Egyptian government installed mobile apps on targets’ phones to extract files, track their locations, and identify contacts.
Attacks on private U.S. companies
Date: 2019-06-22
Affiliations: Iran
Sponsor: Iran (Islamic Republic of)
Type: Data destruction
Category: Private sector
Victims: U.S. private sector

This threat actor increased malicious activity targeting U.S. companies following a U.S. attack on Iranian computer systems.
Response: Confirmation   https://www.dhs.gov/cisa/news/2019/06/22/cisa-statement-iranian-cybersecurity-threats
Targeting of the Cambodian government
Date: 2019-12-07
Affiliations: Rancor
Sponsor: China
Type: Espionage
Category: Government
Victims: Cambodian government

The China-linked threat actor group Rancor targeted unnamed Cambodian government entities.
Targeting of Russian speakers
Date: 2019-10-10
Affiliations: Unknown
Type: Espionage
Category: Government
Victims: Russian speakers, as well as diplomatic and government institutions in Eastern Europe

ESET researchers discovered a new malware called Attor that has been used to target only a few dozen victims since 2013. The victims include diplomatic and government institutions and the malware is designed to steal encryption information from certain applications.
APT 41
Date: 2019-08-07
Affiliations: Also known as Earth Longzhi.
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: United States, France, Japan, Singapore, United Kingdom, Hong Kong

This threat actor has, since 2014, conducted operations backed by the Chinese government, including targeting the health-care and high-tech sectors and conducting espionage against political dissidents. It has simultaneously conducted its own for-profit illicit activity in the video games industry, amassing millions of dollars in digital currency to be sold to gamers on the black market. The threat actor operates outside of state control but is linked to other Chinese APT malware actors and tools on a part-time or contractual basis, or is a full-time, state-sponsored APT actor that simultaneously conducts nonstate campaigns for supplemental income. This threat actor is a notable example of the blurring lines between state-sponsored and commercial cyber criminals.
Targeting of BMW and Hyundai
Date: 2019-12-06
Affiliations: Ocean Lotus
Sponsor: Vietnam
Type: Espionage
Category: Private sector
Victims: BMW and Hyundai

Ocean Lotus (aka APT 32), a threat actor aligned with the Vietnamese government, attacked BMW and Hyundai in an attempt to steal automotive trade secrets.
Targeting of universities' maritime military secrets
Date: 2019-03-05
Affiliations: Believed to be the work of Leviathan.
Sponsor: China
Type: Espionage
Category: Civil society, Private sector
Victims: University of Hawaii, University of Washington, Massachusetts Institute of Technology , Pennsylvania State University, Duke University

Chinese hackers targeted twenty-seven universities in the United States, Canada, and Southeast Asia as part of a scheme to steal research about maritime technology under development for military use.
Targeting of a U.S. presidential campaign
Date: 2019-10-04
Affiliations: Believed to be the work of Phosphoros, also known as APT 35
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: An unnamed U.S. presidential campaign

A threat actor targeted the email accounts of an unnamed U.S. presidential campaign, current and former U.S. officials and journalists, and others. During a thirty-day period in August and September, Microsoft observed more than 2,700 attempts to identify the emails of specific customers and 241 hacks.  Four accounts were compromised, though not those connected to the presidential campaign or the officials. A threat actor linked to the Iranian government unsuccessfully attempted to break into President Donald J. Trump's reelection campaign, according to sources familiar with the incident.
Targeting of Uzbek dissidents
Date: 2019-10-31
Affiliations: Government of Uzbkeistan
Sponsor: Uzbekistan
Type: Espionage
Category: Civil society
Victims: Uzbek activists and dissidents

Unit 02616 of Uzbekistan’s National Security Service used FinFisher, a German spyware, to attack dissidents.
Targeting of U.S. government and private entities and other victims
Date: 2019-11-13
Affiliations: APT 33
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: U.S. government,

The Iran-aligned espionage group APT 33 used botnets to launch a campaign against a small number of victims in the public and private sectors in the United States, Asia, and the Middle East.
Targeting of Internet Research Agency
Date: 2019-02-26
Affiliations: U.S. Cyber Command
Sponsor: United States of America
Type: Sabotage
Category: Private sector
Victims: Russia

U.S. Cyber Command conducted operations to disable online activities of the Internet Research Agency (IRA), a Russia-based company closely affiliated to the Russian government that conducts information operations. The operation was meant to prevent the IRA from interfering in the 2018 U.S. midterm elections.
Compromise of Bahraini government agencies and critical infrastructure
Date: 2019-08-07
Sponsor: Iran (Islamic Republic of)
Type: Sabotage
Category: Government, Private sector
Victims: Bahrain

A threat actor broke into the systems of Bahrain's National Security Agency, Ministry of Interior, and office of the first deputy prime minister. On July 25, 2019, Bahraini authorities detected intrusions into its electric and water authority that shut down several systems. The attacks were similar to two hacks in 2012, in which the Shamoon virus was used to knock Qatar's natural gas firm RasGas offline and wipe data from the hard drives at Saudi Aramco, Saudi Arabia's national oil company.
Targeting of telecom companies across Africa, Europe, and Southeast Asia
Date: 2019-12-12
Affiliations: Gallium
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Telecom companies in Africa, Europe, and Southeast Asia

Gallium, an allegedly China-aligned threat actor, attacked telecom companies across the globe for several months.
Whitefly
Date: 2019-03-06
Affiliations: Believed to be behind the Singapore health-care breach in July 2018.
Category: Government, Private sector
Victims: Singapore, Russia, United Kingdom

This threat actor has been active since mid-2017, targeting mainly health-care, media, telecommunications, and engineering organizations in Singapore, in addition to multinational companies with a presence in the country. The group has also targeted defense, telecommunications, and energy companies in Russia, the United Kingdom, and Southeast Asia. The group relies on a combination of custom malware, open-source hacking tools, and legitimate applications to achieve its goals.
U.S. retaliation against Iran
Date: 2019-10-16
Affiliations: Government of the United States
Sponsor: United States
Type: Data destruction
Category: Government
Victims: Iran

The United States carried out a cyberattack against Iran designed to limit Tehran’s ability to spread propaganda in retaliation for the September 14attacks on Saudi oil facilities.
Attack of  Japanese companies with links to China
Date: 2019-11-29
Affiliations: Bronze Butler
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japanese organizations with subsidiaries in China

China-linked espionage group Bronze Butler targeted companies with head offices in Japan and subsidiaries in China to try to steal highly classified information.
Targeting of Moroccan activists
Date: 2019-10-10
Affiliations: Government of Morocco
Sponsor: Morocco
Type: Espionage
Category: Civil society
Victims: Maati Monjib, an academic and activist, and Abdessadak El Bouchattaoui, a human rights lawyer

Amnesty International released a report showing how Morocco’s government used the NSO Group’s Pegasus malware to target two human rights activists in Morocco.
Targeting of secure messaging app used by Hong Kong protesters
Date: 2019-06-13
Affiliations: Hong Kong police
Sponsor: Hong Kong
Type: Espionage
Category: Civil society
Victims: Hong Kong

Hong Kong authorities used a network of Chinese computers to track protesters' organizing activity on Telegram, a secure messaging app.
Gallium
Date: 2019-12-12
Sponsor: China

Gallium is a possibly China-linked threat actor that has carried out attacks against telecom companies across the globe.
2019 Indonesian elections
Date: 2019-03-12
Affiliations: Believed to be the work of Russian and Chinese hackers.
Sponsor: China, Russian Federation
Type: Espionage
Category: Government
Victims: Indonesia

Senior Indonesian election officials accused Chinese and Russian hackers of manipulating and modifying Indonesia's voter data base to disrupt the presidential elections.
Compromise of Airbus suppliers
Date: 2019-09-26
Affiliations: Believed to be the work of APT 10 or the Jiangsu Province Ministry of State Security.
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Airbus

A threat actor targeted virtual private networks (VPNs) used by suppliers of European aerospace company Airbus with a series of attacks. The attacks resulted in unauthorized access to data, including the theft of documents related to Airbus's military transport plane A400M, designed with one of the most powerful propeller engines in the world.
Targeting of European ministries
Date: 2019-10-17
Affiliations: the Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ministries of foreign affairs of three European countries and an EU country embassy in the United States

Believed to have gone dark, Russian threat actor the Dukes targeted the ministries of foreign affairs of three European countries and a European Union (EU) country embassy in the United States with malware.
Targeting of the Australian Parliament, including the Liberal, National, and Labor Parties
Date: 2019-08-15
Affiliations: China’s Ministry of State Security
Sponsor: China
Type: Espionage

A threat actor targeted the computer network of the Parliament of Australia. The hackers breached the Parliament's network and the networks of the three largest political parties.
Targeting of South Korean macOS users
Date: 2019-11-20
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Victims: South Korean macOS users

The North Korean threat actor Lazarus Group targeted South Korean macOS users with a new malware variant.