Maljean/dataset huggingface dataset:
Targeting of nuclear security researcher
Date: 2022-09-13
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: A nuclear security researcher

An expert in nuclear security was targeted as part of an Iranian spear-phishing campaign. The threat actors conversed at length with the target via email before sending a malicious document to the researcher.
Response: Unknown
Targeting of Tibetan organizations
Date: 2021-02-25
Affiliations: Lucky Cat
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Tibetan organizations and the Tibetan diaspora

Chinese APT Lucky Cat has been using a malicious Mozilla Firefox browser extension dubbed FriarFox to infiltrate and control targets’ Gmail accounts. Primary objectives of the actor appear to be espionage and surveillance of dissidents, including the Tibetan diaspora.
RedFoxTrot
Date: 2021-06-16
Affiliations: Also known as PLA Unit 69010.
Sponsor: China
Type: Espionage
Category: Private sector, Government, Military
Victims: Aerospace, mining, research, telecommunications, government, and military organizations in Afghanistan, India, Kazakhstan, Kyrgyzstan, Pakistan, Tajikistan, and Uzbekistan.

RedFoxTrot, a group associated with PLA Unit 69010, ran a long-term cyber espionage campaign since at least 2014 directed primarily toward countries in Central Asia, as well as Afghanistan, India, and Pakistan. The group is believed to operate out of Xinjiang.
Targeting of Indian media organizations
Date: 2021-09-21
Affiliations: TAG-28
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Indian media organizations

A Chinese threat actor was found using phishing attacks to gain access to the systems of several Indian media groups.
Targeting of Uyghur activists, journalists, and dissidents
Date: 2021-03-24
Affiliations: Poison Carp
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Uyghur activists, journalists, and dissidents living in the United States, Australia, Canada, Kazakhstan, Syria, Turkey, and other countries

The Chinese threat actor Evil Eye used fake Facebook profiles and websites that masqueraded as legitimate Turkish and Uyghur news sites to disseminate malicious links to Uyghur activists around the world.
Targeting of Ukrainian naval exercises
Date: 2021-07-09
Affiliations: Russian Federation
Sponsor: Russian Federation
Type: Defacement
Category: Military
Victims: Ukrainian government websites and emails

Russian hackers were accused of defacing the Ukrainian Navy's website and uploading fake documents to spread disinformation about the annual Sea Breeze military exercises.
Response: Confirmation
Targeting of North Korean defectors and South Korean journalists
Date: 2021-11-29
Affiliations: APT37
Type: Espionage
Category: Civil society
Victims: South Korean journalists and North Korean defectors

North Korea conducted a spear-phishing campaign against North Korean defectors and South Korean journalists.
Confucius
Date: 2021-02-11
Sponsor: India
Type: Espionage
Category: Government, Military
Victims: Electoral officials in Kashmir and authorities linked to Pakistan’s nuclear agencies and military

Indian APT believed to have targeted communications of government authorities in Pakistan and Kashmir.
Targeting of Uyghurs in China and Pakistan
Date: 2021-05-27
Affiliations: China
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Uyghurs living in Pakistan and China

Chinese hackers distributed malware pretending to be a UN document on funding for displaced Uyghurs. The hackers impersonated several UN websites for most of 2020 to spread the malware and communicate with infected systems.
Targeting of Israeli entities
Date: 2021-08-10
Affiliations: UNC215
Sponsor: China
Type: Espionage
Category: Government
Victims: Israeli government agencies

As part of a broader espionage campaign spanning multiple countries, Chinese-linked APT UNC215 inserted malware into Israeli government computers to extract data
Targeting of Japanese corporations
Date: 2021-12-28
Affiliations: BlackTech
Sponsor: Japan
Type: Espionage
Category: Private sector
Victims: Japanese defense, media, and telecommunication companies

Japanese corporations were targeted in a spear-phishing campaign launched by a Chinese threat actor. The campaign is likely focused on acquiring trade secrets from targeted companies.
Targeting of the defense industry
Date: 2021-02-25
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Defense firms in more than a dozen countries

North Korean APT Lazarus Group used a custom backdoor dubbed ThreatNeedle to laterally move through infected defense firm networks and gather sensitive information in over a dozen countries. The actor achieved initial entry to victim networks through spear-phishing emails with malicious attachments or links.
Targeting of South Korean nuclear research center
Date: 2021-06-18
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Korean Atomic Energy Research Institute (KAERI)

South Korea's nuclear research center detected an intrusion into its systems in the middle of May 2021, but was able to remove the malicious code from its VPN before it could be executed.
Targeting of Afghan telecommunication firm Roshan
Date: 2021-09-28
Affiliations: RedFoxTrot
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Roshan and other major Afghan telecommunication companies

An email server controlled by the Afghan telecommunication company Roshan was targeted by a Chinese threat actor since at least July 2020. RedFoxTrot was also identified targeting other unnamed Afghan telecommunication companies during the same period.
Targeting of Malwarebytes’ Office 365 tenant
Date: 2021-01-19
Affiliations: Cozy Bear
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Malwarebytes’ employees,

The same threat actor that compromised SolarWinds abused applications with privileged access to Microsoft 365 and Azure environments, granting the actor access to a limited subset of Malwarebytes’ internal emails.
Targeting of U.S. and Israeli medical researchers
Date: 2021-03-30
Affiliations: Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Less than twenty-five senior medical professionals at a variety of institutions in the United States and Israel

The Iranian threat actor Charming Kitten targeted medical researchers in the United States and Israel with spear-phishing techniques. The threat actor used a malicious Gmail account masquerading as a prominent Israeli physicist to trick targets into downloading malware.
Targeting of civil society groups in Nepal, the Philippines, Taiwan, and Hong Kong
Date: 2021-07-09
Affiliations: TAG-22, Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Governments, academics, and research and development institutions across Nepal, the Philippines, Taiwan, and Hong Kong

Chinese state-sponsored hackers were detected infiltrating networks in Nepal, the Philippines, Taiwan, and Hong Kong, with a focus on academic and governmental networks.
Targeting of South Korean company recruiters
Date: 2021-11-30
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Engineers were targeted in the hopes that Lazarus Group would access the systems of South Korean engineering and defense companies.

Hackers from the North Korean Lazarus Group sent malware disguised as job openings at Samsung to engineers. These attacks followed a methodology similar to that of a July 2021 Lazarus Group campaign against engineering firms in South Korea.
Domestic Kitten
Date: 2021-02-08
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Internal dissidents, opposition forces, self-proclaimed Islamic State advocates, and Kurds, among others

Iranian APT believed to be primarily involved in domestic surveillance.
Targeting of U.S. Agency for International Development
Date: 2021-05-27
Affiliations: Nobelium
Sponsor: Russian Federation
Type: Espionage
Category: Government, Civil society
Victims: U.S. Agency for International Development (USAID)

The Russian hacking group Nobelium compromised the company hosting the servers for the U.S. Agency for International Development (USAID) and used its access to send phishing emails to other aid groups.
Response: Confirmation   https://www.cisa.gov/uscert/ncas/alerts/aa21-148a
Targeting of manufacturing groups across Asia
Date: 2021-08-12
Affiliations: Aggah, Gorgon Group
Sponsor: Pakistan
Type: Espionage
Category: Private sector
Victims: Manufacturing companies in Taiwan and South Korea.

The Pakistani-linked APT Aggah launched a spear-phishing campaign in early 2021 that targeted manufacturing firms in Taiwan and South Korea, as well as other countries.
Targeting of various industries through Gmail compromises
Date: 2021-10-07
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society, Government
Victims: More than fourteen thousand Gmail users who work as activists, journalists, or national security professionals.

APT28 was detected conducting a wide-ranging phishing attack against more than fourteen thousand Gmail users who work as activists, journalists, and national security officials.
Targeting of India’s power infrastructure
Date: 2021-02-28
Affiliations: Winnti Umbrella
Sponsor: China
Type: Sabotage
Category: Government
Victims: Ten distinct Indian power-sector organizations

Amid mounting border tensions between China and India in 2020, Chinese threat actors allegedly infected India’s power grid’s control systems with malware.
Targeting of Polish members of parliament's email accounts
Date: 2021-06-18
Affiliations: UNC1151
Sponsor: Belarus
Type: Espionage
Category: Government
Victims: Polish members of parliament

In a campaign known as Ghostwriter, Polish politicians' personal email accounts were targeted by hackers who stole classified documents. The Polish government has said Russia was behind the attack, a claim disputed by Mandiant, which attributes the attack to Belarus.
Calypso
Date: 2021-09-28
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: Roshan, a major Afghan telecommunication company, as well asgovernment agencies in Brazil, Indonesia, Russia, Thailand, and Turkey

Calypso has been observed targeting government agencies worldwide since 2016, including institutions in Brazil, Indonesia, Russia, Thailand, and Turkey. The group was also implicated in a breach of Afghan telecommunication company Roshan.
Targeting of security researchers with malware
Date: 2021-01-25
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector, Civil society
Victims: Cybersecurity research community

North Korean hackers used spear-phishing social media techniques to target security researchers to install malware onto targets’ Windows systems.
Targeting of the Vietnamese and Thai governments and military
Date: 2021-04-05
Affiliations: Emissary Panda
Sponsor: China
Type: Espionage
Category: Government, Military, Civil society
Victims: Vietnamese government, military, and civil society institutions along with comparable institutions in Thailand

APT 27 conducted a wide-ranging espionage campaign to gather data from a variety of institutions throughout Southeast Asia, primarily concentrated in Vietnam.
Targeting of academics focusing on the Middle East
Date: 2021-07-13
Affiliations: TA453, Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Private sector
Victims: Researchers in the United Kingdom focused on the Middle East

Charming Kitten was found using spear-phishing attacks against UK experts who study the Middle East. The attacks involved impersonating scholars from the University of London's School of Oriental and African Studies and prompted the victims to either turn over sensitive information or download malware onto their systems.
Targeting of Afghan government and military
Date: 2021-12-22
Affiliations: APT 36
Sponsor: Pakistan
Type: Espionage
Category: Government, Military
Victims: Afghan government and military officials

A Pakistani threat actor launched a series of spear-phishing attacks against the Afghan government. The attackers stole personal information from high-level diplomats and military officials, including names, email addresses, and diplomatic visa forms.
Targeting of domestic citizens in Iran
Date: 2021-02-08
Affiliations: Domestic Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Internal dissidents, opposition forces, self-proclaimed Islamic State advocates, and Kurds, among others

Iranian APT Domestic Kitten used spyware FurBall to surveil domestic citizens and anyone considered a threat to Tehran. Campaigns have been ongoing since 2017, with the latest launched in November 2020.
Targeting of South Korean government
Date: 2021-06-01
Affiliations: Kimsuky
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Government
Victims: South Korean Ministry of Trade, Industry, and Energy; South Korean Ministry of Foreign Affairs; Consulate of South Korea in Hong Kong; and the Embassy of Sri Lanka in Seoul

The South Korean government was targeted in a wide-ranging attack by North Korean threat actors. The attacks installed the AppleSeed backdoor, which was used to exfiltrate information.
Targeting of Air India
Date: 2021-08-12
Affiliations: APT 41, Barium, TA415
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Air India

While investigating a breach of Air India's data systems, cybersecurity researchers stumbled on a previously undetected intrusion into Air India's systems likely carried out by Chinese threat actors.
Targeting of South Korean think tank
Date: 2021-10-26
Affiliations: Lazarus Group 
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: A Latvian technology company and a South Korean think tank

Using an unusual route to gain access to civil society and government groups, North Korean hackers accessed the servers of a South Korean think tank by compromising a Latvian company providing third-party services.
Targeting of organizations via Microsoft Exchange Server vulnerability
Date: 2021-03-02
Affiliations: Hafnium
Sponsor: China
Type: Espionage
Category: Civil society, Private sector, Government
Victims: Various industry sectors, including state and local governments, universities, defense contractors, law firms, medical researchers, think tanks, and others

The Chinese threat actor Hafnium exploited vulnerabilities in the Microsoft Exchange Server to access the emails of hundreds of thousands of entities across the globe.
Targeting of Norwegian government's IT network
Date: 2021-06-19
Affiliations: APT 31, Hurricane Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: Norwegian government and its IT system

An investigation by the Norwegian Police Security Service (PST) found that a 2018 breach of the government's IT systems was carried out by a Chinese threat actor. The hackers removed large amounts of data in the breach, although the PST is still unsure of exactly how much data or what files were taken
Targeting of Afghan telecommunication firm Roshan
Date: 2021-09-28
Affiliations: Calypso
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Roshan, a major Afghan telecommunication company

An email server controlled by the Afghan telecommunication company Roshan was targeted by a Chinese threat actor since at least early 2021. Calypso’s data exfiltration activity spiked in August and September 2021, coinciding with the United States military’s withdrawal from Afghanistan.
Take down of EMOTET botnet
Date: 2021-01-27
Affiliations: Law enforcement agencies in the United States, Canada, France, Germany, Lithuania, the Netherlands, Ukraine, and United Kingdom
Sponsor: United States, Canada, France, Germany, Lithuania, Netherlands, Ukraine, United Kingdom
Type: Sabotage
Category: Civil society
Victims: EMOTET cybercriminal group

An international coalition of law enforcement authorities successfully took down notorious criminal botnet EMOTET by taking control of its command-and-control servers.
Targeting of South African freight companies
Date: 2021-04-08
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: South African shipping companies

Vyveva, a known Lazarus Group malware tool, was spotted in the systems of South African shipping companies. The malware appears designed to facilitate file transfers.
Targeting of Philippine and Nepalese governments
Date: 2021-07-14
Affiliations: HoneyMyte, Mustang Panda, Bronze President
Sponsor: China
Type: Espionage
Category: Government
Victims: Government agencies in Myanmar, Nepal, and the Philippines

Kaspersky Labs detected a high-volume campaign in Southeast Asia primarily aimed at government agencies in Myanmar, Nepal, and the Philippines. The attackers used a compromised version of the popular video conference application Zoom to break into computers.
Targeting of Pfizer vaccine data
Date: 2021-02-16
Affiliations: North Korean government
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: Pfizer

South Korean lawmaker Ha Tae-keung told reporters that North Korean hackers attempted to steal COVID-19 vaccine data from U.S. pharmaceutical company Pfizer. It is unclear whether the alleged operation was successful.
Targeting of Myanmar's presidential website
Date: 2021-06-02
Affiliations: Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Government, Civil society
Victims: Visitors to Myanmar's presidential webpage

The Chinese hacking group Red Echo inserted malicious code into a download link on the webpage for Myanmar's president. This marks the second time Myanmar’s presidential website has been used in watering-hole attacks by Chinese hackers.
Targeting of Slovakian government agencies
Date: 2021-08-13
Affiliations: Nobelium, APT 29
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Slovakian diplomats

Nobelium launched spear-phishing attacks against Slovakian diplomats by posing as the Slovak National Security Authority.
Emennet Pasargad
Date: 2021-11-18
Affiliations: Believed to be the work of the Iranian government. Also known as Holy Souls and Neptunium.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society, Government
Victims: Organizations related to the U.S. electoral process and news outlets.

An Iranian company hired by the Iranian government to interfere in U.S. elections. Emennet Pasargad has attacked voting-related websites and news outlets and distributed misinformation designed to undermine confidence in the U.S. electoral system. 
Response: Sanctions   https://home.treasury.gov/news/press-releases/jy0494
Hafnium
Date: 2021-03-02
Sponsor: China
Type: Espionage
Category: Civil society, Private sector, Government
Victims: Various industry sectors, including state and local governments, universities, defense contractors, law firms, medical researchers, think tanks, and others

The Chinese APT believed to be behind the exploitation of vulnerabilities in the Microsoft Exchange email server to access user emails. Historically, Hafnium has primarily targeted entities in the United States.
Targeting of government and energy organizations in India and Afghanistan
Date: 2021-06-22
Affiliations: Pakistan
Sponsor: Pakistan
Type: Espionage
Category: Government, Private sector
Victims: Indian government agencies and energy providers

Pakistani threat actors compromised Indian government organizations and energy suppliers with open-source remote access Trojan horses.
Targeting of South Korean companies with ransomware
Date: 2021-06-15
Affiliations: Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Private sector
Victims: South Korean corporations

North Korean hackers launched ransomware attacks on South Korean businesses. The malware used is an old incarnation of Lazarus Group’s espionage tools with added ransomware functionality.
Disruption of NetWalker ransomware
Date: 2021-01-27
Affiliations: Federal Bureau of Investigation, Bulgarian National Investigative Service
Sponsor: United States, Bulgaria
Type: Sabotage
Category: Civil society
Victims: Cybercriminals behind NetWalker ransomware

U.S. and Bulgarian authorities disrupted the NetWalker ransomware in a coordinated effort that disabled dark web resources and led to the arrest of a Canadian citizen and the seizure of approximately $500,000 in cryptocurrency delivered by victims as ransomware payments.
Targeting of Lebanese job seekers
Date: 2021-04-08
Affiliations: APT 34, OilRig
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: Job seekers in Lebanon

Lebanese job seekers were sent a compromised pdf document claiming to be an offer from an American IT firm. The exact targets of this phishing campaign remain unclear.
Targeting of U.S. defense industry using Facebook
Date: 2021-07-15
Affiliations: Tortoiseshell,  Charming Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Military
Victims: Individuals in the defense industry in the United States and United Kingdom

Iran was accused of attempting to break into the personal accounts of over two hundred senior defense personnel in the United States and United Kingdom. The individuals were targeted in phishing attacks.
Targeting of French public organizations
Date: 2021-12-07
Affiliations: The Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: French civil society organizations with significant foreign ties.

Nobelium, a Russian threat actor, is believed to have compromised the servers of several French organizations as early as February 2021 to launch spear-phishing attacks against foreign organizations.
Targeting of French IT monitoring company
Date: 2021-02-15
Affiliations: Sandworm
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Fifteen entities, including France’s Ministry of Justice, that used Centreon’s outdated, open-source services

Russian APT Sandworm used two different malware strains to hack the IT monitoring software of French cybersecurity firm Centreon. The hacking campaign lasted from 2017 to 2020 and only affected entities using the open-source version of Centreon’s software.
Targeting of Southeast Asian ministry of foreign affairs
Date: 2021-06-03
Affiliations: Sharp Panda
Sponsor: China
Type: Espionage
Category: Government
Victims: A South Asian foreign ministry

A South Asian government was targeted as part of a long-running cyber espionage campaign carried out by a Chinese threat actor. The campaign used spear phishing to drop malware onto the government's systems.
Watering-hole attack on popular North Korean news site
Date: 2021-08-18
Affiliations: APT 37, ScarCruft, Stardust Chollima
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Civil society
Victims: Visitors to the Daily NK website

North Korea launched watering-hole attacks from popular anti-North Korea website the Daily NK.
Targeting of U.S. newspaper chain
Date: 2021-11-18
Affiliations: Emennet Pasargad 
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Civil society
Victims: A U.S. newspaper owned by Lee Enterprises.

Iranian hackers are accused of compromising a major U.S. newspaper before the 2020 election. 
Response: Sanctions   https://home.treasury.gov/news/press-releases/jy0494
Targeting of Indian vaccine makers
Date: 2021-03-01
Affiliations: APT 10
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Indian vaccine makers Bharat Biotech and the Serum Institute of India

APT 10 targeted Indian vaccine makers Bharat Biotech and the Serum Institute of India for espionage purposes.