Maljean/dataset huggingface dataset:
Stealth Mango and Tangelo
Date: 2018-05-15
Sponsor: Pakistan
Type: Espionage
Category: Government, Civil society
Victims: Pakistan, Afghanistan, India, Iraq, United Arab Emirates, United States, Australia, Germany

This threat actor, which consists of Stealth Mango (Android) and Tangelo (iOS), targets government officials, diplomats, military personnel, and activists in primarily Afghanistan, India, Iraq, Pakistan, and the United Arab Emirates for espionage.
Raspite
Date: 2018-08-02
Type: Espionage
Category: Private sector
Victims: United States

This threat actor targets entities that operate industrial control systems in the electric utility sector.
Attempt to compromise Ukraine's judicial system
Date: 2018-12-04
Affiliations: Believed to be the work of a Russian hacking group.
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Ukraine

Ukraine’s security agency thwarted an attack attempting to target the country’s court system.
Bad Rabbit
Date: 2017-10-24
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Sabotage
Category: Government
Victims: Ukraine, Japan, Russia, Bulgaria, Turkey

Using a tool called Bad Rabbit, a threat actor launched a ransomware operation that encrypted data on networks in Bulgaria, Japan, Russia, Turkey, and Ukraine. The operation is believed to have disrupted the Kiev metro system's payment network and delayed flights at Odessa's airport. In October 2018, the United Kingdom attributed this incident to Russian military intelligence.
Targeting of a Swiss federal agency
Date: 2017-09-15
Affiliations: Believed to be the work of Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Switzerland

A threat actor targeted servers controlled by the Swiss Federal Department of Defense, Civil Protection, and Sports.
Response: Denouncement   https://www.admin.ch/gov/en/start/documentation/media-releases.msg-id-68135.html
Targeting of certain individuals in Panama
Date: 2017-06-20
Sponsor: Panama
Type: Espionage
Category: Civil society, Private sector
Victims: Panama

A threat actor targeted individuals who were political critics and business rivals of Ricardo Martinelli, president of Panama between 2009 and 2014, for espionage purposes. The threat actor uses the Pegasus tool, created by the NSO Group.
Compromise of cryptocurrency exchanges in South Korea
Date: 2017-09-11
Affiliations: Believed to be the work of a subset of the Lazarus Group known as Bluenoroff
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Cryptocurrency exchanges in South Korea

A threat actor targeted cryptocurrency exchanges in South Korea for the purpose of raising money.
Compromise of email accounts of a UK TV station
Date: 2017-03-30
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Islam Channel

A threat actor compromised Islam Channel, a small UK TV station, in July 2015. In October 2018, the United Kingdom publicly attributed the compromise to Russian military intelligence.
Response: Denouncement   https://www.ncsc.gov.uk/news/reckless-campaign-cyber-attacks-russian-military-intelligence-service-exposed
MuddyWater
Date: 2017-11-14
Affiliations: Also known as TEMP.Zagros, Seedworm and Static Kitten. 
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: Saudi Arabia, Iraq, United Arab Emirates, Georgia, Israel, Pakistan, Turkey, India, United States

This threat actor targets governments, primarily in the Middle East and South Asia, for espionage purposes.
Compromise of the International Association of Athletics Federations
Date: 2017-04-03
Affiliations: Believed to be the work of APT 28. 
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: International Association of Athletics Federations

A threat actor compromises the networks of the International Association of Athletics Federations with the purpose of obtaining the medical records of athletes. In October 2018, the United States indicted seven alleged Russian military intelligence officials involved in the incident.
Response: Denouncement   http://www.reuters.com/article/us-sport-doping-iaaf-idUSKBN1750ZM
Greenbug
Date: 2017-01-23
Sponsor: Iran (Islamic Republic of)
Victims: South Asian telecommunication providers, Middle Eastern government, aviation, education, and investment organizations

Greenbug is believed to be an Iranian threat actor with ties to the group behind the Shamoon malware. It has previously used off-the-shelf tools and living-off-the-land techniques to gain access to South Asian telecommunication companies’ servers. It has also used custom remote access trojans (RAT) to steal information and credentials from Middle Eastern targets.
Compromise of Far Eastern International Bank
Date: 2017-10-07
Affiliations: Believed to be the work of the Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Private sector
Victims: Far Eastern International Bank

A threat actor compromised the networks of Far Eastern International Bank in Taiwan, allowing them to transfer US$60 million to accounts based in the United States, Cambodia, and Sri Lanka using the SWIFT network.
APT 40
Date: 2017-10-16
Affiliations: Also known as TEMP.Periscope, Leviathan, and Mudcarp. Believed to be behind the compromise of Cambodia’s election organizations and the Target of universities' maritime military secrets.
Sponsor: China
Type: Espionage
Category: Government, Private sector
Victims: United States, The Philippines, Asia Pacific Economic Cooperation, Hong Kong, Malaysia

This threat actor targets defense contractors, law firms, engineering firms, shipping companies, and government agencies with responsibilities or business in the maritime industry.
NotPetya
Date: 2017-07-01
Affiliations: Possibly linked to Sandworm.
Sponsor: Russian Federation
Type: Data destruction
Category: Government, Private sector
Victims: Rosneft, WPP Plc., Maersk, Cie de Saint-Gobain, SNCF, Merck, Mondelez, Port of Rosario, Kyivenergo, The government of Ukraine

Threat actors deploy a tool, called NotPetya, with the purpose of encrypting data on victims' machines and rendering it unusable. The malware was spread through tax software that companies and individuals require for filing taxes in Ukraine. Australia, Estonia, Denmark, Lithuania, Ukraine, the United Kingdom, and the United States issued statements attributing NotPetya to Russian state-sponsored actors. In June 2018, the United States sanctioned Russian organizations believed to have assisted the Russian state-sponsored actors with the operation. 
Response: Denouncement   https://ssu.gov.ua/en/news/1/category/2/view/3660#.HyeD9NJ6.dpbs
JadeRAT
Date: 2017-10-20
Affiliations: Possibly linked to APT 30
Sponsor: China
Type: Espionage
Category: Civil society
Victims: Ethnic minorities in China

This threat actor, using a tool called JadeRAT, targets the mobile phones of ethnic minorities in China, notably Uighurs, for the purpose of espionage.
Bronze Butler
Date: 2017-10-12
Affiliations: Also known as Tick and RedBaldKnight
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Japan, Korea (Republic of), Russian Federation, China, Mitsubishi Group

This threat actor targets organizations in the critical infrastructure, heavy industry, manufacturing, and international relations sectors for espionage purposes.
Indictment of APT 3 threat actors
Date: 2017-11-27
Sponsor: China
Type: Espionage
Category: Private sector
Victims: Moody's Analytics, Siemens, Trimble

The U.S. Department of Justice indicted three members of Boyusec, a China-based internet security firm, on charges including conspiring to commit computer fraud and abuse and conspiring to commit trade-secret theft. The victims included Moody’s Analytics, Siemens, and Trimble. Though not mentioned in the indictment, Boyusec is believed to work on behalf of China’s Ministry of State Security.
Response: Denouncement   https://www.justice.gov/opa/pr/us-charges-three-chinese-hackers-who-work-internet-security-firm-hacking-three-corporations
APT 10
Date: 2017-04-04
Affiliations: Also known as Cloud Hopper, Red Apollo, CNVX, Stone Panda, MenuPass, and POTASSIUM. Believed to be a part of the Tianjin bureau of the Chinese Ministry of State Security.
Sponsor: China
Type: Espionage
Category: Private sector, Government
Victims: Japan, United States, United Kingdom, India, Canada, Brazil, South Africa, Australia, Thailand, South Korea, France, Switzerland, Sweden, Finland, Norway, New Zealand

Also known as TA410. This threat actor targets managed information technology service providers to access client information for espionage purposes. APT 10 has been active since at least 2009.
Compromise of Kaspersky Labs
Date: 2017-10-10
Affiliations: Believed to be the work of the same threat actors who used the Duqu 2.0 tool. 
Sponsor: Israel
Type: Espionage
Category: Private sector
Victims: Kaspersky Labs

A threat actor, believed to be the Israeli government, compromised Kaspersky Labs, a Russia-based cybersecurity company. The compromise of Kaspersky allegedly led Israeli intelligence to tip off U.S. officials that a former contractor had classified data from the National Security Agency on his home computer.
APT 34
Date: 2017-12-07
Affiliations: Possibly linked to OilRig
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector

This threat actor targets organizations in the financial, energy, government, chemical, and telecommunications sectors worldwide for the purpose of espionage.
Targeting of the government of Belarus
Date: 2017-09-28
Affiliations: Possibly linked to NetTraveler
Type: Espionage
Category: Government
Victims: Belarus

A threat actor targeted the government of Belarus for espionage purposes, using a tool known as Travle or PYLOT, which is believed to be an update of malware used by NetTraveler.
Targeting of Chinese-language news websites
Date: 2017-07-05
Affiliations: Believed to be the work of Winnti Umbrella
Sponsor: China
Type: Espionage
Category: Civil society
Victims: United States

A threat actor targeted the China Digital Times, a civil-society and news organization based outside China that publishes English- and Chinese-language content, using phishing techniques with the goal of compromising its network.
Attempted compromise of email accounts associated with the UK Parliament
Date: 2017-06-25
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government
Victims: UK Parliament

A threat actor attempted to gain access to email accounts associated with members and other staffers of the British Parliament. The incident, originally believed to be the work of Russian or North Korean actors, was later attributed to Iran.
CopyKittens
Date: 2017-07-25
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector, Civil society
Victims: Israel, Saudi Arabia, United States, Jordan, Germany

This threat actor targets government institutions, universities, defense contractors, and large IT companies for the purpose of espionage.
Compromise of the Czech foreign minister's computer
Date: 2017-01-31
Affiliations: APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Czech Republic

A threat actor compromised the computer networks of the Ministry of Foreign Affairs of the Czech Republic, including those used by the foreign minister and close aides.
Sowbug
Date: 2017-11-07
Type: Espionage
Category: Government
Victims: Argentina, Brazil, Peru, Ecuador, Brunei, Malaysia

This threat actor targets government organizations with a foreign policy role primarily in Latin America for espionage purposes. The threat actor uses the tools Felismus and Starloader.
Targeting of U.S. electric companies
Date: 2017-10-10
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Victims: United States

A threat actor targeted U.S. electric companies with spear-phishing emails in an attempt to gain access to internal networks.
Compromise of Qatari website, leading to diplomatic rift
Date: 2017-07-16
Sponsor: United Arab Emirates
Type: Defacement
Category: Government
Victims: Qatar News Agency

Qatar claims the website of the Qatar News Agency was compromised by an unknown actor, who posted false remarks attributed to the Emir of Qatar that expressed support for Iran, Israel, Hezbollah and Hamas. The Washington Post reports that U.S. intelligence officials have identified the unknown actor as the United Arab Emirates.
Response: Denouncement   https://www.reuters.com/article/us-gulf-qatar-emirates-statement/qatar-accuses-uae-of-hack-that-sparked-gulf-crisis-idUSKBN1A21H8
Targeting of the citizen journalism website Bellingcat
Date: 2017-11-02
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Bellingcat

A threat actor attempted to compromise Bellingcat, a citizen journalism website that conducts investigations, including about Russian involvement in the Syrian and Ukrainian conflicts.
WannaCry
Date: 2017-06-14
Affiliations: Believed to be the work of the Lazarus Group.
Sponsor: Korea (Democratic People's Republic of)
Type: Data destruction
Category: Private sector, Government
Victims: FedEx, UK National Health Service, Telefonica, Deutsche Bahn, PetroChina, Hitachi, Renault, Nissan, Sberbank

A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with the decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system. On December 19, 2017, the United States, Australia, Canada, Japan, and the United Kingdom issued statements accusing North Korea of being responsible for WannaCry.

In September 2018, the U.S. Department of Justice announced criminal charges alleging that North Korean entities were responsible for this incident.
Response: Denouncement   https://www.wsj.com/articles/its-official-north-korea-is-behind-wannacry-1513642537
APT 33
Date: 2017-09-20
Affiliations: Also known as Magnallium and Elfin. Suspected to be linked to the Shamoon malware attacks in 2018.
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Private sector
Victims: United States, Saudi Arabia, South Korea

This threat actor is an Iranian state-sponsored APT that targets private-sector entities in the aviation, energy, and petrochemical sectors for the purpose of espionage. It first became active in late 2015 or early 2016, and has been involved in a three-year campaign against multiple firms in the United States and Saudi Arabia. On December 19, 2018, McAfee attributed the 2016 and 2017 Shamoon wiper malware attacks on several companies in the Middle East and Europe to APT 33.
Targeting of Ethiopian dissidents
Date: 2017-12-06
Sponsor: Ethiopia
Type: Espionage
Category: Civil society
Victims: Ethiopian dissidents

A threat actor targeted Ethiopian dissidents for the purpose of espionage, using commercially available spyware sold by Cyberbit, an Israel-based company. Cyberbit is also believed to have tried to sell its spyware to law enforcement and national security organizations in the Philippines, Thailand, Uzbekistan, and Zambia.
Mexico accused of targeting journalists and civil society groups
Date: 2017-06-19
Sponsor: Mexico
Type: Espionage
Category: Civil society
Victims: Aristegui Noticias, Carlos Loret de Mola, Mexicans against Corruption and Impunity, Centro PRODH, Mexican Institute for Competitiveness

A threat actor targets journalists, lawyers, and other civil society groups in Mexico using commercial malware, developed by the NSO Group, for the purpose of espionage.
Targeting North Korea's Reconnaissance General Bureau
Date: 2017-09-30
Sponsor: United States
Type: Denial of service
Category: Government
Victims: North Korea

U.S. government officials told the Washington Post that the United States had launched a denial of service campaign against North Korea's Reconnaissance General Bureau, the country's intelligence agency.
Distributed denial of service against the government of Montenegro
Date: 2017-02-17
Sponsor: Russian Federation
Type: Denial of service
Category: Government
Victims: Montenegro

A threat actor launched a distributed denial of service attack against government of Montenegro websites.
Compromise of Singapore's Ministry of Defense
Date: 2017-02-28
Type: Espionage
Category: Military
Victims: Ministry of Defense

A threat actor compromised an internet-facing computer network in the Ministry of Defense of Singapore, compromising the personal data of approximately 850 servicemen and employees.
Compromise the North Korean nuclear program
Date: 2017-03-04
Sponsor: United States
Type: Sabotage
Category: Military
Victims: North Korea

A threat actor, believed to be the United States, targeted computer networks and electronic components associated with the North Korean nuclear program to sabotage and slow its development.
Targeting of Marco Rubio's presidential campaign
Date: 2017-03-30
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: The 2016 presidential campaign of Marco Rubio

A threat actor targeted the presidential campaign of U.S. Senator Marco Rubio.
Longhorn
Date: 2017-04-10
Affiliations: Also known as the Lamberts
Sponsor: United States
Type: Espionage
Category: Private sector, Government
Victims: Global

This threat actor compromises governments, international organizations, academic institutions, and financial, telecommunications, energy, aerospace, information technology, and natural resource  industries for espionage purposes. Some of the tools used by this threat actor were released by Wikileaks under the name "Vault 7."
Phishing campaign against Montenegro
Date: 2017-06-06
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Montenegro

A threat actor targeted officials from Montenegro for the purpose of espionage. The phishing campaign came during the country’s accession to NATO.
Compromise of a Danish Ministry of Defense e-mail service
Date: 2017-04-23
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Military, Government
Victims: Denmark

A threat actor compromised an email service maintained by the Danish Ministry of Defense, and is also believed to have compromised Ministry of Foreign Affairs networks.
Response: Denouncement   https://fe-ddis.dk/cfcs/nyheder/arkiv/2017/Pages/Udenlandskaktoerspionerermoddanskemyndigheder.aspx
Targeting of French presidential candidate Emmanuel Macron's campaign
Date: 2017-04-26
Affiliations: Believed to be the work of APT 28
Sponsor: Russian Federation
Type: Espionage
Category: Civil society
Victims: Emmanuel Macron's 2017 presidential election campaign

A threat actor targeted the campaign of French presidential candidate Emmanuel Macron. The U.S. National Security Agency has confirmed that it believes Russia was responsible.
Magic Hound
Date: 2017-02-15
Affiliations: Also known as Cobalt Gypsy and possibly associated with Rocket Kitten
Sponsor: Iran (Islamic Republic of)
Type: Espionage
Category: Government, Private sector
Victims: Saudi Arabia

This threat actor targets entities in the government, energy, and technology sectors that are located in or do business with Saudi Arabia.
WhiteBear
Date: 2017-08-30
Affiliations: Associated with Turla
Sponsor: Russian Federation
Type: Espionage
Category: Government, Private sector
Victims: United States, United Kingdom, Uzbekistan, South Korea

This threat actor targets defense contractors and diplomatic institutions for the purpose of espionage.
Compromise of the Italian Ministry of Foreign Affairs
Date: 2017-02-10
Sponsor: Russian Federation
Type: Espionage
Category: Government
Victims: Italy

A threat actor compromised the Italian Ministry of Foreign Affairs’ computer networks.
Operation BugDrop
Date: 2017-02-17
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: Ukraine, Russia, Saudi Arabia, Austria

This threat actor targets critical infrastructure entities in the oil and gas sector, primarily in Ukraine. The threat actors deploy the BugDrop malware to remotely access the microphones in their targets' computers to eavesdrop on conversations.
Targeting of employees of companies that operate U.S. nuclear power plants
Date: 2017-06-30
Sponsor: Russian Federation
Type: Espionage
Category: Private sector
Victims: United States

A threat actor targeted employees of companies that operate nuclear power plants in the United States, which prompted the Department of Homeland Security and the FBI to issue an alert to the industry. An administrative network of the Wolf Creek Nuclear Operating Corporation was compromised.
Attempted compromise of Norwegian government networks
Date: 2017-02-04
Affiliations: Believed to be the work of the Dukes
Sponsor: Russian Federation
Type: Espionage
Category: Government, Military
Victims: Norway

A threat actor targeted the computer networks of the Norwegian government: the Ministry of Foreign Affairs, the army, a nuclear radiation protection agency, and a parliamentary group.
Response: Denouncement   http://www.tv2.no/nyheter/8903847/
Compromise of Israeli Defense Force personnel
Date: 2017-02-16
Type: Espionage
Category: Military
Victims: Israel Defense Force

A threat actor used a tool called ViperRAT to target Israeli Defense Force personnel and compromise devices running the Android operating system, allowing a remote actor to access the devices' video and audio capabilities as well as text message and location data.
Shamoon 2.0
Date: 2016-12-01
Affiliations: Believed to have been partially the work of Chrysene
Type: Data destruction
Category: Government
Victims: General Authority of Civil Aviation of Saudi Arabia

A threat actor used malware known as Shamoon 2.0 to exfiltrate and delete data from computers in the Saudi transportation sector.
Denial of service incident against media websites in Sweden
Date: 2016-03-19
Sponsor: Russian Federation
Type: Denial of service
Category: Private sector
Victims: Sweden

A threat actor launched a denial of service attack on ten news websites in Sweden, triggering a local police investigation. U.S. diplomatic cables later revealed that the United States suspected that Russia was responsible for the incident.
SWIFT-related bank heists
Date: 2016-05-26
Affiliations: Believed to be the work of Lazarus Group
Sponsor: Korea (Democratic People's Republic of)
Type: Financial Theft
Category: Government
Victims: Bangladesh Central Bank, Tien Phong Bank, Banco Del Austro, Poland

A threat actor targets the worldwide financial transfer mechanism known as SWIFT to steal funds from banks in Bangladesh, Vietnam, Ecuador, and Poland. This is the first instance in where a state-sponsored actor was discovered to have compromised networks for financial gain.

In September 2018, the U.S. Department of Justice announced criminal charges alleging that North Korean entities were responsible for this incident.
Response: Criminal charges   https://www.justice.gov/opa/press-release/file/1092091/download
Compromise of South Korean government computers (2016)
Date: 2016-12-06
Sponsor: Korea (Democratic People's Republic of)
Type: Espionage
Category: Military
Victims: South Korea

A threat actor compromised computers associated with the South Korean Ministry of National Defense. In October 2017, South Korean officials confirmed that North Korea had exfiltrated over two hundred gigabytes of data from the defense ministry networks, including military plans the United States and South Korea would implement in the event of a war with North Korea.
Response: Denouncement   http://english.yonhapnews.co.kr/news/2016/12/05/0200000000AEN20161205010451315.html
Compromise of Ukrainian banks
Date: 2016-12-13
Affiliations: Believed to be the work of Sandworm.
Sponsor: Russian Federation
Type: Data destruction
Category: Private sector
Victims: Ukraine

A threat actor compromised Ukrainian banks.