auren-research/cyber-sec huggingface dataset:
type: intrusion-set
spec_version: 2.1
id: intrusion-set--28f04ed3-8e91-4805-b1f6-869020517871
created: 2020-11-17T20:33:44.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0116
external_id: G0116
source_name: Operation Wocao
description: (Citation: FoxIT Wocao December 2019)
source_name: FoxIT Wocao December 2019
description: Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
url: https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:27.086Z
name: Operation Wocao
description: [Operation Wocao](https://attack.mitre.org/groups/G0116) described activities carried out by a China-based cyber espionage adversary. [Operation Wocao](https://attack.mitre.org/groups/G0116) targeted entities within the government, managed service providers, energy, health care, and technology sectors across several countries, including China, France, Germany, the United Kingdom, and the United States. [Operation Wocao](https://attack.mitre.org/groups/G0116) used similar TTPs and tools to APT20, suggesting a possible overlap.(Citation: FoxIT Wocao December 2019)
aliases: Operation Wocao
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Erik Schamper, @Schamperr, Fox-IT
Maarten van Dantzig, @MaartenVDantzig, Fox-IT
type: intrusion-set
spec_version: 2.1
id: intrusion-set--7b404cd0-3ae9-41d4-90c0-023793d35d97
created: 2025-10-19T19:08:22.474Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1053
external_id: G1053
source_name: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022
description: Avertium. (2022, January 11). An In-Depth Look at Ransomware Gang, Sabbath. Retrieved October 19, 2025.
url: https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang
source_name: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024
description: Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.
url: https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/
source_name: Microsoft Storm-0501 Embargo Ransomware August 2025
description: Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.
url: https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/
source_name: Google Mandiant Storm-0501 Sabbath Ransomware November 2021
description: Tyler McLellan, Brandan Schondorfer. (2021, November 29). Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again. Retrieved October 19, 2025.
url: https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T02:33:31.401Z
name: Storm-0501
description: [Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202), and [Embargo](https://attack.mitre.org/software/S1247) ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)
aliases: Storm-0501
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--56319646-eb6e-41fc-ae53-aadfa7adb924
created: 2019-01-29T20:17:48.717Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0081
external_id: G0081
source_name: Pirate Panda
description: (Citation: Crowdstrike Pirate Panda April 2020)
source_name: Tropic Trooper
description: (Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)
source_name: KeyBoy
description: (Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper Mar 2018)
source_name: Crowdstrike Pirate Panda April 2020
description: Busselen, M. (2020, April 7). On-demand Webcast: CrowdStrike Experts on COVID-19 Cybersecurity Challenges and Recommendations. Retrieved May 20, 2020.
url: https://www.crowdstrike.com/blog/on-demand-webcast-crowdstrike-experts-on-covid-19-cybersecurity-challenges-and-recommendations/
source_name: TrendMicro Tropic Trooper May 2020
description: Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
url: https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf
source_name: TrendMicro Tropic Trooper Mar 2018
description: Horejsi, J., et al. (2018, March 14). Tropic Trooper’s New Strategy. Retrieved November 9, 2018.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/
source_name: Unit 42 Tropic Trooper Nov 2016
description: Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
url: https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T23:19:38.101Z
name: Tropic Trooper
description: [Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
aliases: Tropic Trooper
Pirate Panda
KeyBoy
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.6
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Edward Millington
x_mitre_domains: enterprise-attack
modified: 2024-03-25T21:23:15.556Z
name: Mustard Tempest
description: [Mustard Tempest](https://attack.mitre.org/groups/G1020) is an initial access broker that has operated the [SocGholish](https://attack.mitre.org/software/S1124) distribution network since at least 2017. [Mustard Tempest](https://attack.mitre.org/groups/G1020) has partnered with [Indrik Spider](https://attack.mitre.org/groups/G0119) to provide access for the download of additional malware including LockBit, [WastedLocker](https://attack.mitre.org/software/S0612), and remote access tools.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks Gold Prelude Profile)(Citation: SocGholish-update)
aliases: Mustard Tempest
DEV-0206
TA569
GOLD PRELUDE
UNC1543
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--0d4ac089-ced4-4cc4-a989-174d08e6d030
created: 2023-12-06T19:00:11.581Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1020
external_id: G1020
source_name: DEV-0206
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: TA569
description: (Citation: Secureworks Gold Prelude Profile)
source_name: GOLD PRELUDE
description: (Citation: Secureworks Gold Prelude Profile)
source_name: UNC1543
description: (Citation: Secureworks Gold Prelude Profile)
source_name: SocGholish-update
description: Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024.
url: https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft Ransomware as a Service
description: Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.
url: https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
source_name: Secureworks Gold Prelude Profile
description: Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.
url: https://www.secureworks.com/research/threat-profiles/gold-prelude
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-12-18T18:59:44.199Z
name: 2015 Ukraine Electric Power Attack
description: [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [BlackEnergy](https://attack.mitre.org/software/S0089) (specifically BlackEnergy3) and [KillDisk](https://attack.mitre.org/software/S0607) to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
aliases: 2015 Ukraine Electric Power Attack
first_seen: 2015-12-01T05:00:00.000Z
last_seen: 2016-01-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Booz Allen Hamilton)
x_mitre_last_seen_citation: (Citation: Booz Allen Hamilton)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--46421788-b6e1-4256-b351-f8beffd1afba
created: 2023-09-27T13:11:52.340Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0028
external_id: C0028
source_name: Booz Allen Hamilton
description: Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.
url: https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: ics-attack
enterprise-attack
type: campaign
spec_version: 2.1
id: campaign--519ee082-8ab6-439b-988f-a8a3f02c8d30
created: 2023-01-17T21:42:34.998Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0018
external_id: C0018
source_name: Costa AvosLocker May 2022
description: Costa, F. (2022, May 1). RaaS AvosLocker Incident Response Analysis. Retrieved January 11, 2023.
url: https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory
source_name: Cisco Talos Avos Jun 2022
description: Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023.
url: https://blog.talosintelligence.com/avoslocker-new-arsenal/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-21T19:40:47.537Z
name: C0018
description: 
[C0018](https://attack.mitre.org/campaigns/C0018) was a month-long ransomware intrusion that successfully deployed [AvosLocker](https://attack.mitre.org/software/S1053) onto a compromised network. The unidentified actors gained initial access to the victim network through an exposed server and used a variety of open-source tools prior to executing [AvosLocker](https://attack.mitre.org/software/S1053).(Citation: Costa AvosLocker May 2022)(Citation: Cisco Talos Avos Jun 2022)
aliases: C0018
first_seen: 2022-02-01T05:00:00.000Z
last_seen: 2022-03-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Cisco Talos Avos Jun 2022)
x_mitre_last_seen_citation: (Citation: Cisco Talos Avos Jun 2022)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Flávio Costa, @Segurança Descomplicada
x_mitre_domains: enterprise-attack
modified: 2024-04-11T03:03:02.576Z
name: APT19
description: [APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)
aliases: APT19
Codoso
C0d0so0
Codoso Team
Sunshop Group
x_mitre_deprecated: no
x_mitre_version: 1.6
x_mitre_contributors: FS-ISAC
Darren Spruell
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fe8796a4-2a02-41a0-9d27-7aa1e995feb6
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0073
external_id: G0073
source_name: Sunshop Group
description: (Citation: Dark Reading Codoso Feb 2015)
source_name: Codoso Team
description: (Citation: FireEye APT Groups)
source_name: APT19
description: (Citation: FireEye APT19)
source_name: Codoso
description: (Citation: Unit 42 C0d0so0 Jan 2016)
source_name: C0d0so0
description: (Citation: Unit 42 C0d0so0 Jan 2016)
source_name: FireEye APT19
description: Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.
url: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
source_name: Dark Reading Codoso Feb 2015
description: Chickowski, E. (2015, February 10). Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole. Retrieved September 13, 2018.
url: https://www.darkreading.com/attacks-breaches/chinese-hacking-group-codoso-team-uses-forbescom-as-watering-hole-/d/d-id/1319059
source_name: FireEye APT Groups
description: FireEye. (n.d.). Advanced Persistent Threat Groups. Retrieved August 3, 2018.
url: https://www.fireeye.com/current-threats/apt-groups.html#apt19
source_name: Unit 42 C0d0so0 Jan 2016
description: Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.
url: https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/
source_name: ICIT China's Espionage Jul 2016
description: Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018.
url: https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T00:39:25.190Z
name: Moses Staff
description: [Moses Staff](https://attack.mitre.org/groups/G1009) is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. [Moses Staff](https://attack.mitre.org/groups/G1009) openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.(Citation: Checkpoint MosesStaff Nov 2021) 

Security researchers assess [Moses Staff](https://attack.mitre.org/groups/G1009) is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.(Citation: Cybereason StrifeWater Feb 2022)
aliases: Moses Staff
DEV-0500
Marigold Sandstorm
x_mitre_deprecated: no
x_mitre_version: 2.0
x_mitre_contributors: Hiroki Nagahama, NEC Corporation
Pooja Natarajan, NEC Corporation India
Manikantan Srinivasan, NEC Corporation India
type: intrusion-set
spec_version: 2.1
id: intrusion-set--4c4a7846-45d5-4761-8eea-725fa989914c
created: 2022-08-11T22:47:27.686Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1009
external_id: G1009
source_name: DEV-0500
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Marigold Sandstorm
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Checkpoint MosesStaff Nov 2021
description: Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.
url: https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/
source_name: Cybereason StrifeWater Feb 2022
description: Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.
url: https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T00:30:42.003Z
name: Operation Dust Storm
description: [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.(Citation: Cylance Dust Storm)

[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.(Citation: Cylance Dust Storm)
aliases: Operation Dust Storm
first_seen: 2010-01-01T07:00:00.000Z
last_seen: 2016-02-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: Cylance Dust Storm)
x_mitre_last_seen_citation: (Citation: Cylance Dust Storm)
x_mitre_deprecated: no
x_mitre_version: 1.1
type: campaign
spec_version: 2.1
id: campaign--4603cf2f-06d0-4970-9c5d-5071b08c817f
created: 2022-09-29T20:00:38.136Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0016
external_id: C0016
source_name: Cylance Dust Storm
description: Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
url: https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
mobile-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--23b6a0f5-fa95-46f9-a6f3-4549c5e45ec8
created: 2017-05-31T21:31:51.643Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0014
external_id: G0014
source_name: Night Dragon
description: (Citation: McAfee Night Dragon)
source_name: McAfee Night Dragon
description: McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
url: https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:27.259Z
name: Night Dragon
description: [Night Dragon](https://attack.mitre.org/groups/G0014) is a campaign name for activity involving a threat group that has conducted activity originating primarily in China. (Citation: McAfee Night Dragon)
aliases: Night Dragon
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_attack_spec_version: 3.2.0