Threat actor activity this month
MITRE ATT&CK groups ranked by the indicators Q-Feeds attributed to them for the first time in the last 30 days. Only direct attribution counts. Figures through , refreshed every month.
- 25Groups in the ranking
- 6,860New indicators for the most active group, 30 days
- 18Groups whose indicators reference a CVE in the CISA KEV catalog
Key findings
In the 30 days to , Kimsuky had the most new indicators attributed to it in Q-Feeds data: 6,860.
A high count means a group is busy in the infrastructure Q-Feeds sees: new domains, IP addresses, URLs and file hashes that the evidence ties to it. It does not say how dangerous a group is. A group that reuses little infrastructure can rank low and still be very active.
The CVE column lists vulnerabilities referenced on indicators attributed to each group. That links the group's infrastructure to those CVEs, but it does not prove the group exploited them. CVEs in the CISA Known Exploited Vulnerabilities catalog are marked KEV.
Threat actors by new indicators
| Rank | Group | New indicators, 30 days | 90 days | Weekly trend, 13 weeks | Linked malware | CVEs referenced |
|---|---|---|---|---|---|---|
| 1 | Kimsuky | 6,860 | 7,112 | AsyncRAT, XLoader, PureCrypter, AppleSeed, KONNI |
| |
| 2 | Akira | 340 | 358 | Akira, Agendacrypt, Cobalt Strike, SocGholish, Etherrat |
| |
| 3 | The Gentlemen | 121 | 142 | Gentlemen, Hastalamuerte, SystemBC, The Gentlemen Ransomware, Cobalt Strike |
| |
| 4 | APT29 | 67 | 75 | CozyCar, CloudDuke, Mispadu, Rogue, Graphdrop |
| |
| 5 | Lazarus Group | 47 | 156 | BeaverTail, InvisibleFerret, Fudmodule, AppleJeus, Comebacker |
| |
| 6 | APT28 | 42 | 79 | Grunt, Beardshell, Slimagent, Gonepostal, JHUHUGIT |
| |
| 7 | Sandworm Team | 40 | 66 | Matchboil, Matchwok, Mythicratatoskr, QuasarRAT, Bluemoon |
| |
| 8 | menuPass | 36 | 93 | ChChes, PlugX, RedLeaves, Php2shell, Amadey |
| |
| 9 | Leviathan | 27 | 27 | Stealc, BADFLICK, BLACKCOFFEE, China Chopper, Cobalt Strike | 0 | |
| 10 | APT38 | 26 | 27 | Sugarloader, Rustbucket, Snatchcrypto, Clickfix, Wannacryptor |
| |
| 11 | TeamPCP | 25 | 47 | Shai-Hulud, CanisterWorm, Systemd, Litellm, Telnyx |
| |
| 12 | MuddyWater | 25 | 32 | Handala, Tsundere Botnet, Mango, Phoenix, Bugsleep |
| |
| 13 | BITTER | 21 | 23 | Dracarys, Wmrat, Miyarat, ZxxZ, Orpcbackdoor |
| |
| 14 | ShinyHunters | 20 | 53 | Scout, Blackfile, Agendacrypt, Gentlemen, MEDUSA |
| |
| 15 | Transparent Tribe | 15 | 48 | TRUSTTRAP, Findpos, Crimson, Crimson rat, Elizarat |
| |
| 16 | Sidewinder | 5 | 18 | WhisperGate, Valleyrat, Donut_injector, Donutloader, Revive |
| |
| 17 | APT-C-36 | 4 | 23 | Remcos, PureCrypter, AsyncRAT, njRAT, DCRAT | 0 | |
| 18 | SideCopy | 4 | 13 | Reverserat, Xenorat, Xenofiscal, Sidecopy apt, Crimson |
| |
| 19 | Patchwork | 3 | 14 | Spyder, Donot, Donut_injector, Modelorat, QuasarRAT | 0 | |
| 20 | Star Blizzard | 2 | 29 | Coldcopy, Norobot, Redflick, Lostkeys, Proton | 0 | |
| 21 | Contagious Interview | 2 | 19 | BeaverTail, InvisibleFerret, Ottercookie, Etherrat, Golangghost | 0 | |
| 22 | Mustang Panda | 1 | 60 | PlugX, PUBLOAD, TONESHELL, Mistcloak, Adaptixc2 |
| |
| 23 | Dark Caracal | 1 | 46 | Bandook, Gocaracal, Clickfix, Kazuar, Phishingit | 0 | |
| 24 | Salt Typhoon | 0 | 133 | Ghostemperor, Silkparasite, Sparrowdoor, Dacls, Snappybee |
| |
| 25 | CURIUM | 0 | 87 | LIGHTRAIL, Mirage, Mirage kitten, IMAPLoader | 0 |
An indicator counts in the window in which Q-Feeds first saw it. The group ID links to its MITRE ATT&CK page. Linked malware is software that MITRE ATT&CK or Q-Feeds data ties to the group. Groups with too few new indicators in 90 days are left out.
Group names, aliases and IDs come from MITRE ATT&CK®. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
How we measure this
- Source. The Q-Feeds threat intelligence database, which aggregates, enriches and scores indicators from more than 2,500 sources.
- Direct attribution only. An indicator counts for a group when the evidence that comes with it names that group or one of its aliases. Q-Feeds also derives hints from overlapping MITRE ATT&CK techniques. Those stay out of this ranking, so a guess never adds to a group's count.
- Time windows. An indicator counts in the window in which Q-Feeds first saw it: the last 30 days and the last 90 days, ending on the snapshot date.
- CVEs. A CVE is listed when it is referenced on an indicator attributed to the group. False positives are left out. The KEV mark comes from the CISA Known Exploited Vulnerabilities catalog.
- Updates. A new snapshot is computed in the first days of every month and published here automatically.
Need the indicators themselves?
This page counts indicators per group and never lists them. The indicators, their attribution and the full actor profiles are in the Q-Feeds portal, Threat Lookup and the threat feeds.
Threat Intelligence Platform
How Q-Feeds maps indicators to threat actors, malware and CVEs, and what the portal shows for each group.
Threat Lookup
Check a domain, IP address, URL or hash and see the actors and malware linked to it.
Threat statistics
The other monthly rankings: the most abused TLDs and the networks with the most malicious IP addresses.
Frequently asked questions about this ranking
What is a threat actor?
A person or group behind malicious activity. This page uses the groups tracked in MITRE ATT&CK, a public knowledge base that gives each group an ID such as G0032 and lists its known aliases, techniques and software.
How does Q-Feeds attribute an indicator to a group?
Through the evidence that comes with the indicator: a source tag, a report or an enrichment that names the group or one of its aliases. Only those direct links count here. The portal also shows hints based on overlapping techniques, labelled as hints, but they are not part of this ranking.
Does a CVE in the table mean the group exploited it?
No. It means the CVE is referenced on one or more indicators attributed to the group, for example a domain or file hash reported together with that vulnerability. Treat it as a lead for patch priority, not as proof of exploitation.
Why is a well-known group missing?
The ranking counts indicators Q-Feeds saw for the first time in the last 30 and 90 days. A group that was quiet in that period, reuses old infrastructure or is reported under a name MITRE ATT&CK does not list stays out until new indicators appear.
How often is this page updated?
Every month. A new snapshot is computed in the first days of the month, and this page updates automatically.
Can I use this data?
Yes. The figures are published under CC BY 4.0. Reuse them freely, also commercially, with a link to this page as attribution. Group names, aliases and IDs come from MITRE ATT&CK and fall under its terms of use.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Start free