Threat Actors
Profiles built from public, credible reporting. Attribution is shown only when supported by sources and always carries a confidence label.
Cl0p Ransomware Group
confidence: high
Aliases: TA505 / Clop
Responsible for the MOVEit Transfer mass exploitation campaign and double-extortion ransomware operations.
OriginAttribution reported by credible sources; disputed.
TargetsGovernmentBankingEnergy
CountriesUSNZAUUK
TechniquesExploitationData theftExtortion
MITRET1190T1486
Last seen2026-08-16
Source: CISA / NCSC joint advisories
LockBit
confidence: high
Aliases: LockBit 3.0 / LockBit Black
Ransomware-as-a-service operation with global affiliate activity.
OriginAttribution reported by credible sources; disputed.
TargetsManufacturingTransportRetail
CountriesEUUKDEFR
TechniquesRansomwareLateral movement
MITRET1486T1021
Last seen2026-08-15
Source: Europol / law-enforcement disclosures
QakBot Operators
confidence: medium
Aliases: Qbot / PinkSlip
Botnet and malware delivery operation focused on credential theft.
OriginUnknown.
TargetsBankingFinanceInsurance
CountriesUSUKDE
TechniquesMalwareCredential theft
MITRET1059T1003
Last seen2026-08-14
Source: NCSC UK / security research
Volt Typhoon
confidence: high
Aliases: Vanguard Panda
State-sponsored activity targeting critical infrastructure in the Five Eyes community.
OriginAttribution reported by credible sources; disputed.
TargetsCritical infrastructureGovernment
CountriesUSNZAUUK
TechniquesLiving off the landPersistence
MITRET1078T1547
Last seen2026-08-10
Source: CISA / NCSC joint advisory
