Threat Actor Most Wanted

Prolific Ransomware-as-a-Service operation responsible for thousands of attacks worldwide. Known for advanced encryption, data exfiltration, and a dedicated leak site.

Russian state-sponsored threat group attributed to the SVR. Known for supply chain attacks, diplomatic targets, and long-term espionage campaigns.

Rust-based RaaS group known for sophisticated attacks, data extortion, and targeting critical infrastructure across multiple sectors.

North Korean state-sponsored threat group responsible for destructive attacks, cryptocurrency thefts, and the Sony Pictures breach.

Ransomware group first observed in 2022. Uses double-extortion tactics and has targeted enterprises across North America and Europe.

Highly social engineering-focused criminal group targeting SaaS platforms and cloud environments. Known for SIM-swapping and MFA bypass.

Chinese state-sponsored group with dual motivations of espionage and financial gain. Targets gaming, tech, and healthcare sectors.

Ransomware group notorious for exploiting zero-day vulnerabilities in file transfer software (Accellion, GoAnywhere, MOVEit).

Iranian state-sponsored threat group targeting aerospace, energy, and petrochemical sectors with destructive wiper attacks.

North Korean threat group focused on intelligence gathering against South Korean government, think tanks, and academia.

Pro-Russian hacktivist group known for large-scale DDoS attacks against governments and critical infrastructure in NATO countries.

Hacktivist group known for targeting pro-LGBTQ+ causes and government entities with data breaches and leaks.