Threat actors behind identity attacks
Each group here is included because a US government advisory, charging document or sanctions designation names it. Groups are listed alphabetically, not ranked. Every claim on a profile carries its source.
Akira
Profile, techniques and government sources
ALPHV Blackcat
Profile, techniques and government sources
APT29
Profile, techniques and government sources
Black Basta
Profile, techniques and government sources
Lazarus Group
Profile, techniques and government sources
LockBit
Profile, techniques and government sources
Scattered Spider
Profile, techniques and government sources
Volt Typhoon
Profile, techniques and government sources