README.md

Cyber_Threat_Intelligence

Advanced Persistent Threats

Note: Attribution is hard and each entity may only see part of a group's activity. These groupings may change as more information becomes available but are listed to the best of my knowledge at the time of creation.

	China
	APT-1
Mandiant	APT-1: Exposing One of China's Cyber Espionage Units
MITRE	APT-1: MITRE ATT&CK
	APT-2
CrowdStrike	CrowdStrike Intelligence Report: Putter Panda
MITRE	Putter Panda: MITRE ATT&CK
	APT-3
Mandiant	Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign
Mandiant	Operation Double Tap
MITRE	APT-3 Adversary Emulation Plan
MITRE	APT-3: MITRE ATT&CK
Recorded Future	Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3
	APT-4
AT&T	Are the Sykipot’s authors obsessed with next generation US drones?
AT&T	Sykipot is back
SANS	Detailed Analysis Of Sykipot (Smartcard Proxy Variant)
Trend Micro	SYKIPOT: Threat Encyclopedia
	APT-5
NSA	APT5: Citrix ADC Threat Hunting Guidance
FireEye	SouthEast Asia: An Evolving Cyber Threat Landscape
	APT-10
CrowdStrike	Two Birds, One Stone Panda
CYWARE	APT10: A Chinese Threat on a Global Espionage Mission
MITRE	menuPass: MITRE ATT&CK
PWC	Operation Cloud Hopper
US DoJ	Two Chinese Hackers Associated With the Ministry of State Security Charged
	APT-30
FireEye	APT30 and the Mechanics of a Long-Running Cyber Espionage Operation
	APT-4
AT&T	Are the Sykipot’s authors obsessed with next generation US drones?
	APT-41
Mandiant	APT41: A Dual Espionage and Cyber Crime Operation

	Democratic People's Republic of Korea
	APT-37
Zscaler	The Unintentional Leak: A glimpse into the attack vectors of APT37
	APT-38
CISA	Hidden Cobra – North Korea’s DDoS Botnet Infrastructure
FireEye	APT38: Un-usual Suspects
Recorded Future	North Korea-Aligned TAG-71 Spoofs Financial Institutions in Asia and US
	APT-43
Mandiant	APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

	Islamic Republic of Iran
	APT-42
Mandiant	APT42: Crooked Charms, Cons and Compromises

	Russian Federation
	APT-28
FireEye	APT28: At the Center of the Storm
	APT-29
FireEye	HammerToss: Stealthy Tactics Define a Russian Cyber Threat Group

	Financially Motivated Groups
	FIN10
FireEye	FIN10: Anatomy of a Cyber Extortion Operation

Models and Methodology