Skip to main content

Actor Index

This index is the entry point for actor-centric navigation. Use the Field Manual Actor Profile Template and Attribution Methodology when editing actor claims. Each actor links to its profile and to the generated cross-reference workbench that joins actor pages to TTPs, IOC references, malware/tool references, hunts, detections, and surfaces.

ActorProfileWorkbenchPriorityTTPsIOC refsToolsHuntsDetectionsIntel leads
MuddyWatermuddywater.mddrilldownHigh4426221
OilRigoilrig.mddrilldownHigh2131001
Magic Houndapt35.mddrilldownHigh2014111
APT42apt42.mddrilldownHigh323111
Agriusagrius.mddrilldownHigh2110111
CyberAv3ngerscyberav3ngers.mddrilldownHigh312110
Imperial Kittenimperial-kitten.mddrilldownHigh302001
Pioneer Kittenpioneer-kitten.mddrilldownHigh301221
DarkBitdarkbit.mddrilldownHigh201000
Lyceumlyceum.mddrilldownHigh2012001
Cotton Sandstormcotton-sandstorm.mddrilldownHigh311110
APT39apt39.mddrilldownMedium2011001
APT-C-23arid-viper.mddrilldownHigh237001
UNC3890unc3890.mddrilldownMedium-High111000
Cyber Toufancyber-toufan.mddrilldownMedium-High301110
Void Manticore / Handalahandala.mddrilldownHigh729221
Lebanese Cedarlebanese-cedar.mddrilldownMedium212111
WIRTEwirte.mddrilldownHigh522221
TA402ta402.mddrilldownMedium-High221002
UNC1860unc1860.mddrilldownHigh529110
Scarred Manticorescarred-manticore.mddrilldownHigh501110

Profiles are starter assessments. They MUST be updated as new public reporting becomes available. Counts are generated from repository data and should be treated as navigation coverage, not production detection coverage.