Actor Index
This index is the entry point for actor-centric navigation. Use the Field Manual Actor Profile Template and Attribution Methodology when editing actor claims. Each actor links to its profile and to the generated cross-reference workbench that joins actor pages to TTPs, IOC references, malware/tool references, hunts, detections, and surfaces.
- Actor Navigation Workbench
- TTP To Detection Matrix
- Surface And Capability Matrix
- Detection Status Dashboard
| Actor | Profile | Workbench | Priority | TTPs | IOC refs | Tools | Hunts | Detections | Intel leads |
|---|---|---|---|---|---|---|---|---|---|
| MuddyWater | muddywater.md | drilldown | High | 4 | 4 | 26 | 2 | 2 | 1 |
| OilRig | oilrig.md | drilldown | High | 2 | 1 | 31 | 0 | 0 | 1 |
| Magic Hound | apt35.md | drilldown | High | 2 | 0 | 14 | 1 | 1 | 1 |
| APT42 | apt42.md | drilldown | High | 3 | 2 | 3 | 1 | 1 | 1 |
| Agrius | agrius.md | drilldown | High | 2 | 1 | 10 | 1 | 1 | 1 |
| CyberAv3ngers | cyberav3ngers.md | drilldown | High | 3 | 1 | 2 | 1 | 1 | 0 |
| Imperial Kitten | imperial-kitten.md | drilldown | High | 3 | 0 | 2 | 0 | 0 | 1 |
| Pioneer Kitten | pioneer-kitten.md | drilldown | High | 3 | 0 | 1 | 2 | 2 | 1 |
| DarkBit | darkbit.md | drilldown | High | 2 | 0 | 1 | 0 | 0 | 0 |
| Lyceum | lyceum.md | drilldown | High | 2 | 0 | 12 | 0 | 0 | 1 |
| Cotton Sandstorm | cotton-sandstorm.md | drilldown | High | 3 | 1 | 1 | 1 | 1 | 0 |
| APT39 | apt39.md | drilldown | Medium | 2 | 0 | 11 | 0 | 0 | 1 |
| APT-C-23 | arid-viper.md | drilldown | High | 2 | 3 | 7 | 0 | 0 | 1 |
| UNC3890 | unc3890.md | drilldown | Medium-High | 1 | 1 | 1 | 0 | 0 | 0 |
| Cyber Toufan | cyber-toufan.md | drilldown | Medium-High | 3 | 0 | 1 | 1 | 1 | 0 |
| Void Manticore / Handala | handala.md | drilldown | High | 7 | 2 | 9 | 2 | 2 | 1 |
| Lebanese Cedar | lebanese-cedar.md | drilldown | Medium | 2 | 1 | 2 | 1 | 1 | 1 |
| WIRTE | wirte.md | drilldown | High | 5 | 2 | 2 | 2 | 2 | 1 |
| TA402 | ta402.md | drilldown | Medium-High | 2 | 2 | 1 | 0 | 0 | 2 |
| UNC1860 | unc1860.md | drilldown | High | 5 | 2 | 9 | 1 | 1 | 0 |
| Scarred Manticore | scarred-manticore.md | drilldown | High | 5 | 0 | 1 | 1 | 1 | 0 |
Profiles are starter assessments. They MUST be updated as new public reporting becomes available. Counts are generated from repository data and should be treated as navigation coverage, not production detection coverage.