Cyber threat actors targeting the US

Pre-positioning operations against US critical infrastructure (water, energy, transport, communications) with the apparent goal of disruption during a Taiwan contingency.

Long-running telecom intrusion campaign. In 2024 breached multiple US carriers and accessed CALEA lawful-intercept systems, exposing communications of senior US officials.

Built and operated the Raptor Train IoT botnet (260k+ devices) used for intermediate routing and operational obfuscation. Targets Taiwan especially.

Dual-mission group conducting both state-directed espionage and financially motivated operations (game studios, cryptocurrency). 5 members indicted by DOJ in 2020.

Maritime, defense and naval research espionage in support of PRC modernization. 4 officers indicted by DOJ in 2021.

Intellectual property and political intelligence collection. Indicted by DOJ in 2024 for targeting US political dissidents, journalists, and members of IPAC.

Operation Cloud Hopper, global managed service provider (MSP) compromise enabling downstream access to thousands of client organizations.

Targets NGOs, religious groups, ASEAN governments, and the Tibetan/Mongolian diaspora. Heavy use of PlugX delivered via USB and themed lures.

Focused on South China Sea regional intelligence, military, diplomatic and economic targets in ASEAN states.

Author of the 2021 ProxyLogon Microsoft Exchange zero-day campaign that compromised 30,000+ servers worldwide.

Microsoft umbrella designation for clusters using ShadowPad, frequently overlapping with APT41 tradecraft against telecom and government.

SVR-attributed espionage group behind the SolarWinds supply-chain compromise and sustained targeting of US government, think-tank and cloud-provider networks.

GRU military intelligence unit responsible for destructive attacks including the Ukrainian power-grid outages, NotPetya, and the Olympic Destroyer wiper.

Espionage and destructive-capable group targeting US and allied aerospace, defense and energy sectors, with reported password-spray campaigns against satellite and defense companies.

Long-running social-engineering-heavy espionage group targeting US officials, journalists, and dissidents, including reported attempts against presidential campaign staff.

Hacktivist-branded persona conducting operations against Israeli and US industrial control systems, notably exploiting default credentials on water-utility programmable logic controllers.

Regime-directed group combining espionage, destructive attacks (Sony Pictures), and large-scale cryptocurrency theft to fund sanctioned weapons programs.

Intelligence-collection group focused on Korean Peninsula policy experts and US think tanks, using elaborate spearphishing and credential-harvesting personas.

One of the most prolific ransomware-as-a-service operations, responsible for thousands of attacks on US hospitals, schools, and government entities before a 2024 international law-enforcement disruption.

Rust-based ransomware-as-a-service operation responsible for the 2024 Change Healthcare attack, which disrupted prescription processing and payments across the US healthcare system.

Social-engineering-focused group known for SIM-swapping and help-desk impersonation attacks against major US casino, telecom and technology companies, often partnering with ransomware operators.

GRU signals-intelligence unit conducting political, military and election-related intrusions against the United States, NATO members and Ukraine, including the 2016 DNC compromise and later router-exploitation campaigns.

Technically sophisticated FSB espionage group behind the Snake implant network, known for long-dwell collection against US government, defense and research targets and for hijacking other actors' infrastructure.

Spearphishing-focused FSB group targeting US and UK policy experts, former intelligence officials, journalists and non-governmental organizations working on Russia.

MOIS-subordinate group conducting espionage and access operations across the Middle East and against US government and telecommunications interests, frequently abusing legitimate remote-management software.

Access broker that exploits internet-facing appliances to sell footholds in US networks to ransomware affiliates while also supporting Iranian state collection requirements.

RGB subunit indicted by the US Justice Department for stealing defense and nuclear-technology information while funding operations through ransomware attacks on American hospitals.

Extortion group specializing in mass exploitation of managed file-transfer products, including the MOVEit campaign that affected hundreds of US companies and government agencies at once.

Fast-growing ransomware operation hitting US small and mid-sized businesses, manufacturers and municipalities, typically entering through VPN accounts without multifactor authentication.

Distributed denial-of-service operation that disrupted US hospital, airport and cloud-service websites for political signaling; US prosecutors charged two operators in 2024.

Hacktivist front that manipulated human-machine interfaces at small US and European water and wastewater utilities, publicizing the intrusions for psychological effect; sanctioned by the US Treasury in 2024.