# Threat Actors
Perfis detalhados de grupos de ameaça que operam globalmente, com ênfase em atores que alvejam o Brasil e a América Latina. Cada perfil inclui TTPs mapeadas ao MITRE ATT&CK, infraestrutura conhecida, campanhas documentadas e indicadores de comprometimento (IoCs).
**Categorias monitoradas:**
- **APTs (Advanced Persistent Threats)** - grupos com suporte estatal, motivação de espionagem ou sabotagem
- **Grupos criminosos** - ransomware-as-a-service, fraude financeira, carding
- **Hacktivistas** - motivação ideológica ou política
- **Atores emergentes** - novos grupos identificados com atividade crescente
---
## Mapa de Threat Actors por Origem
> [!example]- Mapa por Origem Geográfica
> ```mermaid
> mindmap
> root((Threat Actors por Origem))
> Rússia
> APT28 - Fancy Bear
> APT29 - Cozy Bear
> Sandworm
> Turla
> Gamaredon
> LockBit
> Cl0p
> Qilin
> China
> APT41
> Volt Typhoon
> Salt Typhoon
> Mustang Panda
> APT10 - Cloud Hopper
> APT9 - Nightshade Panda
> Silk Typhoon - HAFNIUM
> UNC5221
> UNC5325
> UNC5337
> Citrine Sleet
> Coreia do Norte
> Lazarus Group
> Andariel
> Kimsuky
> Citrine Sleet
> Irã
> MuddyWater - MOIS
> APT42 - IRGC
> CyberAv3ngers - IRGC
> Void Manticore - IRGC
> LATAM
> Grandoreiro - Brasil
> Blind Eagle - Colombia
> APT Tekir
> Aggah - Oriente Medio
> ```
> [!example]- Mapa por Motivação
> ```mermaid
> mindmap
> root((Threat Actors por Motivação))
> Ransomware
> LockBit
> Cl0p
> Qilin
> Interlock
> Monti
> Zollo
> Espionagem
> APT28 - Fancy Bear
> APT29 - Cozy Bear
> Turla
> Gamaredon
> APT41
> Volt Typhoon
> Salt Typhoon
> Mustang Panda
> APT10 - Cloud Hopper
> APT9 - Nightshade Panda
> Silk Typhoon - HAFNIUM
> MuddyWater - MOIS
> APT42 - IRGC
> Kimsuky
> Financeiro
> Lazarus Group
> Andariel
> Citrine Sleet
> Grandoreiro - Brasil
> Blind Eagle - Colombia
> Aggah Group
> Hacktivismo
> Void Manticore - IRGC
> CyberAv3ngers - IRGC
> APT Tekir
> ```
---
## Atores Ativos
%%
```dataview
TABLE WITHOUT ID link(file.link, title) AS "Ator", origin AS "Origem", join(motivation, ", ") AS "Motivação", status AS "Status", join(targets-sectors, ", ") AS "Setores Alvo"
FROM "cti/groups"
WHERE type = "threat-actor" AND status = "active"
SORT file.mtime DESC
```
%%
<!-- QueryToSerialize: TABLE WITHOUT ID link(file.link, title) AS "Ator", origin AS "Origem", join(motivation, ", ") AS "Motivação", status AS "Status", join(targets-sectors, ", ") AS "Setores Alvo" FROM "cti/groups" WHERE type = "threat-actor" AND status = "active" SORT file.mtime DESC -->
<!-- SerializedQuery: TABLE WITHOUT ID link(file.link, title) AS "Ator", origin AS "Origem", join(motivation, ", ") AS "Motivação", status AS "Status", join(targets-sectors, ", ") AS "Setores Alvo" FROM "cti/groups" WHERE type = "threat-actor" AND status = "active" SORT file.mtime DESC -->
| Ator | Origem | Motivação | Status | Setores Alvo |
| ---------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------- |
| [[void-manticore\|Void Manticore]] | Irã | disruptivo, hacktivismo | active | government, telecommunications, healthcare |
| [[volt-typhoon\|Volt Typhoon]] | China | pré-posicionamento para conflito, sabotagem, espionagem | active | critical-infrastructure, telecommunications, energy, water, transportation, government |
| [[unc6691\|UNC6691]] | Desconhecida (possívelmente nexo chinês) | espionagem, acesso a dispositivos móveis | active | government, technology, telecommunications |
| [[unc4736\|UNC4736]] | Coreia do Norte | financeiro | active | financial, technology, cryptocurrency |
| [[unc4841\|UNC4841]] | China | espionagem, coleta de inteligência | active | government, technology, defense, telecommunications |
| [[unc1549\|UNC1549]] | Iran | espionagem | active | defense, aerospace, aviation, telecommunications, technology, government |
| [[unc1945\|UNC1945]] | Desconhecida (possívelmente China) | espionagem, roubo de dados de telecomúnicações | active | telecommunications |
| [[teamtnt\|TeamTNT]] | Alemanha (suspeita) | financeiro, cryptojacking, roubo de credenciais cloud | active | technology, cloud, cryptocurrency |
| [[teampcp\|TeamPCP]] | Desconhecido | destruição, roubo-de-credenciais, ransomware | active | technology, devops, open-source |
| [[ta2727\|TA2727]] | Desconhecida | financeiro | active | technology, financial, retail |
| [[storm-1567\|Storm-1567]] | Desconhecida (provavel Russia / Leste Europeu) | financeiro | active | manufacturing, healthcare, financial, technology, government, education, food-agriculture |
| [[storm-0844\|Storm-0844]] | Desconhecida (afiliado DragonForce) | financeiro | active | manufacturing, retail, technology, critical-infrastructure, real-estate, transportation |
| [[shinyhunters\|ShinyHunters]] | Ocidente (anglófono) | financeiro, extorsão | active | telecommunications, financial, technology, retail, aviation |
| [[silver-fox\|Silver Fox]] | China | espionage, financial | active | financial, healthcare, government, technology |
| [[sandworm\|Sandworm]] | Rússia (GRU — Unidade 74455) | sabotagem, espionagem, disrupção de infraestrutura | active | energy, critical-infrastructure, government, telecommunications, financial |
| [[romcom-group\|RomCom]] | Rússia | espionagem, financeiro, ransomware | active | government, defense, financial, technology, energy |
| [[cti/groups/red-menshen.md\|Red Menshen]] | China | espionagem | active | telecommunications, critical-infrastructure, government |
| [[cti/groups/mispadu.md\|Mispadu (SAMBA SPIDER)]] | Brasil / México | financial | active | financial, government, technology |
| [[lockbit\|LockBit]] | Rússia | financeiro | active | manufacturing, healthcare, financial, technology, government |
| [[lazarus-group\|Lazarus Group]] | Coreia do Norte | espionagem, financeiro, sabotagem | active | financial, cryptocurrency, government, defense, technology |
| [[jetbrains-teamcity\|Atores que Exploram JetBrains TeamCity]] | Múltiplos (Rússia / Coreia do Norte) | espionagem, supply chain compromise, ransomware | active | technology, software-development, financial, government |
| [[grandoreiro\|Grandoreiro (Operadores)]] | Brasil | financeiro | active | financial, cryptocurrency |
| [[g1009-moses-staff\|Moses Staff]] | Iran | destruicao, influencia, dano politico | active | government, defense, financial, energy, manufacturing, transportation |
| [[g0128-apt31\|APT31]] | China | espionagem | active | government, technology, defense, telecommunications, media |
| [[g0114-fin12\|FIN12]] | Russofono | financeiro, ransomware | active | healthcare, critical-infrastructure, government, financial, manufacturing, technology |
| [[g0059-apt35\|APT35]] | Iran | espionagem | active | government, defense, technology, academia, media |
| [[g0005-apt12\|APT12]] | China | espionagem | active | government, media, technology, defense, telecommunications, education |
| [[fin6\|FIN6]] | Rússia / Leste Europeu | financeiro, ransomware, roubo de dados de cartão | active | retail, hospitality, financial, technology |
| [[fin7\|FIN7]] | Rússia / Ucrânia | financeiro, ransomware | active | financial, retail, hospitality, technology, healthcare |
| [[cti/groups/cyberav3ngers.md\|CyberAv3ngers]] | Irã (IRGC-CEC) | sabotagem | active | critical-infrastructure, energy, water |
| [[cardinal-cybercrime-group\|Cardinal Cybercrime Group]] | Rússia / Leste Europeu | financeiro, ransomware, extorsão | active | technology, financial, government |
| [[blackmatter\|BlackMatter]] | Rússia | financeiro, extorsao | active | critical-infrastructure, food-agriculture, manufacturing, healthcare, financial, energy |
| [[bianlian-group\|BianLian]] | Desconhecida (possívelmente Rússia/CIS) | financeiro, extorsão, ransomware | active | healthcare, government, financial, manufacturing, critical-infrastructure |
| [[apt9\|APT9]] | China | espionagem, roubo-de-propriedade-intelectual | active | healthcare, pharmaceutical, biotechnology, aerospace, defense, construction-engineering |
| [[apt41\|APT41]] | China | espionagem, financeiro, roubo de propriedade intelectual | active | healthcare, technology, gaming, telecommunications, financial, government |
| [[apt5\|APT5]] | China | espionagem, roubo de propriedade intelectual | active | telecommunications, defense, technology, aerospace |
| [[apt40\|APT40]] | China (MSS — Hainan State Security Department) | espionagem, roubo de propriedade intelectual naval | active | defense, maritime, aerospace, government, research |
| [[apt33\|APT33]] | Irã | espionagem, sabotagem | active | energy, defense, government, aerospace, financial |
| [[apt35\|APT35]] | Irã (IRGC — Guarda Revolucionária Islâmica) | espionagem, vigilância de dissidentes, coleta de inteligência | active | government, defense, academic, think-tanks, journalism, human-rights |
| [[apt38\|APT38]] | Coreia do Norte (RGB) | financeiro, roubo de criptoativos, ataques SWIFT | active | financial, cryptocurrency, banking |
| [[apt31\|APT31]] | China (MSS) | espionagem, coleta de inteligência política, roubo de propriedade intelectual | active | government, political, financial, defense, aerospace |
| [[apt28\|APT28]] | Rússia (GRU — Unidade 26165 e 74455) | espionagem, interferência política, sabotagem | active | government, defense, energy, technology, political |
| [[apt29\|APT29]] | Rússia (SVR — Serviço de Inteligência Estrangeiro) | espionagem, coleta de inteligência | active | government, technology, defense, think-tanks, healthcare |
| [[apt24\|APT24]] | China | espionagem | active | government, technology, telecommunications, healthcare |
| [[akira-group\|Akira Group]] | Desconhecida (suspeito ligação Conti) | financeiro, ransomware | active | manufacturing, education, technology, healthcare, financial, critical-infrastructure |
| [[8220-gang\|8220 Gang]] | China | financeiro | active | technology, cloud, financial, government |
| [[water-galura\|Water Galura]] | Rússia | financeiro, extorsão | active | healthcare, manufacturing, financial, legal, government, education, technology |
| [[unc5820\|UNC5820]] | unknown | espionagem, acesso-inicial | active | technology, critical-infrastructure, financial, managed-service-providers |
| [[unc5337\|UNC5337]] | China | espionagem | active | government, defense, technology, telecommunications |
| [[unc5221\|UNC5221]] | China | espionagem | active | government, defense, healthcare, technology, financial, telecommunications |
| [[unc3890\|UNC3890]] | Iran | espionagem | active | government, transportation, energy, healthcare, technology |
| [[unc2630\|UNC2630]] | China | espionagem | active | government, defense, critical-infrastructure |
| [[unc2596\|UNC2596]] | | financeiro, extorsão, espionagem | active | government, financial, critical-infrastructure, healthcare, technology |
| [[unc2565\|UNC2565]] | Europa Oriental / Rússia | financeiro, acesso-inicial | active | healthcare, financial, legal, technology |
| [[unc2448\|UNC2448]] | Irã | financeiro, espionagem | active | government, critical-infrastructure, technology, healthcare |
| [[unc215\|UNC215]] | China | espionagem | active | government, technology, telecommunications |
| [[uat-8616\|UAT-8616]] | Desconhecido | espionagem, acesso-persistente | active | critical-infrastructure, telecommunications, government, energy, manufacturing |
| [[cti/groups/ta558.md\|TA558]] | Unknown | financeiro | active | hospitality, travel, transportation, financial |
| [[ta505\|TA505]] | Russia | financeiro | active | financial, healthcare, manufacturing, technology, government, logistics |
| [[ta2722\|TA2722]] | Filipinas (provável) | financeiro, espionagem | active | manufacturing, transportation, shipping, energy, pharmaceutical, technology |
| [[stormous\|Stormous]] | Oriente Medio / Russia (membros de ambas regioes) | financeiro, hacktivismo, politico | active | technology, energy, manufacturing, government, financial |
| [[royal-blacksuit-group\|Royal BlackSuit Group]] | Desconhecida (suspeito Russofono) | financeiro, ransomware | active | healthcare, government, critical-infrastructure, manufacturing, commercial-facilities, critical-manufacturing |
| [[cti/groups/rhysida.md\|Rhysida]] | Suspeito Russofono | financeiro | active | healthcare, education, government, manufacturing, technology |
| [[cti/groups/qilin.md\|Qilin]] | Rússia | financeiro | active | manufacturing, financial, healthcare, government, energy, critical-infrastructure, technology |
| [[lockbit-group\|LockBit]] | Russia (provavel) | financeiro, ransomware | active | financial, healthcare, government, manufacturing, critical-infrastructure, technology, education |
| [[killnet\|Killnet]] | Russia | hacktivism, disruption | active | government, healthcare, transportation, critical-infrastructure, financial |
| [[gorgon-group\|Gorgon Group]] | Paquistão (suspeito) | espionagem, financeiro, cybercrime | active | government, manufacturing, financial, technology |
| [[cti/groups/ghostsec.md\|GhostSec]] | Internacional (membros globais; C2 em Moscou documentado) | hacktivismo, financeiro, politico | active | government, critical-infrastructure, technology, financial, manufacturing, education, telecommunications |
| [[g1053-storm-0501\|Storm-0501]] | Unknown | financeiro | active | healthcare, education, government, public-safety, manufacturing, transportation |
| [[g1052-contagious-interview\|Contagious Interview]] | Coreia do Norte (RPDC) | financeiro, roubo de criptomoedas, espionagem | active | technology, financial, cryptocurrency, software |
| [[g1051-medusa-ransomware\|Medusa Ransomware]] | Desconhecida | financeiro | active | healthcare, education, technology, manufacturing, government, legal, insurance |
| [[g1048-unc3886\|UNC3886]] | China | espionagem | active | defense, technology, telecommunications, government, energy |
| [[g1043-blackbyte\|BlackByte]] | Desconhecida | espionagem | active | \- |
| [[g1042-redecho\|RedEcho]] | China | espionagem, pre-posicionamento-estratégico | active | energy, critical-infrastructure, power-grid, government |
| [[g1040-play\|Play]] | Suspeito Russofono | financeiro | active | government, manufacturing, financial, healthcare, legal, critical-infrastructure, media |
| [[g1036-moonstone-sleet\|Moonstone Sleet]] | North Korea | financeiro, espionagem | active | technology, defense, financial, aerospace, education |
| [[g1034-daggerfly\|Daggerfly]] | China | espionagem, vigilancia interna | active | government, telecommunications, ngo, technology, education, religious-organizations |
| [[g1032-inc-ransom\|INC Ransom]] | Desconhecida (possívelmente Europa Oriental) | financeiro, extorsao | active | healthcare, manufacturing, education, government, technology |
| [[g1031-saint-bear\|Saint Bear]] | Rússia | espionagem, geopolítico | active | government, energy, critical-infrastructure, defense |
| [[g1030-agrius\|Agrius]] | Irã (MOIS) | disruptivo, espionagem, hacktivismo-estatal | active | technology, education, government, financial, diamond-industry |
| [[g1023-apt5\|APT5]] | China | espionagem | active | telecommunications, aerospace, defense, technology, government, critical-infrastructure |
| [[g1022-toddycat\|ToddyCat]] | China (atribuição moderada) | espionagem, coleta-de-inteligencia | active | government, defense, military, telecommunications, technology |
| [[g1020-mustard-tempest\|Mustard Tempest]] | Rússia (suspeito - ligação Evil Corp) | financeiro, acesso-inicial | active | technology, financial, manufacturing, government, legal |
| [[g1018-ta2541\|TA2541]] | Unknown | espionagem, financeiro | active | aviation, aerospace, transportation, manufacturing, defense |
| [[g1016-fin13\|FIN13]] | Unknown | financeiro | active | financial, retail, hospitality |
| [[g1015-scattered-spider\|Scattered Spider]] | EUA e Reino Unido | financeiro, extorsao | active | technology, financial, gaming, telecommunications, hospitality, retail, insurance |
| [[g1014-luminousmoth\|LuminousMoth]] | China (atribuição moderada - relacionado ao Mustang Panda) | espionagem | active | government, military, telecommunications, finance |
| [[g1012-curium\|CURIUM]] | Iran | espionagem | active | \- |
| [[g1013-metador\|Metador]] | Desconhecida (suspeita espanhol-falante) | espionagem | active | telecommunications, internet-service-providers, education, government |
| [[g1011-exotic-lily\|EXOTIC LILY]] | Desconhecida (possívelmente Europa Oriental) | financeiro, extorsao | active | technology, cybersecurity, healthcare, financial, manufacturing, retail, media |
| [[g1007-aoqin-dragon\|Aoqin Dragon]] | China (falante de chinês) | espionagem, vigilância política, inteligência estratégica | active | government, education, telecommunications |
| [[g1006-earth-lusca\|Earth Lusca]] | China | espionagem, financeiro | active | government, telecommunications, technology, media, education, financial, cryptocurrency |
| [[g1005-polonium\|POLONIUM]] | Libano (coordenado com Iran/MOIS) | espionagem, coleta de inteligência | active | defense, technology, critical-infrastructure, financial, government, healthcare |
| [[g1003-ember-bear\|Ember Bear]] | Russia | espionagem, sabotagem | active | government, telecommunications, critical-infrastructure, technology |
| [[g1002-bitter\|BITTER]] | India (suspeita) | espionagem | active | government, energy, engineering, defense, nuclear |
| [[g1001-hexane\|HEXANE]] | Ira | espionagem | active | energy, oil-gas, telecommunications, aviation, government |
| [[g0143-aquatic-panda\|Aquatic Panda]] | China | espionagem, espionagem industrial | active | telecommunications, technology, government, education, ngo |
| [[g0142-confucius\|Confucius]] | India (suspeita) | espionagem, coleta de inteligência militar | active | government, military, defense, energy |
| [[g0140-lazyscripter\|LazyScripter]] | desconhecida (suspeita: Oriente Médio ou Asia do Sul) | espionagem, coleta de inteligência | active | aviation, government, transportation |
| [[g0138-andariel\|Andariel]] | Coreia do Norte | espionagem, financeiro, ransomware | active | defense, government, financial, healthcare, manufacturing, aerospace, nuclear, engineering, energy, critical-infrastructure |
| [[g0137-ferocious-kitten\|Ferocious Kitten]] | Irã | espionagem, vigilância de dissidentes | active | civil-society, dissidents, activism |
| [[g0135-backdoordiplomacy\|BackdoorDiplomacy]] | China (suspeito) | espionagem, coleta de inteligência geopolítica | active | government, diplomatic, telecommunications |
| [[g0136-indigozebra\|IndigoZebra]] | China | espionagem, coleta de inteligência política | active | government |
| [[g0130-ajax-security-team\|Ajax Security Team]] | Irã | espionagem, vigilância de dissidentes, hacktivismo-estatal | active | defense, technology, civil-society, dissidents |
| [[g0131-tonto-team\|Tonto Team]] | China | espionagem, roubo de propriedade intelectual | active | government, military, defense, energy, mining, financial, healthcare, technology, education |
| [[g0129-mustang-panda\|Mustang Panda]] | China | espionagem | active | government, NGO, research, military, telecommunications, maritime, diplomacy, law-enforcement |
| [[g0123-volatile-cedar\|Volatile Cedar]] | Líbano (afiliação Hezbollah suspeita) | espionagem, vigilância política, coleta de inteligência | active | government, telecommunications, technology, defense, education, media |
| [[g0121-sidewinder\|Sidewinder]] | India | espionagem | active | government, military, maritime, nuclear-energy, telecommunications, logistics, financial, education |
| [[g0119-indrik-spider\|Indrik Spider]] | Russia | financeiro, espionagem | active | financial, healthcare, critical-infrastructure, government, technology |
| [[g0114-chimera\|Chimera]] | China | espionagem industrial, roubo de propriedade intelectual | active | technology, semiconductor, aviation, manufacturing |
| [[g0112-windshift\|Windshift]] | desconhecida (suspeita: Oriente Médio) | espionagem, vigilância direcionada | active | government, critical-infrastructure, telecommunications |
| [[g0108-blue-mockingbird\|Blue Mockingbird]] | Desconhecida | espionagem | active | \- |
| [[g0106-rocke\|Rocke]] | China | espionagem | active | \- |
| [[g0105-darkvishnya\|DarkVishnya]] | Desconhecida | espionagem | active | \- |
| [[g0100-inception-framework\|Inception Framework]] | Desconhecida (suspeita Russia) | espionagem | active | government, defense, energy, telecommunications, aerospace |
| [[g0098-blacktech\|BlackTech]] | China | espionagem, roubo de propriedade intelectual | active | technology, government, defense, telecommunications, media, electronics, financial |
| [[cti/groups/g0096-apt41.md\|APT41]] | China | espionagem, financeiro | active | healthcare, telecommunications, technology, financial, education, gaming, manufacturing, logistics, government |
| [[g0095-machete\|Machete]] | Latin America | espionagem | active | government, military, defense, telecommunications, energy |
| [[g0094-kimsuky\|Kimsuky]] | Coreia do Norte | espionagem, coleta-de-inteligencia | active | government, defense, research, think-tanks, energy, nuclear, academia, diplomacy |
| [[g0093-gallium\|GALLIUM]] | China | espionagem | active | telecommunications, government, financial, critical-infrastructure |
| [[g0091-silence\|Silence]] | Rússia | financeiro, crime | active | financial, banking |
| [[g0090-wirte\|WIRTE]] | Palestina (Hamas-afiliado, suspeito) | espionagem, sabotagem, motivação política | active | government, military, diplomatic, financial, technology, legal |
| [[g0089-the-white-company\|The White Company]] | desconhecida (possívelmente patrocinado por Estado) | espionagem, coleta de inteligência militar | active | defense, government, military |
| [[g0088-tempveles\|TEMP.Veles]] | Russia | sabotagem, espionagem | active | energy, oil-gas, petrochemical, critical-infrastructure |
| [[g0087-apt39\|APT39]] | Iran | espionagem | active | telecommunications, travel, hospitality, technology, government, academia |
| [[g0085-fin11\|FIN11]] | Russia | financeiro, extorsão | active | healthcare, financial, government, technology, manufacturing |
| [[g0083-silverterrier\|SilverTerrier]] | Nigeria | financeiro | active | technology, manufacturing, education, financial, government |
| [[g0082-apt38\|APT38]] | North Korea | financeiro, espionagem | active | financial, banking, cryptocurrency, critical-infrastructure |
| [[g0081-tropic-trooper\|Tropic Trooper]] | China (atribuição moderada) | espionagem | active | government, transportation, healthcare, technology, defense, energy |
| [[g0080-cobalt-group\|Cobalt Group]] | Europa Oriental (atribuição provável) | financeiro | active | financial, banking, payment-processing |
| [[g0079-darkhydrus\|DarkHydrus]] | Irã (suspeito) | espionagem, coleta de credenciais | active | government, education |
| [[g0075-rancor\|Rancor]] | China (suspeito) | espionagem, vigilância política | active | government, political-entities |
| [[g0073-apt19\|APT19]] | China | espionagem, roubo de propriedade intelectual | active | legal, financial, defense, technology, energy, pharmaceutical, telecommunications, education |
| [[g0071-orangeworm\|Orangeworm]] | Desconhecida | espionagem-corporativa, roubo de propriedade intelectual | active | healthcare, manufacturing, technology, logistics, agriculture |
| [[g0070-dark-caracal\|Dark Caracal]] | Líbano (GDGS - General Directoraté of General Security) | espionagem, vigilancia-politica | active | government, military, utilities, financial, telecommunications, technology, education |
| [[g0068-platinum\|PLATINUM]] | Desconhecida (suspeita China) | espionagem | active | government, defense, intelligence, telecommunications, technology |
| [[g0067-apt37\|APT37]] | North Korea | espionagem | active | government, defense, technology, telecommunications, healthcare, manufacturing |
| [[g0066-elderwood\|Elderwood]] | China | espionagem | active | \- |
| [[g0062-ta459\|TA459]] | China | espionagem, roubo de informação | active | government, telecommunications, media, financial |
| [[g0061-fin8\|FIN8]] | | financeiro | active | hospitality, retail, entertainment, financial, insurance, technology, chemical |
| [[g0056-promethium\|PROMETHIUM]] | Turkey | espionagem | active | \- |
| [[g0054-sowbug\|Sowbug]] | Desconhecida (suspeito Estado-nação) | espionagem, inteligência diplomática | active | government, foreign-policy, diplomatic |
| [[g0052-copykittens\|CopyKittens]] | Iran | espionagem | active | government, defense, technology, academia, media |
| [[g0050-apt32\|APT32]] | Vietnam | espionagem | active | government, technology, manufacturing, hospitality, ngo, media |
| [[g0048-rtm\|RTM]] | Rússia | financeiro | active | financial, banking, accounting, remote-banking |
| [[g0040-gaza-cybergang\|Gaza Cybergang]] | Palestina | espionagem, geopolitica, hacktivismo | active | government, defense, financial, media, civil-society |
| [[g0038-stealth-falcon\|Stealth Falcon]] | Emirados Arabes Unidos (EAU) | espionagem, vigilancia | active | media, government, civil-society, ngo |
| [[g0036-gcman\|GCMAN]] | Rússia | financeiro | active | financial, banking |
| [[g0035-dragonfly\|Dragonfly]] | Russia | espionagem, sabotagem | active | energy, critical-infrastructure, government, defense, aviation |
| [[g0033-poseidon-group\|Poseidon Group]] | Brasil (suspeito) | espionagem, extorsão, financeiro | active | financial, banking, government, telecommunications, manufacturing, energy, media |
| [[g0029-scarlet-mimic\|Scarlet Mimic]] | China | espionagem, vigilância-política | active | government, civil-society, ngo |
| [[g0027-threat-group-3390\|Threat Group-3390]] | China | espionagem, financeiro | active | aerospace, government, defense, energy, technology, financial, telecommunications, gaming |
| [[g0026-apt18\|APT18]] | China (PLA Navy - suspeito) | espionagem, roubo de dados, inteligência estratégica | active | healthcare, technology, manufacturing, government, education, aerospace, human-rights |
| [[g0025-apt17\|APT17]] | China | espionagem, coleta-de-inteligencia | active | government, defense, technology, financial, legal, mining |
| [[g0024-putter-panda\|Putter Panda]] | China | espionagem | active | \- |
| [[g0023-apt16\|APT16]] | China | espionagem, coleta-de-inteligencia | active | government, media, financial, technology |
| [[g0019-naikon\|Naikon]] | China | espionagem | active | government, military, critical-infrastructure |
| [[g0018-admin338\|admin@338]] | China | espionagem, inteligência econômica, inteligência comercial | active | financial, government, think-tanks, media, political-entities |
| [[g0016-apt29\|APT29]] | Russia | espionagem | active | government, defense, technology, think-tanks, healthcare, energy, ngos, manufacturing, media |
| [[g0013-apt30\|APT30]] | China | espionagem, coleta-de-inteligencia | active | government, defense, diplomatic, media, technology |
| [[g0012-darkhotel\|Darkhotel]] | Coreia do Sul | espionagem | active | \- |
| [[g0010-turla\|Turla]] | Russia | espionagem | active | government, defense, military, think-tanks, energy, telecommunications, diplomacy |
| [[g0009-deep-panda\|Deep Panda]] | China | espionagem, roubo-de-dados-pessoais, contra-inteligencia | active | government, defense, financial, healthcare, telecommunications, technology |
| [[g0006-apt1\|APT1]] | China | espionagem | active | technology, aerospace, defense, telecommunications, energy, manufacturing, financial |
| [[g0003-cleaver\|Cleaver]] | Iran | espionagem, pre-posicionamento estratégico | active | energy, oil-gas, transportation, airlines, defense, government, telecommunications, healthcare, aerospace, education |
| [[chamelgang\|ChamelGang]] | China (alta confianca) | espionagem, roubo-de-dados, financeiro | active | energy, aviation, government, healthcare, manufacturing, financial |
| [[bianlian\|BianLian]] | Russia | financeiro | active | legal, healthcare, engineering, financial, manufacturing, critical-infrastructure, government |
| [[unc6201\|UNC6201]] | China | espionagem | active | technology, critical-infrastructure |
| [[apt-tekir\|APT Tekir]] | desconhecida | espionagem, financeiro | active | government |
| [[citrine-sleet\|Citrine Sleet]] | Coreia do Norte | financeiro, criptomoeda | active | financial, cryptocurrency, technology |
| [[lunar-spider\|Lunar Spider]] | Russia / Leste Europeu | financeiro | active | financial, technology, retail, healthcare |
| [[g0128-zirconium\|ZIRCONIUM]] | China | espionagem | active | \- |
| [[g0126-higaisa\|Higaisa]] | China | espionagem | active | \- |
| [[g0078-gorgon-group\|Gorgon Group]] | Russia | espionagem | active | \- |
| [[g0053-fin5\|FIN5]] | Russia | espionagem | active | \- |
| [[g1008-sidecopy\|SideCopy]] | Pakistan | espionagem | active | \- |
| [[g1026-malteiro\|Malteiro]] | Brasil | espionagem | active | \- |
| [[g0139-teamtnt\|TeamTNT]] | Desconhecida | espionagem | active | \- |
| [[g0051-fin10\|FIN10]] | Desconhecida | espionagem | active | \- |
| [[g0122-silent-librarian\|Silent Librarian]] | Iran | espionagem | active | \- |
| [[g0028-threat-group-1314\|Threat Group-1314]] | Desconhecida | espionagem | active | \- |
| [[g0124-windigo\|Windigo]] | Desconhecida | espionagem | active | \- |
| [[g1050-water-galura\|Water Galura]] | Russia | espionagem | active | \- |
| [[g0076-thrip\|Thrip]] | China | espionagem | active | \- |
| [[g0107-whitefly\|Whitefly]] | China | espionagem | active | \- |
| [[g1019-moustachedbouncer\|MoustachedBouncer]] | Belarus | espionagem | active | \- |
| [[g0034-sandworm-team\|Sandworm Team]] | Rússia (GRU — Unidade 74455) | sabotagem, espionagem, disrupção de infraestrutura | active | \- |
| [[ransom-hub\|RansomHub]] | Desconhecida (provavelmente Rússia/CIS) | financeiro, ransomware | active | healthcare, financial, critical-infrastructure, government, technology, manufacturing |
| [[nso-group-pegasus\|NSO Group / Pegasus]] | Israel | espionagem, vigilância governamental | active | government, journalism, civil-society, political |
| [[darksword-group\|DarkSword Group]] | Desconhecida | espionagem, acesso a dispositivos móveis iOS | active | government, technology, journalism |
| [[fancy-bear\|Fancy Bear]] | Rússia (GRU) | espionagem, interferência política, sabotagem | active | government, defense, political |
| [[cozy-bear\|Cozy Bear]] | Rússia (SVR) | espionagem, coleta de inteligência | active | government, technology, defense |
| [[zollo-ransomware\|Zollo Ransomware]] | desconhecida | financeiro | active | desconhecido |
| [[xenotime\|XENOTIME]] | Russia | sabotagem, ataques-destrutivos-ICS, preparação-para-catastrofe-industrial | active | energy, petrochemical, oil-gas, critical-infrastructure |
| [[uta0218\|UTA0218]] | China | espionagem | active | government, defense, technology, critical-infrastructure |
| [[unc6748\|UNC6748]] | Desconhecido (cliente PARS Defense) | espionagem, vigilancia | active | government, defense, technology |
| [[unc6353\|UNC6353]] | Rússia (suspeito) | espionagem | active | government, defense, technology, critical-infrastructure |
| [[unc5325\|UNC5325]] | China | espionagem | active | government, defense, technology |
| [[traffers-teams\|Traffers Teams]] | Russia/CIS (provável) | financeiro, roubo-de-credenciais | active | technology, financial, retail, education, government |
| [[cti/groups/ta571.md\|TA571]] | Desconhecida | financeiro | active | technology, financial, government, healthcare, retail |
| [[cti/groups/ta544.md\|TA544]] | Europa do Leste (provavel) | financeiro | active | financial, retail, technology, government |
| [[ta2726\|TA2726]] | Desconhecida | financeiro | active | technology, financial, healthcare |
| [[scarred-manticore\|Scarred Manticore]] | Iran | espionagem, acesso inicial para terceiros | active | government, military, telecommunications, financial, technology |
| [[ruzki-threat-actor\|Ruzki]] | Rússia | financeiro | active | technology, financial, consumer |
| [[pix-threat-actors\|Atores de Ameaça ao Sistema PIX]] | Brasil | financeiro, fraude bancária, roubo | active | financial, retail, consumers |
| [[cti/groups/octo-tempest.md\|Octo Tempest]] | EUA/Reino Unido | financeiro, espionagem | active | technology, retail, telecommunications, financial, aviation, gaming |
| [[nso-group\|NSO Group]] | Israel | vigilância, espionagem | active | government, civil-society, journalism, law-enforcement |
| [[monti-ransomware\|MONTI Ransomware]] | desconhecida | financeiro | active | government, defense |
| [[lucid-phaas\|Lucid PhaaS (XinXin Group)]] | China | financial | active | financial, government, telecommunications, technology |
| [[kamacite\|Kamacite]] | Russia | sabotagem, ataques-destrutivos-ICS, espionagem | active | energy, oil-gas, manufacturing, critical-infrastructure |
| [[jasper-sleet\|Jásper Sleet]] | Coreia do Norte | financeiro, roubo de propriedade intelectual, geracao de receita para o regime | active | technology, financial, manufacturing, defense, government |
| [[indra-group\|Indra Group]] | Desconhecida (suspeita oposicao iraniana) | sabotagem, hacktivismo | active | transportation, energy, financial, government |
| [[imperial-kitten\|Imperial Kitten]] | Iran | espionagem, recolha de inteligencia cinetica | active | defense, aerospace, maritime, logistics, technology, telecommunications, energy |
| [[gunra-ransomware\|Gunra Ransomware]] | Desconhecida | financeiro | active | healthcare, manufacturing, government, technology, agriculture |
| [[g1049-applejeus\|AppleJeus]] | Coreia do Norte | financeiro, espionagem | active | financial, technology, government, energy, telecommunications |
| [[g1047-velvet-ant\|Velvet Ant]] | China | espionagem, roubo-propriedade-intelectual | active | technology, financial, manufacturing, government |
| [[g1046-storm-1811\|Storm-1811]] | Desconhecida (motivação financeira) | financeiro, extorsao | active | financial, technology, healthcare, manufacturing, government |
| [[g1044-apt42\|APT42]] | Iran (IRGC-IO) | espionagem, vigilancia | active | government, media, research, ngo, technology |
| [[g1041-sea-turtle\|Sea Turtle]] | Turquia | espionagem, coleta-de-inteligencia | active | government, telecommunications, technology, media, internet-service-providers, defense |
| [[g1039-redcurl\|RedCurl]] | Russia (atribuição moderada) | espionagem, roubo-de-propriedade-intelectual | active | technology, financial, retail, insurance, travel, construction, real-estate, legal |
| [[g1038-ta578\|TA578]] | Desconhecida | financeiro | active | technology, financial, retail, professional-services |
| [[g1037-ta577\|TA577]] | Russia / Leste Europeu | financeiro | active | financial, technology, government, retail, healthcare |
| [[g1035-winter-vivern\|Winter Vivern]] | Russia | espionagem | active | \- |
| [[g1033-star-blizzard\|Star Blizzard]] | Russia | espionagem, influencia, roubo-de-credenciais | active | government, defense, academia, think-tanks, media, NGO, civil-society, journalism |
| [[g1028-apt-c-23\|APT-C-23]] | Médio Oriente (Palestina / Hamas) | espionagem | active | defense, military, government, media, technology |
| [[cti/groups/g1024-akira.md\|Akira]] | Desconhecida (provavelmente Russia/Europa Oriental) | financeiro, extorsao | active | manufacturing, financial, healthcare, technology, education, agriculture, critical-infrastructure |
| [[g1021-cinnamon-tempest\|Cinnamon Tempest]] | China | espionagem, roubo de propriedade intelectual, disrupcao via ransomware como cobertura | active | technology, gambling, pharmaceutical, media, government, defense |
| [[g0133-nomadic-octopus\|Nomadic Octopus]] | Russia | espionagem | active | \- |
| [[g0127-ta551\|TA551]] | Russia (provável) | financeiro | active | financial, healthcare, manufacturing, technology, education |
| [[g0124-bluenoroff\|BlueNoroff]] | North Korea | financeiro, roubo de criptomoeda | active | financial, cryptocurrency, technology, web3 |
| [[g0117-fox-kitten\|Fox Kitten]] | Iran | espionagem, financeiro, acesso inicial broker | active | government, defense, healthcare, financial, education, technology, energy |
| [[g0103-mofang\|Mofang]] | China | espionagem, coleta-de-inteligencia | active | government, defense, automotive, energy, technology |
| [[g0065-leviathan\|Leviathan]] | China | espionagem, roubo-propriedade-intelectual | active | maritime, defense, government, academic, aerospace, technology, energy |
| [[g0060-bronze-butler\|BRONZE BUTLER]] | China | espionagem | active | technology, manufacturing, defense, energy, biotechnology, government |
| [[g0049-oilrig\|OilRig]] | Iran (MOIS) | espionagem | active | government, energy, financial, telecommunications, defense, healthcare |
| [[g0044-winnti-group\|Winnti Group]] | China | espionagem, financeiro | active | technology, gaming, shipping, media, telecommunications, healthcare, automotive, pharmaceutical |
| [[g0040-patchwork\|Patchwork]] | India | espionagem | active | government, defense, research, technology, financial |
| [[g0037-fin6\|FIN6]] | Desconhecida (provavelmente Europa Oriental) | financeiro, extorsao | active | retail, hospitality, financial, e-commerce, healthcare, manufacturing |
| [[g0021-molerats\|Molerats]] | Palestina (Gaza) | espionagem, sabotagem | active | government, defense, military, media |
| [[g0001-axiom\|Axiom]] | China | espionagem, roubo-propriedade-intelectual | active | aerospace, defense, manufacturing, media, government, technology, telecommunications |
| [[donot-team\|DoNot Team]] | India | espionagem | active | government, military, defense, telecommunications |
| [[dev-0237\|DEV-0237]] | unknown | financeiro | active | healthcare, education, financial, critical-infrastructure |
| [[coinbasecartel\|CoinbaseCartel]] | desconhecido | financeiro | active | financial, food-and-agriculture |
| [[cti/groups/cl0p.md\|Cl0p]] | Ucrânia/Rússia (atribuição moderada) | financeiro, extorsao | active | financial, healthcare, government, technology, energy, manufacturing, retail, legal |
| [[brazen-bamboo\|BrazenBamboo]] | China | espionagem | active | government, defense, technology |
| [[atomsilo\|AtomSilo]] | China (suspeita - vinculado ao Cinnamon Tempest) | financeiro | active | technology, healthcare, financial |
| [[aggah-group\|Aggah Group]] | Oriente Medio (suspeito Palestina/Paquistao) | financeiro, espionagem | active | financial, manufacturing, retail, healthcare, technology, government |
<!-- SerializedQuery END -->
---
## Por Origem Geográfica
%%
```dataview
TABLE WITHOUT ID link(file.link, title) AS "Nota", origin AS "Origem", join(motivation, ", ") AS "Motivação", status AS "Status"
FROM "cti/groups"
WHERE type = "threat-actor"
GROUP BY origin
SORT origin ASC
```
%%
<!-- QueryToSerialize: TABLE WITHOUT ID link(file.link, title) AS "Nota", origin AS "Origem", join(motivation, ", ") AS "Motivação", status AS "Status" FROM "cti/groups" WHERE type = "threat-actor" GROUP BY origin SORT origin ASC -->
<!-- SerializedQuery: TABLE WITHOUT ID link(file.link, title) AS "Nota", origin AS "Origem", join(motivation, ", ") AS "Motivação", status AS "Status" FROM "cti/groups" WHERE type = "threat-actor" GROUP BY origin SORT origin ASC -->
| Nota | Origem | Motivação | Status |
| ---- | ---------------------------------------------------------- | --------- | ------ |
| \- | \- | \- | \- |
| \- | | \- | \- |
| \- | Alemanha (suspeita) | \- | \- |
| \- | Belarus | \- | \- |
| \- | Brasil | \- | \- |
| \- | Brasil (suspeito) | \- | \- |
| \- | Brasil / México | \- | \- |
| \- | Brasil / Reino Unido | \- | \- |
| \- | Brasil e Reino Unido | \- | \- |
| \- | China | \- | \- |
| \- | China (alta confianca) | \- | \- |
| \- | China (atribuição moderada - relacionado ao Mustang Panda) | \- | \- |
| \- | China (atribuição moderada) | \- | \- |
| \- | China (Chengdu) | \- | \- |
| \- | China (falante de chinês) | \- | \- |
| \- | China (Guangdong) | \- | \- |
| \- | China (MSS — Hainan State Security Department) | \- | \- |
| \- | China (MSS — Ministério de Segurança do Estado) | \- | \- |
| \- | China (MSS) | \- | \- |
| \- | China (PLA Navy - suspeito) | \- | \- |
| \- | China (suspeita - vinculado ao Cinnamon Tempest) | \- | \- |
| \- | China (suspeito) | \- | \- |
| \- | Coreia do Norte | \- | \- |
| \- | Coreia do Norte (Lazarus Group) | \- | \- |
| \- | Coreia do Norte (RGB) | \- | \- |
| \- | Coreia do Norte (RPDC) | \- | \- |
| \- | Coreia do Sul | \- | \- |
| \- | desconhecida | \- | \- |
| \- | Desconhecida | \- | \- |
| \- | Desconhecida (afiliado DragonForce) | \- | \- |
| \- | Desconhecida (motivação financeira) | \- | \- |
| \- | Desconhecida (possível Estado-nação) | \- | \- |
| \- | Desconhecida (possívelmente China) | \- | \- |
| \- | Desconhecida (possívelmente Europa Oriental) | \- | \- |
| \- | Desconhecida (possívelmente nexo chinês) | \- | \- |
| \- | desconhecida (possívelmente patrocinado por Estado) | \- | \- |
| \- | Desconhecida (possívelmente Rússia/CIS) | \- | \- |
| \- | Desconhecida (provavel Europa Oriental) | \- | \- |
| \- | Desconhecida (provavel Russia / Leste Europeu) | \- | \- |
| \- | Desconhecida (provavelmente Europa Oriental) | \- | \- |
| \- | Desconhecida (provavelmente Rússia/CIS) | \- | \- |
| \- | Desconhecida (provavelmente Russia/Europa Oriental) | \- | \- |
| \- | Desconhecida (suspeita China) | \- | \- |
| \- | Desconhecida (suspeita espanhol-falante) | \- | \- |
| \- | Desconhecida (suspeita ocidental - EUA ou Europa) | \- | \- |
| \- | Desconhecida (suspeita oposicao iraniana) | \- | \- |
| \- | Desconhecida (suspeita Russia) | \- | \- |
| \- | desconhecida (suspeita: Oriente Médio ou Asia do Sul) | \- | \- |
| \- | desconhecida (suspeita: Oriente Médio) | \- | \- |
| \- | Desconhecida (suspeito Estado-nação) | \- | \- |
| \- | Desconhecida (suspeito ligação Conti) | \- | \- |
| \- | Desconhecida (suspeito Russofono) | \- | \- |
| \- | desconhecido | \- | \- |
| \- | Desconhecido | \- | \- |
| \- | Desconhecido (cliente PARS Defense) | \- | \- |
| \- | Emirados Arabes Unidos (EAU) | \- | \- |
| \- | EUA e Reino Unido | \- | \- |
| \- | EUA/Reino Unido | \- | \- |
| \- | Europa do Leste (provavel) | \- | \- |
| \- | Europa Oriental (atribuição provável) | \- | \- |
| \- | Europa Oriental / Rússia | \- | \- |
| \- | Filipinas (provável) | \- | \- |
| \- | India | \- | \- |
| \- | India (suspeita) | \- | \- |
| \- | Internacional (membros globais; C2 em Moscou documentado) | \- | \- |
| \- | Ira | \- | \- |
| \- | Irã | \- | \- |
| \- | Irã (IRGC — Guarda Revolucionária Islâmica) | \- | \- |
| \- | Irã (IRGC-CEC) | \- | \- |
| \- | Irã (MOIS) | \- | \- |
| \- | Irã (suspeito) | \- | \- |
| \- | Iran | \- | \- |
| \- | Iran (IRGC-IO) | \- | \- |
| \- | Iran (MOIS) | \- | \- |
| \- | Israel | \- | \- |
| \- | Latin America | \- | \- |
| \- | Líbano (afiliação Hezbollah suspeita) | \- | \- |
| \- | Libano (coordenado com Iran/MOIS) | \- | \- |
| \- | Líbano (GDGS - General Directoraté of General Security) | \- | \- |
| \- | Médio Oriente (Palestina / Hamas) | \- | \- |
| \- | Múltiplos (Rússia / Coreia do Norte) | \- | \- |
| \- | Nigeria | \- | \- |
| \- | North Korea | \- | \- |
| \- | Ocidente (anglófono) | \- | \- |
| \- | Ocidente (provável agência de inteligência ocidental) | \- | \- |
| \- | Oriente Médio | \- | \- |
| \- | Oriente Medio (suspeito Palestina/Paquistao) | \- | \- |
| \- | Oriente Medio / Russia (membros de ambas regioes) | \- | \- |
| \- | Pakistan | \- | \- |
| \- | Palestina | \- | \- |
| \- | Palestina (Gaza) | \- | \- |
| \- | Palestina (Hamas-afiliado, suspeito) | \- | \- |
| \- | Paquistão (suspeito) | \- | \- |
| \- | Reino Unido / Alemanha | \- | \- |
| \- | Russia | \- | \- |
| \- | Rússia | \- | \- |
| \- | Russia (atribuição moderada) | \- | \- |
| \- | Russia (Europa Oriental) | \- | \- |
| \- | Rússia (GRU — APT28) | \- | \- |
| \- | Rússia (GRU — Unidade 26165 e 74455) | \- | \- |
| \- | Rússia (GRU — Unidade 74455) | \- | \- |
| \- | Rússia (GRU) | \- | \- |
| \- | Russia (provavel, falantes de russo) | \- | \- |
| \- | Russia (provavel) | \- | \- |
| \- | Russia (provável) | \- | \- |
| \- | Rússia (suspeito - ligação Evil Corp) | \- | \- |
| \- | Rússia (suspeito) | \- | \- |
| \- | Rússia (SVR — Serviço de Inteligência Estrangeiro) | \- | \- |
| \- | Rússia (SVR) | \- | \- |
| \- | Russia / Leste Europeu | \- | \- |
| \- | Rússia / Leste Europeu | \- | \- |
| \- | Rússia / Ucrânia | \- | \- |
| \- | Russia/CIS (provável) | \- | \- |
| \- | Russia/Kazakhstan | \- | \- |
| \- | Russofono | \- | \- |
| \- | Suspeito Russofono | \- | \- |
| \- | Turkey | \- | \- |
| \- | Turquia | \- | \- |
| \- | Ucrânia/Rússia (atribuição moderada) | \- | \- |
| \- | unknown | \- | \- |
| \- | Unknown | \- | \- |
| \- | Vietnam | \- | \- |
<!-- SerializedQuery END -->
---
## Com Foco em LATAM e Brasil
%%
```dataview
TABLE WITHOUT ID link(file.link, title) AS "Ator", origin AS "Origem", join(motivation, ", ") AS "Motivação", join(targets-sectors, ", ") AS "Setores"
FROM "cti/groups"
WHERE type = "threat-actor" AND (contains(targets-countries, "Brasil") OR contains(targets-countries, "México") OR contains(targets-countries, "Colômbia") OR contains(origin, "Brasil") OR contains(origin, "Colômbia"))
SORT file.mtime DESC
```
%%
<!-- QueryToSerialize: TABLE WITHOUT ID link(file.link, title) AS "Ator", origin AS "Origem", join(motivation, ", ") AS "Motivação", join(targets-sectors, ", ") AS "Setores" FROM "cti/groups" WHERE type = "threat-actor" AND (contains(targets-countries, "Brasil") OR contains(targets-countries, "México") OR contains(targets-countries, "Colômbia") OR contains(origin, "Brasil") OR contains(origin, "Colômbia")) SORT file.mtime DESC -->
<!-- SerializedQuery: TABLE WITHOUT ID link(file.link, title) AS "Ator", origin AS "Origem", join(motivation, ", ") AS "Motivação", join(targets-sectors, ", ") AS "Setores" FROM "cti/groups" WHERE type = "threat-actor" AND (contains(targets-countries, "Brasil") OR contains(targets-countries, "México") OR contains(targets-countries, "Colômbia") OR contains(origin, "Brasil") OR contains(origin, "Colômbia")) SORT file.mtime DESC -->
| Ator | Origem | Motivação | Setores |
| -------------------------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| [[cti/groups/vice-society.md\|Vice Society]] | Russia (provavel, falantes de russo) | financeiro, ransomware | education, healthcare, manufacturing, government |
| [[sandworm\|Sandworm]] | Rússia (GRU — Unidade 74455) | sabotagem, espionagem, disrupção de infraestrutura | energy, critical-infrastructure, government, telecommunications, financial |
| [[cti/groups/mispadu.md\|Mispadu (SAMBA SPIDER)]] | Brasil / México | financial | financial, government, technology |
| [[lazarus-group\|Lazarus Group]] | Coreia do Norte | espionagem, financeiro, sabotagem | financial, cryptocurrency, government, defense, technology |
| [[lapsus-group\|LAPSUS$]] | Brasil / Reino Unido | financeiro, fama, extorsão | technology, telecommunications, government, gaming |
| [[grandoreiro\|Grandoreiro (Operadores)]] | Brasil | financeiro | financial, cryptocurrency |
| [[fin6\|FIN6]] | Rússia / Leste Europeu | financeiro, ransomware, roubo de dados de cartão | retail, hospitality, financial, technology |
| [[fin7\|FIN7]] | Rússia / Ucrânia | financeiro, ransomware | financial, retail, hospitality, technology, healthcare |
| [[cobalt-group\|Cobalt Group]] | Rússia / Leste Europeu | financeiro, roubo bancário, ataques ATM | financial, banking |
| [[apt38\|APT38]] | Coreia do Norte (RGB) | financeiro, roubo de criptoativos, ataques SWIFT | financial, cryptocurrency, banking |
| [[cti/groups/ta558.md\|TA558]] | Unknown | financeiro | hospitality, travel, transportation, financial |
| [[stormous\|Stormous]] | Oriente Medio / Russia (membros de ambas regioes) | financeiro, hacktivismo, politico | technology, energy, manufacturing, government, financial |
| [[cti/groups/qilin.md\|Qilin]] | Rússia | financeiro | manufacturing, financial, healthcare, government, energy, critical-infrastructure, technology |
| [[pinchy-spider\|Pinchy Spider]] | Russia | financeiro, extorcao, ransomware-as-a-service | financial, healthcare, manufacturing, government, technology, food-agriculture |
| [[lockbit-group\|LockBit]] | Russia (provavel) | financeiro, ransomware | financial, healthcare, government, manufacturing, critical-infrastructure, technology, education |
| [[cti/groups/hunters-international.md\|Hunters International]] | Suspeito Russofono | financeiro | manufacturing, healthcare, financial, government, education, professional-services, energy |
| [[gold-blazer\|Gold Blazer]] | Russia | financeiro | financial, healthcare, technology, critical-infrastructure, retail, government |
| [[cti/groups/ghostsec.md\|GhostSec]] | Internacional (membros globais; C2 em Moscou documentado) | hacktivismo, financeiro, politico | government, critical-infrastructure, technology, financial, manufacturing, education, telecommunications |
| [[g1052-contagious-interview\|Contagious Interview]] | Coreia do Norte (RPDC) | financeiro, roubo de criptomoedas, espionagem | technology, financial, cryptocurrency, software |
| [[g1051-medusa-ransomware\|Medusa Ransomware]] | Desconhecida | financeiro | healthcare, education, technology, manufacturing, government, legal, insurance |
| [[g1040-play\|Play]] | Suspeito Russofono | financeiro | government, manufacturing, financial, healthcare, legal, critical-infrastructure, media |
| [[g1016-fin13\|FIN13]] | Unknown | financeiro | financial, retail, hospitality |
| [[g1004-lapsus\|LAPSUS$]] | Brasil e Reino Unido | financeiro, destruicao, notoriedade | technology, telecommunications, gaming, automotive, media, government, healthcare, semiconductor |
| [[g0115-gold-southfield\|GOLD SOUTHFIELD]] | Rússia | financeiro, ransomware | technology, financial, healthcare, manufacturing, government, food-and-beverage |
| [[g0082-apt38\|APT38]] | North Korea | financeiro, espionagem | financial, banking, cryptocurrency, critical-infrastructure |
| [[g0071-orangeworm\|Orangeworm]] | Desconhecida | espionagem-corporativa, roubo de propriedade intelectual | healthcare, manufacturing, technology, logistics, agriculture |
| [[g0070-dark-caracal\|Dark Caracal]] | Líbano (GDGS - General Directoraté of General Security) | espionagem, vigilancia-politica | government, military, utilities, financial, telecommunications, technology, education |
| [[g0054-sowbug\|Sowbug]] | Desconhecida (suspeito Estado-nação) | espionagem, inteligência diplomática | government, foreign-policy, diplomatic |
| [[g0033-poseidon-group\|Poseidon Group]] | Brasil (suspeito) | espionagem, extorsão, financeiro | financial, banking, government, telecommunications, manufacturing, energy, media |
| [[g0008-carbanak\|Carbanak]] | | financeiro | financial, banking, hospitality, retail |
| [[cti/groups/darkside.md\|DarkSide]] | Russia (Europa Oriental) | financeiro, ransomware | critical-infrastructure, energy, manufacturing, healthcare, financial, technology |
| [[chamelgang\|ChamelGang]] | China (alta confianca) | espionagem, roubo-de-dados, financeiro | energy, aviation, government, healthcare, manufacturing, financial |
| [[blacksuit\|BlackSuit]] | Russia | financeiro | healthcare, manufacturing, government, technology, education, critical-infrastructure, financial |
| [[cti/groups/blackbasta.md\|Black Basta]] | Russia | financeiro | healthcare, financial, manufacturing, critical-infrastructure, government, legal, technology |
| [[8base\|8Base]] | Russia | financeiro | manufacturing, financial, technology, healthcare, construction, professional-services |
| [[apt-tekir\|APT Tekir]] | desconhecida | espionagem, financeiro | government |
| [[g1026-malteiro\|Malteiro]] | Brasil | espionagem | \- |
| [[nso-group-pegasus\|NSO Group / Pegasus]] | Israel | espionagem, vigilância governamental | government, journalism, civil-society, political |
| [[traffers-teams\|Traffers Teams]] | Russia/CIS (provável) | financeiro, roubo-de-credenciais | technology, financial, retail, education, government |
| [[ruzki-threat-actor\|Ruzki]] | Rússia | financeiro | technology, financial, consumer |
| [[pix-threat-actors\|Atores de Ameaça ao Sistema PIX]] | Brasil | financeiro, fraude bancária, roubo | financial, retail, consumers |
| [[lucid-phaas\|Lucid PhaaS (XinXin Group)]] | China | financial | financial, government, telecommunications, technology |
| [[gunra-ransomware\|Gunra Ransomware]] | Desconhecida | financeiro | healthcare, manufacturing, government, technology, agriculture |
| [[g1049-applejeus\|AppleJeus]] | Coreia do Norte | financeiro, espionagem | financial, technology, government, energy, telecommunications |
| [[cti/groups/g1024-akira.md\|Akira]] | Desconhecida (provavelmente Russia/Europa Oriental) | financeiro, extorsao | manufacturing, financial, healthcare, technology, education, agriculture, critical-infrastructure |
| [[g1021-cinnamon-tempest\|Cinnamon Tempest]] | China | espionagem, roubo de propriedade intelectual, disrupcao via ransomware como cobertura | technology, gambling, pharmaceutical, media, government, defense |
| [[g0044-winnti-group\|Winnti Group]] | China | espionagem, financeiro | technology, gaming, shipping, media, telecommunications, healthcare, automotive, pharmaceutical |
| [[coinbasecartel\|CoinbaseCartel]] | desconhecido | financeiro | financial, food-and-agriculture |
| [[cti/groups/cl0p.md\|Cl0p]] | Ucrânia/Rússia (atribuição moderada) | financeiro, extorsao | financial, healthcare, government, technology, energy, manufacturing, retail, legal |
| [[atomsilo\|AtomSilo]] | China (suspeita - vinculado ao Cinnamon Tempest) | financeiro | technology, healthcare, financial |
| [[aggah-group\|Aggah Group]] | Oriente Medio (suspeito Palestina/Paquistao) | financeiro, espionagem | financial, manufacturing, retail, healthcare, technology, government |
<!-- SerializedQuery END -->
---
## Últimas Atualizações
%%
```dataview
TABLE WITHOUT ID link(file.link, title) AS "Ator", type AS "Tipo", dateformat(file.mtime, "yyyy-MM-dd HH:mm") AS "Modificado"
FROM "cti/groups"
WHERE publish = true AND !contains(file.name, "_")
SORT file.mtime DESC
LIMIT 5
```
%%
<!-- QueryToSerialize: TABLE WITHOUT ID link(file.link, title) AS "Ator", type AS "Tipo", dateformat(file.mtime, "yyyy-MM-dd HH:mm") AS "Modificado" FROM "cti/groups" WHERE publish = true AND !contains(file.name, "_") SORT file.mtime DESC LIMIT 5 -->
<!-- SerializedQuery: TABLE WITHOUT ID link(file.link, title) AS "Ator", type AS "Tipo", dateformat(file.mtime, "yyyy-MM-dd HH:mm") AS "Modificado" FROM "cti/groups" WHERE publish = true AND !contains(file.name, "_") SORT file.mtime DESC LIMIT 5 -->
| Ator | Tipo | Modificado |
| ------------------------------------------------ | ------------ | ---------------- |
| [[void-manticore\|Void Manticore]] | threat-actor | 2026-03-30 19:12 |
| [[volt-typhoon\|Volt Typhoon]] | threat-actor | 2026-03-30 19:12 |
| [[cti/groups/vice-society.md\|Vice Society]] | threat-actor | 2026-03-30 19:12 |
| [[unc6691\|UNC6691]] | threat-actor | 2026-03-30 19:12 |
| [[unc4736\|UNC4736]] | threat-actor | 2026-03-30 19:12 |
<!-- SerializedQuery END -->
---
*Perfis são atualizados continuamente conforme nova inteligência é públicada. Para ver campanhas associadas a grupos específicos, consulte [[_campaigns|Campanhas e Incidentes]].*