Seraph CTI tracks threat actor groups sourced from the public MITRE ATT&CK knowledge base — their aliases, techniques, tools and campaigns — and connects that intelligence to the technologies, sectors and regions that matter to you.
A suspicious process, a strange login, an unfamiliar tool on a host — on their own, these are just events. Attributing them to a known threat actor's documented behaviour is what turns an isolated observation into an informed decision about what happens next.
This is what MITRE ATT&CK was built to standardise, and what Seraph CTI carries the rest of the way to a defensive priority.
Something happens in your environment.
A technique, tool or artefact is observed.
Search by name, alias, MITRE ATT&CK ID or technique. Sourced from MITRE's public Enterprise ATT&CK dataset.
176 threat actor groups match your filters.
| Actor | MITRE ID | Aliases | Techniques | Campaigns |
|---|
MITRE ATT&CK documents actor behaviour, not specific CVE exploitation — that link has to be made deliberately, from real reporting, not inferred. Seraph CTI maintains that connection separately in its CISA KEV tracking, correlating confirmed exploited vulnerabilities against the technologies you run.
Seraph does not publish actor-to-CVE links here unless independently sourced and confirmed — an unverified link is worse than none.
View CISA KEV IntelligenceMost organisations don't need to track every documented threat actor — they need to know which ones are relevant to their industry, region and technology stack.
Illustrative — organisational relevance scoring is computed against your own declared environment inside the authenticated Seraph CTI platform, not shown here for any real customer.
Signed-in Seraph CTI customers can build a watchlist of specific threat actor groups and get notified when their profile changes — new techniques, new campaigns, or a newly-published alias.
A threat actor isn’t just an intelligence artefact — it’s a lens every other part of the Seraph platform can apply.
Match documented actor behaviour against your technology stack, sector and region — and get notified when a tracked actor's profile changes.
The indicator matches known attacker behaviour.
What the actor is known to do, mapped to ATT&CK.
Who this actor typically goes after.
Espionage, financial gain, disruption — based on known history.
What to check, harden or watch for first.
| Updated |
|---|
| Action |
|---|
| Rocke | G0106 | — | 36 | — | Jul 31, 2026 | View |
| HEXANE | G1001 | Lyceum, Siamesekitten +1 | 36 | — | Jul 31, 2026 | View |
| FIN8 | G0061 | Syssphinx | 36 | — | Jul 31, 2026 | View |
| Aquatic Panda | G0143 | — | 35 | — | Jul 31, 2026 | View |
| Cobalt Group | G0080 | GOLD KINGSWOOD, Cobalt Gang +1 | 34 | — | Jul 31, 2026 | View |
| TA505 | G0092 | Hive0065, Spandex Tempest +1 | 34 | — | Jul 31, 2026 | View |
| Indrik Spider | G0119 | Evil Corp, Manatee Tempest +2 | 33 | — | Jul 31, 2026 | View |
| APT42 | G1044 | — | 32 | — | Jul 31, 2026 | View |
| GALLIUM | G0093 | Granite Typhoon | 31 | — | Jul 31, 2026 | View |
| APT33 | G0064 | HOLMIUM, Elfin +1 | 31 | — | Jul 31, 2026 | View |
| Storm-1811 | G1046 | — | 31 | — | Jul 31, 2026 | View |
| Sidewinder | G0121 | T-APT-04, Rattlesnake | 30 | — | Jul 31, 2026 | View |
| Moonstone Sleet | G1036 | Storm-1789 | 30 | — | Jul 31, 2026 | View |
| APT37 | G0067 | InkySquid, ScarCruft +4 | 29 | — | Jul 31, 2026 | View |
| ZIRCONIUM | G0128 | APT31, Violet Typhoon | 29 | — | Jul 31, 2026 | View |
| APT5 | G1023 | Mulberry Typhoon, MANGANESE +3 | 29 | 1 | Jul 31, 2026 | View |
| Silence | G0091 | Whisper Spider | 28 | — | Jul 31, 2026 | View |
| LuminousMoth | G1014 | — | 28 | — | Jul 31, 2026 | View |
| Higaisa | G0126 | — | 28 | — | Jul 31, 2026 | View |
| TA2541 | G1018 | — | 28 | — | Jul 31, 2026 | View |
| Sea Turtle | G1041 | Teal Kurma, Marbled Dust +2 | 27 | — | Jul 31, 2026 | View |
| Winter Vivern | G1035 | TA473, UAC-0114 | 27 | — | Jul 31, 2026 | View |
| Play | G1040 | — | 26 | — | Jul 31, 2026 | View |
| WIRTE | G0090 | Ashen Lepus | 26 | — | Jul 31, 2026 | View |
Flag phishing and social engineering patterns tied to known actors.
Validate exposure to specific, relevant actor techniques.
Match known actor techniques against your actual attack surface.
Correlate live security events against known actor behaviour.
Flag phishing and social engineering patterns tied to known actors.
Validate exposure to specific, relevant actor techniques.
Can't find what you need? Ask a security expert.
Most public threat intelligence is written from a US/European vantage point. Seraph CTI surfaces the groups whose own MITRE ATT&CK documentation names an African or Middle Eastern country or region — so relevance to this region is never asserted where the source material doesn't support it.
“Mentioned” reflects MITRE's own description text, not confirmed active targeting of any specific organisation in the region today.
MITRE ATT&CK documents specific, time-bound campaigns separately from the groups behind them. Here are the most recently active ones in the public dataset, on one timeline.
The most widely-shared tools and malware families across every tracked group — dual-use tools like Mimikatz and PsExec often outrank purpose-built malware, since so many actors rely on them.
Ranked by the number of independent sources MITRE ATT&CK cites for each profile — not an editorial pick.
Here's one of the most extensively documented groups in the public dataset, shown exactly as Seraph CTI tracks it.
Also tracked as TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad
Computed live from every tracked group's documented techniques. Darker cells mean more groups are known to use that technique.
Source: MITRE ATT&CK® Enterprise matrix. Hover or open a technique for its full MITRE reference.
Counted directly from sector and region names appearing in MITRE ATT&CK's own group descriptions — a text-derived signal of documented activity, not a confirmed targeting assessment for any specific organisation.
Which industries appear most often in group descriptions?
Which countries and regions appear most often?
Seraph never asserts that an actor targets a sector or region beyond what MITRE's own published text documents — counts here reflect mentions, not verified, exhaustive targeting scope.
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.…
Every vendor that tracks a threat actor tends to name it independently — one group can carry names from CrowdStrike, Mandiant, Microsoft and government advisories at once. Collapsing that into a single identity is attribution work, and getting it wrong creates false confidence.
Seraph CTI treats aliases exactly as MITRE ATT&CK publishes them: names MITRE has already assessed as referring to the same tracked activity. We don't merge additional vendor names ourselves unless that merge is independently confirmed — an unverified alias is worse than no alias.
A general framework, not a per-actor rating applied on this public page — confidence assessment is evidence-specific and shown in context inside Seraph CTI.
“Confirmed alias” means MITRE ATT&CK lists this name as referring to the same group — not that every vendor uses the terms interchangeably in every report.
