malware-log.hatenablog.com
malware-log.hatenablog.com
malware-log.hatenablog.com
【目次】
【中国】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| 中国 | APT1 | APT1 | FireEye(Mandiant) | |
| BrownFox | iSight(FireEye) | |||
| Byzantine Candor | ||||
| Comment Crew | ||||
| Comment Group | ||||
| Comment Panda | Crowdstrike | |||
| G0006 | ATT&CK | |||
| Gif89a | ||||
| Greop 3 | ||||
| PLA Unit 61398 | 中国政府の対応組織 | |||
| ShadyRat | ||||
| Shanghai Group | ||||
| TG-8223 | Dell SecureWorks | |||
| APT2 | APT2 | FireEye(Mandiant) | ||
| G0024 | ATT&CK | |||
| Group 36 | Talos(CISCO) | |||
| PLA Unit 61486 | 中国政府の対応組織 | |||
| Putter Panda | CrowdStrike | |||
| SearchFire | ||||
| Sulphur | Microsoft | |||
| TG-6952 | Dell Secure Works | |||
| APT3 | APT3 | FireEye(Mandiant) | ||
| Boyusec | ||||
| Buckeye | Symantec | |||
| Clandestine Fox | ||||
| G0022 | ATT&CK | |||
| Gothic Panda | CrowdStrike | |||
| Group 6 | Talos(Cisco) | |||
| Oldcarp | iDefense | |||
| Pirpi | PWC | |||
| Silvercarp | iDefense | |||
| Templar | ||||
| TG-0110 | Dell Secureworks | |||
| Threat Group-0110 | ||||
| UPS | ||||
| UPS Team | ||||
| APT4 | APT4 | FireEye(Mandiant) | ||
| Maverick Panda | CrowdStrike | |||
| Samurai Panda | CrowdStrike | |||
| Sykipot | AlienVault | |||
| Wisp Team | Symantec | |||
| APT5 | APT5 | FireEye(Mandiant) | ||
| Bronze Fleetwood | Secureworks | |||
| DPD | Palo Alto | |||
| G1023 | ATT&CK | |||
| Keyhole Panda | CrowdStrike | |||
| Manganese | Microsoft | |||
| Poisoned Flight | Kaspersky | |||
| TEMP.Bottle | iSight | |||
| UNC2630 | FireEye | |||
| TG-2754 | SCWX CTU | |||
| APT6 | 1.php Group | ZScaler | ||
| APT6 | FireEye | |||
| APT7 | APT7 | FireEye(Mandiant) | ||
| APT8 | APT8 | FireEye(Mandiant) | ||
| APT20 | FireEye(Mandiant) | |||
| Covert Grobe | ||||
| TH3Bug | Paloalto | |||
| Violin Panda | CrowdStrike | |||
| APT9 | APT9 | FireEye(Mandiant) | ||
| Flowerlady | ||||
| Flowershow | ||||
| Group 27 | ASERT | |||
| Nightshade Panda | CrowdStrike | |||
| APT10 | APT10 | FireEye(Mandiant) | ||
| CVNX | BAE Systems | |||
| Hogfish | iDefense | |||
| menuPass | Symantec, Paloalto | |||
| Potassium | Microsoft | |||
| Red Apollo | PwC | |||
| Stone Panda | CrowdStrike | |||
| APT12 | APT12 | FireEye(Mandiant) | ||
| Calc Team | ||||
| G0005 | ATT&CK | |||
| Numbered Panda | ||||
| APT14 | APT14 | FireEye(Mandiant) | ||
| Anchor Panda | ||||
| APT15 | APT15 | FireEye(Mandiant) | ||
| GREF | Dell SecureWorks | |||
| Ke3chang | FireEye | |||
| Playful Dragon | FireEye | |||
| Royay APT | NCC Group | |||
| Vixen Panda | CrowdStrike | |||
| APT16 | APT16 | FireEye(Mandiant) | ||
| G0023 | ATT&CK | |||
| SVCMONDR | Kaspersky | |||
| APT17 | APT17 | FireEye(Mandiant) | ||
| Deputy Dog | iDefense | |||
| Dogfish | iDefense | |||
| G0025 | ATT&CK | |||
| Hidden Lynx | Symantec | |||
| Tailgater Team | Symantec | |||
| APT18 | APT18 | FireEye(Mandiant) | ||
| Dogfish | iDefense | |||
| Dynamite Panda | CrowdStrike | |||
| G0026 | ATT&CK | |||
| Scandium | Microsoft | |||
| TG-0416 | Dell SecureWorks | |||
| Wekby | Paloalto | |||
| APT19 | APT19 | FireEye(Mandiant) | ||
| Codoso | Unit 42 (Paloalto) | |||
| Deep Panda | CrowdStrike | |||
| G0073 | ATT&CK | |||
| SunShop Group | FireEye | |||
| APT20 | APT20 | FireEye(Mandiant), APT8と関係か? | ||
| Twivy | ||||
| APT21 | NetTraveler | |||
| APT21 | FireEye(Mandiant) | |||
| Zhenbao | ||||
| APT22 | APT22 | FireEye(Mandiant) | ||
| Barista | ||||
| APT23 | APT23 | FireEye(Mandiant) | ||
| APT24 | APT24 | FireEye(Mandiant) | ||
| Manganese | Microsoft | |||
| Pitty Panda | CrowdStrike | |||
| PittyTiger | FireEye(Mandiant) | |||
| Tigerbarb | iDefense | |||
| APT25 | APT25 | FireEye(Mandiant) | ||
| Ke3chang | ||||
| Uncool | ||||
| Vixen Panda | ||||
| Sushi Roll | ||||
| Tor | ||||
| APT26 | APT26 | FireEye(Mandiant) | ||
| Deep Panda | CrowdStrike | |||
| APT27 | APT27 | FireEye(Mandiant) | ||
| ARCHERFISH | ||||
| Bronze Union | SecureWorks | |||
| Emissary Panda | CrowdStrike, NCC Group | |||
| Group 35 | Talos (Cisco) | |||
| HIPPOTeam | ||||
| Iron Tiger | ||||
| LuckyMouse | Kaspersky | |||
| TEMP.Hippo | ||||
| TG-3390 | SecureWorks | |||
| Threat Group-3390 | ||||
| ZipToken | ||||
| APT30 | APT30 | FireEye(Mandiant) | ||
| APT.Naikon | ||||
| Camerashy | ||||
| G0013 | ATT&CK | |||
| Lotus Panda | ||||
| Naikon | Kaspersky | |||
| Override Panda | CrowdStrik | |||
| PLA Unit 78020 | 中国政府 | |||
| Possibly responsible | ||||
| APT31 | APT31 | FireEye(Mandiant) | ||
| APT40 | APT40 | FireEye(Mandiant) | ||
| Bronze Mohawk | Secureworks | |||
| Feverdream | Microsoft | |||
| G0065 | ATT&CK | |||
| Gadolinium | Microsoft | |||
| GreenCrash | Kaspersky | |||
| Hellsing | Kaspersky | |||
| Kryptonite Panda | Crowdstrike | |||
| Leviathan | Proofpoint | |||
| Mudcarp | ||||
| Periscope | ||||
| TEMP.Periscope | FireEye | |||
| TEMP.Jumper | FireEye | |||
| APT41 | Amoeva | TeamT5 | ||
| APT41 | FireEye(Mandiant) | |||
| Barium | Microsoft | |||
| Blackfly | ||||
| Bronze Atlas | Dell Secure Works | |||
| G0096 | ATT&CK | |||
| Suckfly | Symantec | |||
| UNIT2025 | ||||
| Vision2025 | ||||
| Wicked Panda | ||||
| Wicked Spider | ||||
| Winnti | 一般的 (Kaspersky, ESET, Cleasky) | |||
| DragonOK | DragonOK | |||
| Icefog | Icefog | |||
| Moafee | Moafee | |||
| Titan Rain | Titan Rain | |||
| Tick | Bald Knight | |||
| Bronze Butler | Dell Secureworks, (Trendmicro) | |||
| NCPH | iDefense | |||
| Nian | ||||
| RedBaldKnight | Trendmicro | |||
| The Bald Knight Rises | kaspersky | |||
| Tick | Symantec, (Trendmicro), Ahnlab |
【北朝鮮】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| 北朝鮮 | 110研究所 | 110研究所 | ||
| LAB110 | ||||
| 121部隊 | 121部隊 | |||
| 180部隊 | 180部隊 | |||
| Andariel | Andariel | |||
| APT45 | Mandiant | |||
| Clasiopa | ||||
| DarkSeoul | ||||
| Nickel Hyatt | ||||
| Onyx Sleet | Microsoft | |||
| Plutonium | Microsoft (旧名称) | |||
| Stonefly | ||||
| Silent Chollima | CrowdStrike | |||
| APT37 | APT37 | FireEye | ||
| ATK4 | ||||
| Dark Sleeper | ||||
| FreeMilk | ||||
| G0067 | ATT&CK | |||
| Group 123 | Tolos (Cisco) | |||
| InkySquid | ||||
| Moldy Pisces | ||||
| Reaper | ||||
| Red Eyes | ||||
| Ricochet Chollima | ||||
| ScarCruft | Kaspersky | |||
| Sun Team | ||||
| Venus 121 | ||||
| APT38 | APT38 | FireEye | ||
| G0082 | ATT&CK | |||
| Stardust Chollima | CrowdStrike | |||
| Temp.Hermit | FireEye | |||
| Bluenoroff | Bluenoroff | |||
| Cerium | Cerium | |||
| DEV-0530 | DEV-0530 | |||
| Hermit | Hermit | |||
| Temp.Hermit | ||||
| Lazarus | Appleworm | |||
| Bureau 121 | ||||
| Dark Seoul | ||||
| Group 77 | Talos (Cisco) | |||
| Guardians of Peace | ||||
| Hastati (Group) | ||||
| Hidden Cobra | 米国政府 | |||
| Labyrinth Chollima | ||||
| Lazarus | ||||
| NewRomanic Cyber Army Team | ||||
| TA404 | Proofpoint | |||
| Unit 121 | ||||
| Whois Hacking Team | ||||
| Zinc | Microsoft | |||
| TA444 | TA444 | |||
| Thallium | Thallium | Microsoft | ||
| UNC3782 | UNC3782 | |||
| UNC4469 | UNC4469 | |||
| UNC4736 | UNC4736 | |||
| 偵察総局 | 偵察総局 |
【ベトナム】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| ベトナム | APT32 | APT32 | ||
| APT-C-00 | 360 | |||
| Cobalt Kitty | ||||
| G0050 | ATT&CK | |||
| Ocean Buffalo | CrowdStrike | |||
| Ocean Lotus | SkyEye Lab | |||
| SeaLotus |
【ロシア】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| ロシア | APT28 | APT28 | FireEye | |
| Fancy Bear | CrowdStrike | |||
| Fighting Ursa | Paloalto | |||
| Forest Blizzard | Microsoft (新) | |||
| G0007 | ATT&CK | |||
| Grizzly Steppe | 米国政府 | |||
| Group 74 | Talos(CISCO) | |||
| GRU Unit 26165 | 海外(部隊の名称) | |||
| Iron Twilight | Dell SecureWorks | |||
| Pawn Storm | Trendmicro | |||
| Sednit | ESET | |||
| SIG40 | NSA | |||
| SnakeMackerel | iDefense | |||
| Sofacy | NSA, FBI | |||
| Strontium | Microsoft (旧) | |||
| Swallowtail | Symantec | |||
| TG-4127 | SecureWorks | |||
| Threat Group-4127 | SecureWorks | |||
| Tsar Team | iSight(FireEye) | |||
| UAC-0001 | CERT-UA | |||
| x-agent | ||||
| 第26165部隊 | 日本(部隊の名称) | |||
| APT29 | APT29 | FireEye(Mandiant) | ||
| CloudLook | Kaspersky | |||
| CozyDuke | ||||
| Cozy Bear | CrowdStrike | |||
| G0016 | ATT&CK | |||
| Grizzly Steppe | 米国政府 | |||
| Group 100 | Talos(CISCO) | |||
| Iron Hemlock | Dell SecureWorks | |||
| Minidionis | Palo Alto | |||
| The Dukes | F-secure | |||
| Dragonfly | Dragonfly | Symantec | ||
| Bromine | Microsoft | |||
| Energetic Bear | ||||
| Red October | Red October | Kaspersky, 一般 | ||
| Cloud Atlas | Kaspersky, 一般 | |||
| Sandworm | APT44 | Mandiant | ||
| BlackEnergy | Kaspersky | |||
| Blue Echidna | ||||
| Cyclops Blink | ||||
| ELECTRUM | ||||
| G0034 | ||||
| Grey Tornado | ||||
| GTsST | ||||
| Iridium | ||||
| Iron Viking | Secureworks | |||
| OlympicDestroyer | ||||
| Quedagh | ||||
| Razing Ursa | ||||
| Sandworm | 一般的 | |||
| Telebots | ESET | |||
| UAC-0082 | ||||
| Unit 74455 | ||||
| Voodoo Bear | CrowdStrike | |||
| Turla | Turla | Kaspersky | ||
| Krypton | ||||
| Snake | ※ Ransamware の Snake とは別物 | |||
| Uroburos | ||||
| Venomous Bear | ||||
| Waterbug | ||||
| WhiteBear |
【ベラルーシ】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| ベラルーシ | Ghostwriter | Ghostwriter | ||
| Storm-0257 | ||||
| UNC1151 | ||||
| UAC-0051 | ||||
| White Lynx |
【イラン】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| イラン | APT33 | APT33 | FireEye(Mandiant) | |
| Charming Kitten | (APT35の別名に分類するベンダーも) | |||
| Elfin | ||||
| G0064 | ATT&CK | |||
| Holmium | Microsoft | |||
| iKittens | ||||
| MacDownloader | EnigmaSoft | |||
| Magnallium | Dragos | |||
| NewsBeef | ||||
| Parastoo | ||||
| Refined Kitten | Crowdstrike | |||
| APT34 | APT34 | FireEye(Mandiant) | ||
| Helix Kitten | Wikipedia | |||
| OilRig | Kaspersky | |||
| Irn2 | ||||
| Pipefish | iDefense | |||
| GreenBug | ||||
| Chrysene | ||||
| Crambus | ||||
| Cobalt Gyp | ||||
| APT35 | Ajax Security Team | |||
| APT35 | FireEye(Mandiant) | |||
| Charming Kitten | Clearsky CrowdStrike CERTFA |
|||
| Cobalt Gypsy | ||||
| Cobalt Illusion | Secureworks | |||
| ITG18 | X-Force(IBM) | |||
| Magic Hound | Paloalto | |||
| NewsBeef | Kaspersky | |||
| Newscaster | ||||
| Phosphorus | Microsoft | |||
| TA453 | Proofpoint | |||
| Tarh Andishan | Cylance | |||
| TEMP.Beanie | FireEye | |||
| Timberworm | Symantec | |||
| Yellow Garuda | PwC | |||
| APT39 | APT39 | FireEye(Mandiant) | ||
| Cadelle | ||||
| Chafer | ||||
| G0087 | ATT&CK | |||
| Helix Kitten | ||||
| APT42 | APT42 | FireEye(Mandiant) | ||
| Mint Sandstorm | ||||
| PhosPhorous | Microsoft | |||
| UNC788 | ||||
| Iridium | DEV-0960 | |||
| Iridium | Microsoft | |||
| Seashell Blizzard | Microsoft | |||
| Pioneer Kitten | Fox Kitten | Clearsky | ||
| Lemon Sandstorm | ||||
| Parasite | ||||
| Pioneer Kitten | Crowdstrike | |||
| Rubidium | Microsoft | |||
| UNC757 | Mandiant | |||
| Rocket Kitten | Rocket Kitten | CrowdStrike | ||
| UNC1860 | DEV-0861 | Microsoft | ||
| Scarred Manticore | Check Point | |||
| ShroudedSnooper | Talos (Cisco) | |||
| Storm-0861 | Microsoft | |||
| UNC1860 | Mandiant |
【パキスタン】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| パキスタン | APT36 | APT36 | FireEye(Mandiant) | |
| Cmajor | ||||
| C-Major | ||||
| Copper Fieldstone | ||||
| Earth Karkaddan | Trendmicro | |||
| Fast-Cargo | ||||
| G0134 | ATT&CK | |||
| Green Halvidar | ||||
| Havildar Team | ||||
| Lapis | ||||
| Mythic Leopard | Crowdstrike | |||
| Opaque Draco | Palo Alto | |||
| ProjectM | Palo Alto | |||
| Transparent Tribe | Cisco | |||
| Gorgon Group | Gorgon Group | |||
| Sidecopy | G1008 | ATT&CK | ||
| Mocking Draco | Palo Alto | |||
| Sidecopy | ThreatDown | |||
| UNC2269 | ||||
| White dev 55 | PwC |
【シリア】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| シリア | シリア電子軍 | シリア電子軍 | ||
| Syrian Electronic Army |
【インド】
| 国名(推定) |
攻撃組織名 |
別名 |
備考 |
|
|---|---|---|---|---|
| インド | Confucius | Confucius | ||
| SideWinder | APT-C-17 | |||
| APT-Q-39 | ||||
| BabyElephant | ||||
| Chinastrats | ||||
| DEV-0124 | ||||
| Dropping Elephant | Kaspersky | |||
| G0121 | ATT&CK | |||
| GroupA21 | ||||
| Hardcore Nationalist | ||||
| HN2 | ||||
| Leafperphorator | ||||
| Orange Chandi | ||||
| Patchwork | ||||
| Rattlesnake | Tencent | |||
| Razor Tiger | Crowdstrike | |||
| Sidewinder | Kaspersky | |||
| T-APT-04 | Tencent | |||
| UNC1687 | Mandiant | |||
| Venomous Gemini | Palo Alto |
ベンダー別名称
| FireEye |
CrowdStrike |
Dell SecureWorks |
Talos(CISCO) |
Trendmicro |
Symantec |
Kaspersky |
Microsoft |
ATT&CK |
所属国(推定) |
|---|---|---|---|---|---|---|---|---|---|
| APT1 | Comment Panda | TG-8223 | G0006 | 中国 | |||||
| APT2 | Putter Panda | TG-6952 | Group 36 | 中国 | |||||
| APT3 | Gothic Panda | TG-0110 | Group 6 | 中国 | |||||
| APT4 | Samurai Panda | 中国 | |||||||
| APT5 | Keyhole Panda | Bronze Fleetwood | Poisoned Flight | 中国 | |||||
| APT6 | |||||||||
| APT7 | |||||||||
| APT8 | Violin Panda | 中国 | |||||||
| APT9 | Nightshade Panda | 中国 | |||||||
| APT10 | Stone Panda | 中国 | |||||||
| APT12 | Numbered Panda | 中国 | |||||||
| APT14 | Anchor Panda | 中国 | |||||||
| APT15 | Vixen Panda | Flea | Nylon Typhoon | G0004 | 中国 | ||||
| APT16 | SVCMONDR | 中国 | |||||||
| APT17 | Tailgater Team | 中国 | |||||||
| APT19 | Deep Panda | 中国 | |||||||
| APT27 | Emissary Panda | 中国 | |||||||
| APT28 | Fancy Bear | TG-4127 | Group 74 | Pawn Storm | Swallowtail | Sofacy | ロシア | ||
| APT29 | Cozy Bear | ロシア | |||||||
| APT30 | Override Panda | G0013 | 中国 | ||||||
| APT32 | Ocean Buffalo | ベトナム | |||||||
| APT33 | イラン | ||||||||
| APT34 | イラン | ||||||||
| APT35 | イラン | ||||||||
| APT36 | G0134 | パキスタン | |||||||
| APT39 | イラン | ||||||||
| APT41 | Bronze Atlas | Winnti | 中国 | ||||||
| APT42 | イラン | ||||||||
| Energetic Bear | ロシア | ||||||||
| Rocket Kitten | イラン | ||||||||
| Tick | Bronze Butler | 中国 |
【関連まとめ記事】
◆標的型攻撃組織 / APT (まとめ)
https://malware-log.hatenablog.com/entry/APT
