Campaigns against documented threat groups. Each one’s wave roster is weighted by what that actor actually does, derived from its MITRE ATT&CK technique list, so a phishing operation floods the perimeter and a destructive one arrives armoured and slow. The composition is the lesson.
APT1 · also Comment Crew, Comment Group
A long-running espionage effort that got in the same way almost everyone gets in: a convincing email to somebody who had no reason to doubt it.
Relentless phishing. Volume at the perimeter, little subtlety once inside.
menuPass · also Cicada, POTASSIUM
An intrusion built on looking like software that belongs. Payloads arrive wearing the name of something you installed on purpose.
Disguised traffic. Detection matters more than raw damage.
Turla · also IRON HUNTER, Group 88
Command and control routed through infrastructure nobody thinks to watch, by an actor with a long history of doing exactly that.
Heavy command-and-control presence. Expect the lanes to stay busy.
APT29 · also IRON RITUAL, IRON HEMLOCK
Access obtained legitimately and kept quietly. The credentials are real, which is what makes it hard.
Persistence over force. Long-lived threats that keep coming back.
FIN7 · also GOLD NIAGARA, ITG14
A financially motivated crew with a taste for attachments that run more than they claim to, aimed squarely at payment systems.
Delivered payloads in volume. Splash damage earns its place.
Wizard Spider · also UNC1878, TEMP.MixMaster
A criminal enterprise that treats initial access as a product. Whatever gets in first is rarely what does the damage.
Credential abuse and lateral movement. The board fills from the inside.
Sandworm Team · also ELECTRUM, Telebots
A state programme that has repeatedly turned intrusion into destruction, including against systems that keep the lights on.
Destructive impact. Armoured, slow and extremely expensive to let through.
Lazarus Group · also Labyrinth Chollima, HIDDEN COBRA
Wiper and ransomware operations run at national scale, with a habit of spreading far beyond the intended target.
Ransomware behind a screen of stealth. Detection and burst damage, together.
Volt Typhoon · also BRONZE SILHOUETTE, Vanguard Panda
An actor that avoids malware where it can, living off tools already present and routing traffic through equipment nobody audits.
Tunnelled traffic and stealth. Most of your board simply cannot see it.
APT28 · also IRON TWILIGHT, SNAKEMACKEREL
A well-resourced programme with a long record of using vulnerabilities before anybody has a patch for them.
Zero-days and persistence. Nothing about this one is signature-based.