- Name = APT1
- Full aliases = Comment Crew
- Organisation = China’s People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department (总参三部二局), Military Unit Cover Designator (MUCD) Unit 61398 (61398部队)
- Country of organisation = People's Republic of China
- Name = APT2
- Full aliases = Putter Panda, MSUpdater Group
- Organisation = China's People’s Liberation Army (PLA) General Staff Department's (GSD) 3rd Department, 12th Bureau, Military Unit Cover Designator (MUCD) 61486
- Country of organisation = People's Republic of China
- Name = APT3
- Full aliases = UPS Team, Gothic Panda, TG-0110, BRONZE MAYFAIR, Buckeye, Red Sylvan
- Organisation =
- Name = APT4
- Full aliases = Maverick Panda, Sykipot Group, Wisp, BRONZE EDISON, TG-0623, Salmon Typhoon
- Organisation =
- Name = APT5
- Full aliases = BRONZE FLEETWOOD, DPD, Keyhole Panda, Poisoned Flight, TG-2754, MANGANESE, TABCTENG, Mulberry Typhoon
- Organisation =
- Country of organisation = People's Republic of China
- Name = APT6
- Full aliases = N/A
- Organisation =
- Name = APT7
- Full aliases = N/A
- Organisation =
- Name = APT8
- Full aliases =
- Organisation =
- Name = APT9
- Full aliases =
- Organisation =
- Name = APT10
- Full aliases = Stone Panda, Menu Pass, Red Apollo, CVNX, Potassium, Cicada, Cloud Hopper, BRONZE RIVERSIDE, CTG-5938, Hogfish
- Partial aliases = A41APT
- Country of organisation = People's Republic of China
- Name = Earth Tengshe
- Full aliases = A41APT
- Name = MirrorFace
- Name = APT11
- Full aliases = N/A
- Organisation =
- Name = APT12
- Full aliases = Calc Team, BRONZE GLOBE, CTG-8223, DNSCalc, DyncCalc, Numbered Panda
- Organisation =
- Name = APT13
- Full aliases = N/A
- Organisation =
- Name = APT14
- Full aliases =
- Organisation =
- Name = APT15
- Full aliases = NICKEL, Nylon Typhoon, ke3chang, Vixen Panda
- Associations = Winnti Umbrella
- Organisation =
- Country of organisation = People's Republic of China
- Name = APT16
- Full aliases =
- Organisation =
- Name = APT17
- Full aliases =
- Associations = Winnti Umbrella
- Organisation =
- Name = APT18
- Full aliases = Wekby
- Organisation =
- Name = APT19
- Full aliases =
- Organisation =
- Name = APT20
- Full aliases =
- Organisation =
- Name = APT21
- Full aliases = Zhenbao, Hammer Panda, NetTraveler
- Organisation =
- Name = APT22
- Full aliases = Barista, Group 46, Suckfly, BRONZE OLIVE
- Organisation =
- Name = APT23
- Full aliases = Earth Centaur, BRONZE HOBART, TA413, White Dev, LuckyCat
- Organisation =
- Name = APT24
- Full aliases = PittyTiger
- Organisation =
- Name = APT25
- Full aliases =
- Organisation =
- Name = APT26
- Full aliases =
- Organisation =
- Name = APT27
- Full aliases =
- Organisation =
- Name = Emissary Panda
- Country of organisation = People's Republic of China
- Name = Goblin Panda
- Country of organisation = People's Republic of China
- Name = APT28
- Full aliases = Fancy Bear, Sofacy, Strontium, Grizzly Steppe, Sednit, SIG40, Group 74, PawnStorm, Snakemackerel, TG-4127, Tsar Team, Blue Athena, IRON TWILIGHT, Swallowtail, Threat Group-4127, Forest Blizzard, FROZENLAKE
- Subgroups = Zebrocy
- Organisation = Unit 26165 of the 85th Main Special Service Center
- Country of organisation = Russian Federation
- Name = Zebrocy
- Full aliases = PETROVITE
- Name = APT29
- Full aliases = Cozy Bear, The Dukes, Nobelium, UNC2452, YTTRIUM, IRON HEMLOCK, Dark Halo, NOBELIUM, StellarParticle, UNC2452, Blue Kitsune, CozyDuke, NobleBaron, HotCousin, Midnight Blizzard, UNC3524, Cranefly
- Organisation = Foreign Intelligence Service, SVR
- Country of organisation = Russian Federation
- Name = APT30
- Full aliases = RADIUM, Raspberry Typhoon, LotusBlossom
- Organisation = China's People’s Liberation Army Unit 78020
- Country of organisation = People's Republic of China
- Name = APT31
- Full aliases = ZIRCONIUM, Violet Typhoon
- Country of organisation = People's Republic of China
- Name = APT32
- Full aliases = WOODLAWN, SCWX CTU, TIN WOODLAWN, BISMUTH, OceanLotus, Canvas Cyclone
- Country of organisation = Socialist Republic of Vietnam
- Name = APT33
- Full aliases = Elfin, Refined Kitten, Magnallium, Holmium, COBALT TRINITY, TA451, Peach Sandstorm
- Organisation = Islamic Revolutionary Guard Corps
- Country of organisation = Islamic Republic of Iran
- Name = APT34
- Full aliases = EUROPIUM, Hazel Sandstorm, Cobalt Gypsy, OilRig, Homeland Justice
- Organisation = Ministry of Intelligence and Security
- Country of organisation = Islamic Republic of Iran
- Name = CHRYSENE
- Name = APT35
- Full aliases = PHOSPHORUS, Mint Sandstorm, Charming Kitten
- Subgroups = DEV-0270
- Organisation = Islamic Revolutionary Guard Corps
- Country of organisation = Islamic Republic of Iran
- Name = Nemesis Kitten
- Name = TunnelVision
- Name = APT36
- Full aliases = Transparent Tribe, ProjectM, Mythic Leopard, TEMP.Lapis, COPPER FIELDSTONE, Gorgon Group, Green Havildar, Operation C-Major, ProjectM, Earth Karkaddan, APT-C-56
- Country of organisation = Islamic Republic of Pakistan
- Name = APT37
- Full aliases = Thallium, Reaper, ScarCruft, InkySquid, Velvet Chollima, Konni Group, Black Banshee, Group 123, RICOCHET CHOLLIMA, NICKEL FOXCROFT, NICKEL KIMBALL, SharpTongue, RedEyes, Emerald Sleet
- Organisation = Ministry of State Security
- Country of organisation = Democratic People's Republic of Korea
- Name = Kimsuky
- Subgroups = TA406, TA408, TA427
- Department = 5th Bureau, Inter-Korean Affairs
- Organisation = Reconnaissance Bureau of the General Staff Department (RGB)
- Country of organisation = Democratic People's Republic of Korea
- Name = TA406
- Parent Group = Kimsuky
- Name = TA408
- Parent Group = Kimsuky
- Name = TA427
- Parent Group = Kimsuky
- Name = Ruby Sleet
- Full aliases = CERIUM
- Country of organisation = Democratic People's Republic of Korea
- Name = APT38
- Full aliases = TraderTraitor
- Partial Aliases = CryptoCore - shared between APT38 and APT43
- Organisation = Reconnaissance General Bureau
- Country of organisation = Democratic People's Republic of Korea
- Name = BlueNorOff
- Full aliases = Stardust Chollima, BeagleBoyz, CTG-6459, NICKEL GLADSTONE, COPERNICIUM, Genie Spider, Sapphire Sleet
- Country of organisation = Democratic People's Republic of Korea
- Name = AndAriel
- Full aliases = Silent Chollima, Dark Seoul, Rifle, Wassonite, NICKEL HYATT, PLUTONIUM, Stonefly
- Country of organisation = Democratic People's Republic of Korea
- Name = Pompilios
- Name = Bollworm
- Name = Cloverworm
- Name = Springtail
- Name = APT39
- Full aliases = Chafer, Cadelspy, Remexi, ITG07, COBALT HICKMAN, Remix Kitten, Cadelle
- Organisation = Iranian Ministry of Intelligence and Security, Rana Intelligence Computing
- Country of organisation = Islamic Republic of Iran
- Name = APT40
- Full aliases = GADOLINIUM, Leviathan, TEMP.Periscope, Kryptonite Panda, Gingham Typhoon
- Country of organisation = People's Republic of China
- Name = APT41
- Full aliases = BARIUM, Brass Typhoon, Wicked Panda
- Subgroups = Earth Lusca, Earth Longzhi
- Country of organisation = People's Republic of China
- Name = Grayfly
- Name = Blackfly
- Name = Earth Lusca
- Full aliases = Fishmaster, TAG-22
- Parent group = APT41
- Name = Earth Longzhi
- Parent group = APT41
- Name = Tianwu
- Name = APT42
- Name = APT43
- Partial Aliases = CryptoCore - shared between APT38 and APT43
- Name = APT44
- Name = APT45
- Full aliases = Lazarus Group, Hidden Cobra, Guardians of Peace, NICKEL ACADEMY, Black Artemis, COVELLITE, CTG-2460, Dark Seoul, High Anonymous, Labyrinth Chollima, New Romanic Cyber Army Team, NNPT Group, Who Am I?, Whois Team, ZINC, TA404, APT-C-26, ZINC, Diamond Sleet
- Subgroups = AndAriel
- Country of organisation = Democratic People's Republic of Korea
- Name = FIN6
- Full aliases = ITG08, MageCart Group 6, Skeleton Spider, White Giant, GOLD FRANKLIN, TAAL, Camouflage Tempest
- Name = FIN7
- Full aliases = Carbon Spider, Calcium, Carbanak, Navigator, TelePort Crew, GOLD NIAGARA, Anunak, ELBRUS, Black Basta, Sangria Tempest
- Name = FIN8
- Name = FIN11
- Full aliases = DEV-0950, Lace Tempest
- Name = FIN12
- Full aliases = Pistachio Tempest
- Name = APT-C-21
- Full aliases = GnatSpy, FrozenCell, VAMP
- Name = APT-C-35
- Full aliases = Donot Team, SectorE02, SideWinder, Rattlesnake, Hardcore Nationalist, RAZOR TIGER, T-APT-04, APT-C-17
- Name = APT-C-36
- Full aliases = Blind Eagle
- Name = APT-C-38
- Full aliases = COBALT JUNO, SABER LION, TG-2884
- Name = APT-C-50
- Name = APT-Q-11
- Name = APT-Q-27
- Name = UNC94
- Name = UNC215
- Name = UNC1151
- Full aliases = Ghostwriter, TA445, Storm-0257, DEV-0257
- Name = UNC2465
- Name = UNC2546
- Name = UNC2582
- Name = UNC2628
- Name = UNC2659
- Name = UNC2717
- Name = Hexane
- Full aliases = Lyceum, COBALT LYCEUM, ScorchedEpoch, SiameseKitten, DEV-0133
- Name = Xenotime
- Full aliases = Triton, Trisis, Temp.Veles
- Department = Applied Developments Center of the Central Scientific Research Institute of Chemistry and Mechanics, TsNIIKhM, State Research Center
- Organisation = Ministry of Defense
- Country of organisation = Russian Federation
- Members = Evgeny Viktorovich Gladkikh
- Name = Sandworm
- Full aliases = Electrum, Telebots, BlackEnergy, Quedagh, Voodoo Bear, CTG-7263, Hades, OlympicDestroyer, IRIDIUM, TEMP.Noble, IRON VIKING, Seashell Blizzard, FROZENBARENTS
- Department = Unit 74455 of the Main Center of Special Technologies, GTsST
- Organisation = Main Directorate of the General Staff of the Armed Forces, GRU
- Country of organisation = Russian Federation
- Name = Black Energy
- Name = Grey Energy
- Name = Kamacite
- Parent group = Sandworm
- Name = Muddy Water
- Full aliases = Cobalt Ultser, Seed Worm, TEMP.Zagros, Static Kitten, Earth Vetala, MERCURY, Mango Sandstorm
- Organisation = Ministry of Intelligence
- Country of organisation = Islamic Republic of Iran
- Name = Gaza Cybergang
- Full aliases = TA402, ALUMINUM SARATOGA, Extreme Jackal, DustySky, Moonlight
- Subgroups = Molerats, Desert Falcon, Gaza Cybergang Group3
- Organisation = Hamas
- Country of organisation = Palestine
- Name = Molerats
- Full aliases = Gaza Cybergang Group1
- Parent group = Gaza Cybergang
- Campaigns = SneakyPastes
- Organisation = Hamas
- Country of organisation = Palestine
- Name = Desert Falcon
- Full aliases = Arid Viper, APT-C-23, Two-Tailed Scorpion, Gaza Cybergang Group2
- Parent group = Gaza Cybergang
- Organisation = Hamas
- Country of organisation = Palestine
- Name = Gaza Cybergang Group3
- Campaigns = Operation Parliament
- Organisation = Hamas
- Country of organisation = Palestine
- Name = Dragonfly
- Full aliases = Energetic Bear, Koala, Iron Liberty, BROMINE, BERSERK BEAR, Crouching Yeti, Temp.Isotope, Ghost Blizzard
- Department = 16th Centre, Military Unit 71330 of the Special Communications and Information Service
- Organisation = Federal Security Service, FSB
- Country of organisation = Russian Federation
- Members = Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, Marat Valeryevich Tyukov
- Name = Electric Panda
- Country of organisation = People's Republic of China
- Name = Cobalt Dickens
- Full aliases = Yellow Nabu
- Name = Shadow Academy
- Name = Cactus Pete
- Full aliases = Karma Panda, Tonto Team, BRONZE HUNTLEY
- Name = BlackTech
- Full aliases = Palmerworm, Temp.Overboard, Circuit Panda, Radio Panda, BRONZE CANAL, CTG-6177, Shrouded Crossbow
- Name = Water Bear
- Campaigns = PLEAD, Shrouded Crossbow
- Name = Red Delta
- Full aliases = BRONZE PRESIDENT, HoneyMyte, Red Lich, Temp.Hex, Earth Preta, Mustang Panda, Stately Taurus, Luminous Moth, Camaro Dragon
- Subgroups = Groups 724, Group 1358, Group 5171
- Country of organisation = People's Republic of China
- Name = Groups 724
- Parent group = [Red Delta](https://www.trendmicro.com/en_au/research/23/c/earth-preta-cyberespionage-campaign-hits-over-200.html
- Country of organisation = People's Republic of China
- Name = Groups 1358
- Parent group = [Red Delta](https://www.trendmicro.com/en_au/research/23/c/earth-preta-cyberespionage-campaign-hits-over-200.html
- Country of organisation = People's Republic of China
- Name = Groups 5171
- Parent group = [Red Delta](https://www.trendmicro.com/en_au/research/23/c/earth-preta-cyberespionage-campaign-hits-over-200.html
- Country of organisation = People's Republic of China
- Name = Dark Hotel
- Full aliases = TUNGSTEN BRIDGE, CTG-1948, DUBNIUM, Zigzag Hail, Tapaoux
- Country of organisation = Republic of Korea
- Name = UNC2630
- Name = Agrius
- Full aliases = Deadwood, BlackShadow, SharpBoys, AMERICIUM, Pink Sandstorm, DEV-0227, Justice Blade
- Organisation = Ministry of Intelligence and Security
- Country of organisation = Islamic Republic of Iran
- Name = DLTminer
- Name = SixLittleMonkeys
- Name = Websiic
- Name = Calypso
- Full aliases = BRONZE MEDLEY
- Name = Tick
- Full aliases = REDBALDKNIGHT, BRONZE BUTLER, CTG-2006, Stalker Panda
- Name = TALONITE
- Name = Silk Typhoon
- Full aliases = HAFNIUM
- Country of organisation = People's Republic of China
- Name = Gamaredon
- Full aliases = Armageddon, Blue Otso, Dancing Salome, Primitive Bear, WinterFlounder, IRON TILDEN, ACTINIUM, Aqua Blizzard
- Country of organisation = Russian Federation
- Name = InvisiMole
- Name = BlueAlpha
- Name = Sharp Panda
- Name = Indrik Spider
- Full aliases = EvilCorp, Silverfish, GOLD DRAKE, DEV-0243, DEV-0243, Manatee Tempest, UNC2165
- Partial aliases = Gold Winter, Mustard Tempest, Purple Vallhund, DEV-0206
- Breakaway groups = Doppel Spider
- Name = Mustard Tempest
- Full aliases = Purple Vallhund, DEV-0206
- Name = Wizard Spider
- Full aliases = UNC1878, RYUK, DEV-0193, GOLD BLACKBURN
- Partial aliases = FIN12, Pistachio Tempest/DEV-0237, Periwinkle Tempest/DEV-0193/UNC2053
- Subgroups = Conti Team 1, Conti Team 2, Conti Team 3
- Name = Conti Team 1
- Parent group = Wizard Spider
- Name = Conti Team 2
- Parent group = Wizard Spider
- Name = Conti Team 3
- Parent group = Wizard Spider
- Name = Exotic Lily
- Name = Mummy Spider
- Full aliases = Mealybug, TA542, GOLD CRESTWOOD, ATK 104, TEMP.Mixmaster, UNC3443
- Name = DarkSide
- Full aliases = GOLD WATERFALL
- Name = REvil Group
- Full aliases = GOLD SOUTHFIELD, Sodinokibi, Pinchy Spider
- Name = DeathStalker
- Full aliases = Eviulnum
- Name = StrongPity
- Full aliases = Promethium
- Name = Aoqin Dragon
- Name = AppMilad
- Name = Earth Berberoka
- Full Aliases = GamblingPuppet, DiceyF
- Name = Scattered Spider
- Full aliases = Roasted 0ktapus, UNC3944
- Name = KillNet
- Full aliases = Zatoichi
- Name = Urpage
- Full aliases = EHDEVEL, WINDSHIFT, THE WHITE COMPANY, BAHAMUT
- Name = Tomato Tempest
- Full Aliases = SPURR, Vatet, GOLD DUPONT
- Name = Turla
- Full aliases = CTG-8875, ITG12, KRYPTON, Venomous Bear, Waterbug, Iron Hunter, Uroburos, Snake, Secret Blizzard
- Country of organisation = Russian Federation
- Name = Void Balaur
- Full aliases = Rockethack
- Name = TEMP.Hermit
- Name = EMBER BEAR
- Full aliases = UAC-0056, Lorec53, Lorec Bear, Bleeding Bear, Saint Bear Nodaria
- Country of organisation = Russian Federation
- Name = MontysThree
- Name = DarkHydrus
- Name = LofyGang
- Name = IAmTheKing
- Name = IntelBroker
- Name = Gonjeshke Darande
- Full aliases = Predatory Sparrow
- Name = Indra
- Name = 8220 Gang
- Name = Hagga
- Name = IndigoZebra
- Name = TA410
- Subgroups = FlowingFrog, LookingFrog, JollyFrog
- Name = FlowingFrog
- Parent Group = TA410
- Name = LookingFrog
- Parent Group = TA410
- Name = JollyFrog
- Parent Group = TA410
- Name = MalKamak
- Name = Smoke Sandstorm
- Full aliases = BOHRIUM
- Country of organisation = Islamic Republic of Iran
- Name = Spandex Tempest
- Full aliases = TA505
- Name = Charcoal Typhoon
- Full aliases = ControlX, CHROMIUM, BRONZE UNIVERSITY, RedHotel
- Country of organisation = People's Republic of China
- Name = TortoiseShell
- Full aliases = Houseblend, CURIUM, TA456, Crimson Sandstorm
- Country of organisation = Islamic Republic of Iran
- Name = Granite Typhoon
- Full aliases = GALLIUM, Alloy Taurus, Softcell
- Country of organisation = People's Republic of China
- Name = Pearl Sleet
- Full aliases = LAWRENCIUM, DEV-0215
- Country of organisation = Democratic People's Republic of Korea
- Name = Emennet Pasargad
- Full aliases = NEPTUNIUM, Holy Souls, Cotton Sandstorm, Vice Leaker, DEV-0198, Hackers of Savior, Sangkancil, Black Magic, Holy Souls, AMC239, Generous Thief, Atlas Group, Al-Toufan
- Organisation = Islamic Revolutionary Guard Corps
- Country of organisation = Islamic Republic of Iran
- Name = Opal Sleet
- Aliases = Konni, OSMIUM
- Organisation =
- Country of organisation = Democratic People's Republic of Korea
- Name = Wine Tempest
- Full aliases = PARINACOTA, Wadhrama
- Name = Plaid Rain
- Full aliases = POLONIUM
- Country of organisation = Republic of Lebanon
- Name = Fox Kitten
- Full aliases = RUBIDIUM, Parasite, COBALT FOXGLOVE, Pioneer Kitten, UNC757, Lemon Sandstorm
- Country of organisation = Islamic Republic of Iran
- Name = Star Blizzard
- Full aliases = SEABORGIUM, Callisto, Reuse Team
- Country of organisation = Russian Federation
- Name = Sea Turtle
- Aliases = SILICON, UNC1326, Marbled Dust
- Country of organisation = Republic of Türkiye
- Name = Metador
- Name = Modified Elephant
- Country of organisation = [Republic of India]
- Name = Pumpkin Sandstorm
- Full aliases = DEV-0146, HomeLand Justice
- Country of organisation = Islamic Republic of Iran
- Name = Cuboid Sandstorm
- Full aliases = DEV-0228
- Country of organisation = Islamic Republic of Iran
- Name = Lilac Typhoon
- Full aliases = DEV-0234
- Country of organisation = People's Republic of China
- Name = Circle Typhoon
- Full aliases = DEV-0322
- Country of organisation = People's Republic of China
- Name = Gray Sandstorm
- Full aliases = DEV-0343
- Country of organisation = Islamic Republic of Iran
- Name = Cinnamon Tempest
- Full aliases = DEV-0401, Emperor Dragonfly, Bronze Starlight
- Name = Moses Staff
- Full aliases = Marigold Sandstorm, DEV-0500, Cobalt Sapling, Abraham's Ax
- Organisation = Islamic Revolutionary Guard Corps
- Country of organisation = Islamic Republic of Iran
- Name = Velvet Tempest
- Full aliases = DEV-0504
- Name = H0lyGh0st
- Full aliases = DEV-0530, Storm-0530
- Country of organisation = Democratic People's Republic of Korea
- Name = Lapsus$
- Full aliases = DEV-0537, Strawberry Tempest
- Name = Cadet Blizzard
- Full aliases = DEV-0586
- Country of organisation = Russian Federation
- Name = Sunglow Blizzard
- Full aliases = DEV-0665
- Country of organisation = Russian Federation
- Name = Phlox Tempest
- Full aliases = DEV-0796, ClickPirate
- Name = Vice Society
- Full aliases = DEV-0832, Vanilla Tempest
- Name = Moshen Dragon
- Country of organisation = People's Republic of China
- Name = TA551
- Full aliases = Shathak, GOLD CABIN, Monster Libra
- Name = Red Alpha
- Full aliases = Deepcliff, Red Dev 3
- Country of organisation = People's Republic of China
- Name = Volatile Cedar
- Full aliases = Lebanese Cedar, DeftTorero
- Country of organisation = Republic of Lebanon
- Name = Lilac Wolverine
- Name = Naikon
- Name = LuoYu
- Country of organisation = People's Republic of China
- Name = Storm-1084
- Full aliases = DEV-1084, DarkBit
- Organisation = Ministry of Intelligence and Security
- Country of organisation = Islamic Republic of Iran
- Name = Narwhal Spider
- Full aliases = GOLD ESSEX, TA544
- Name = Worok
- Name = UNC4191
- Country of organisation = People's Republic of China
- Name = DragonOK
- Full aliases = Bronze Overbrook
- Country of organisation = People's Republic of China
- Name = SowBug
- Name = Patchwork
- Full Aliases = Dropping Elephant, Chinastrats
- Country of organisation = Republic of India
- Name = Daixin Team
- Name = UNC2198
- Name = Cyborg Spider
- Full aliases = Mespinoza, Gold Burlap
- Name = RANCOR
- Name = BlackSnakeTeam
- Name = RedFoxTrot
- Organisation = People's Liberation Army Unit 69010
- Country of organisation = People's Republic of China
- Name = Ferocious Kitten
- Name = Gallmaker
- Name = GOLD GALLEON
- Name = OnePercent Group
- Name = Keksec
- Name = PassCV
- Name = APT-C-43
- Name = RedCurl
- Name = Red Menshen
- Name = Gold Lagoon
- Operators = QakBot/Qbot
- Name = Rocket Kittens
- Country of organisation = Islamic Republic of Iran
- Name = Bitter APT
- Name = Blackgear
- Name = Tropical Scorpius
- Full aliases = Void Rabisu
- Name = Dark Caracal
- Name = DRAGONBRIDGE
- Country of organisation = People's Republic of China
- Name = XakNet
- Name = XDSpy
- Name = COBALT KATANA
- Name = Earth Bogle
- Name = DustSquad
- Name = DukeEugene
- Name = PureCoder
- Name = UNC2565
- Name = GOLD NORTHFIELD
- Name = GhostEmperor
- Name = Boss Spider
- Name = NoName057(16)
- Name = PureCoder
- Name = Viking Spider
- Name = Gold Fairfax
- Name = Raccoon Gang
- Name = Sprite Spider
- Name = FunnyDream
- Name = COLDRIVER
- Full aliases = Callisto, CALISTO, Blue Callisto, Callisto Group, TAG-53
- Name = BellTroX InfoTech Services
- Name = TeamTNT
- Name = TEMP_Heretic
- Name = Teng Snake
- Name = Roaming Mantis
- Full aliases = Yanbian Gang
- Name = UNC2903
- Name = LazyScripter
- Name = DEV-0569
- Name = Dark Pink
- Name = TA569
- Name = Haskers Gang
- Name = 0Day Technologies
- Name = NTC Vulkan
- Name = UNC4466
- Name = Evasive Panda
- Full aliases = BRONZE HIGHLAND, Daggerfly)
- Name = Gold Hawthorne
- Name = XE Group
- Name = YoroTrooper
- Country of organisation = Republic of Kazakhstan
- Name = UNC4166
- Name = UNC3886
- Name = LightBasin
- Full aliases = UNC1945
- Name = UCID902
- Name = TA866
- Name = TA558
- Name = TACTICAL#OCTOPUS
- Name = DEV-0569
- Name = DragonForce Malaysia
- Name = Lancefly
- Name = Gold Mystic
- Name = Kurdistan 4455
- Name = Silence
- Name = Lemon Group
- Name = UNC2970
- Country of organisation = Democratic People's Republic of Korea
- Name = TA444
- Country of organisation = Democratic People's Republic of Korea
- Name = Crossing Elf
- Operators = 0mega ransomware
- Name = Entry Elf
- Operators = 8Base ransomware
- Name = Chip Elf
- Operators = Prometheus ransomware
- Name = Side Copy
- Name = XeGroup
- Nane = Neo_Net
- Name = Plain Elf
- Operators = Cl0p ransomware
- Name = Sticky Elf
- Operators = BabLock ransomware/Rorschach ransomware
- Name = Storm-0558
- Country of organisation = People's Republic of China
- Name = Pupil Elf
- Operators = Key Group ransomware
- Name = BianLian
- Name = Asylum Ambuscade
- Name = Flush Elf
- Operators = Avaddon ransomware
- Name = Guarantee Elf
- Operators = AvosLocker ransomware
- Name = Water Minyades
- Operators = Batloader
- Name = Scenario Elf
- Operators = Kinsing
- Name = Safari Elf
- Operators = PLAY/PlayCrypt ransomware
- Name = Vanguard Panda
- Full aliases = Volt Typhoon, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, and Insidious Taurus
- Country of organisation = People’s Republic of China
- Name = Cottage Elf
- Operators = MedusaLocker
- Name = Fan Elf
- Operators = Mallox ransomware
- Name = Water Orthrus
- Name = Mysterious Elephant
- Name = Winter Vivern
- Full aliases = TA473
- Name = Flax Typhoon
- Name = UNC4841
- Name = Wrap Elf
- Operators = Royal ransomware
- Name = MoustachedBouncer
- Name = TAG-74
- Name = TA578
- Name = TA577
- Name = TA581
- Name = TraderTraitor
- Full aliases = UNC4899
- Organisation = Reconnaissance General Bureau
- Country of organisation = Democratic People's Republic of Korea
- Name = Scrap Elf
- Operators = BlackCat, ALPHV, Noberus
- Ransomware affiliates = DEV-0504
- Name = Bolt Elf
- Deploys = GlobeImposter Ransomware
- Name = MoustachedBouncer
- Name = BlogXX
- Name = Be Elf
- Operators = CatB ransomware
- Name = SideCopy
- Name = TA2725
- Name = OPERA1ER
- Name = Luna Moth
- Name = Twisted Spider
- Name = MeowCorp
- Operators = Meow ransomware
- Name = Day Elf
- Operators = Agenda/Qilin ransomware
- Name = Decade Elf
- Operators = Rhysida Ransomware
- Name = Battery Elf
- Operators = Abyss Ransomware/Abyss Locker
- Name = Water Curupira
- Name = Ganosec Team