Threat Actor Intelligence
Know Your Adversary
Comprehensive profiles of ransomware groups, nation-state APTs, and cybercriminal operations. Each profile includes TTPs, MITRE ATT&CK mappings, detection rules, and actionable hunting procedures.
UNC5221 / WARP PANDA
AKA: UNC5337 (merged), UTA0178
China-nexus state-sponsored espionage actor targeting edge devices and virtualization infrastructure. Known for BRICKSTORM backdoor, 393-day average dwell time, and 5+ zero-day exploits.
Qilin Ransomware
AKA: Agenda
#1 ransomware threat to US SLTT organizations. Known for GPO-based Chrome credential harvesting and BYOVD EDR evasion with dark.sys driver.
Scattered Spider
AKA: UNC3944, Octo Tempest, 0ktapus
Social engineering specialists targeting identity providers. Known for SIM swapping, MFA bombing, and help desk impersonation.
APT44 / Sandworm
AKA: Sandworm Team, Voodoo Bear, IRIDIUM
Russian military intelligence unit responsible for NotPetya, Olympic Destroyer, and ongoing attacks against Ukraine and NATO allies.
Volt Typhoon
AKA: VANGUARD PANDA, Bronze Silhouette
China-nexus actor pre-positioning in US critical infrastructure. Living-off-the-land techniques for long-term persistence.
Z-Pentest
AKA: ZPT
Pro-Russian hacktivist group targeting industrial control systems and critical infrastructure in NATO countries.
SafePay Ransomware
Emerging RaaS operation with unique encryption and double extortion tactics. Growing victim count in Q4 2024.
Protect Against These Threat Actors
BRACE provides automated detection for all profiled threat actors, including Qilin, Scattered Spider, APT44, and more.