Live Blog: Cyber Reflections on the Iran-Israel-U.S. War Read the Analysis
SOCRadar Blog

Threat Actor Profiles

Latest SOCRadar research and analysis on Threat Actor Profiles: threat reports, advisories and practical guidance for security teams.

Latest articles

Dark Web Profile: APT31 SOCRadar

Dark Web Profile: APT31

Advanced Persistent Threat Group 31 (APT31), also known by aliases like ZIRCONIUM or Judgment Panda, represents a sophisticated cybersecurity threat with ties to state-sponsored activities. Threat Actor Card of APT31…

Threat Actor Profile: Molerats SOCRadar

Dark Web Profile: Molerats

Much like mole rats create an intricate network of underground tunnels, the cyber threat group known as Molerats has expertly burrowed its way through the digital defenses of its targets.…

Dark Web Profile: Red Ransomware SOCRadar

Dark Web Profile: Red Ransomware

On April 3, 2024, a newly discovered ransomware group surfaced as Senior Threat Analyst Rakesh Krishnan shed light. Known as Red CryptoApp, this group began its operations between February and March, coinciding…

Dark Web Profile: Akira Ransomware SOCRadar

Dark Web Profile: Akira Ransomware

[Update] October 1, 2024: “What Are the Latest Akira News?” Since its discovery in early 2023, Akira ransomware has evolved from a seemingly ordinary addition to the ransomware landscape to…

Dark Web Profile: Mallox Ransomware SOCRadar

Dark Web Profile: Mallox Ransomware

Mallox, a strain of ransomware and a group with the same name, encrypts its victims’ data and subsequently demands a ransom, typically in cryptocurrency, in return for providing the decryption key,…

Dark Web Profile: DonutLeaks SOCRadar

Dark Web Profile: DonutLeaks

In 2022, the DonutLeaks group emerged as a significant player, demonstrating a sophisticated approach to data extortion. Linked to cyber incidents targeting notable enterprises such as Greek natural gas company DESFA, UK…

Dark Web Profile: RansomHub SOCRadar

Dark Web Profile: RansomHub

[Update] January 22, 2025: “What Has Changed In A Year?” [Update] June 6, 2024: “RansomHub Adds ZeroLogon Vulnerability to Its Arsenal”  [Update] April 8, 2024: “From ALPHV to RansomHub: Change…

Dark Web Profile: ShinyHunters SOCRadar

Dark Web Profile: ShinyHunters

[Update] July 31, 2025: “ShinyHunters Behind CRM Attacks on Qantas, Adidas, and Others” Within the obscured world of the Deep/Dark Web, where cybercrime flourishes amidst databases, initial access brokers, and…

Never miss a critical advisory.

Join 30,000+ security professionals who read SOCRadar research every week.

See SOCRadar in Action