Live Blog: Cyber Reflections on the Iran-Israel-U.S. War Read the Analysis
SOCRadar Blog

Threat Actor Profiles

Latest SOCRadar research and analysis on Threat Actor Profiles: threat reports, advisories and practical guidance for security teams.

Latest articles

Dark Web Profile: GhostSec SOCRadar

Dark Web Profile: GhostSec

[Update] May 16, 2024: “GhostSec Shifts Focus from Cybercrime to Hacktivism” GhostSec, a significant member of The Five Families, has garnered substantial attention with the latest research, following their recent twin…

Dark Web Profile: Meow Ransomware SOCRadar

Dark Web Profile: Meow Ransomware

In late 2022, 4 ransomware strains were discovered that are derived from Conti‘s leaked ransomware strain. One of them was Meow ransomware. The operation of this crypto-ransomware was observed from late…

Dark Web Profile: Patchwork APT SOCRadar

Dark Web Profile: Patchwork APT

The Patchwork APT group, identified in December 2015 but probably active since 2009, is a cyber espionage entity suspected to be based in India. It targets a variety of high-profile…

dark-web-profile-hunters-international SOCRadar

Dark Web Profile: Hunters International

[Update] July 22, 2025: “Hunters International Shuts Down, Rebrands as World Leaks” Originating in the latter part of 2023, this Ransomware-as-a-Service (RaaS) operation has drawn attention due to its technical…

Threat Actor Profile: ScarCruft / APT37 SOCRadar

Dark Web Profile: ScarCruft / APT37

[Update] October 17, 2024: “ScarCruft Exploits CVE-2024-38178 to Deploy RokRAT Malware” ScarCruft, also widely known as APT37 or Reaper APT, is an espionage group associated with North Korean state activities that…

Dark Web Profile: 3AM Ransomware SOCRadar

Dark Web Profile: 3AM Ransomware

In late 2023, a new and distinct ransomware group named 3AM Ransomware emerged. It came to the forefront as a fallback for other ransomware, notably during failed deployments of the infamous LockBit ransomware…

Dark Web Profile: Sandman APT SOCRadar

Dark Web Profile: Sandman APT

The Sandman APT group has garnered massive attention in 2023 for its targeted attacks against telecommunications providers in regions including Europe and Asia. As revealed by By Aleksandar Milenkoski, Bendik…

Dark Web Profile: CyberNiggers SOCRadar

Dark Web Profile: CyberNiggers

[Update] August 9, 2024: “Revival and Recruitment of CyberNiggers Group” The cybersecurity landscape is in a state of flux, marked by flow of illicit activities within hacker forums. Not so…

Never miss a critical advisory.

Join 30,000+ security professionals who read SOCRadar research every week.

See SOCRadar in Action