Live Blog: Cyber Reflections on the Iran-Israel-U.S. War Read the Analysis
SOCRadar Blog

Threat Actor Profiles

Latest SOCRadar research and analysis on Threat Actor Profiles: threat reports, advisories and practical guidance for security teams.

Latest articles

Dark Web Profile: Orion Ransomware SOCRadar

Dark Web Profile: Orion Ransomware

Orion Ransomware is a newly observed operation identified after the detection of a previously unknown ransomware Data Leak Site (DLS) by SOCRadar. The group emerged publicly by listing 13 alleged…

Top 10 APT Groups in 2025 SOCRadar

Top 10 APT Groups in 2025

Advanced Persistent Threats, known as APTs, represent some of the most capable cyber adversaries. These groups are often state-backed or part of well funded organizations and their primary goals include…

Top 10 Ransomware Groups of 2025 SOCRadar

Top 10 Ransomware Groups of 2025

The Top 10 Ransomware Groups of 2025 illustrate how the ransomware ecosystem changed in structure rather than simply growing in volume. After the disruption of dominant groups in 2024, the…

Dark Web Profile: ByteToBreach SOCRadar

Dark Web Profile: ByteToBreach

By mid-2025, the alias ByteToBreach was already an active seller on a major cybercrime forum, offering access and databases from banks, telecom, airlines, and other large enterprises. On November 14,…

Dark Web Profile: Berserk Bear SOCRadar

Dark Web Profile: Berserk Bear

Berserk Bear is a Russian state-sponsored cyber espionage group linked to the FSB. They have been active since at least 2010 under many names (Dragonfly, Energetic Bear, Havex, Crouching Yeti,…

Dark Web Profile: Sarcoma Ransomware SOCRadar

Dark Web Profile: Sarcoma Ransomware

Sarcoma ransomware group emerged in late 2024 and quickly launched aggressive double-extortion campaigns worldwide; Sarcoma’s fast-growing victim list and use of sophisticated techniques, including reported zero-day exploits, make it a…

Dark Web Profile: Scattered Lapsus$ Hunters SOCRadar

Dark Web Profile: Scattered Lapsus$ Hunters

[Update] November 28, 2025: “Is the DLS Already on Its Way Out?” and “Rey, ShinySp1d3r and the Gainsight Breach” In mid-2025, attackers launched coordinated intrusions into the Salesforce environments of…

Dark Web Profile: Dire Wolf Ransomware SOCRadar

Dark Web Profile: Dire Wolf Ransomware

Dire Wolf emerged in 2025 and quickly carried out disruptive ransomware attacks in multiple regions. Dire Wolf appeared on dark web leak sites within weeks and was noted in security…

Never miss a critical advisory.

Join 30,000+ security professionals who read SOCRadar research every week.

See SOCRadar in Action