Live Blog: Cyber Reflections on the Iran-Israel-U.S. War Read the Analysis
SOCRadar Blog

Threat Actor Profiles

Latest SOCRadar research and analysis on Threat Actor Profiles: threat reports, advisories and practical guidance for security teams.

Latest articles

Dark Web Profile: APT35 SOCRadar

Dark Web Profile: APT35

APT35, also known as Charming Kitten, Phosphorus, Mint Sandstorm, and many other names, is an Iranian state-sponsored cyberwarfare group classified as an advanced persistent threat by multiple organizations and government…

Dark Web Profile: Ghost (Cring) Ransomware SOCRadar

Dark Web Profile: Ghost (Cring) Ransomware

In February 2025, the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Federal Bureau of Investigation (FBI) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), released a…

Top 10 Advanced Persistent Threat (APT) Groups That Dominated 2024 SOCRadar

Top 10 Advanced Persistent Threat (APT) Groups That Dominated 2024

Advanced Persistent Threats (APTs) are among the most sophisticated and persistent cyber adversaries in the world. Unlike ordinary cybercriminals, APT groups are usually state-sponsored or highly organized entities that engage…

Dark Web Profile: Fog Ransomware SOCRadar

Dark Web Profile: Fog Ransomware

Fog Ransomware emerged in April 2024, was first detected in the wild in early May, primarily targeting US based educational institutions targeting both Windows and Linux endpoints. It operates as…

Dark Web Profile: Tortoiseshell APT SOCRadar

Dark Web Profile: Tortoiseshell APT

In recent years, Iran has ramped up cyber campaigns to safeguard national interests, deter adversaries, and conduct espionage. These operations are carried out by units within the IRGC and MOIS.…

Dark Web Profile: RA World SOCRadar

Dark Web Profile: RA World

RA World is believed to be a rebranded iteration of the ransomware operation previously known as RA Group. This is because it employed the same extortion and encryption techniques, in…

Dark Web Profile: Termite Ransomware SOCRadar

Dark Web Profile: Termite Ransomware

The dark web, a hidden part of the internet, remains a source of growing cyber threats, with ransomware being one of the most prominent. Among these threats, Termite Ransomware has…

Dark Web Profile: FunkSec SOCRadar

Dark Web Profile: FunkSec

[Update] January 4, 2024: “Update: FunkSec Expands Their Operation and Teams Up With Other Cyber Criminals” A new ransomware group, FunkSec, has gained attention after taking responsibility for attacks on…

Never miss a critical advisory.

Join 30,000+ security professionals who read SOCRadar research every week.

See SOCRadar in Action