CyberGeoDigest / Resources

APT Groups Tracker 2026: Active Nation-State Threat Actors

A continuously referenced guide to every major advanced persistent threat group, organized by sponsoring nation, with aliases, targets, notable campaigns, and MITRE ATT&CK mappings.

Table of Contents

What Are APT Groups and Why Tracking Them Matters

An advanced persistent threat (APT) group is a state-sponsored or state-tolerated hacking organization that conducts long-duration intrusion campaigns against strategic targets. The term "advanced" refers to their use of custom tooling, zero-day exploits, and sophisticated tradecraft. "Persistent" captures their defining characteristic: they do not give up after initial failure, and they maintain access to compromised networks for months or years. "Threat" acknowledges that their objectives, whether espionage, sabotage, or financial theft, cause real-world harm to national security, economic competitiveness, and human rights.

Tracking APT groups matters because attribution drives defense. When you know that a specific intrusion was conducted by APT29 rather than a ransomware gang, your incident response changes fundamentally. The attacker's objectives shift from extortion to long-term intelligence collection. Their persistence mechanisms will be different. Their willingness to re-compromise you after remediation is virtually guaranteed. Without understanding the adversary, defenders waste resources on the wrong countermeasures.

For security teams, an APT groups list is not an academic exercise. It is the foundation of threat-informed defense. By mapping your organization's industry, geography, and data assets against the known targeting patterns of active APT groups, you can prioritize which threats demand the most attention and allocate defensive resources accordingly. A defense contractor in the United States faces a fundamentally different APT landscape than a cryptocurrency exchange in Singapore or a human rights organization in Europe.

This tracker catalogs every major nation-state threat actor active in 2026, organized by sponsoring country, with the operational details security teams need for threat modeling and detection engineering. CyberGeoDigest tracks these groups daily, connecting their technical operations to the geopolitical events that drive them.

🇷🇺 Russia

Russia maintains the most destructive and operationally diverse state cyber capability in the world. Operations are split between the GRU (military intelligence), SVR (foreign intelligence), and FSB (domestic security), each running distinct APT groups with different mandates, tradecraft, and targeting patterns.

APT28 (Fancy Bear)

APT28 is the GRU's primary cyber espionage and information operations unit. They favor rapid exploitation of publicly disclosed vulnerabilities, aggressive credential harvesting, and hack-and-leak operations designed to influence political outcomes. Their targeting directly reflects Russian military and foreign policy priorities.

APT29 (Cozy Bear)

APT29 is the SVR's elite cyber espionage group and among the most technically sophisticated threat actors in existence. They prioritize stealth over speed, often maintaining access for years before detection. Their targeting of cloud infrastructure and identity providers reflects a strategic shift toward compromising the technology supply chain rather than individual targets.

Sandworm (Voodoo Bear)

Sandworm is the most destructive cyber actor on the planet. Unlike espionage-focused groups, Sandworm's mandate includes sabotage and disruption of critical infrastructure. NotPetya remains the costliest cyber attack in history. Their operations during Russia's invasion of Ukraine have demonstrated that cyber attacks are now a permanent feature of conventional warfare.

Turla

Turla is one of the oldest and most technically sophisticated APT groups, active since at least 2004. They are known for innovative tradecraft, including using satellite internet connections to hide their C2 infrastructure and hijacking the infrastructure of other threat actors to conduct false-flag operations. The FBI's 2023 takedown of the Snake implant network revealed infrastructure embedded in government systems across more than 50 countries.

Gamaredon

Gamaredon is the most prolific Russian APT group in terms of sheer volume. While less technically sophisticated than APT29 or Turla, Gamaredon compensates with relentless tempo, launching thousands of spearphishing campaigns per year. Their nearly exclusive focus on Ukrainian targets and FSB attribution make them a key indicator of Russian intelligence priorities against Ukraine.

🇨🇳 China

China operates the largest and most prolific state-sponsored cyber espionage program in the world, coordinated primarily by the Ministry of State Security (MSS) and the People's Liberation Army (PLA). Chinese APT groups target every sector, but intellectual property theft, military intelligence, and pre-positioning in critical infrastructure are the strategic priorities.

APT41 (Double Dragon)

APT41 is unique among nation-state actors for conducting both state-directed espionage and financially motivated cybercrime, often simultaneously. Their dual-hat model reflects the MSS's use of private contractors who are permitted to pursue personal profit outside of sanctioned intelligence operations. This makes APT41 one of the most versatile and prolific threat actors globally.

APT40 (Leviathan)

APT40's targeting patterns map precisely to China's maritime territorial claims and naval modernization efforts. The group is known for extremely rapid exploitation of newly disclosed vulnerabilities, often weaponizing public proof-of-concept code within hours. Five Eyes intelligence agencies issued a joint advisory in 2024 specifically warning about APT40's speed of exploitation.

Volt Typhoon

Volt Typhoon represents a strategic shift in Chinese cyber operations from espionage to pre-positioning for disruption. U.S. intelligence officials assess that Volt Typhoon's objective is not to steal data but to maintain persistent access to critical infrastructure that could be leveraged for destructive operations during a military conflict, most likely over Taiwan. The campaign's exclusive use of living-off-the-land techniques made detection extraordinarily difficult.

Salt Typhoon

Salt Typhoon's compromise of major U.S. telecommunications providers gave Chinese intelligence access to the communications metadata and content of millions of Americans, including the wiretap systems used by law enforcement. The campaign underscored the strategic value of targeting telecommunications infrastructure and prompted emergency cybersecurity reviews across the U.S. telecom sector.

HAFNIUM

HAFNIUM's mass exploitation of Exchange servers in 2021 was among the most impactful cyber campaigns in recent years. The indiscriminate scale of the attack, affecting hundreds of thousands of organizations worldwide, demonstrated China's willingness to conduct broad opportunistic exploitation alongside targeted espionage operations.

Mustang Panda

Mustang Panda is one of China's most active espionage groups targeting Southeast Asian nations. Their operations align closely with China's Belt and Road Initiative interests and territorial disputes in the South China Sea. Mustang Panda is known for heavy reliance on the PlugX remote access trojan and creative use of USB-based propagation techniques.

🇮🇷 Iran

Iran's cyber operations are primarily run by the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS). Iranian APT groups focus on regional adversaries (Israel, Saudi Arabia, Gulf states), surveillance of dissidents, and retaliatory operations triggered by geopolitical tensions over sanctions and the nuclear program.

Charming Kitten (APT35)

Charming Kitten is Iran's most prolific espionage group and one of the most persistent social engineering operators among all nation-state actors. They build elaborate fake personas, sometimes engaging targets in weeks-long email correspondence before delivering a payload. Their primary mission is intelligence collection on perceived threats to the Islamic Republic, with a particular emphasis on identifying and surveilling political opponents.

MuddyWater

MuddyWater is distinguished from other Iranian groups by its MOIS sponsorship rather than IRGC. The group is known for leveraging legitimate remote management tools as an evasion technique, blending malicious activity with normal administrative traffic. Their targeting of government networks across the Middle East reflects MOIS intelligence collection priorities.

OilRig (APT34)

OilRig has been one of Iran's most technically capable espionage groups since at least 2014. Their targeting of energy sector organizations and Gulf state governments reflects Iran's focus on regional intelligence collection. The 2019 leak of their tools and victim data by a mysterious persona known as Lab Dookhtegan was an unprecedented exposure of a nation-state group's operational details.

🇰🇵 North Korea

North Korean cyber operations are unique among nation-states because revenue generation, not intelligence collection, is the primary objective. The Reconnaissance General Bureau (RGB) runs multiple cyber units that have collectively stolen billions of dollars to fund the regime's weapons programs, making North Korea's hackers the most financially successful state-sponsored threat actors in history.

Lazarus Group

Lazarus is North Korea's flagship cyber unit and the most financially destructive APT group in the world. U.N. investigators estimate North Korean cyber actors have stolen over $3 billion in cryptocurrency since 2017. Lazarus operators increasingly target the software supply chain and cryptocurrency developers through elaborate social engineering, including fake job offers delivered via LinkedIn and other professional platforms.

Kimsuky

Kimsuky is North Korea's dedicated intelligence collection unit, focused on gathering political and military intelligence related to the Korean Peninsula. Their social engineering is among the most patient of any APT group. Kimsuky operators routinely impersonate real journalists and researchers, sometimes exchanging weeks of benign emails before delivering a malicious payload or credential harvesting link.

Andariel

Andariel blends espionage with revenue-generating ransomware operations, targeting defense and critical infrastructure organizations. The U.S. DOJ has indicted Andariel operatives for deploying Maui ransomware against American hospitals and healthcare providers, with the extorted cryptocurrency funneled back to fund further North Korean intelligence operations.

Others: Non-State and Ambiguously Attributed Groups

Not all significant threat actors fit neatly into the nation-state category. Several groups operating in 2025 and 2026 blur the line between criminal enterprise and state-tolerated operations.

Scattered Spider

Scattered Spider is the most impactful English-speaking threat group to emerge in recent years. Their mastery of social engineering, particularly against help desks and identity providers, has made them effective against organizations with mature technical defenses. Their collaboration with ransomware-as-a-service operations amplifies their impact significantly.

Lapsus$

Lapsus$ demonstrated that technically unsophisticated actors leveraging social engineering and insider recruitment can compromise even the most well-defended technology companies. While several members were arrested in 2022 and 2023, the group's tactics have been widely adopted by other threat actors, particularly Scattered Spider. Their legacy is a permanent reminder that identity and access management are the weakest points in most organizations' defenses.

How to Use This APT Tracker for Threat Modeling

A comprehensive APT groups list becomes actionable when you map it against your organization's specific risk profile. Here is a practical framework for using this tracker to inform your security program.

Resources and Naming Conventions

The APT landscape is tracked by multiple organizations, each with their own naming conventions. Understanding these conventions is essential for cross-referencing intelligence.

APT group tracking is not a static exercise. Groups evolve, retool, merge, and spawn new subunits. This tracker reflects the landscape as of early 2026 and is best used alongside daily intelligence sources that capture changes as they happen.

Track APT groups in real time

Get a free daily briefing that connects APT campaigns to the geopolitical events driving them. Nation-state threats, attribution updates, and critical infrastructure risks in 5 minutes.

Subscribe free