<![CDATA[CyberMaterial: Threats]]>https://www.cybermaterial.com/s/threatshttps://substackcdn.com/image/fetch/$s_!nNgF!,w_256,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa6c57d21-5644-4f88-bf07-ea44d2603e80_482x482.pngCyberMaterial: Threatshttps://www.cybermaterial.com/s/threatsSubstackFri, 03 Apr 2026 21:28:25 GMT<![CDATA[CryptoCore / UNC1069]]>https://www.cybermaterial.com/p/cryptocore-unc1069https://www.cybermaterial.com/p/cryptocore-unc1069Thu, 19 Feb 2026 19:49:37 GMT

The group widely tracked as CryptoCore, also referred to by Mandiant as UNC1069, has evolved from traditional spear-phishing campaigns into multi-stage intrusions powered by AI-generated deception, deepfake video, and tailored malware frameworks.

This is not opportunistic crime. It is structured, patient, and increasingly sophisticated.

A Familiar Actor with Evolving Tradecraft

CryptoCore has been active since at least 2018, primarily targeting:

Read more

]]><![CDATA[Storm-1811 (Cybercriminal) – Threat Actor]]>https://www.cybermaterial.com/p/storm-1811-cybercriminal-threat-actorhttps://www.cybermaterial.com/p/storm-1811-cybercriminal-threat-actorMon, 03 Mar 2025 03:06:18 GMT

Storm-1811

Date of Initial Activity

April 2024

Suspected attribution

Cybercriminal

Government Affiliation

No

Motivation

Financial Gain

Associated tools

Quick Assist
Black Basta Ransomware
Batch Files
Custom Scrip…

Read more

]]><![CDATA[CopyCop (State-Sponsored) – Threat Actor]]>https://www.cybermaterial.com/p/copycop-state-sponsored-threat-actorhttps://www.cybermaterial.com/p/copycop-state-sponsored-threat-actorMon, 03 Mar 2025 03:05:03 GMT

CopyCop

Location

Russia

Date of Initial Activity

March 2024

Suspected attribution

State-sponsored Threar Group

Government Affiliation

Yes

Motivation

Spreading Disinformation campaigns by leveraging generative …

Read more

]]><![CDATA[Storm-0539 – Threat Actor]]>https://www.cybermaterial.com/p/storm-0539-threat-actorhttps://www.cybermaterial.com/p/storm-0539-threat-actorMon, 03 Mar 2025 03:03:04 GMT

Storm-0539

Location

Morocco

Date of Initial Activity

2021

Suspected Attribution 

Cybercriminal

Motivation

Financial Gain

Overview

Storm-0539 is a sophisticated cybercrime group originating from Morocco and act…

Read more

]]><![CDATA[Void Manticore (Storm-0842) – Threat Actor]]>https://www.cybermaterial.com/p/void-manticore-storm-0842-threat-actorhttps://www.cybermaterial.com/p/void-manticore-storm-0842-threat-actorMon, 03 Mar 2025 02:56:16 GMT

Void Manticore

Other Names

Storm-0842

Karma

Homeland Justice

Location

Iran

Date of initial activity

2023

Suspected attribution

State-sponsored Threat Group

Government Affiliation

Yes

Associated Groups

Scarred Mant…

Read more

]]><![CDATA[Unfading Sea Haze – Threat Actor]]>https://www.cybermaterial.com/p/unfading-sea-haze-threat-actorhttps://www.cybermaterial.com/p/unfading-sea-haze-threat-actorMon, 03 Mar 2025 02:55:03 GMT

Unfading Sea Haze

Location

China

Date of initial activity

2018

Suspected attribution

Cybercriminal

Government Affiliation

Unknown

Motivation

Cyberespionage

Associated tools

SilentGh0st
.NET Payloads
Ps2dllLoader
Sh…

Read more

]]><![CDATA[Ikaruz Red Team – Threat Actor]]>https://www.cybermaterial.com/p/ikaruz-red-team-threat-actorhttps://www.cybermaterial.com/p/ikaruz-red-team-threat-actorMon, 03 Mar 2025 02:53:43 GMT

Ikaruz Red Team

Location

Turkey

Date of Initial Activity

2004

Suspected attribution

Hactivist Group

Government Affiliation

Unknown

Associated Groups

Turk Hack Team, PHEDS

Motivation

Hacktivism

Associated tools

Loc…

Read more

]]><![CDATA[UAC-0188 (FRwL) – Threat Actor]]>https://www.cybermaterial.com/p/uac-0188-frwl-threat-actorhttps://www.cybermaterial.com/p/uac-0188-frwl-threat-actorMon, 03 Mar 2025 02:52:10 GMT

UAC-0188

Other Names

From Russia With Love, FRwL

Location

Russia

Date of initial activity

2022

Suspected attribution

Hactivist Group

Government Affiliation

Unknown

Motivation

Hacktivism

Associated tools

Somnia Ran…

Read more

]]><![CDATA[Ghostr (Cybercriminal) – Threat Actor]]>https://www.cybermaterial.com/p/ghostr-cybercriminal-threat-actorhttps://www.cybermaterial.com/p/ghostr-cybercriminal-threat-actorMon, 03 Mar 2025 02:51:25 GMT

Ghostr

Location

China

Date of initial activity

2017

Suspected attribution

Cybercriminal

Government Affiliation

No

Associated Groups

APT10(MenuPass, POTASSIUM, Stone Panda, Red Apollo, and CVNX)

Motivation

Financ…

Read more

]]><![CDATA[UAC-0200 (State-Sponsored) – Threat Actor]]>https://www.cybermaterial.com/p/uac-0200-state-sponsored-threat-actorhttps://www.cybermaterial.com/p/uac-0200-state-sponsored-threat-actorMon, 03 Mar 2025 02:48:58 GMT

UAC-0200

Location

Luhansk People's Republic (LPR- self proclaimed breakaway region in ukraine supported by Russia)

Date of Initial Activity

2024

Suspected attribution

State-sponsored threat group

Government…

Read more

]]><![CDATA[Turla (The Epic Turla, Snake) – Threat Actor]]>https://www.cybermaterial.com/p/turla-the-epic-turla-snake-threat-actorhttps://www.cybermaterial.com/p/turla-the-epic-turla-snake-threat-actorMon, 03 Mar 2025 02:48:04 GMT

Turla

Other Names

The Epic Turla

Snake

Uroburos

Epic

Location

Russia

Date of initial activity

2004

Suspected attribution

State-sponsored Threat Group

Government Affiliation

Yes

Associated Groups

IRON HUNTER, Group …

Read more

]]><![CDATA[Royal Tiger – Threat Actor]]>https://www.cybermaterial.com/p/royal-tiger-threat-actorhttps://www.cybermaterial.com/p/royal-tiger-threat-actorMon, 03 Mar 2025 02:46:13 GMT

 Royal Tiger

Date of Initial Activity

2024

Suspected Attribution 

Cybercriminal

Government Affiliation

No

Motivation

Financial Gain

Overview

Royal Tiger, led by figures like Prince Jashvantlal Anand and Kausha…

Read more

]]><![CDATA[Sharp Dragon (Sharp Panda) – Threat Actor]]>https://www.cybermaterial.com/p/sharp-dragon-sharp-panda-threat-actorhttps://www.cybermaterial.com/p/sharp-dragon-sharp-panda-threat-actorMon, 03 Mar 2025 02:45:06 GMT

Sharp Dragon

Other Names

Sharp Panda

Panda

Panda Dragon

Location

China

Date of initial activity

2021

Suspected Attribution 

Cybercriminal

Government Affiliation

No

Motivation

Cyberespionage

Associated Tools

VictoryD…

Read more

]]><![CDATA[FlyingYeti (UAC-0149) – Threat Actor]]>https://www.cybermaterial.com/p/flyingyeti-uac-0149-threat-actorhttps://www.cybermaterial.com/p/flyingyeti-uac-0149-threat-actorMon, 03 Mar 2025 02:44:28 GMT

FlyingYeti

Other Names

UAC-0149

Location

Russia

Date of Initial Activity

2014

Suspected Attribution 

State-sponsored threat actor

Government Affiliation

Yes

Associated Groups

Fancy Bear, Cozy Bear, Sofacy

Motivat…

Read more

]]><![CDATA[LilacSquid (UAT-4820) – Threat Actor]]>https://www.cybermaterial.com/p/lilacsquid-uat-4820-threat-actorhttps://www.cybermaterial.com/p/lilacsquid-uat-4820-threat-actorMon, 03 Mar 2025 02:43:04 GMT

LilacSquid

Other Names

UAT-4820

Date of Initial Activity

2021

Suspected Attribution 

Cybercriminal

Government Affiliation

No

Associated Groups

Unknown

Motivation

Financial Gain

Associated Tools

MeshAgent
PurpleInk
I…

Read more

]]><![CDATA[Anon Black Flag Indonesia – Threat Actor]]>https://www.cybermaterial.com/p/anon-black-flag-indonesia-threat-actorhttps://www.cybermaterial.com/p/anon-black-flag-indonesia-threat-actorMon, 03 Mar 2025 02:42:09 GMT

Anon Black Flag Indonesia

Location

Indonesia

Date of Initial Activity

2024

Suspected Attribution 

Hacktivist Group

Government Affiliation

No

Motivation

Hacktivism

Overview

Anon Black Flag Indonesia is an influen…

Read more

]]><![CDATA[Anonymous Bangladesh – Threat Actor]]>https://www.cybermaterial.com/p/anonymous-bangladesh-threat-actorhttps://www.cybermaterial.com/p/anonymous-bangladesh-threat-actorMon, 03 Mar 2025 02:41:23 GMT

Anonymous Bangladesh

Other Names

Fidzxploit
Riski Haxor
Mr Exsploit Wmc

Location

Bangladesh

Date of initial activity

2024

Suspected Attribution 

Hacktivist Group

Government Affiliation

No

Motivation

Hacktivism

Ov…

Read more

]]><![CDATA[Morocco Black Cyber Army – Threat Actor]]>https://www.cybermaterial.com/p/morocco-black-cyber-army-threat-actorhttps://www.cybermaterial.com/p/morocco-black-cyber-army-threat-actorMon, 03 Mar 2025 02:40:33 GMT

Morocco Black Cyber Army

Location

Morocco

Date of Initial Activity

2023

Associated Groups

Lulzsec

Government Affiliation

No

Motivation

Hacktivism

Disruption

Overview

Morocco Black Cyber Army is a prominent hackti…

Read more

]]><![CDATA[Iranian Phishing Campaign (Scam) – Malware]]>https://www.cybermaterial.com/p/iranian-phishing-campaign-scam-malwarehttps://www.cybermaterial.com/p/iranian-phishing-campaign-scam-malwareSun, 02 Mar 2025 22:38:53 GMT

Iranian Phishing Campaign

Type of Campaign

Scam

Country of Origin

Iran

Targeted Countries

United States

United Kingdom

Date of Initial Activity

2024

Motivation

Data Theft

Type of Information Stolen

Personally Ide…

Read more

]]><![CDATA[Fake WalletConnect (Infostealer) – Malware]]>https://www.cybermaterial.com/p/fake-walletconnect-infostealer-malwarehttps://www.cybermaterial.com/p/fake-walletconnect-infostealer-malwareSun, 02 Mar 2025 22:37:43 GMT

Fake WalletConnect

Type of Malware

Infostealer

Date of Initial Activity

2024

Addittional Names

Wallet Scam

Motivation

Data Theft
Financial Gain

Type of Information Stolen

Cryptocurrencies
Financial Information

…

Read more

]]>