

| Last database change | 16 August 2025 | 
| Total threat groups | 504 (416 APT, 54 other, 34 unknown) | 
| Total group aliases | 1789 | 
| Total operations | 2997 | 
| Total counter operations | 274 | 
| Unique source countries | 34 | 
| Unique victim countries | 172 | 
| Unique victim sectors | 42 | 
| Unique tools | 2194 | 
| Total tool aliases | 3328 | 
| Unique external references | 9569 | 
| Pos | Victim country | Count | 
| 1 |  USA | 188 | 
| 2 |  UK | 112 | 
| 3 |  India | 103 | 
| 4 |  Russia | 102 | 
| 5 |  Germany | 88 | 
| 6 |  China | 85 | 
| 7 |  South Korea | 79 | 
|  Thailand | 79 | |
| 9 |  Japan | 75 | 
| 10 |  Canada | 72 | 
| 11 |  Taiwan | 71 | 
| 12 |  Turkey | 70 | 
| 13 |  France | 65 | 
|  Vietnam | 65 | |
| 15 |  Ukraine | 62 | 
| 16 |  Malaysia | 61 | 
| 17 |  UAE | 59 | 
|  Australia | 59 | |
| 19 |  Pakistan | 58 | 
| 20 |  Israel | 56 | 
|  Philippines | 56 | |
| 22 |  Italy | 54 | 
| 23 |  Indonesia | 53 | 
| 24 |  Brazil | 52 | 
| 25 |  Saudi Arabia | 49 | 
| 26 |  Hong Kong | 48 | 
| 27 |  Netherlands | 46 | 
| 28 |  Spain | 45 | 
|  Iran | 45 | |
| 30 |  Singapore | 40 | 
| 31 |  Switzerland | 38 | 
| 32 |  Sweden | 35 | 
|  Belgium | 35 | |
|  Poland | 35 | 
| Pos | Source country | Count | 
| 1 |  China | 177 | 
| 2 |  Russia | 52 | 
| 3 |  Iran | 44 | 
| 4 |  North Korea | 14 | 
| 5 |  USA | 8 | 
| 6 |  Pakistan | 7 | 
| 7 |  India | 6 | 
| 8 |  Lebanon | 4 | 
|  Turkey | 4 | |
| 10 |  Vietnam | 3 | 
|  South Korea | 3 | |
|  Ukraine | 3 | |
|  Belarus | 3 | |
|  Kazakhstan | 3 | |
|  Syria | 3 | |
| 16 |  UAE | 2 | 
|  Spain | 2 | |
|  Israel | 2 | |
|  Brazil | 2 | |
| 20 |  Tunisia | 1 | 
|  Colombia | 1 | |
|  Romania | 1 | |
|  UK | 1 | |
|  Mexico | 1 | |
|  Libya | 1 | |
|  Yemen | 1 | |
|  Nigeria | 1 | |
|  Uzbekistan | 1 | |
|  France | 1 | |
|  Singapore | 1 | |
|  Italy | 1 | |
|  Saudi Arabia | 1 | |
|  Indonesia | 1 | |
|  Canada | 1 | 
| Pos | Tool | Count | 
| 1 | Cobalt Strike | 67 | 
| 2 | Mimikatz | 62 | 
| 3 | Living off the Land | 58 | 
| 4 | PlugX | 39 | 
| 5 | PsExec | 31 | 
| 6 | Poison Ivy | 26 | 
| 7 | Gh0st RAT | 25 | 
| 8 | njRAT | 22 | 
| 9 | China Chopper | 20 | 
| 10 | ProcDump | 19 | 
| Pos | Victim sector | Count | 
| 1 | Government | 204 | 
| 2 | Defense | 117 | 
| 3 | Financial | 108 | 
| 4 | Telecommunications | 92 | 
| 5 | Energy | 87 | 
| 6 | Education | 80 | 
| 7 | Media | 73 | 
| 8 | Healthcare | 59 | 
| Manufacturing | 59 | |
| 10 | IT | 43 | 
| Digital Service Security Center Follow us on    | Report incidents | |
|  | +66 (0)2-123-1227 | |
|  | [email protected] | |