Threat Actor / APT: answer key
Every question with its answer and the reasoning. Work the drill first, or the key only tells you what, not how.
-
The alias "Cozy Bear" refers to which MITRE-tracked threat actor group?
Answer: APT29
"Cozy Bear" is one of 14 publicly known aliases for APT29. APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).
Read more: Full profile: APT29
-
Name the threat actor group attributed to Russia's FSB "Center 16" and known for targeting critical infrastructure and industrial control systems since 2010.
Answer: Dragonfly
Dragonfly (G0035) is the group attributed to Russia's FSB "Center 16" and known for targeting critical infrastructure and industrial control systems since 2010. Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.
Read more: Full profile: Dragonfly
-
Name the threat actor group attributed to Russia's FSB and known for its Uroburos malware and long-running espionage campaigns.
Answer: Turla
Turla (G0010) is the group attributed to Russia's FSB and known for its Uroburos malware and long-running espionage campaigns. Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB).
Read more: Full profile: Turla
-
Name the threat actor group that ran point-of-sale malware campaigns through a front company called Combi Security.
Answer: FIN7
FIN7 (G0046) is the group that ran point-of-sale malware campaigns through a front company called Combi Security. FIN7 is a financially-motivated threat group that has been active since 2013.
Read more: Full profile: FIN7
-
Name the threat actor group that MITRE notes may be linked to Cobalt Group and FIN7, who have also used its namesake malware.
Answer: Carbanak
Carbanak (G0008) is the group that MITRE notes may be linked to Cobalt Group and FIN7, who have also used its namesake malware. Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013.
Read more: Full profile: Carbanak
-
Name the threat actor group that is native English-speaking, active since 2022, and initially targeted CRM/BPO/telecom providers before expanding into gaming and hospitality.
Answer: Scattered Spider
Scattered Spider (G1015) is the group that is native English-speaking, active since 2022, and initially targeted CRM/BPO/telecom providers before expanding into gaming and hospitality. Scattered Spider is a native English-speaking cybercriminal group active since at least 2022.
Read more: Full profile: Scattered Spider
-
Name the threat actor group whose Military Unit Cover Designator (MUCD) is Unit 61398.
Answer: APT1
APT1 (G0006) is the group whose Military Unit Cover Designator (MUCD) is Unit 61398. APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.
Read more: Full profile: APT1
-
Which threat actor group is documented using the malware/tool "BLINDINGCAN"?
Answer: Lazarus Group
BLINDINGCAN is documented malware/tooling used by Lazarus Group (G0032).
Read more: Full profile: Lazarus Group
-
Which threat actor group is documented using the malware/tool "BOOSTWRITE"?
Answer: FIN7
BOOSTWRITE is documented malware/tooling used by FIN7 (G0046).
Read more: Full profile: FIN7
-
Which vendor's naming scheme uses a two-word cryptonym where the second word is an animal indicating nation-state nexus or motivation (e.g. Bear, Panda, Spider)?
Answer: CrowdStrike
CrowdStrike assigns every tracked adversary a two-word cryptonym: a unique first-word qualifier plus a shared second-word category term (Bear = Russia, Panda = China, Spider = eCrime, and more).
Read more: Naming conventions: why one group has so many names
-
In CrowdStrike's naming scheme, what does the qualifier "Panda" indicate?
Answer: China
CrowdStrike's "Panda" category word marks a nation-state actor attributed to China. The second word in a CrowdStrike cryptonym indicates nation-nexus or motivation, never the specific actor.
Read more: Naming conventions: why one group has so many names
-
Mandiant designates a group it assesses to be financially motivated (not nation-state espionage) with what letter-prefixed code?
Answer: FIN
Mandiant/Google Threat Intelligence uses "FIN##" for a group it assesses as financially motivated (cybercrime), separate from "APT##" for nation-state espionage and "UNC####" for a cluster not yet classified either way.
Read more: Naming conventions: why one group has so many names
-
Mandiant opens a new, not-yet-attributed cluster of intrusion activity under what prefix, before it has enough evidence to classify it as APT or FIN?
Answer: UNC
Mandiant's "UNC####" designation is deliberately non-committal. It tracks a cluster of related intrusion activity without yet claiming a motivation or nation-state attribution, and can later graduate into a named APT/FIN group.
Read more: Naming conventions: why one group has so many names
-
Since April 2023, Microsoft names every threat actor after a shared theme. What is that theme?
Answer: weather
Microsoft's post-April-2023 taxonomy assigns every threat actor a weather-themed family name, mapping to a country for nation-state actors or to a motivation/category otherwise. It replaced the older chemical-element codenames (e.g. STRONTIUM, NOBELIUM).
Read more: Naming conventions: why one group has so many names
-
In Microsoft's current weather-themed taxonomy, what does the family name "Blizzard" indicate?
Answer: Russia
Microsoft's "Blizzard" family name is Russia-attributed nation-state activity. "Midnight Blizzard" and "Forest Blizzard" are two distinct Russia-attributed groups sharing that one family name.
Read more: Naming conventions: why one group has so many names
-
A Microsoft-tracked cluster that's newly discovered or not yet fully attributed gets what temporary designation, before it converts to a permanent weather-themed name?
Answer: Storm
Microsoft assigns a temporary "Storm-####" designation to a newly discovered or still-developing cluster; once Microsoft reaches high confidence on origin/identity, it converts to a permanent named actor or merges into an existing one.
Read more: Naming conventions: why one group has so many names
-
Secureworks Counter Threat Unit (CTU) names every threat group after a metal or chemical element plus a nickname. What does the element "IRON" denote?
Answer: Russia
Secureworks CTU's "IRON" element prefix denotes Russia. For example, "IRON TWILIGHT" (APT28/G0007) and "IRON RITUAL"/"IRON HEMLOCK" (APT29/G0016) are both Russia-attributed.
Read more: Naming conventions: why one group has so many names
-
MITRE ATT&CK renamed the field listing every other publicly reported name for a tracked group. It used to be "Aliases". What is it called now?
Answer: Associated Groups
MITRE's own group pages currently label this field "Associated Groups" (with a parenthetical noting it was formerly labeled "Aliases"). It lists every other vendor's publicly reported name for the same tracked activity, regardless of who coined it.
Read more: Naming conventions: why one group has so many names
-
CrowdStrike is naming a newly discovered nation-state adversary it attributes to Russia. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: Bear
CrowdStrike would use "Bear" as the shared category word. Every Russia-attributed CrowdStrike adversary carries it (Cozy Bear, Fancy Bear, Venomous Bear), paired with a unique qualifier for that specific actor.
Read more: Naming conventions: CrowdStrike's own scheme
-
CrowdStrike is naming a newly discovered nation-state adversary it attributes to North Korea. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: Chollima
CrowdStrike uses "Chollima" as its category word for North Korea-attributed nation-state activity.
Read more: Naming conventions: CrowdStrike's own scheme
-
CrowdStrike is naming a newly discovered adversary it assesses as financially motivated (eCrime), not nation-state. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: Spider
CrowdStrike reserves "Spider" for eCrime/financially motivated activity, separate from any of its nation-state animal words.
Read more: Naming conventions: CrowdStrike's own scheme
-
Microsoft is naming a newly attributed nation-state actor tied to China. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: Typhoon
Microsoft assigns China-attributed nation-state actors to its "Typhoon" family (e.g. Volt Typhoon, Flax Typhoon).
Read more: Naming conventions: Microsoft's own scheme
-
Microsoft is naming a newly attributed nation-state actor tied to North Korea. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: Sleet
Microsoft's "Sleet" family name maps to North Korea-attributed nation-state activity.
Read more: Naming conventions: Microsoft's own scheme
-
Microsoft is naming a newly discovered actor it assesses as financially motivated, not nation-state. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: Tempest
Microsoft uses "Tempest" for financially motivated (non-nation-state) activity. It is motivation-based, not country-based, unlike most of its other weather families.
Read more: Naming conventions: Microsoft's own scheme
-
Secureworks CTU is naming a newly tracked threat group it attributes to China. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: BRONZE
Secureworks CTU prefixes China-attributed groups with "BRONZE" (e.g. BRONZE UNION, formerly tracked as TG-3390).
Read more: Naming conventions: Secureworks Counter Threat Unit (now part of Sophos)'s own scheme
-
Secureworks CTU is naming a newly tracked threat group it attributes to North Korea. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: NICKEL
Secureworks CTU prefixes North Korea-attributed groups with "NICKEL."
Read more: Naming conventions: Secureworks Counter Threat Unit (now part of Sophos)'s own scheme
-
Secureworks CTU is naming a newly tracked threat group it assesses as cybercrime/financially motivated. Applying that vendor's own real naming convention, what code/qualifier would it assign?
Answer: GOLD
Secureworks CTU prefixes financially motivated/cybercrime groups with "GOLD". It is motivation-based, not country-based, unlike most of its other element prefixes.
Read more: Naming conventions: Secureworks Counter Threat Unit (now part of Sophos)'s own scheme
-
Axiom and Winnti Group are frequently confused/linked in reporting. Sort each item below into the group it actually, verifiably belongs to.
Answer: Group 72 → Axiom · Blackfly → Winnti Group · Hikit → Axiom · PipeMon → Winnti Group · gh0st RAT → Axiom · Winnti for Windows → Winnti Group
MITRE's own reporting notes a degree of overlap between Axiom and Winnti Group in how each has been described, but assesses them as distinct groups based on differences in TTPs and targeting. Axiom: Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Winnti Group: Winnti Group is a threat group with Chinese origins that has been active since at least 2010.
Read more: Full profile: Axiom (compare against Winnti Group)
-
APT19 and Deep Panda are frequently confused/linked in reporting. Sort each item below into the group it actually, verifiably belongs to.
Answer: Codoso → APT19 · Shell Crew → Deep Panda · Sunshop Group → APT19 · Sakula → Deep Panda · Empire → APT19 · StreamEx → Deep Panda
Some analysts track APT19 and Deep Panda as the same group, though MITRE itself notes it is unclear from open-source reporting whether the two are actually the same activity. APT19: APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. Deep Panda: Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications.
-
Scarlet Mimic and Putter Panda are frequently confused/linked in reporting. Sort each item below into the group it actually, verifiably belongs to.
Answer: FakeM → Scarlet Mimic · APT2 → Putter Panda · MobileOrder → Scarlet Mimic · MSUpdater → Putter Panda · Psylo → Scarlet Mimic · pngdowner → Putter Panda
MITRE notes some overlap between IP infrastructure used by Scarlet Mimic and Putter Panda, though it hasn't been concluded the two are the same group. Scarlet Mimic: Scarlet Mimic is a threat group that has targeted minority rights activists. Putter Panda: Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD).
Read more: Full profile: Scarlet Mimic (compare against Putter Panda)