TA428 socradar-apt-ta428 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | TA428 via TA428 Vicious Panda via TA428 | - SOCRadar has separate records for TA428 / Vicious Panda.
- IntelliOS noticed those records share alias evidence: BRONZE DUDLEY, Colourful Panda, TA428.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Storm-0558 socradar-apt-storm-0558 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Storm-0558 via Storm-0558 Storm0558 via Storm0558 | - SOCRadar has separate records for Storm-0558 / Storm0558.
- IntelliOS noticed those records share alias evidence: Storm-0558.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Inception socradar-apt-inception | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Inception via Cloud Atlas Inception Framework via Cloud Atlas | - SOCRadar has separate records for Inception / Inception Framework.
- IntelliOS noticed those records share alias evidence: Inception Framework, Cloud Atlas.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
MALLARD SPIDER socradar-apt-mallard-spider | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | MALLARD SPIDER via DEV-0450 TA570 via DEV-0450 | - SOCRadar has separate records for MALLARD SPIDER / TA570.
- IntelliOS noticed those records share alias evidence: TA570, DEV-0450.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
tridentlocker socradar-ransomware-tridentlocker | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | tridentlocker via tridentlocker TridentLocker via Trident Locker | - SOCRadar has separate records for tridentlocker / TridentLocker.
- IntelliOS noticed those records share alias evidence: TridentLocker.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
DEV-0586 socradar-apt-dev-0586 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | DEV-0586 via UAC-0056 SaintBear via UAC-0056 | - SOCRadar has separate records for DEV-0586 / SaintBear.
- IntelliOS noticed those records share alias evidence: Cadet Blizzard, Ember Bear, UNC2589, Bleeding Bear, Frozenvista, UAC-0056.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
akira socradar-ransomware-akira | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | akira via Howling Scorpius Storm-1567 via Howling Scorpius | - SOCRadar has separate records for akira / Storm-1567.
- IntelliOS noticed those records share alias evidence: akira, Storm-1567, GOLD SAHARA, PUNK SPIDER, Howling Scorpius.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Mustang Panda socradar-apt-mustang-panda | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Mustang Panda via TEMP.HEX Vicious Panda via Temp.Hex | - SOCRadar has separate records for Mustang Panda / Vicious Panda.
- IntelliOS noticed those records share alias evidence: TEMP.HEX.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Camaro Dragon socradar-apt-camaro-dragon | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Camaro Dragon via Camaro Dragon Mustang Panda via CAMARO DRAGON | - SOCRadar has separate records for Camaro Dragon / Mustang Panda.
- IntelliOS noticed those records share alias evidence: CAMARO DRAGON.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
GOLD PRELUDE socradar-apt-gold-prelude | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | GOLD PRELUDE via UNC1543 Mustard Tempest via UNC1543 | - SOCRadar has separate records for GOLD PRELUDE / Mustard Tempest.
- IntelliOS noticed those records share alias evidence: TA569, GOLD PRELUDE, UNC1543.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Naikon socradar-apt-naikon | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Naikon via G0013 Raspberry Typhoon via G0013 | - SOCRadar has separate records for Naikon / Raspberry Typhoon.
- IntelliOS noticed those records share alias evidence: G0013.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
GOLD SOUTHFIELD socradar-apt-gold-southfield | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | GOLD SOUTHFIELD via Pinchy Spider PINCHY SPIDER via PINCHY SPIDER | - SOCRadar has separate records for GOLD SOUTHFIELD / PINCHY SPIDER.
- IntelliOS noticed those records share alias evidence: Pinchy Spider.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Lazarus Group socradar-apt-lazarus-group | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Lazarus Group via Andariel Silent Chollima via Andariel | - SOCRadar has separate records for Lazarus Group / Silent Chollima.
- IntelliOS noticed those records share alias evidence: OperationTroy, Andariel.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
babuk-bjorka socradar-ransomware-babuk-bjorka | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | babuk-bjorka via Bjorka Babuk-Locker via Bjorka babuk2 via Bjorka | - SOCRadar has separate records for babuk-bjorka / Babuk-Locker / babuk2.
- IntelliOS noticed those records share alias evidence: Babuk2, SkyWave, Bjorka.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Storm-2603 socradar-ransomware-storm-2603 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Storm-2603 via Storm-2603 warlock via Storm-2603 | - SOCRadar has separate records for Storm-2603 / warlock.
- IntelliOS noticed those records share alias evidence: Storm-2603.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
sinobi socradar-ransomware-sinobi | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | sinobi via sinobi Sinobi via Sinobi | - SOCRadar has separate records for sinobi / Sinobi.
- IntelliOS noticed those records share alias evidence: sinobi.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Lazarus Group socradar-apt-lazarus-group | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Lazarus Group via Citrine Sleet UNC4736 via Citrine Sleet | - SOCRadar has separate records for Lazarus Group / UNC4736.
- IntelliOS noticed those records share alias evidence: Citrine Sleet.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT 12 socradar-apt-apt-12 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT 12 via Calc Team IXESHE via Calc Team | - SOCRadar has separate records for APT 12 / IXESHE.
- IntelliOS noticed those records share alias evidence: APT 12, IXESHE, DynCalc, Numbered Panda, DNSCALC, Calc Team.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT 28 socradar-apt-apt-28 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT 28 via Grizzly Steppe APT 29 via Grizzly Steppe | - SOCRadar has separate records for APT 28 / APT 29.
- IntelliOS noticed those records share alias evidence: Grizzly Steppe.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT 29 socradar-apt-apt-29 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT 29 via UNC2452 UNC2452 via UNC2452 | - SOCRadar has separate records for APT 29 / UNC2452.
- IntelliOS noticed those records share alias evidence: UNC2452.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT 29 socradar-apt-apt-29 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT 29 via UNC3524 UNC3524 via UNC3524 | - SOCRadar has separate records for APT 29 / UNC3524.
- IntelliOS noticed those records share alias evidence: UNC3524.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT 17 socradar-apt-apt-17 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT 17 via APT17 Aurora Panda via APT17 | - SOCRadar has separate records for APT 17 / Aurora Panda.
- IntelliOS noticed those records share alias evidence: APT 17.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
cheers socradar-ransomware-cheers | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | cheers via Cheerscrypt Cheerscrypt via Cheerscrypt | - SOCRadar has separate records for cheers / Cheerscrypt.
- IntelliOS noticed those records share alias evidence: cheers, Cheerscrypt.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
MONTY SPIDER socradar-apt-monty-spider | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | MONTY SPIDER via Spandex Tempest TA505 via Spandex Tempest | - SOCRadar has separate records for MONTY SPIDER / TA505.
- IntelliOS noticed those records share alias evidence: Spandex Tempest.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
BRONZE STARLIGHT socradar-apt-bronze-starlight | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | BRONZE STARLIGHT via BRONZE STARLIGHT Cheerscrypt via Bronze Starlight | - SOCRadar has separate records for BRONZE STARLIGHT / Cheerscrypt.
- IntelliOS noticed those records share alias evidence: DEV-0401, Emperor Dragonfly, Bronze Starlight.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Cheerscrypt socradar-ransomware-cheerscrypt | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Cheerscrypt via Night Sky nightsky via nightsky | - SOCRadar has separate records for Cheerscrypt / nightsky.
- IntelliOS noticed those records share alias evidence: Night Sky.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
conti socradar-ransomware-conti | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | conti via Wizard Spider WIZARD SPIDER via WIZARD SPIDER | - SOCRadar has separate records for conti / WIZARD SPIDER.
- IntelliOS noticed those records share alias evidence: Wizard Spider.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
conti socradar-ransomware-conti | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | conti via Gold Ulrick GRIM SPIDER via GOLD ULRICK | - SOCRadar has separate records for conti / GRIM SPIDER.
- IntelliOS noticed those records share alias evidence: Gold Ulrick.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
conti socradar-ransomware-conti | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | conti via UNC1878 UNC1878 via UNC1878 WIZARD SPIDER via UNC1878 | - SOCRadar has separate records for conti / UNC1878 / WIZARD SPIDER.
- IntelliOS noticed those records share alias evidence: UNC1878.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Coinbase Cartel socradar-apt-coinbase-cartel | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Coinbase Cartel via Coinbase Cartel coinbasecartel via coinbasecartel | - SOCRadar has separate records for Coinbase Cartel / coinbasecartel.
- IntelliOS noticed those records share alias evidence: coinbasecartel.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Lotus Blossom socradar-apt-lotus-blossom | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Lotus Blossom via RADIUM Raspberry Typhoon via RADIUM | - SOCRadar has separate records for Lotus Blossom / Raspberry Typhoon.
- IntelliOS noticed those records share alias evidence: Raspberry Typhoon, LotusBlossom, RADIUM.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Dropping Elephant socradar-apt-dropping-elephant | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Dropping Elephant via Operation Hangover VICEROY TIGER via OPERATION HANGOVER | - SOCRadar has separate records for Dropping Elephant / VICEROY TIGER.
- IntelliOS noticed those records share alias evidence: Operation Hangover.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
elcometa socradar-ransomware-elcometa | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | elcometa via elcometa synack via El_Cometa | - SOCRadar has separate records for elcometa / synack.
- IntelliOS noticed those records share alias evidence: synack, El_Cometa.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT27 socradar-apt-apt27 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT27 via TG-3390 Threat Group-3390 via TG-3390 | - SOCRadar has separate records for APT27 / Threat Group-3390.
- IntelliOS noticed those records share alias evidence: APT27, BRONZE UNION, EMISSARY PANDA, Earth Smilodon, Iron Tiger, Linen Typhoon, Lucky Mouse, TG-3390.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT27 socradar-apt-apt27 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT27 via Circle Typhoon TiltedTemple via Circle Typhoon | - SOCRadar has separate records for APT27 / TiltedTemple.
- IntelliOS noticed those records share alias evidence: Circle Typhoon.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
jsworm socradar-ransomware-jsworm | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | jsworm via Nemty nefilim via Nemty nemty via nemty | - SOCRadar has separate records for jsworm / nefilim / nemty.
- IntelliOS noticed those records share alias evidence: nefilim, Nemty.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
nefilim socradar-ransomware-nefilim | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | nefilim via Nephilim nemty via Nephilim | - SOCRadar has separate records for nefilim / nemty.
- IntelliOS noticed those records share alias evidence: Nephilim.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT 6 socradar-apt-apt-6 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT 6 via 1.php Group APT6 via 1.php Group | - SOCRadar has separate records for APT 6 / APT6.
- IntelliOS noticed those records share alias evidence: APT6, 1.php Group.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
darkrace socradar-ransomware-darkrace | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | darkrace via darkrace donex via DarkRace | - SOCRadar has separate records for darkrace / donex.
- IntelliOS noticed those records share alias evidence: darkrace.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT 5 socradar-apt-apt-5 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT 5 via UNC2630 UNC2630 via UNC2630 | - SOCRadar has separate records for APT 5 / UNC2630.
- IntelliOS noticed those records share alias evidence: UNC2630.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Cyber Caliphate Army socradar-apt-cyber-caliphate-army | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Cyber Caliphate Army via United Cyber Caliphate Cyber Caliphate Army (CCA) via United Cyber Caliphate | - SOCRadar has separate records for Cyber Caliphate Army / Cyber Caliphate Army (CCA).
- IntelliOS noticed those records share alias evidence: CyberCaliphate, Islamic State Hacking Division, United Cyber Caliphate.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
GOLD WINTER socradar-apt-gold-winter | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | GOLD WINTER via GOLD WINTER hades via GOLD WINTER | - SOCRadar has separate records for GOLD WINTER / hades.
- IntelliOS noticed those records share alias evidence: GOLD WINTER.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
HomeLand Justice socradar-apt-homeland-justice | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | HomeLand Justice via HomeLand Justice Void Manticore via Homeland Justice | - SOCRadar has separate records for HomeLand Justice / Void Manticore.
- IntelliOS noticed those records share alias evidence: Homeland Justice.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
karma socradar-ransomware-karma | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | karma via karma Void Manticore via Karma | - SOCRadar has separate records for karma / Void Manticore.
- IntelliOS noticed those records share alias evidence: Karma.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
BANISHED KITTEN socradar-apt-banished-kitten | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | BANISHED KITTEN via Red Sandstorm Void Manticore via Red Sandstorm | - SOCRadar has separate records for BANISHED KITTEN / Void Manticore.
- IntelliOS noticed those records share alias evidence: BANISHED KITTEN, Red Sandstorm.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Bahamut socradar-apt-bahamut | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Bahamut via Bahamut WindShift via Bahamut | - SOCRadar has separate records for Bahamut / WindShift.
- IntelliOS noticed those records share alias evidence: Bahamut.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Cyber Toufan socradar-apt-cyber-toufan | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Cyber Toufan via Cyber Toufan toufan via Cyber Toufan | - SOCRadar has separate records for Cyber Toufan / toufan.
- IntelliOS noticed those records share alias evidence: Cyber Toufan.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
dispossessor socradar-ransomware-dispossessor | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | dispossessor via radar radar via radar | - SOCRadar has separate records for dispossessor / radar.
- IntelliOS noticed those records share alias evidence: dispossessor, radar.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
DoppelPaymer socradar-ransomware-doppelpaymer | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | DoppelPaymer via DoppelPaymer grief via DoppelPaymer | - SOCRadar has separate records for DoppelPaymer / grief.
- IntelliOS noticed those records share alias evidence: Pay OR Grief, DoppelPaymer.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
royal socradar-ransomware-royal | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | royal via Zeon zeon via zeon | - SOCRadar has separate records for royal / zeon.
- IntelliOS noticed those records share alias evidence: Zeon.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
CIRCUS SPIDER socradar-apt-circus-spider | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | CIRCUS SPIDER via CIRCUS SPIDER netwalker via Circus Spider | - SOCRadar has separate records for CIRCUS SPIDER / netwalker.
- IntelliOS noticed those records share alias evidence: CIRCUS SPIDER.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
ragroup socradar-ransomware-ragroup | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | ragroup via RA World raworld via raworld | - SOCRadar has separate records for ragroup / raworld.
- IntelliOS noticed those records share alias evidence: ragroup, RA World.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
lockbit socradar-ransomware-lockbit | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | lockbit via lockbit lockbit3 via lockbit | - SOCRadar has separate records for lockbit / lockbit3.
- IntelliOS noticed those records share alias evidence: lockbit3, ABCD ransomware, lockbit.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
LockBit 3.0 FS socradar-ransomware-lockbit3-fs | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | LockBit 3.0 FS via LockBit Black lockbit3 via LockBit Black | - SOCRadar has separate records for LockBit 3.0 FS / lockbit3.
- IntelliOS noticed those records share alias evidence: LockBit Black.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
shinyhunters socradar-ransomware-shinyhunters | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | shinyhunters via Scattered Lapsus$ Hunters (SLH) ShinySp1d3r via Scattered Lapsus$ Hunters (SLH) | - SOCRadar has separate records for shinyhunters / ShinySp1d3r.
- IntelliOS noticed those records share alias evidence: Scattered Lapsus$ Hunters (SLH).
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
avos socradar-ransomware-avos | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | avos via avos avoslocker via Avos | - SOCRadar has separate records for avos / avoslocker.
- IntelliOS noticed those records share alias evidence: avoslocker, Avos.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Callisto socradar-apt-callisto | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Callisto via TA446 Cold River via TA446 | - SOCRadar has separate records for Callisto / Cold River.
- IntelliOS noticed those records share alias evidence: Cold River, Star Blizzard, SEABORGIUM, TA446.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
3am socradar-ransomware-3am | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | 3am via ThreeAM threeam via threeam | - SOCRadar has separate records for 3am / threeam.
- IntelliOS noticed those records share alias evidence: ThreeAM.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Turla Group socradar-apt-turla-group | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Turla Group via Secret Blizzard White Bear via Secret Blizzard | - SOCRadar has separate records for Turla Group / White Bear.
- IntelliOS noticed those records share alias evidence: Turla, IRON HUNTER, Group 88, Waterbug, Snake, Krypton, Venomous Bear, Secret Blizzard.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Bohrium socradar-apt-bohrium | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Bohrium via Smoke Sandstorm Tortoiseshell via Smoke Sandstorm | - SOCRadar has separate records for Bohrium / Tortoiseshell.
- IntelliOS noticed those records share alias evidence: IMPERIAL KITTEN, Smoke Sandstorm.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Ragnar Locker socradar-ransomware-ragnar-locker | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Ragnar Locker via Ragnar Locker ragnarlocker via ragnarlocker ragnarok via Ragnar Locker | - SOCRadar has separate records for Ragnar Locker / ragnarlocker / ragnarok.
- IntelliOS noticed those records share alias evidence: Ragnar Locker.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
anubis socradar-ransomware-anubis | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | anubis via Sphinx Sphinx via Sphinx | - SOCRadar has separate records for anubis / Sphinx.
- IntelliOS noticed those records share alias evidence: Sphinx.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
AjaxTM socradar-apt-ajaxtm | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | AjaxTM via Rocket Kitten Rocket Kitten via Rocket Kitten | - SOCRadar has separate records for AjaxTM / Rocket Kitten.
- IntelliOS noticed those records share alias evidence: Operation Woolen-Goldfish, Rocket Kitten.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
losttrust socradar-ransomware-losttrust | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | losttrust via MetaEncryptor metaencryptor via metaencryptor | - SOCRadar has separate records for losttrust / metaencryptor.
- IntelliOS noticed those records share alias evidence: losttrust, MetaEncryptor.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
blackout socradar-ransomware-blackout | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | blackout via Blackoutware Blackoutware via Blackoutware | - SOCRadar has separate records for blackout / Blackoutware.
- IntelliOS noticed those records share alias evidence: Blackoutware.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Dark Pink socradar-apt-dark-pink | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Dark Pink via Saaiwc DarkPink via Saaiwc | - SOCRadar has separate records for Dark Pink / DarkPink.
- IntelliOS noticed those records share alias evidence: DarkPink, Saaiwc.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
shinyhunters socradar-ransomware-shinyhunters | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | shinyhunters via UNC6040 UNC6040 via UNC6040 | - SOCRadar has separate records for shinyhunters / UNC6040.
- IntelliOS noticed those records share alias evidence: UNC6040.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Contagious Interview socradar-apt-contagious-interview | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Contagious Interview via PurpleBravo WageMole via PurpleBravo | - SOCRadar has separate records for Contagious Interview / WageMole.
- IntelliOS noticed those records share alias evidence: PurpleBravo.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
holyghost socradar-ransomware-holyghost | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | holyghost via H0lyGh0st Storm-0530 via H0lyGh0st | - SOCRadar has separate records for holyghost / Storm-0530.
- IntelliOS noticed those records share alias evidence: Storm-0530, DEV-0530, H0lyGh0st.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
crylock socradar-ransomware-crylock | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | crylock via crylock trigona via CryLock | - SOCRadar has separate records for crylock / trigona.
- IntelliOS noticed those records share alias evidence: crylock.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
flocker socradar-ransomware-flocker | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | flocker via flocker Fs0ciety Locker Ransomware via Flocker FuckSociety Ransomware via Flocker | - SOCRadar has separate records for flocker / Fs0ciety Locker Ransomware / FuckSociety Ransomware.
- IntelliOS noticed those records share alias evidence: Flocker.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Asnarök socradar-apt-asnar-k | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Asnarök via Asnarök ragnarok via Asnarök | - SOCRadar has separate records for Asnarök / ragnarok.
- IntelliOS noticed those records share alias evidence: Asnarök.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Malek Team socradar-apt-malek-team | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Malek Team via Malek Team malekteam via malekteam | - SOCRadar has separate records for Malek Team / malekteam.
- IntelliOS noticed those records share alias evidence: malekteam.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Desert Falcons socradar-apt-desert-falcons | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Desert Falcons via Two-tailed Scorpion Sphinx via Two-tailed Scorpion | - SOCRadar has separate records for Desert Falcons / Sphinx.
- IntelliOS noticed those records share alias evidence: APT-C-23, Two-tailed Scorpion.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
darkangels socradar-ransomware-darkangels | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | darkangels via darkangels dunghill via Dark Angels | - SOCRadar has separate records for darkangels / dunghill.
- IntelliOS noticed those records share alias evidence: darkangels.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
alphv socradar-ransomware-alphv | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | alphv via alphv BlackCat via ALPHV | - SOCRadar has separate records for alphv / BlackCat.
- IntelliOS noticed those records share alias evidence: ALPHV.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Earth Alux socradar-apt-earth-alux | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Earth Alux via Earth Alux REF7707 via Earth Alux | - SOCRadar has separate records for Earth Alux / REF7707.
- IntelliOS noticed those records share alias evidence: Earth Alux.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
APT35 socradar-apt-apt35 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | APT35 via Phosphorus TA453 via Phosphorus | - SOCRadar has separate records for APT35 / TA453.
- IntelliOS noticed those records share alias evidence: APT35, Charming Kitten, Magic Hound, Mint Sandstorm, Phosphorus.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
ITG18 socradar-apt-itg18 | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | ITG18 via ITG18 TA453 via ITG18 | - SOCRadar has separate records for ITG18 / TA453.
- IntelliOS noticed those records share alias evidence: ITG18.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
GRIM SPIDER socradar-apt-grim-spider | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | GRIM SPIDER via GRIM SPIDER WIZARD SPIDER via Grim Spider | - SOCRadar has separate records for GRIM SPIDER / WIZARD SPIDER.
- IntelliOS noticed those records share alias evidence: Grim Spider.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
hellogookie socradar-ransomware-hellogookie | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | hellogookie via FiveHands hellokitty via FiveHands | - SOCRadar has separate records for hellogookie / hellokitty.
- IntelliOS noticed those records share alias evidence: hellokitty, HelloGookie, FiveHands.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
hive socradar-ransomware-hive | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | hive via hive Hunters via hive | - SOCRadar has separate records for hive / Hunters.
- IntelliOS noticed those records share alias evidence: hive.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
blackmatter socradar-ransomware-blackmatter | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | blackmatter via DarkSide darkside via darkside | - SOCRadar has separate records for blackmatter / darkside.
- IntelliOS noticed those records share alias evidence: DarkSide.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
ransomhub socradar-ransomware-ransomhub | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | ransomhub via Water Bakunawa Water Bakunawa via Water Bakunawa | - SOCRadar has separate records for ransomhub / Water Bakunawa.
- IntelliOS noticed those records share alias evidence: Water Bakunawa.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Cyber Islamic Resistance socradar-apt-cyber-islamic-resistance | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Cyber Islamic Resistance via Cyber Islamic Resistance Cyber Islamic Resistance via Cyber Islamic Resistance | - SOCRadar has separate records for Cyber Islamic Resistance / Cyber Islamic Resistance.
- IntelliOS noticed those records share alias evidence: Cyber Islamic Resistance.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Babuk socradar-ransomware-babuk | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Babuk via Vasa Locker Babuk-Locker via Vasa Locker | - SOCRadar has separate records for Babuk / Babuk-Locker.
- IntelliOS noticed those records share alias evidence: Vasa Locker.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Babuk socradar-ransomware-babuk | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Babuk via Babyk Babuk-Locker via Babyk babuk2 via Babyk | - SOCRadar has separate records for Babuk / Babuk-Locker / babuk2.
- IntelliOS noticed those records share alias evidence: Babyk.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
onyx socradar-ransomware-onyx | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | onyx via onyx Vsop via Onyx | - SOCRadar has separate records for onyx / Vsop.
- IntelliOS noticed those records share alias evidence: onyx.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
cuba socradar-ransomware-cuba | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | cuba via Tropical Scorpius Void Rabisu via Tropical Scorpius | - SOCRadar has separate records for cuba / Void Rabisu.
- IntelliOS noticed those records share alias evidence: Tropical Scorpius.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
cyclops socradar-ransomware-cyclops | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | cyclops via cyclops knight via Cyclops | - SOCRadar has separate records for cyclops / knight.
- IntelliOS noticed those records share alias evidence: cyclops.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
05250lock socradar-ransomware-05250lock | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | 05250lock via Interlock ExoLock via Interlock interlock via interlock | - SOCRadar has separate records for 05250lock / ExoLock / interlock.
- IntelliOS noticed those records share alias evidence: interlock.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
ExoLock socradar-ransomware-exolock | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | ExoLock via ExoLock interlock via ExoLock | - SOCRadar has separate records for ExoLock / interlock.
- IntelliOS noticed those records share alias evidence: ExoLock.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
RansomVC socradar-apt-ransomvc | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | RansomVC via Ransomed.vc raznatovic via RansomedVC rebornvc via RansomedVC | - SOCRadar has separate records for RansomVC / raznatovic / rebornvc.
- IntelliOS noticed those records share alias evidence: RansomedVC.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Evil Corp socradar-apt-evil-corp | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Evil Corp via Evil Corp INDRIK SPIDER via Evil Corp | - SOCRadar has separate records for Evil Corp / INDRIK SPIDER.
- IntelliOS noticed those records share alias evidence: EvilCorp.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
silent socradar-ransomware-silent | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | silent via Chatty Spider Silent Ransom Group / LeakedData via Chatty Spider | - SOCRadar has separate records for silent / Silent Ransom Group / LeakedData.
- IntelliOS noticed those records share alias evidence: UNC3753, Luna Moth, LeakedData, Chatty Spider.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
mamona socradar-ransomware-mamona | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | mamona via Offline Ransomware Offline ransomware via Offline ransomware | - SOCRadar has separate records for mamona / Offline ransomware.
- IntelliOS noticed those records share alias evidence: Offline ransomware.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Ghostwriter socradar-apt-ghostwriter | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Ghostwriter via UNC1151 Operation Ghostwriter via UNC1151 | - SOCRadar has separate records for Ghostwriter / Operation Ghostwriter.
- IntelliOS noticed those records share alias evidence: DEV-0257, PUSHCHA, Storm-0257, TA445, UAC-0057, UNC1151.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Russian Legion Cardinal socradar-apt-russian-legion-cardinal | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Russian Legion Cardinal via Cardinal UNC4393 via Cardinal | - SOCRadar has separate records for Russian Legion Cardinal / UNC4393.
- IntelliOS noticed those records share alias evidence: Cardinal.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Operation Shadow Force socradar-apt-operation-shadow-force | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | Operation Shadow Force via TA-ShadowCricket TA-ShadowCricket via TA-ShadowCricket | - SOCRadar has separate records for Operation Shadow Force / TA-ShadowCricket.
- IntelliOS noticed those records share alias evidence: Operation Shadow Force, Larva-24013, TA-ShadowCricket.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
blacklock socradar-ransomware-blacklock | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | blacklock via blacklock el dorado via BlackLock ElDorado via BlackLock | - SOCRadar has separate records for blacklock / el dorado / ElDorado.
- IntelliOS noticed those records share alias evidence: blacklock.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
blacklock socradar-ransomware-blacklock | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | blacklock via El Dorado BrLock via El Dorado el dorado via Eldorado ElDorado via ElDorado | - SOCRadar has separate records for blacklock / BrLock / el dorado / ElDorado.
- IntelliOS noticed those records share alias evidence: Eldorado.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
cipherforce socradar-ransomware-cipherforce | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | cipherforce via cipherforce TeamPcp via CipherForce | - SOCRadar has separate records for cipherforce / TeamPcp.
- IntelliOS noticed those records share alias evidence: CipherForce.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
mallox socradar-ransomware-mallox | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | mallox via TargetCompany targetcompany via targetcompany weaxor via TargetCompany | - SOCRadar has separate records for mallox / targetcompany / weaxor.
- IntelliOS noticed those records share alias evidence: mallox, FARGO, TargetCompany.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
mallox socradar-ransomware-mallox | SOCRadar Actor Alias Index socradar_actor_alias_index possible same actor | mallox via Tohnichi targetcompany via Tohnichi | - SOCRadar has separate records for mallox / targetcompany.
- IntelliOS noticed those records share alias evidence: Tohnichi.
- That may indicate overlap, alias reuse, a sub-cluster relationship, or duplicate card boundaries, so IntelliOS records the collision but does not merge them.
| open | Source |
Mirage socradar-apt-mirage | Google Cloud Security APT Groups google_mandiant_apt_groups ambiguous alias match | APT25 via apt25 APT15 via apt15 | - SOCRadar currently maps this card to Mirage.
- Google Cloud Security APT Groups produced multiple plausible profile matches for the retained aliases: APT25 via alias "apt25"; APT15 via alias "apt15".
- IntelliOS preserves the SOCRadar baseline and keeps the competing source claims separate so readers can decide how to interpret the actor boundary.
| open | Source |
