1. Tailored Access Operations, NSA

Active since at least 1998, the Office of Tailored Access Operations is a cyber-warfare intelligence-gathering unit of the National Security Agency (NSA). A document leaked by former NSA contractor Edward Snowden describing the unit’s work says TAO has software templates allowing it to break into commonly used hardware like routers and switches.

With 600 employees gathering information around the world, their motto is "Your data is our data, your equipment is our equipment – anytime, any place, by any legal means."

 

2. Sofacy Group – APT28 – Pawn Storm

Believed to have ties to the Russian Government and said to have been operational from 2007, the group is known to target government, military, and security organizations. Characterised as an advanced persistent threat, the group employs spear phishing attacks, using malware to gain control of systems via a command and control infrastructure.

The group is said to have had involvement in the TV5Monde cyber attack and the six-month long attack on the German parliament that began in December 2014.

 

3. Bureau 121

Bureau 121 is a North Korean cyberwarfare agency, which is part of the General Bureau of Reconnaissance of North Korea’s military. According to American authorities, Bureau 121 was created in 1998, with the agency coming to public attention following the Sony hack.

Bureau 121 has been blamed for the cyber breach, but North Korea has rejected this accusation. It is thought that many of the agency’s activities are directed at South Korea and, Prior to the Sony hack, reports emerged that 30,000 PCs in South Korea had been attacked.

 

4. Putter Panda

Putter Panda is the name of bad actor responsible for a series of cyber espionage operations originating in Shanghai, with security experts linking its operation to the activity of the People’s Liberation Army 3rd General Staff Department 12th Bureau Unit 61486.

The group has been operating since at least 2007 and appears very interested in research companies in the space and satellite industry, experts at CrowdStrike have collected evidence of a numerous attacks against these industries.

 

5. Hidden Lynx

Dubbed Hidden Lynx by Symantec, the professional hackers for hire were dubbed best of breed by Symantec following various targeted attacks or Advanced Persistent Threats (APTs). Given the breadth and number of targets and regions involved, we infer that this group is most likely a professional hacker-for-hire operation that are contracted by clients to provide information.

They steal on demand, whatever their clients are interested in, hence the wide variety and range of targets. The group are assumed to have extensive hacking expertise, up to 100 people in the group and enough time and effort to carryout attacks on a large and varied scale.