APT IOC Aggregator

Available malware-family indicators linked to MITRE ATT&CK groups — hashes, domains and IPs for investigation.

Dataset generated Fri, 30 Oct 2026 16:38:43 GMT. Daily refresh is scheduled; the displayed date is the last available dataset, not a promise of daily success.

Indicators: loadingFamilies: loadingGroups: loadinglast 180 days

Use these IOCs in a SOC investigation

Choose a group and a recent observation window, then copy only the indicator types your SIEM or EDR supports.
Search historical telemetry first. Record the matching indicator, observation time, asset and source; corroborate a hit with process, DNS or network context.
Open the linked ATT&CK group profile to compare reported techniques and tooling with your evidence.

These indicators are associated through malware-family mappings. A shared family or an IOC match alone does not establish actor attribution. Check source context, age and false positives before creating a blocking rule. A missing match does not show that a host is clean.

Seen in last

Full group index — every ATT&CK group with attributable indicators

What this dataset contains

127 MITRE ATT&CK groups mapped to malware-family indicators from abuse.ch ThreatFox and MalwareBazaar: 14,085 MD5, 13,462 SHA-1, 14,989 SHA-256, 5,740 domains and 6,532 IPs. Last generated Fri, 30 Oct 2026 16:38:43 GMT; refresh attempts are scheduled daily.

Only 51 of 127 groups have any group-attributable indicator. Families used by five or more distinct groups are commodity tooling (AdFind, CobaltStrike, Empire, Gh0stRAT, LaZagne, Mimikatz, …) and are counted separately — seeing one tells you little about which group is involved.

Groups with attributable indicators, most first
Group	Origin	Attributable	Shared tooling
Akira	—	313	6
APT-C-36	—	582	1,602
APT28	Russia	72	6
APT29	Russia	323	156
APT33	Iran	536	6
APT38	North Korea	47	6
APT41	China	3	850
Carbanak	—	3	6
Cinnamon Tempest	China	323	151
Contagious Interview	North Korea	1	0
Dark Caracal	—	256	0
EXOTIC LILY	—	6	0
Ferocious Kitten	Iran	3	0
FIN6	—	3	156
FIN7	—	16	156
Fox Kitten	Iran	10	0
Gamaredon Group	Russia	487	0
GOLD SOUTHFIELD	—	1,120	0
Gorgon Group	Pakistan	990	1,602
Group5	Iran	503	467
HEXANE	—	11	6
Indrik Spider	Russia	2	156
Kimsuky	North Korea	269	1,350
Lazarus Group	North Korea	372	0
LazyScripter	—	553	1,602
Magic Hound	Iran	19	6
Malteiro	—	6	0
Mofang	China	21	0
Moonstone Sleet	North Korea	4	0
MuddyWater	Iran	1,186	6
Putter Panda	China	4	0
Sandworm Team	Russia	11	156
Scattered Spider	—	1,120	6
Sidewinder	India	66	0
SilverTerrier	—	1,215	0
Sowbug	—	15	0
Star Blizzard	Russia	4	0
Storm-0501	—	16	150
Storm-1811	—	3	150
TA2541	—	670	467
TA505	—	277	156
TA551	—	323	0
TA577	—	70	0
TA578	—	76	0
The White Company	—	6	0
Transparent Tribe	Pakistan	47	467
Turla	Russia	9	6
UNC3886	China	46	0
Water Galura	—	4	0
WIRTE	—	244	0
Wizard Spider	Russia	15	156