Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)
Summary: Unit 42's catalog organizes tracked threat actor groups by constellation designators, sorted alphabetically, with each entry listing the actor category, typically impacted industries and a threat summary. The state-backed groups covered include Pakistan-linked Mocking Draco and Opaque Draco, Belarus-linked White Lynx, North Korea's Jumpy Pisces and Slow Pisces, and Iran-linked groups including Academic Serpens, Agent Serpens, Agonizing Serpens, Boggy Serpens, Devious Serpens and Evasive Serpens, plus China-attributed Alloy Taurus and Charging Taurus.
Why it matters: Slow Pisces, a North Korea group under the Reconnaissance General Bureau, has reportedly stolen in excess of $1 billion in 2023 alone by targeting organizations that handle large volumes of cryptocurrency.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026