Most
Wanted
The Adversary Watchlist
Meet 10 adversaries that earned a place on our Most Wanted list. See who they target, how they operate, and the tactics and techniques they rely on. Then put their playbooks to the test to see how your own defenses respond.
Tracking Active
art@attackiq — watchlist — 2026
art watchlist –series 2026 –status
#AdversaryTypePrimary targetEmu
01Scattered SpidereCrimeTelecom1 EMU
02RomComAPTGovernment7 EMU
03EverestRansomwareGovernment1 EMU
04SandwormAPTEnergy1 EMU
05QilinRansomwareHealthcare1 EMU
06NightSpireRansomwareTechnology1 EMU
07SideWinderAPTGovernment1 EMU
08DragonBreathAPTCryptocurrency1 EMU
09The GentlemenRansomwareManufacturing2 EMU
10NovaRansomwareTechnology1 EMU
watchlist loaded ok
The Watchlist
No. 01Wanted
Scattered Spider
Click to open case fileTap to open case file
Scattered Spider
No. 01
Aliases: 0ktapus, UNC3944, Octo Tempest, Muddled Libra
Assessment AvailableNo. 01
Assessment Available
Known targets
TelecommunicationsTechnologyFinanceRetail
Wanted for
Social EngineeringIdentity AttacksExtortionRansomware
Modus operandi
IT ImpersonationMFA FatigueSIM SwappingCredential TheftLiving off the Land
Aliases0ktapus, UNC3944, Octo Tempest, Muddled Libra
Wanted forSocial Engineering, Identity Attacks, Extortion, Ransomware
Known targetsTelecommunications, Technology, Finance, Retail
Modus operandiIT Impersonation, MFA Fatigue, SIM Swapping, Credential Theft, Living off the Land
ART Series 2026 · 01 / 10
No. 02Wanted
RomCom
Click to open case fileTap to open case file
RomCom
No. 02
Aliases: UAT-5647, Storm-0978
7 Emulations AvailableNo. 02
7 Emulations Available
Known targets
GovernmentDefenseUkraineNATO-Aligned Organizations
Wanted for
CyberespionageData TheftRansomware
Modus operandi
ReconnaissanceCredential HarvestingCustom MalwareData ExfiltrationRansomware
AliasesUAT-5647, Storm-0978
Wanted forCyberespionage, Data Theft, Ransomware
Known targetsGovernment, Defense, Ukraine, NATO-Aligned Organizations
Modus operandiReconnaissance, Credential Harvesting, Custom Malware, Data Exfiltration, Ransomware
ART Series 2026 · 02 / 10
No. 03Wanted
Everest
Click to open case fileTap to open case file
Everest
No. 03
Aliases: None on record
Assessment AvailableNo. 03
Assessment Available
Known targets
GovernmentHealthcareManufacturingIT Services
Wanted for
RansomwareData TheftDouble Extortion
Modus operandi
Wake-on-LANRecovery SabotageSecurity Control TamperingNetwork Share DiscoveryFile Encryption
AliasesNone on record
Wanted forRansomware, Data Theft, Double Extortion
Known targetsGovernment, Healthcare, Manufacturing, IT Services
Modus operandiWake-on-LAN, Recovery Sabotage, Security Control Tampering, Network Share Discovery, File Encryption
ART Series 2026 · 03 / 10
No. 04Wanted
Sandworm
Click to open case fileTap to open case file
Sandworm
No. 04
Aliases: APT44, Seashell Blizzard, Voodoo Bear
Assessment AvailableNo. 04
Assessment Available
Known targets
EnergyGovernmentTelecommunicationsCritical Infrastructure
Wanted for
CyberespionageSabotageDestructive Operations
Modus operandi
Destructive MalwareWipersCredential AccessPersistent IntrusionICS/SCADA Targeting
AliasesAPT44, Seashell Blizzard, Voodoo Bear
Wanted forCyberespionage, Sabotage, Destructive Operations
Known targetsEnergy, Government, Telecommunications, Critical Infrastructure
Modus operandiDestructive Malware, Wipers, Credential Access, Persistent Intrusion, ICS/SCADA Targeting
ART Series 2026 · 04 / 10
No. 05Wanted
Qilin
Click to open case fileTap to open case file
Qilin
No. 05
Aliases: Agenda
Assessment AvailableNo. 05
Assessment Available
Known targets
HealthcareGovernmentEducationManufacturingFinance
Wanted for
RansomwareData TheftDouble Extortion
Modus operandi
EDR EvasionBYOVDSafe Mode AbuseShadow Copy DeletionCross-Platform Encryption
AliasesAgenda
Wanted forRansomware, Data Theft, Double Extortion
Known targetsHealthcare, Government, Education, Manufacturing, Finance
Modus operandiEDR Evasion, BYOVD, Safe Mode Abuse, Shadow Copy Deletion, Cross-Platform Encryption
ART Series 2026 · 05 / 10
No. 06Wanted
NightSpire
Click to open case fileTap to open case file
NightSpire
No. 06
Aliases: None on record
Assessment AvailableNo. 06
Assessment Available
Known targets
TechnologyManufacturingFinancial ServicesProfessional Services
Wanted for
RansomwareData TheftDouble Extortion
Modus operandi
Credential AccessDefense EvasionData ExfiltrationRecovery InhibitionFile Encryption
AliasesNone on record
Wanted forRansomware, Data Theft, Double Extortion
Known targetsTechnology, Manufacturing, Financial Services, Professional Services
Modus operandiCredential Access, Defense Evasion, Data Exfiltration, Recovery Inhibition, File Encryption
ART Series 2026 · 06 / 10
No. 07Wanted
SideWinder
Click to open case fileTap to open case file
SideWinder
No. 07
Aliases: None on record
Assessment AvailableNo. 07
Assessment Available
Known targets
GovernmentMilitaryMaritimePorts
Wanted for
CyberespionageInformation Theft
Modus operandi
Spear PhishingExploit DeliveryDLL Side-LoadingIn-Memory MalwareStealerBot
AliasesNone on record
Wanted forCyberespionage, Information Theft
Known targetsGovernment, Military, Maritime, Ports
Modus operandiSpear Phishing, Exploit Delivery, DLL Side-Loading, In-Memory Malware, StealerBot
ART Series 2026 · 07 / 10
No. 08Wanted
DragonBreath
Click to open case fileTap to open case file
DragonBreath
No. 08
Also known as: APT-Q-27
Emulation AvailableNo. 08
Emulation Available
Known targets
Chinese-Speaking UsersCryptocurrency UsersGaming & VPN Users
Wanted for
CyberespionageMalware Deployment
Modus operandi
Multi-Stage LoadersDLL Side-LoadingDefense EvasionModified gh0st RATRoningLoader
Also known asAPT-Q-27
Wanted forCyberespionage, Malware Deployment
Known targetsChinese-Speaking Users, Cryptocurrency Users, Gaming & VPN Users
Modus operandiMulti-Stage Loaders, DLL Side-Loading, Defense Evasion, Modified gh0st RAT, RoningLoader
ART Series 2026 · 08 / 10
No. 09Wanted
The Gentlemen
Click to open case fileTap to open case file
The Gentlemen
No. 09
Aliases: None on record
2 Assessments AvailableNo. 09
2 Assessments Available
Known targets
ManufacturingConstructionHealthcareInsurance
Wanted for
RansomwareData TheftDouble Extortion
Modus operandi
ReconnaissanceGPO AbuseDefense EvasionLateral MovementData Exfiltration
AliasesNone on record
Wanted forRansomware, Data Theft, Double Extortion
Known targetsManufacturing, Construction, Healthcare, Insurance
Modus operandiReconnaissance, GPO Abuse, Defense Evasion, Lateral Movement, Data Exfiltration
ART Series 2026 · 09 / 10
No. 10Wanted
Nova
Click to open case fileTap to open case file
Nova
No. 10
Formerly known as: RALord
Assessment AvailableNo. 10
Assessment Available
Known targets
TechnologyManufacturingHealthcareEducationProfessional Services
Wanted for
RansomwareData TheftDouble Extortion
Modus operandi
Microsoft Defender TamperingSecurity Process TerminationAnti-AnalysisRecovery InhibitionFile Encryption
Formerly known asRALord
Wanted forRansomware, Data Theft, Double Extortion
Known targetsTechnology, Manufacturing, Healthcare, Education, Professional Services
Modus operandiMicrosoft Defender Tampering, Security Process Termination, Anti-Analysis, Recovery Inhibition, File Encryption
ART Series 2026 · 10 / 10
Think Bad.
Do Good.
Intel to Action
art@attackiq — next-steps
Knowing your adversary is only the beginning.
Threat intelligence is most valuable when you can put it into action. The advantage comes from applying that intelligence before an adversary puts you to the test.
Know Their Moves
Build your knowledge of real-world adversary tactics and techniques so you can better understand how attacks unfold.
Build Your SkillsPut Them to the Test
Test real-world adversary tactics and techniques against your defenses to uncover gaps and see how your controls respond.
Test Your Defenses FreeTest for FreeKeep Proving It
Continuously validate your defenses against real-world adversary tactics and techniques to measure readiness as threats evolve.
Explore AttackIQ EnterpriseExplore Enterprise