# Who is targeting charities and NGOs?

> Public reporting links 28 threat groups to attacks on charities and NGOs, including APT18, Beijing Group and APT32. 24 of them are thought to have state backing. This page lists them and where they are thought to operate from, so you can see who might come after a business like yours.

Canonical page: https://www.precursorintelligence.com/industries/civil-society-ngos
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Industries](https://www.precursorintelligence.com/industries) > Charities and NGOs

## At a glance

| Fact | Value |
|---|---|
| Threat groups linked | 28 |
| Sectors with their own page | 4 |
| Suspected state backing | 24 of 28 |
| Countries of origin | 8 |

## Which groups target charities and NGOs?

| Group | Thought to operate from | Suspected state backing | Profile |
|---|---|---|---|
| APT18 | China | China | https://www.precursorintelligence.com/threat-actors/apt18 |
| Beijing Group | China | China | https://www.precursorintelligence.com/threat-actors/beijing-group |
| APT32 | Vietnam | Vietnam | https://www.precursorintelligence.com/threat-actors/apt32 |
| APT17 | China | China | https://www.precursorintelligence.com/threat-actors/apt17 |
| RANCOR | China | China | https://www.precursorintelligence.com/threat-actors/rancor |
| MUSTANG PANDA | China | China | https://www.precursorintelligence.com/threat-actors/mustang-panda |
| HenBox | China | China | https://www.precursorintelligence.com/threat-actors/henbox |
| Operation C-Major | Pakistan | Pakistan | https://www.precursorintelligence.com/threat-actors/operation-c-major |
| CopyKittens | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/copykittens |
| TEMPER PANDA | China | China | https://www.precursorintelligence.com/threat-actors/temper-panda |
| Flying Kitten | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/flying-kitten |
| Tortoiseshell | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/tortoiseshell |
| Molerats | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/molerats |
| Gelsemium | Not known | No | https://www.precursorintelligence.com/threat-actors/gelsemium |
| Stealth Falcon | United Arab Emirates | United Arab Emirates | https://www.precursorintelligence.com/threat-actors/stealth-falcon |
| OilRig | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/oilrig |
| Operation Parliament | Not known | Unknown | https://www.precursorintelligence.com/threat-actors/operation-parliament |
| Stealth Mango and Tangelo | Pakistan | Pakistan | https://www.precursorintelligence.com/threat-actors/stealth-mango-and-tangelo |
| AridViper | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/aridviper |
| Unnamed Actor | China | China | https://www.precursorintelligence.com/threat-actors/unnamed-actor |
| POLONIUM | Lebanon | Lebanon | https://www.precursorintelligence.com/threat-actors/polonium |
| ModifiedElephant | Not known | No | https://www.precursorintelligence.com/threat-actors/modifiedelephant |
| Earth Lusca | China | No | https://www.precursorintelligence.com/threat-actors/earth-lusca |
| TA406 | South Korea | No | https://www.precursorintelligence.com/threat-actors/ta406 |
| APT42 | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/apt42 |
| RedGolf | China | China | https://www.precursorintelligence.com/threat-actors/redgolf |
| Cotton Sandstorm | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/cotton-sandstorm |
| BANISHED KITTEN | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/banished-kitten |

## Where are they thought to operate from?

- China: 10
- Iran: 7
- Pakistan: 2
- Palestinian Territories: 2
- Vietnam: 1
- United Arab Emirates: 1
- Lebanon: 1
- South Korea: 1
- Not known: 3

## What counts as charities and NGOs?

- [Civil society](https://www.precursorintelligence.com/sub-industries/civil-society): 24 groups
- [NGOs](https://www.precursorintelligence.com/sub-industries/ngos): 8 groups (also called NGO)
- [Religious organisations](https://www.precursorintelligence.com/sub-industries/religious-organizations): 3 groups
- [Human rights](https://www.precursorintelligence.com/sub-industries/human-rights): 1 group

## Frequently asked questions

### Which threat groups target charities and NGOs?

Public reporting links 28 threat groups to attacks on charities and NGOs, including APT18, Beijing Group, APT32, APT17 and RANCOR.

### Where are these groups thought to operate from?

Most are thought to operate from China (10), Iran (7) and Pakistan (2). 24 of the 28 are thought to have backing from a government.

### What counts as charities and NGOs?

Public reporting describes charities and NGOs victims in several ways. The narrower sectors with groups of their own are civil society (24), NGOs (8), religious organisations (3) and human rights (1).

### How can I check my own organisation's exposure?

Create an account and tell us the software you run. We match it against known flaws, rank each one from 0 to 100 using evidence it is being exploited, let you know as soon as something changes that affects you, and show which groups and ransomware gangs are hitting your sector.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact