# Who is targeting intergovernmental organisations?

> Public reporting links 92 threat groups to attacks on intergovernmental organisations, part of the government and public sector industry, including Grayling, APT18 and Hellsing. 75 of them are thought to have state backing. This page lists them and where they are thought to operate from, so you can see who might come after a business like yours.

Canonical page: https://www.precursorintelligence.com/sub-industries/intergovernmental
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Industries](https://www.precursorintelligence.com/industries) > [Government and public sector](https://www.precursorintelligence.com/industries/government-public-sector) > Intergovernmental

## At a glance

| Fact | Value |
|---|---|
| Threat groups linked | 92 |
| Related sectors with groups | 3 |
| Suspected state backing | 75 of 92 |
| Countries of origin | 14 |
| Part of | Government and public sector |

## Which groups target intergovernmental organisations?

| Group | Thought to operate from | Suspected state backing | Profile |
|---|---|---|---|
| Grayling | China | China | https://www.precursorintelligence.com/threat-actors/grayling |
| APT18 | China | China | https://www.precursorintelligence.com/threat-actors/apt18 |
| Hellsing | China | China | https://www.precursorintelligence.com/threat-actors/hellsing |
| Tonto Team | China | China | https://www.precursorintelligence.com/threat-actors/tonto-team |
| APT27 | China | Unknown | https://www.precursorintelligence.com/threat-actors/apt27 |
| Sandworm | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/sandworm |
| APT32 | Vietnam | Vietnam | https://www.precursorintelligence.com/threat-actors/apt32 |
| APT17 | China | China | https://www.precursorintelligence.com/threat-actors/apt17 |
| Naikon | China | China | https://www.precursorintelligence.com/threat-actors/naikon |
| Rocket Kitten | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/rocket-kitten |
| LOTUS PANDA | China | China | https://www.precursorintelligence.com/threat-actors/lotus-panda |
| Cleaver | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/cleaver |
| APT28 | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/apt28 |
| RANCOR | China | China | https://www.precursorintelligence.com/threat-actors/rancor |
| APT10 | China | China | https://www.precursorintelligence.com/threat-actors/apt10 |
| APT29 | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/apt29 |
| Careto | Spain | Spain | https://www.precursorintelligence.com/threat-actors/careto |
| DAGGER PANDA | China | China | https://www.precursorintelligence.com/threat-actors/dagger-panda |
| APT15 | China | China | https://www.precursorintelligence.com/threat-actors/apt15 |
| APT14 | China | China | https://www.precursorintelligence.com/threat-actors/apt14 |
| APT21 | China | China | https://www.precursorintelligence.com/threat-actors/apt21 |
| Longhorn | United States | United States | https://www.precursorintelligence.com/threat-actors/longhorn |
| Lazarus Group | North Korea | Korea (Democratic People's Republic of) | https://www.precursorintelligence.com/threat-actors/lazarus-group |
| Equation Group | United States | United States | https://www.precursorintelligence.com/threat-actors/equation-group |
| Gamaredon Group | Not known | No | https://www.precursorintelligence.com/threat-actors/gamaredon-group |
| SNOWGLOBE | France | France | https://www.precursorintelligence.com/threat-actors/snowglobe |
| White Bear | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/white-bear |
| Operation C-Major | Pakistan | Pakistan | https://www.precursorintelligence.com/threat-actors/operation-c-major |
| APT-C-36 | Not known | No | https://www.precursorintelligence.com/threat-actors/apt-c-36 |
| CopyKittens | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/copykittens |
| WIZARD SPIDER | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/wizard-spider |
| Higaisa | South Korea | Korea (Republic of) | https://www.precursorintelligence.com/threat-actors/higaisa |
| Madi | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/madi |
| TEMPER PANDA | China | China | https://www.precursorintelligence.com/threat-actors/temper-panda |
| Inception Framework | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/inception-framework |
| ENERGETIC BEAR | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/energetic-bear |
| Kimsuky | North Korea | Korea (Democratic People's Republic of) | https://www.precursorintelligence.com/threat-actors/kimsuky |
| Tortoiseshell | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/tortoiseshell |
| ProjectSauron | United States | United States | https://www.precursorintelligence.com/threat-actors/projectsauron |
| BackdoorDiplomacy | Not known | No | https://www.precursorintelligence.com/threat-actors/backdoordiplomacy |
| Charming Kitten | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/charming-kitten |
| MuddyWater | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/muddywater |
| APT37 | North Korea | Korea (Democratic People's Republic of) | https://www.precursorintelligence.com/threat-actors/apt37 |
| APT2 | China | China | https://www.precursorintelligence.com/threat-actors/apt2 |
| RAZOR TIGER | India | India | https://www.precursorintelligence.com/threat-actors/razor-tiger |
| Molerats | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/molerats |
| Gelsemium | Not known | No | https://www.precursorintelligence.com/threat-actors/gelsemium |
| APT1 | China | China | https://www.precursorintelligence.com/threat-actors/apt1 |
| APT12 | China | China | https://www.precursorintelligence.com/threat-actors/apt12 |
| APT30 | China | China | https://www.precursorintelligence.com/threat-actors/apt30 |
| Blue Termite | China | Unknown | https://www.precursorintelligence.com/threat-actors/blue-termite |
| OilRig | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/oilrig |
| Operation Parliament | Not known | Unknown | https://www.precursorintelligence.com/threat-actors/operation-parliament |
| Turla | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/turla |
| TeamSpy Crew | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/teamspy-crew |
| Stealth Mango and Tangelo | Pakistan | Pakistan | https://www.precursorintelligence.com/threat-actors/stealth-mango-and-tangelo |
| APT-C-12 | Not known | No | https://www.precursorintelligence.com/threat-actors/apt-c-12 |
| AridViper | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/aridviper |
| TempTick | China | China | https://www.precursorintelligence.com/threat-actors/temptick |
| Mofang | China | China | https://www.precursorintelligence.com/threat-actors/mofang |
| Infy | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/infy |
| Unit 8200 | Israel | Israel | https://www.precursorintelligence.com/threat-actors/unit-8200 |
| El Machete | Not known | Unknown | https://www.precursorintelligence.com/threat-actors/el-machete |
| Sowbug | Not known | Unknown | https://www.precursorintelligence.com/threat-actors/sowbug |
| Unnamed Actor | China | China | https://www.precursorintelligence.com/threat-actors/unnamed-actor |
| OnionDog | North Korea | Unknown | https://www.precursorintelligence.com/threat-actors/oniondog |
| APT40 | China | China | https://www.precursorintelligence.com/threat-actors/apt40 |
| LYCEUM | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/lyceum |
| Attor | Not known | No | https://www.precursorintelligence.com/threat-actors/attor |
| ToddyCat | Not known | No | https://www.precursorintelligence.com/threat-actors/toddycat |
| APT41 | China | People's Republic of China | https://www.precursorintelligence.com/threat-actors/apt41 |
| Ghostwriter | Belarus | Belarus | https://www.precursorintelligence.com/threat-actors/ghostwriter |
| InvisiMole | Not known | No | https://www.precursorintelligence.com/threat-actors/invisimole |
| BladeHawk | Not known | No | https://www.precursorintelligence.com/threat-actors/bladehawk |
| Copy-Paste | Not known | No | https://www.precursorintelligence.com/threat-actors/copy-paste |
| Curious Gorge | China | No | https://www.precursorintelligence.com/threat-actors/curious-gorge |
| Killnet | Not known | No | https://www.precursorintelligence.com/threat-actors/killnet |
| Red Menshen | China | No | https://www.precursorintelligence.com/threat-actors/red-menshen |
| Earth Wendigo | China | No | https://www.precursorintelligence.com/threat-actors/earth-wendigo |
| NoName057(16) | Not known | No | https://www.precursorintelligence.com/threat-actors/noname057-16 |
| TianWu | China | China | https://www.precursorintelligence.com/threat-actors/tianwu |
| Aoqin Dragon | China | No | https://www.precursorintelligence.com/threat-actors/aoqin-dragon |
| Evasive Panda | China | China | https://www.precursorintelligence.com/threat-actors/evasive-panda |
| Worok | China | China | https://www.precursorintelligence.com/threat-actors/worok |
| TA406 | South Korea | No | https://www.precursorintelligence.com/threat-actors/ta406 |
| APT42 | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/apt42 |
| RedGolf | China | China | https://www.precursorintelligence.com/threat-actors/redgolf |
| MoustachedBouncer | Belarus | Belarus | https://www.precursorintelligence.com/threat-actors/moustachedbouncer |
| Storm-0558 | China | China | https://www.precursorintelligence.com/threat-actors/storm-0558 |
| Sandman APT | China | China | https://www.precursorintelligence.com/threat-actors/sandman-apt |
| Cotton Sandstorm | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/cotton-sandstorm |
| BANISHED KITTEN | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/banished-kitten |

## Where are they thought to operate from?

- China: 35
- Iran: 13
- Russia: 9
- North Korea: 4
- United States: 3
- Pakistan: 2
- South Korea: 2
- Palestinian Territories: 2
- Belarus: 2
- Vietnam: 1
- Spain: 1
- France: 1
- India: 1
- Israel: 1
- Not known: 15

## Other sectors in government and public sector

- [Government agencies and services](https://www.precursorintelligence.com/sub-industries/government-agencies-and-services): 92 groups
- [Government institutions](https://www.precursorintelligence.com/sub-industries/government-institutions): 91 groups
- [Political](https://www.precursorintelligence.com/sub-industries/political): 1 group

## Frequently asked questions

### Which threat groups target intergovernmental organisations?

Public reporting links 92 threat groups to attacks on intergovernmental organisations, including Grayling, APT18, Hellsing, Tonto Team and APT27.

### Where are these groups thought to operate from?

Most are thought to operate from China (35), Iran (13) and Russia (9). 75 of the 92 are thought to have backing from a government.

### Which industry is intergovernmental part of?

Intergovernmental sits within government and public sector. The industry page lists every group linked to the wider sector.

### How can I check my own organisation's exposure?

Create an account and tell us the software you run. We match it against known flaws, rank each one from 0 to 100 using evidence it is being exploited, let you know as soon as something changes that affects you, and show which groups and ransomware gangs are hitting your sector.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact