# Who is targeting military organisations?

> Public reporting links 32 threat groups to attacks on military organisations, part of the defence and military industry, including APT19, Tonto Team and SAMURAI PANDA. 27 of them are thought to have state backing. This page lists them and where they are thought to operate from, so you can see who might come after a business like yours.

Canonical page: https://www.precursorintelligence.com/sub-industries/military
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Industries](https://www.precursorintelligence.com/industries) > [Defence and military](https://www.precursorintelligence.com/industries/defense-military) > Military

## At a glance

| Fact | Value |
|---|---|
| Threat groups linked | 32 |
| Related sectors with groups | 4 |
| Suspected state backing | 27 of 32 |
| Countries of origin | 9 |
| Part of | Defence and military |

## Which groups target military organisations?

| Group | Thought to operate from | Suspected state backing | Profile |
|---|---|---|---|
| APT19 | China | China | https://www.precursorintelligence.com/threat-actors/apt19 |
| Tonto Team | China | China | https://www.precursorintelligence.com/threat-actors/tonto-team |
| SAMURAI PANDA | China | China | https://www.precursorintelligence.com/threat-actors/samurai-panda |
| Rocket Kitten | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/rocket-kitten |
| LOTUS PANDA | China | China | https://www.precursorintelligence.com/threat-actors/lotus-panda |
| APT28 | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/apt28 |
| DAGGER PANDA | China | China | https://www.precursorintelligence.com/threat-actors/dagger-panda |
| APT14 | China | China | https://www.precursorintelligence.com/threat-actors/apt14 |
| APT21 | China | China | https://www.precursorintelligence.com/threat-actors/apt21 |
| Equation Group | United States | United States | https://www.precursorintelligence.com/threat-actors/equation-group |
| Operation C-Major | Pakistan | Pakistan | https://www.precursorintelligence.com/threat-actors/operation-c-major |
| QUILTED TIGER | India | India | https://www.precursorintelligence.com/threat-actors/quilted-tiger |
| Flying Kitten | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/flying-kitten |
| Tortoiseshell | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/tortoiseshell |
| ProjectSauron | United States | United States | https://www.precursorintelligence.com/threat-actors/projectsauron |
| Charming Kitten | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/charming-kitten |
| RAZOR TIGER | India | India | https://www.precursorintelligence.com/threat-actors/razor-tiger |
| Molerats | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/molerats |
| Turla | Russia | Russian Federation | https://www.precursorintelligence.com/threat-actors/turla |
| APT-C-12 | Not known | No | https://www.precursorintelligence.com/threat-actors/apt-c-12 |
| AridViper | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/aridviper |
| APT4 | China | China | https://www.precursorintelligence.com/threat-actors/apt4 |
| Unit 8200 | Israel | Israel | https://www.precursorintelligence.com/threat-actors/unit-8200 |
| El Machete | Not known | Unknown | https://www.precursorintelligence.com/threat-actors/el-machete |
| LYCEUM | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/lyceum |
| ToddyCat | Not known | No | https://www.precursorintelligence.com/threat-actors/toddycat |
| POLONIUM | Lebanon | Lebanon | https://www.precursorintelligence.com/threat-actors/polonium |
| Curious Gorge | China | No | https://www.precursorintelligence.com/threat-actors/curious-gorge |
| NoName057(16) | Not known | No | https://www.precursorintelligence.com/threat-actors/noname057-16 |
| Red Dev 17 | China | No | https://www.precursorintelligence.com/threat-actors/red-dev-17 |
| APT42 | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/apt42 |
| Blackatom | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/blackatom |

## Where are they thought to operate from?

- China: 10
- Iran: 6
- Palestinian Territories: 3
- Russia: 2
- United States: 2
- India: 2
- Pakistan: 1
- Israel: 1
- Lebanon: 1
- Not known: 4

## Other sectors in defence and military

- [Government and military](https://www.precursorintelligence.com/sub-industries/government-military): 98 groups
- [Defence](https://www.precursorintelligence.com/sub-industries/defense): 11 groups
- [Defence industrial base](https://www.precursorintelligence.com/sub-industries/defense-industrial-base): 10 groups
- [Defence contractor](https://www.precursorintelligence.com/sub-industries/defense-contractor): 9 groups

## Frequently asked questions

### Which threat groups target military organisations?

Public reporting links 32 threat groups to attacks on military organisations, including APT19, Tonto Team, SAMURAI PANDA, Rocket Kitten and LOTUS PANDA.

### Where are these groups thought to operate from?

Most are thought to operate from China (10), Iran (6) and Palestinian Territories (3). 27 of the 32 are thought to have backing from a government.

### Which industry is military part of?

Military sits within defence and military. The industry page lists every group linked to the wider sector.

### How can I check my own organisation's exposure?

Create an account and tell us the software you run. We match it against known flaws, rank each one from 0 to 100 using evidence it is being exploited, let you know as soon as something changes that affects you, and show which groups and ransomware gangs are hitting your sector.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact