# Who is targeting tech organisations?

> Public reporting links 13 threat groups to attacks on tech organisations, part of the technology and telecoms industry, including Grayling, Tortoiseshell and AridViper. 10 of them are thought to have state backing. This page lists them and where they are thought to operate from, so you can see who might come after a business like yours.

Canonical page: https://www.precursorintelligence.com/sub-industries/tech
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Industries](https://www.precursorintelligence.com/industries) > [Technology and telecoms](https://www.precursorintelligence.com/industries/technology-telecommunications) > Tech

## At a glance

| Fact | Value |
|---|---|
| Threat groups linked | 13 |
| Related sectors with groups | 6 |
| Suspected state backing | 10 of 13 |
| Countries of origin | 4 |
| Part of | Technology and telecoms |

## Which groups target tech organisations?

| Group | Thought to operate from | Suspected state backing | Profile |
|---|---|---|---|
| Grayling | China | China | https://www.precursorintelligence.com/threat-actors/grayling |
| Tortoiseshell | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/tortoiseshell |
| AridViper | Palestinian Territories | Palestine | https://www.precursorintelligence.com/threat-actors/aridviper |
| LYCEUM | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/lyceum |
| APT41 | China | People's Republic of China | https://www.precursorintelligence.com/threat-actors/apt41 |
| POLONIUM | Lebanon | Lebanon | https://www.precursorintelligence.com/threat-actors/polonium |
| Earth Berberoka | China | No | https://www.precursorintelligence.com/threat-actors/earth-berberoka |
| BRONZE SPRING | China | No | https://www.precursorintelligence.com/threat-actors/bronze-spring |
| TianWu | China | China | https://www.precursorintelligence.com/threat-actors/tianwu |
| Red Dev 17 | China | No | https://www.precursorintelligence.com/threat-actors/red-dev-17 |
| RedGolf | China | China | https://www.precursorintelligence.com/threat-actors/redgolf |
| Cotton Sandstorm | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/cotton-sandstorm |
| BANISHED KITTEN | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/banished-kitten |

## Where are they thought to operate from?

- China: 7
- Iran: 4
- Palestinian Territories: 1
- Lebanon: 1

## Other sectors in technology and telecoms

- [Telecom](https://www.precursorintelligence.com/sub-industries/telecom): 13 groups
- [High-Tech](https://www.precursorintelligence.com/sub-industries/high-tech): 7 groups
- [Telecommunications](https://www.precursorintelligence.com/sub-industries/telecommunications): 7 groups (also called telecommunication)
- [Information technology](https://www.precursorintelligence.com/sub-industries/information-technology): 6 groups (also called technology)
- [Telecomms](https://www.precursorintelligence.com/sub-industries/telecomms): 3 groups
- [Semiconductor industry](https://www.precursorintelligence.com/sub-industries/semiconductor-industry): 1 group

## Frequently asked questions

### Which threat groups target tech organisations?

Public reporting links 13 threat groups to attacks on tech organisations, including Grayling, Tortoiseshell, AridViper, LYCEUM and APT41.

### Where are these groups thought to operate from?

Most are thought to operate from China (7), Iran (4) and Palestinian Territories (1). 10 of the 13 are thought to have backing from a government.

### Which industry is tech part of?

Tech sits within technology and telecoms. The industry page lists every group linked to the wider sector.

### How can I check my own organisation's exposure?

Create an account and tell us the software you run. We match it against known flaws, rank each one from 0 to 100 using evidence it is being exploited, let you know as soon as something changes that affects you, and show which groups and ransomware gangs are hitting your sector.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact