Every group the NIDSARK research desk is actively tracking, sorted by what drives them. Names follow the most widely cited industry name, vendor aliases are cross-referenced onto one record, and origin is always stated as reported by the source. Each profile keeps its own history as the six-hour research run reports on it.
Ransomware and extortion crews, initial-access brokers, infostealer operators and fraud groups. Measured by leak-site postings where the group runs one, otherwise by brief mentions.
Intrusion sets that governments and vendors attribute to a state program: espionage, pre-positioning in critical infrastructure, and influence operations. NIDSARK repeats the reported attribution and does not add its own.
Ideologically driven collectives and groups whose motive is still unclear. Claims from these groups stay "Reported" until a second source corroborates them.
NIDSARK Threat Intelligence maps the groups above to your sector, your stack and your exposure, and turns their techniques into detections your team can run.