Example searches
Each example opens a live search. Use them as a starting point and edit the search box on the results page.
Name / alias
APT28
An actor with dozens of aliases (Fancy Bear, Sofacy, Forest Blizzard…), descriptions from many sources and 100+ references.
Name / alias
Forest Blizzard
Search by any alias and you land on the same actor - here, Microsoft's name for APT28.
Name / alias · wildcard
MUSTANG*
Use * to match every actor whose name or alias starts with MUSTANG.
Name / alias · regex
UNC39\d+
A regular expression that matches Mandiant's UNC3944 (Scattered Spider) and UNC3973.
Name / alias · Malpedia
APT28
Adds Malpedia's bibliography for the actor - over 140 more dated reports.
Descriptions
australia
Threat actors whose descriptions mention Australia.
Descriptions
new zealand
Phrases work too.
References
silentpush
Every threat actor with a Silent Push report in its references.
References
cert.gov.ua
Actors reported on by CERT-UA - search by any domain.