G0076
Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques.
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
MITRE lists Thrip as an associated name for Lotus Blossom while retaining Thrip as a separate group record.
MediumReviewed identity mapping approved on this date.
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.
MITRE lists Thrip as an associated name for Lotus Blossom while retaining Thrip as a separate group record. The catalog preserves both records and does not infer exact equivalence.
Loading CVEs, techniques, indicators, malware, victims, and activity...