Automated evidence cluster

APT20: Defence targeting activity

Automatically correlated reporting linking APT20 to activity affecting Defence. Review the supporting sources before treating attribution as confirmed.

55% correlation confidence.This grouping supports investigation. It is not a definitive attribution or a vendor-assigned campaign name.

1Reports

1Sources

49Highest signal

24 Jul 2026Latest activity

Actors in supporting reports

APT15APT20APT27APT28APT29APT30APT31APT33APT34APT35APT37APT39APT40APT41APT42APT44APT45FIN7SandwormUNC1069UNC1088UNC2814UNC4057

Supporting evidence

Google Threat Intelligence Group · 24 Jul 2026

Updated Cyber Threat Actor Naming System ↗

Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…