Monthly Threat Actor Group Intelligence Report, November 2025
Contents
This report provides a summary of the activities conducted by various threat actor groups, based on data and intelligence collected by the NSHC Threat Research Lab (Threat Analysis Division) between 21 October 2025 and 20 November 2025. A total of 82 threat actor groups were identified during November, with unidentified groups accounting for the largest share at 52%, followed by activities attributed to the SectorJ and SectorA groups.
[Figure 1: Activity statistics by threat actor group identified in November 2025]
In November, the majority of observed threat actor activity targeted individuals and systems associated with government organizations and the financial sector. Regionally, the highest concentration of activity was directed at countries in North America and Europe.
[Figure 2: Activity statistics by threat actor group identified in November 2025]
The SectorA group focuses heavily on the technology, defense, aerospace, Web3, and mobile ecosystems, employing a wide range of psychological and social-engineering deception techniques such as …
[Figure 1: Activity statistics by threat actor group identified in November 2025]
In November, the majority of observed threat actor activity targeted individuals and systems associated with government organizations and the financial sector. Regionally, the highest concentration of activity was directed at countries in North America and Europe.
[Figure 2: Activity statistics by threat actor group identified in November 2025]
The SectorA group focuses heavily on the technology, defense, aerospace, Web3, and mobile ecosystems, employing a wide range of psychological and social-engineering deception techniques such as …