IOCs by window
0
IOCs tagged #APT
4
IOCs tagged #APT
37
IOCs tagged #APT
1,493
IOCs tagged #APT
Counts as of 2026-10-28. Regenerated daily.
About #APT
- Meaning: IOCs that researchers attribute to an Advanced Persistent Threat.
- Actors: Typically long-running and well-resourced, nation-state-aligned or organised criminal.
- Common in corpus: Kimsuky, Lazarus, APT29, APT41, FIN7, MuddyWater, Konni, OilRig and similar.
- Detection: Behaviour-based detection, blocklists, YARA. Entry: usually phishing or supply chain.
- References: MITRE ATT&CK Groups · CISA APT advisories.
Recent IOCs tagged #APT
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/apt.
| Date | Type | Value | Source |
|---|---|---|---|
| domain | |||
| url | |||
| domain | |||
| url | |||
| url | |||
| ip | |||
| url | |||
| ip | |||
| domain | |||
| url |
Related tags
Frequently asked questions
What is APT (Advanced Persistent Threat)?
Typically a long-running, well-resourced adversary, nation-state-aligned or organised criminal. It runs targeted, mission-focused operations.
Which APT groups produce the most IOCs in this feed?
DPRK-aligned activity (Kimsuky, Lazarus) is the largest part, because researchers cover it often on Twitter/X. Russian-, Iranian- and Chinese-attributed activity also appears.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this APT subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
APT IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.