Skip to content
Install MCP

Threat actor

Griffeye

Last fetched

Griffeye is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Griffeye is the Swedish developer behind Griffeye Analyze Deep Pro, a multi-source data analysis system for police forces. According to the Balkan Investigative Reporting Network (BIRN), the Ministry of Internal Affairs (MUP) of Serbia purchased Griffeye facial recognition software in 2022. Griffeye Analyze DI Pro can recognize faces based only on the eyes, even when the eyes are not visible under certain conditions. It can also download large amounts of personal data from the internet and then search, sort, cross, and process it based on metadata such as GPS coordinates, the time when an image was taken, or phone serial numbers. Europol has used the software since 2019. The Griffeye Analyze platform is used by over 1,000 police agencies across the world. Magnet Forensics, a developer of digital investigation technologies used in over 90 countries, acquired Griffeye in August, 2023.

Techniques by tactic

No ATT&CK techniques are recorded for Griffeye in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Griffeye today — this states the absence of a published link, not that Griffeye has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Griffeye into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.