Adversaries by country
Which country the public sources attribute each brief story's adversary to · 14 days: 2026-10-28 – 2026-11-10 · criminal only
Week by week
By country
Why these attributions
- Unnamed Brazil-attributed actor · Criminal · 1 storythe actor field says "Brazilian credit card skimming group (unnamed)"
Tools seen in more than one story
Malware and frameworks the extraction named, counted wherever a story names them, with the countries the same stories' actors are attributed to.
| X.CPE | 2 stories | not attributed to a country 2 | 2026-11-04 |
Named, but no country stated (20 stories)
The sources name these actors without attributing them to a country. Nation-state here means a source calls the activity espionage or state-sponsored without saying whose.
Criminal (17)
How attribution is read
Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:
- a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
- a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
- the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
- a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.
"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).