Adversaries by country
Which country the public sources attribute each brief story's adversary to · 14 days: 2026-10-28 – 2026-11-10 · hacktivist only
1
countries
1
attributed adversaries
1/296
stories attributed
100%
of those: Syria
Week by week
Syria· a story naming actors from two countries counts once for each
By country
Syria1 hacktivist1
Why these attributions
- Syrian Electronic Army · Hacktivist · 1 storypublic reporting attributes Syrian Electronic Army to Syria
the actor field says "Syrian Electronic Army"
How attribution is read
Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:
- a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
- a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
- the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
- a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.
"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).