Adversaries by country
Which country the public sources attribute each brief story's adversary to · 90 days: 2026-08-13 – 2026-11-10 (briefs stored from 2026-10-15) · hacktivist only
Week by week
By country
Why these attributions
- Cyber Partisans · Hacktivist · 1 story · also Partisan Zmiypublic reporting attributes Cyber Partisans to Belarus
the summary says "Belarus-aligned Cyber Partisans"
Why these attributions
- Syrian Electronic Army · Hacktivist · 1 storypublic reporting attributes Syrian Electronic Army to Syria
the actor field says "Syrian Electronic Army"
Named, but no country stated (2 stories)
The sources name these actors without attributing them to a country. Nation-state here means a source calls the activity espionage or state-sponsored without saying whose.
Hacktivist (2)
How attribution is read
Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:
- a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
- a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
- the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
- a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.
"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).