Adversaries by country
Which country the public sources attribute each brief story's adversary to · 14 days: 2026-10-28 – 2026-11-10 · commercial spyware only
No story in this window names an adversary attributed to a country.
How attribution is read
Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:
- a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
- a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
- the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
- a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.
"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).