Adversaries by country
Which country the public sources attribute each brief story's adversary to · All stored: 2026-10-15 – 2026-11-10 · commercial spyware only
Week by week
By country
Why these attributions
- Candiru · Commercial spyware · 2 stories · also DevilsTongue, Integrity Labspublic reporting attributes Candiru to Israel
Named, but no country stated (1 story)
The sources name these actors without attributing them to a country. Nation-state here means a source calls the activity espionage or state-sponsored without saying whose.
Commercial spyware (1)
How attribution is read
Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:
- a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
- a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
- the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
- a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.
"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).