CUTSIGNcutting for sign — daily OSINT threat read

Adversaries by country

Which country the public sources attribute each brief story's adversary to · 14 days: 2026-10-28 – 2026-11-10 · nation-state only

Window
Kind
Shade by
7
countries
26
attributed adversaries
23/296
stories attributed
39%
of those: China
Russia: 3 stories, 3 adversaries (APT29, Gorbag, Turla)North Korea: 5 stories, 9 adversaries (TraderTraitor, APT38, Lazarus Group, Coral Sleet, Emerald Sleet, Jasper Sleet, …)North Korea: 5 stories, 9 adversaries (TraderTraitor, APT38, Lazarus Group, Coral Sleet, Emerald Sleet, Jasper Sleet, …)India: 1 story, 1 adversary (Bitter)Iran: 3 stories, 3 adversaries (Shahid Kaveh, STATIC KITTEN, Unnamed Iran-attributed actor)Belarus: 2 stories, 2 adversaries (Belarusian Cyber Partisans, Unnamed Belarus-attributed actor)Belarus: 2 stories, 2 adversaries (Belarusian Cyber Partisans, Unnamed Belarus-attributed actor)Turkey: 1 story, 1 adversary (VasyGrek)China: 9 stories, 7 adversaries (Volt Typhoon, Warp Panda, Red Heron, Salt Typhoon, Storm-0940, Unnamed China-attributed actor, …)China 9North Korea 5Iran 3Russia 3Belarus 2India 1
Stories12–34–56–9· hover a country for its actors, click for its card

Week by week

0714week of Oct 12: China 1week of Oct 12: North Korea 1week of Oct 12: Russia 13week of Oct 19: China 3week of Oct 19: North Korea 1week of Oct 19: Iran 1week of Oct 19: Russia 16week of Oct 26: China 9week of Oct 26: North Korea 3week of Oct 26: Russia 1week of Oct 26: Belarus 114week of Nov 2: China 3week of Nov 2: North Korea 2week of Nov 2: Iran 2week of Nov 2: Russia 2week of Nov 2: Belarus 1week of Nov 2: 2 others 212week of Nov 9: Iran 1week of Nov 9: Russia 1week of Nov 9: 2 others 13Oct 12Oct 19Oct 26Nov 2Nov 9
ChinaNorth KoreaIranRussiaBelarus2 others· a story naming actors from two countries counts once for each

By country

China7 nation-state9
9 stories · 7 adversaries1 in 7 days ▼7 (8 before)
Volt Typhoon2Warp Panda2Red Heron1Salt Typhoon1Storm-09401unnamed1Vapor Panda1
Why these attributions
North Korea9 nation-state5
5 stories · 9 adversaries1 in 7 days ▼3 (4 before)
TraderTraitor4APT383Lazarus Group3Coral Sleet1Emerald Sleet1Jasper Sleet1Onyx Sleet1Pearl Sleet1unnamed1
Why these attributions
Iran3 nation-state3
3 stories · 3 adversaries2 in 7 days ▲1 (1 before)
Shahid Kaveh1STATIC KITTEN1unnamed1
Why these attributions
Russia3 nation-state3
3 stories · 3 adversaries3 in 7 days ▲2 (1 before)
APT291Gorbag1Turla1
Why these attributions
Belarus2 nation-state2
2 stories · 2 adversaries0 in 7 days ▼2 (2 before)
Belarusian Cyber Partisans1unnamed1
Why these attributions
India1 nation-state1
1 story · 1 adversary1 in 7 days = (1 before)
Bitter1
Why these attributions
Turkey1 nation-state1
1 story · 1 adversary1 in 7 days ▲1 (0 before)
VasyGrek1
Why these attributions

Tools seen in more than one story

Malware and frameworks the extraction named, counted wherever a story names them, with the countries the same stories' actors are attributed to.

ARTEX3 storiesChina 2 · North Korea 12026-11-03

Named, but no country stated (4 stories)

The sources name these actors without attributing them to a country. Nation-state here means a source calls the activity espionage or state-sponsored without saying whose.

Nation-state (4)

CL-UNK-12111DarkBlinders1Patrick Steven Yaroch1pro-Russian1
How attribution is read

Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:

  • a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
  • a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
  • the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
  • a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.

"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).