CUTSIGNcutting for sign — daily OSINT threat read

Adversaries by country

Which country the public sources attribute each brief story's adversary to · 90 days: 2026-08-13 – 2026-11-10 (briefs stored from 2026-10-15) · nation-state only

Window
Kind
Shade by
9
countries
35
attributed adversaries
34/499
stories attributed
35%
of those: China
Kazakhstan: 2 stories, 1 adversary (UAT-6275)Russia: 6 stories, 6 adversaries (APT28, APT29, Gorbag, Sandworm, Turla, Unnamed Russia-attributed actor)North Korea: 7 stories, 10 adversaries (Lazarus Group, TraderTraitor, APT38, Coral Sleet, Emerald Sleet, Famous Chollima, …)North Korea: 7 stories, 10 adversaries (Lazarus Group, TraderTraitor, APT38, Coral Sleet, Emerald Sleet, Famous Chollima, …)India: 1 story, 1 adversary (Bitter)Iran: 4 stories, 4 adversaries (Prince of Persia, Shahid Kaveh, STATIC KITTEN, Unnamed Iran-attributed actor)Belarus: 2 stories, 2 adversaries (Belarusian Cyber Partisans, Unnamed Belarus-attributed actor)Belarus: 2 stories, 2 adversaries (Belarusian Cyber Partisans, Unnamed Belarus-attributed actor)Turkey: 1 story, 1 adversary (VasyGrek)China: 12 stories, 9 adversaries (Warp Panda, Volt Typhoon, APT41, Bronze Sandcastle, Red Heron, Salt Typhoon, …)Serbia: 1 story, 1 adversary (Unnamed Serbia-attributed actor)Serbia: 1 story, 1 adversary (Unnamed Serbia-attributed actor)China 12North Korea 7Russia 6Iran 4Belarus 2Kazakhstan 2
Stories12–45–78–12· hover a country for its actors, click for its card

Week by week

0815week of Oct 12: China 1week of Oct 12: North Korea 1week of Oct 12: Russia 1week of Oct 12: 4 others 25week of Oct 19: China 3week of Oct 19: North Korea 1week of Oct 19: Russia 1week of Oct 19: Iran 16week of Oct 26: China 9week of Oct 26: North Korea 3week of Oct 26: Russia 1week of Oct 26: Belarus 1week of Oct 26: 4 others 115week of Nov 2: China 3week of Nov 2: North Korea 2week of Nov 2: Russia 2week of Nov 2: Iran 2week of Nov 2: Belarus 1week of Nov 2: 4 others 212week of Nov 9: Russia 1week of Nov 9: Iran 1week of Nov 9: 4 others 13Oct 12Oct 19Oct 26Nov 2Nov 9
ChinaNorth KoreaRussiaIranBelarus4 others· a story naming actors from two countries counts once for each

By country

China9 nation-state12
12 stories · 9 adversaries1 in 7 days ▼7 (8 before)
Warp Panda3Volt Typhoon2APT411Bronze Sandcastle1Red Heron1Salt Typhoon1Storm-09401unnamed1Vapor Panda1
Why these attributions
North Korea10 nation-state7
7 stories · 10 adversaries1 in 7 days ▼3 (4 before)
Lazarus Group4TraderTraitor4APT383Coral Sleet1Emerald Sleet1Famous Chollima1Jasper Sleet1Onyx Sleet1Pearl Sleet1unnamed1
Why these attributions
Russia6 nation-state6
6 stories · 6 adversaries3 in 7 days ▲2 (1 before)
APT281APT291Gorbag1Sandworm1Turla1unnamed1
Why these attributions
Iran4 nation-state4
4 stories · 4 adversaries2 in 7 days ▲1 (1 before)
Prince of Persia1Shahid Kaveh1STATIC KITTEN1unnamed1
Why these attributions
Belarus2 nation-state2
2 stories · 2 adversaries0 in 7 days ▼2 (2 before)
Belarusian Cyber Partisans1unnamed1
Why these attributions
Kazakhstan1 nation-state2
2 stories · 1 adversary0 in 7 days = (0 before)
UAT-62752
Why these attributions
India1 nation-state1
1 story · 1 adversary1 in 7 days = (1 before)
Bitter1
Why these attributions
Serbia1 nation-state1
1 story · 1 adversary0 in 7 days = (0 before)
unnamed1
Why these attributions
Turkey1 nation-state1
1 story · 1 adversary1 in 7 days ▲1 (0 before)
VasyGrek1
Why these attributions

Tools seen in more than one story

Malware and frameworks the extraction named, counted wherever a story names them, with the countries the same stories' actors are attributed to.

ARTEX3 storiesChina 2 · North Korea 12026-11-03

Named, but no country stated (5 stories)

The sources name these actors without attributing them to a country. Nation-state here means a source calls the activity espionage or state-sponsored without saying whose.

Nation-state (5)

CL-STA-09541CL-UNK-12111DarkBlinders1Patrick Steven Yaroch1pro-Russian1
How attribution is read

Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:

  • a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
  • a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
  • the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
  • a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.

"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).