CUTSIGNcutting for sign — daily OSINT threat read

Adversaries by country

Which country the public sources attribute each brief story's adversary to · 14 days: 2026-10-28 – 2026-11-10

Window
Kind
Shade by
9
countries
28
attributed adversaries
25/296
stories attributed
36%
of those: China
Russia: 3 stories, 3 adversaries (APT29, Gorbag, Turla)Brazil: 1 story, 1 adversary (Unnamed Brazil-attributed actor)North Korea: 5 stories, 9 adversaries (TraderTraitor, APT38, Lazarus Group, Coral Sleet, Emerald Sleet, Jasper Sleet, …)North Korea: 5 stories, 9 adversaries (TraderTraitor, APT38, Lazarus Group, Coral Sleet, Emerald Sleet, Jasper Sleet, …)India: 1 story, 1 adversary (Bitter)Iran: 3 stories, 3 adversaries (Shahid Kaveh, STATIC KITTEN, Unnamed Iran-attributed actor)Syria: 1 story, 1 adversary (Syrian Electronic Army)Syria: 1 story, 1 adversary (Syrian Electronic Army)Belarus: 2 stories, 2 adversaries (Belarusian Cyber Partisans, Unnamed Belarus-attributed actor)Belarus: 2 stories, 2 adversaries (Belarusian Cyber Partisans, Unnamed Belarus-attributed actor)Turkey: 1 story, 1 adversary (VasyGrek)China: 9 stories, 7 adversaries (Volt Typhoon, Warp Panda, Red Heron, Salt Typhoon, Storm-0940, Unnamed China-attributed actor, …)China 9North Korea 5Iran 3Russia 3Belarus 2Brazil 1
Stories12–34–56–9· hover a country for its actors, click for its card

Week by week

0815week of Oct 12: China 1week of Oct 12: North Korea 1week of Oct 12: Russia 13week of Oct 19: China 3week of Oct 19: North Korea 1week of Oct 19: Iran 1week of Oct 19: Russia 1week of Oct 19: Belarus 17week of Oct 26: China 9week of Oct 26: North Korea 3week of Oct 26: Russia 1week of Oct 26: Belarus 1week of Oct 26: 4 others 115week of Nov 2: China 3week of Nov 2: North Korea 2week of Nov 2: Iran 2week of Nov 2: Russia 2week of Nov 2: Belarus 1week of Nov 2: 4 others 313week of Nov 9: Iran 1week of Nov 9: Russia 1week of Nov 9: 4 others 13Oct 12Oct 19Oct 26Nov 2Nov 9
ChinaNorth KoreaIranRussiaBelarus4 others· a story naming actors from two countries counts once for each

By country

China7 nation-state9
9 stories · 7 adversaries1 in 7 days ▼7 (8 before)
Volt Typhoon2Warp Panda2Red Heron1Salt Typhoon1Storm-09401unnamed1Vapor Panda1
Why these attributions
North Korea9 nation-state5
5 stories · 9 adversaries1 in 7 days ▼3 (4 before)
TraderTraitor4APT383Lazarus Group3Coral Sleet1Emerald Sleet1Jasper Sleet1Onyx Sleet1Pearl Sleet1unnamed1
Why these attributions
Iran3 nation-state3
3 stories · 3 adversaries2 in 7 days ▲1 (1 before)
Shahid Kaveh1STATIC KITTEN1unnamed1
Why these attributions
Russia3 nation-state3
3 stories · 3 adversaries3 in 7 days ▲2 (1 before)
APT291Gorbag1Turla1
Why these attributions
Belarus2 nation-state2
2 stories · 2 adversaries0 in 7 days ▼2 (2 before)
Belarusian Cyber Partisans1unnamed1
Why these attributions
Brazil1 criminal1
1 story · 1 adversary0 in 7 days ▼1 (1 before)
unnamed1
Why these attributions
India1 nation-state1
1 story · 1 adversary1 in 7 days = (1 before)
Bitter1
Why these attributions
Syria1 hacktivist1
1 story · 1 adversary0 in 7 days ▼1 (1 before)
Syrian Electronic Army1
Why these attributions
Turkey1 nation-state1
1 story · 1 adversary1 in 7 days ▲1 (0 before)
VasyGrek1
Why these attributions

Tools seen in more than one story

Malware and frameworks the extraction named, counted wherever a story names them, with the countries the same stories' actors are attributed to.

ARTEX7 storiesChina 1 · North Korea 1 · not attributed to a country 52026-11-09
X.CPE2 storiesnot attributed to a country 22026-11-04
XMRig2 storiesnot attributed to a country 22026-11-10

Named, but no country stated (34 stories)

The sources name these actors without attributing them to a country. Nation-state here means a source calls the activity espionage or state-sponsored without saying whose.

Nation-state (4)

CL-UNK-12111DarkBlinders1Patrick Steven Yaroch1pro-Russian1

Criminal (17)

BYOD4ShinyHunters3Unnamed criminal actor23AM1Artem Aleksandrovych Stryzhak1C3RB3R1Interlock1Nefilim1Prince Group TCO1Qilin1Scattered Spider1SleepyDuck1UNC69931Videostrong Technology1Videostrong Technology Co.1VYPR1Yoba1

Motive not stated (10)

Leakers$2Crafty Falcon1Department of Peace1Skyw4lker1STA11Storm-33581Taiwan1UAT-114731UMBRAL BISON1UTA05761
How attribution is read

Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:

  • a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
  • a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
  • the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
  • a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.

"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).