CUTSIGNcutting for sign — daily OSINT threat read

Adversaries by country

Which country the public sources attribute each brief story's adversary to · 90 days: 2026-08-13 – 2026-11-10 (briefs stored from 2026-10-15)

Window
Kind
Shade by
12
countries
39
attributed adversaries
39/499
stories attributed
31%
of those: China
Kazakhstan: 2 stories, 1 adversary (UAT-6275)Russia: 6 stories, 6 adversaries (APT28, APT29, Gorbag, Sandworm, Turla, Unnamed Russia-attributed actor)Brazil: 1 story, 1 adversary (Unnamed Brazil-attributed actor)Israel: 2 stories, 1 adversary (Candiru)Israel: 2 stories, 1 adversary (Candiru)North Korea: 7 stories, 10 adversaries (Lazarus Group, TraderTraitor, APT38, Coral Sleet, Emerald Sleet, Famous Chollima, …)North Korea: 7 stories, 10 adversaries (Lazarus Group, TraderTraitor, APT38, Coral Sleet, Emerald Sleet, Famous Chollima, …)India: 1 story, 1 adversary (Bitter)Iran: 4 stories, 4 adversaries (Prince of Persia, Shahid Kaveh, STATIC KITTEN, Unnamed Iran-attributed actor)Syria: 1 story, 1 adversary (Syrian Electronic Army)Syria: 1 story, 1 adversary (Syrian Electronic Army)Belarus: 3 stories, 3 adversaries (Belarusian Cyber Partisans, Cyber Partisans, Unnamed Belarus-attributed actor)Belarus: 3 stories, 3 adversaries (Belarusian Cyber Partisans, Cyber Partisans, Unnamed Belarus-attributed actor)Turkey: 1 story, 1 adversary (VasyGrek)China: 12 stories, 9 adversaries (Warp Panda, Volt Typhoon, APT41, Bronze Sandcastle, Red Heron, Salt Typhoon, …)Serbia: 1 story, 1 adversary (Unnamed Serbia-attributed actor)Serbia: 1 story, 1 adversary (Unnamed Serbia-attributed actor)China 12North Korea 7Russia 6Iran 4Belarus 3Israel 2
Stories12–45–78–12· hover a country for its actors, click for its card

Week by week

0816week of Oct 12: China 1week of Oct 12: North Korea 1week of Oct 12: Russia 1week of Oct 12: 7 others 36week of Oct 19: China 3week of Oct 19: North Korea 1week of Oct 19: Russia 1week of Oct 19: Iran 1week of Oct 19: Belarus 1week of Oct 19: 7 others 18week of Oct 26: China 9week of Oct 26: North Korea 3week of Oct 26: Russia 1week of Oct 26: Belarus 1week of Oct 26: 7 others 216week of Nov 2: China 3week of Nov 2: North Korea 2week of Nov 2: Russia 2week of Nov 2: Iran 2week of Nov 2: Belarus 1week of Nov 2: 7 others 313week of Nov 9: Russia 1week of Nov 9: Iran 1week of Nov 9: 7 others 13Oct 12Oct 19Oct 26Nov 2Nov 9
ChinaNorth KoreaRussiaIranBelarus7 others· a story naming actors from two countries counts once for each

By country

China9 nation-state12
12 stories · 9 adversaries1 in 7 days ▼7 (8 before)
Warp Panda3Volt Typhoon2APT411Bronze Sandcastle1Red Heron1Salt Typhoon1Storm-09401unnamed1Vapor Panda1
Why these attributions
North Korea10 nation-state7
7 stories · 10 adversaries1 in 7 days ▼3 (4 before)
Lazarus Group4TraderTraitor4APT383Coral Sleet1Emerald Sleet1Famous Chollima1Jasper Sleet1Onyx Sleet1Pearl Sleet1unnamed1
Why these attributions
Russia6 nation-state6
6 stories · 6 adversaries3 in 7 days ▲2 (1 before)
APT281APT291Gorbag1Sandworm1Turla1unnamed1
Why these attributions
Iran4 nation-state4
4 stories · 4 adversaries2 in 7 days ▲1 (1 before)
Prince of Persia1Shahid Kaveh1STATIC KITTEN1unnamed1
Why these attributions
Belarus2 nation-state · 1 hacktivist3
3 stories · 3 adversaries0 in 7 days ▼2 (2 before)
Belarusian Cyber Partisans1Cyber Partisans1unnamed1
Why these attributions
Israel1 commercial spyware2
2 stories · 1 adversary0 in 7 days = (0 before)
Candiru2
Why these attributions
Kazakhstan1 nation-state2
2 stories · 1 adversary0 in 7 days = (0 before)
UAT-62752
Why these attributions
Brazil1 criminal1
1 story · 1 adversary0 in 7 days ▼1 (1 before)
unnamed1
Why these attributions
India1 nation-state1
1 story · 1 adversary1 in 7 days = (1 before)
Bitter1
Why these attributions
Serbia1 nation-state1
1 story · 1 adversary0 in 7 days = (0 before)
unnamed1
Why these attributions
Syria1 hacktivist1
1 story · 1 adversary0 in 7 days ▼1 (1 before)
Syrian Electronic Army1
Why these attributions
Turkey1 nation-state1
1 story · 1 adversary1 in 7 days ▲1 (0 before)
VasyGrek1
Why these attributions

Tools seen in more than one story

Malware and frameworks the extraction named, counted wherever a story names them, with the countries the same stories' actors are attributed to.

ARTEX8 storiesChina 1 · North Korea 1 · not attributed to a country 62026-11-09
XMRig4 storiesnot attributed to a country 42026-11-10
GhostAction3 storiesnot attributed to a country 32026-10-29
AdaptixC22 storiesnot attributed to a country 22026-11-09
CoGUI2 storiesnot attributed to a country 22026-10-15
EvilTokens2 storiesnot attributed to a country 22026-10-23
Kali3652 storiesnot attributed to a country 22026-11-06
X.CPE2 storiesnot attributed to a country 22026-11-04

Named, but no country stated (52 stories)

The sources name these actors without attributing them to a country. Nation-state here means a source calls the activity espionage or state-sponsored without saying whose.

Nation-state (5)

CL-STA-09541CL-UNK-12111DarkBlinders1Patrick Steven Yaroch1pro-Russian1

Criminal (28)

BYOD4ShinyHunters3Qilin2Scattered Spider2Tarnished Scorpius2Unnamed criminal actor23AM1Artem Aleksandrovych Stryzhak1BUGSTER1C3RB3R1DataSuckers1Hotejka1Interlock1Nefilim1Prince Group TCO1Rhysida1SafePay1Settra1SleepyDuck1STAC47491Storm-29901Storm-31191The Gentlemen1UNC69931Videostrong Technology1Videostrong Technology Co.1VYPR1Yoba1

Hacktivist (2)

Black Spark1Internet Yiff Machine1

Commercial spyware (1)

Discover-Tech1

Motive not stated (16)

Leakers$2Crafty Falcon1Department of Peace1k0t1MALFEX1ScarlettGroup1Siriusim1Skyw4lker1STA11Storm-33581Taiwan1UAC-00991UAT-114731UMBRAL BISON1UNC70171UTA05761
How attribution is read

Nothing here is Cutsign's own attribution. Each story's actor field, title and summary (written by the extraction from the public sources) are read for, strongest first:

  • a group whose attribution is settled in public reporting (APT28, Lazarus, Storm-0940, …);
  • a vendor naming convention: Microsoft's Typhoon (China), Blizzard (Russia), Sandstorm (Iran), Sleet (North Korea); CrowdStrike's Panda, Bear, Kitten, Chollima; Unit 42's Taurus, Ursa, Serpens, Pisces; Secureworks' Bronze, Iron, Cobalt, Nickel;
  • the sources' own words next to the name: "China-nexus Volt Typhoon", "North Korea's TraderTraitor", "Iranian state-sponsored …";
  • a story that names no actor but says "North Korean threat actors" or "Russia-linked" counts one unnamed actor for that country.

"Russian-speaking" and "Chinese-language" name a language, not a country, and count for neither; "pro-Ukrainian" is a stance; "Russian healthcare organization" is a victim. Vendors' alias tables merge one actor's names (Jade Sleet = TraderTraitor). A story is one update chain: a story and its later updates count once. Every card lists why each actor was placed where it is. JSON: /?view=actors&format=json (same w, cat parameters).