threatintel
actor tracker
global flow map

Where attribution meets targeting

Each edge connects an actor’s publicly attributed origin to a country it has publicly targeted. Thickness scales with the number of distinct actors that share the flow; color tags the operator category. Hover (or focus via keyboard) for the actor list.

70 actors · 153 eventsFilter
102 edges shown
RURussia — 21 outbound, 2 inboundUSUnited States — 1 outbound, 46 inboundDEGermany — 0 outbound, 27 inboundGBUnited Kingdom — 0 outbound, 38 inboundCNChina — 17 outbound, 1 inboundFRFrance — 0 outbound, 17 inboundPLPoland — 0 outbound, 10 inboundUAUkraine — 1 outbound, 10 inboundIRIran — 10 outbound, 2 inboundILIsrael — 1 outbound, 9 inboundAEUnited Arab Emirates — 0 outbound, 7 inboundAUAustralia — 0 outbound, 8 inboundJPJapan — 0 outbound, 13 inboundCACanada — 0 outbound, 10 inboundITItaly — 0 outbound, 6 inboundSASaudi Arabia — 0 outbound, 6 inboundKPDPRK — 5 outbound, 0 inboundKRSouth Korea — 0 outbound, 9 inboundTWTaiwan — 0 outbound, 4 inboundVNVietnam — 0 outbound, 7 inboundLVLatvia — 0 outbound, 4 inboundKHCambodia — 0 outbound, 3 inboundMYMalaysia — 0 outbound, 3 inboundPHPhilippines — 0 outbound, 3 inboundSGSingapore — 0 outbound, 4 inboundBRBrazil — 0 outbound, 4 inboundEEEstonia — 0 outbound, 3 inboundGEGeorgia — 0 outbound, 3 inboundLTLithuania — 0 outbound, 3 inboundBEBelgium — 0 outbound, 4 inboundHKHong Kong — 0 outbound, 2 inboundINIndia — 0 outbound, 6 inboundMMMyanmar — 0 outbound, 2 inboundTHThailand — 0 outbound, 2 inboundJOJordan — 0 outbound, 2 inboundTRTurkey — 0 outbound, 3 inboundCHSwitzerland — 0 outbound, 2 inboundCZCzechia — 0 outbound, 3 inboundESSpain — 0 outbound, 3 inboundNONorway — 0 outbound, 3 inboundRORomania — 0 outbound, 3 inboundFIFinland — 0 outbound, 2 inboundGUGuam — 0 outbound, 1 inboundMNMongolia — 0 outbound, 1 inboundIEIreland — 0 outbound, 1 inboundKWKuwait — 0 outbound, 2 inboundARArgentina — 0 outbound, 1 inboundBDBangladesh — 0 outbound, 1 inboundBHBahrain — 0 outbound, 1 inboundMXMexico — 0 outbound, 2 inboundATAustria — 0 outbound, 1 inboundBYBelarus — 0 outbound, 2 inboundDKDenmark — 0 outbound, 1 inboundNLNetherlands — 0 outbound, 1 inboundSESweden — 0 outbound, 1 inboundPKPakistan — 0 outbound, 1 inboundSYSyria — 0 outbound, 1 inbound
Edge colorState-sponsoredRansomwareCybercrimeHacktivistMultiple kindsCtrl + wheel to zoom · drag to pan · or use the +/− buttons

Data: hand-curated targeting fields on each actor record · projection: equirectangular · centroids: coarse, illustrative