Nation-state intelligence, adversary dossiers, and cross-actor correlation. Map threat actors to their techniques, infrastructure, tools, and targets across your entire threat landscape.
Actor attribution connects individual threat events into cohesive adversary profiles, revealing the who behind the what. By mapping techniques, infrastructure, tooling, and targets across hundreds of threat reports, the Attribution Explorer surfaces patterns that link disparate campaigns to the same operators.
Every profile is built from real intelligence: MITRE ATT&CK technique frequency, IOC clustering, shared infrastructure analysis, detection rule coverage, and temporal correlation of campaign timelines. The result is a living dossier for each tracked group, continuously enriched as new threats are ingested.
38 countries mapped to their attributed threat actors. Filter by nation, view geopolitical context, and track state-sponsored campaigns targeting your sector.
465 MITRE ATT&CK techniques mapped per actor. See which tactics each group favors, identify overlaps between actors, and prioritize detection coverage.
Cross-reference 5,575 indicators across actor profiles. Shared infrastructure, domain patterns, and behavioral fingerprints reveal hidden connections between groups.
1,897 detection rules tied to specific actors. SPL, KQL, and Sigma rules with coverage scores showing your visibility into each group's known tradecraft.
Temporal analysis of actor activity across 160+ threat events. Track campaign cadence, identify dormant groups re-emerging, and correlate activity spikes.
Map each actor's preferred tools, malware families, and exploit chains. From commodity RATs to custom implants, understand the arsenal before it hits your network.
Filter by nation-state, motivation, or severity. Click any row to expand the profile summary with key metrics, top techniques, arsenal, and target sectors.
Each actor profile opens into a tabbed dossier with six intelligence sections. Techniques, indicators, detection rules, campaign timelines, arsenal, and CVE exploitation history are all linked to the source threats.
The correlation engine identifies shared infrastructure, overlapping toolsets, and coordinated campaign timing between distinct threat actors. These links surface when multiple groups share C2 domains, exploit the same zero-day within days, or use identical custom implant variants.
Three Russian-attributed groups operating from overlapping ASNs and using the same bulletproof hosting provider during Q1 2026 campaigns.
ShadowPad modular backdoor deployed by multiple China-nexus groups with distinct configurations but shared C2 protocol signatures.
Three unrelated groups exploited CVE-2023-42793 (TeamCity) within 72 hours of each other, suggesting shared vulnerability intelligence or a common broker.
DNS tunneling patterns, beacon intervals, and jitter configurations match across campaigns attributed to Iranian groups operating under different aliases.
214 threat actors. 38 nation-states. Full dossiers with techniques, IOCs, detections, and timelines. Start exploring the actors targeting your industry.
[ explore_actors ] [ view_plans ]