Live monitoring
Threat actors
Groups whose cyber attacks are documented in public reporting. Open a group to see who it targets, which security flaws it uses, and the report each claim came from.
Naming a country next to a group is an assessment drawn from public reporting, not a conclusive accusation. Check the flaws on CVE watch
24 groups
Show the countries on a map
Suspected origin map
Location = suspected origin (public reporting). Click a country to filter the list.
Show new incidents and advisories
Live threat feed
New incidents and advisories
CISA, NVD, FIRST, Microsoft, and Google/Mandiant sources are checked every five minutes.
This atlas is for defense and awareness only. Actor-country links are suspected attributions based on public reporting, not conclusive accusations. It contains no attack instructions. Each record should be verified with independent sources.