Methodology & sourcing

Source hierarchy

Not all sourcing is equal, and the difference matters most exactly where analysts are most tempted to skip it — attribution. Sources are weighted in this order:

1. 01Criminal indictments and sanctions designationsA U.S. federal indictment names individuals, states their unit, and is filed under penalty of perjury with evidence a prosecutor believes will survive court. Treasury and FCDO designations carry similar weight. This is the only tier that supports a 'confirmed' rating.
2. 02Joint government advisoriesCISA/NSA/FBI and Five Eyes advisories are corroborated across agencies before publication and typically reflect classified collection reduced to releasable technical detail. Multi-country co-sealing raises confidence further.
3. 03Primary vendor researchFirst-hand incident response and malware analysis from the organisation that found it — Mandiant, ESET, Kaspersky, Volexity, Microsoft, Cisco Talos, Recorded Future, Dragos, and others. Excellent for tradecraft; weaker for state attribution, because vendors see telemetry, not tasking.
4. 04National CERT reportingCERT-UA, ROK NIS, ASD, and NCSC-UK reporting, particularly valuable for regional actors that global vendors under-cover.

News reporting is used only to locate primary sources, never cited as one. No claim in this dataset rests on a press article alone.

Confidence levels

Every attribution carries an explicit confidence rating. These are not decorative — the difference between confirmed and moderate is the difference between a fact and an assessment, and briefs that blur the two get people in trouble.

Confirmed21 actors

Named individuals indicted or sanctioned by a government, with the unit stated in the charging document. Example: APT28 → GRU Unit 26165, per the 2018 Netyksho indictment.

High confidence8 actors

Formal government attribution to a state and service without individual charges, or consistent corroboration across multiple independent primary researchers. Example: APT29 → SVR.

Moderate confidence5 actors

Industry consensus based on targeting logic, language and timezone artifacts, and infrastructure patterns, without government confirmation. Example: APT32 → Vietnamese state interests.

Low confidence1 actors

Inferential only. Capability and target selection imply a state sponsor, but no government or vendor has committed to an attribution. Example: Predatory Sparrow.

What a partial alias correlation means

The crosswalk marks some designators partial rather than exact. This is the most important distinction in the whole dataset and the one most often lost in practice.

Vendors do not observe the same thing. Each clusters activity from its own telemetry and draws a boundary around it. Those boundaries frequently overlap without matching. Mandiant's UNC2452 covered the SolarWinds intrusion set specifically and was only merged into APT29 in April 2022 after further analysis. Kaspersky's "Winnti" names a malware family used by several distinct Chinese groups, not one actor. Symantec splits APT41 into Grayfly and Blackfly by motivation, where others treat it as one dual-mission group.

Reading a partial correlation as a synonym means importing another organisation's cluster boundary — and any error in it — into your own assessment. Where this dataset marks a designator partial, the note explains what the actual relationship is.

Known limitations

• Coverage is deliberately narrow

  35 actors, not hundreds. These are the groups most likely to appear in an incoming report. A long tail of regional and criminal actors is not represented, and absence from this dataset means nothing about a group's significance.

• Public reporting is a biased sample

  Everything here is what someone chose to publish. Groups that target Western enterprises with Western security vendors as customers are heavily over-documented; groups operating against regions with less commercial security coverage are under-documented. This is a visibility artifact, not a threat assessment.

• CVE lists are floors, not ceilings

  An actor's CVE list records exploitation that was observed, analysed, and published. Actors certainly exploit vulnerabilities that never get attributed to them. An empty CVE list means no public attribution exists, not that the group doesn't exploit software.

• Technique lists reflect reporting emphasis

  ATT&CK coverage skews toward techniques that make good writeups. Nearly every actor performs discovery and lateral movement; only some get documented doing it. Comparing raw technique counts between actors measures research attention as much as capability.

• The dataset has a currency date

  Curated through 1 Sep 2025. Threat actors do not stop when a dataset does. Treat this as a research baseline to build on, not a live feed.

• Group boundaries are analytical constructs

  “APT28” is a label applied to a set of observed activity, not an org chart. Real services reorganise, share tooling, contract out, and run joint operations. Where the public record supports a specific structural claim it is stated; where it doesn't, the group is treated as an activity cluster.

Keeping it current

The curated dataset lives in version-controlled TypeScript under src/data/, with one file per region and a shared CVE reference table. Every field that asserts something about a real adversary carries a citation in the type system itself — a source is a required field, not an optional one.

A build-time ingestion script (npm run ingest) refreshes CISA Known Exploited Vulnerabilities data and advisory items on each deploy, so KEV status and newly catalogued vulnerabilities stay current without manual editing. Actor profiles and attribution remain hand-curated, because attribution is a judgement and should be made by a person.