CyberSIXT Atlas
Every threat actor on record, and what each is known to use and exploit.
1,477 actors · 230 CVEs exploited · 567 techniques · 636 software
Each hub is the origin sources give a set of actors and each strip an actor, sized by what is on record for it. A line joins two origins whose actors exploit the same CVEs or use the same software and techniques.
Open APT28 or on the map. Zoom in to read every mark.
- actors
- 1,477
- with something on record
- 360
- exploit a CVE in CISA KEV
- 136
- CVEs they exploit
- 230
- techniques
- 567
- software
- 636
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.