suspected victim country
Actors targeting United States
65 actors · source: MISP Galaxy
Every mark is an actor the MISP Galaxy (from the CFR Cyber Operations Tracker) lists with this country among its suspected victims. Red ones exploit a CVE in CISA KEV.
Every one of the 65 is a mark on the map. Named now: 1 to 26, most on record first.
- APT28
- APT41
- APT29
- Lazarus Group
- OilRig
- Turla
- Mustang Panda
- Wizard Spider
- Threat Group-3390
- OceanLotus
- MuddyWater
- menuPass
- Berserk Bear
- Leviathan
- FishMonger
- Graceful Spider
- APT1
- APT3
- APT33
- APT42
- Cloud Atlas
- Naikon
- Molerats
- Tortoiseshell
- Tonto Team
- Cleaver
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.