Radar links OSINT items by specificity-weighted similarity inside a 45-day window — a rare malware, CVE, or tracked actor binds strongly; generic techniques (T1566) barely count, and a specific shared pivot is required to form an edge — then groups them by community detection (Louvain). Clusters are tracked across runs with stable identity (candidate → corroborated → named); when their activity ages out they go dormant. Each is an Activity Group — a cluster of shared tradecraft and victimology, named independently of vendor aliases. Deterministic correlation, not confirmed attribution.