Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| Rocket Kittenactor | Related to | Void Manticore (Storm-0842)actor | — | Technique overlap | — |
| Lynxactor | Related to | MuddyWateractor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | Ballistic Bobcatactor | — | Technique overlap | — |
| Eldoradoactor | Related to | Void Manticore (Storm-0842)actor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | IncRansomactor | — | Technique overlap | — |
| Cl0pactor | Related to | Devmanactor | — | Technique overlap | — |
| BQTLockactor | Related to | Void Manticore (Storm-0842)actor | — | Technique overlap | — |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | Related to | Shamoon Operatorsactor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | StrongPity (PROMETHIUM)actor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | Syrian Electronic Armyactor | — | Technique overlap | — |
| Earth Bogleactor | Related to | Qilin (fka Agenda)actor | — | Technique overlap | — |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | Related to | Sea Turtleactor | — | Technique overlap | — |
| Crypto24actor | Related to | MuddyWateractor | — | Technique overlap | — |
| BladedFelineactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | Related to | UNC1549 / TA455actor | — | Technique overlap | — |
| DireWolfactor | Related to | OilRig (APT34)actor | — | Technique overlap | — |
| Group5actor | Related to | OilRig (APT34)actor | — | Technique overlap | — |
| HEXANE (Lyceum)actor | Related to | Sea Turtleactor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | DireWolfactor | — | Technique overlap | — |
| Void Manticore (Storm-0842)actor | Related to | Volatile Cedaractor | — | Technique overlap | — |
| MuddyWateractor | Related to | UNC1860actor | — | Technique overlap | — |
| Greenbugactor | Related to | OilRig (APT34)actor | — | Technique overlap | — |
| Devmanactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | Poloniumactor | — | Technique overlap | — |
| Careto / Maskactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| Stormousactor | Related to | Void Manticore (Storm-0842)actor | — | Technique overlap | — |
| KillSecactor | Related to | OilRig (APT34)actor | — | Technique overlap | — |
| OilRig (APT34)actor | Related to | RansomHouseactor | — | Technique overlap | — |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | Related to | Sinobiactor | — | Technique overlap | — |
| Money Messageactor | Related to | Void Manticore (Storm-0842)actor | — | Technique overlap | — |
| CopyKittensactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| HEXANE (Lyceum)actor | Related to | LockBit / LockBit 3.0actor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | Tenguactor | — | Technique overlap | — |
| Ballistic Bobcatactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | Related to | Spacebearsactor | — | Technique overlap | — |
| APT39 / Chaferactor | Related to | CopyKittensactor | — | Technique overlap | — |
| 8Baseactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| Duqu (Duqu 2.0)actor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| Cavern Manticoreactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | Related to | Montiactor | — | Technique overlap | — |
| MuddyWateractor | Related to | Novaactor | — | Technique overlap | — |
| MuddyWateractor | Related to | RansomHouseactor | — | Technique overlap | — |
| Flame / Flameractor | Related to | Void Manticore (Storm-0842)actor | — | Technique overlap | — |
| 8Baseactor | Related to | OilRig (APT34)actor | — | Technique overlap | — |
| Flame / Flameractor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| MuddyWateractor | Related to | StrongPity (PROMETHIUM)actor | — | Technique overlap | — |
| Flying Kittenactor | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Technique overlap | — |
| OilRig (APT34)actor | Related to | Spacebearsactor | — | Technique overlap | — |
| OilRig (APT34)actor | Related to | Syrian Electronic Armyactor | — | Technique overlap | — |
| BrainCipheractor | Related to | MuddyWateractor | — | Technique overlap | — |