Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| From Albania to the Middle East: The Scarred Manticore is Listeningreport | Related to | OilRig (APT34)actor | — | ORKL | 2024-01-16 |
| Scattered Spider Threat Group Analysisreport | Related to | ALPHV / BlackCatactor | — | ORKL | 2024-04-22 |
| The Human Factor 2023report | Related to | Sea Turtleactor | — | ORKL | 2023-06-07 |
| Gaza Cybergang Unified Front Targeting Hamas Oppositionreport | Related to | Gaza Cybergang / Moleratsactor | — | ORKL | 2023-12-18 |
| 2023 Adversary Infrastructure Reportreport | Related to | APT33actor | — | ORKL | 2024-01-08 |
| Updated MATA attacks industrial companies in Eastern Europereport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2023-10-18 |
| New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implantsreport | Related to | Scarred Manticore (Storm-0861)actor | — | ORKL | 2024-01-16 |
| Scattered Spiderreport | Related to | DragonForceactor | — | ORKL | 2025-08-01 |
| Crypto Country: North Korea's Targeting of Cryptocurrencyreport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2023-11-29 |
| ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilitiesreport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2024-05-13 |
| eset-apt-activity-report-q2-2025-q3-2025.pdfreport | Related to | Imperial Kitten (CURIUM)actor | — | ORKL | 2025-10-30 |
| 2025 Global Threat Reportreport | Related to | Cleaveractor | — | ORKL | 2025-02-27 |
| Iranian "Dream Job" campaignreport | Related to | UNC1549 / TA455actor | — | ORKL | 2024-11-12 |
| When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectorsreport | Related to | UNC1549 / TA455actor | — | ORKL | 2024-03-13 |
| ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilitiesreport | Related to | Poloniumactor | — | ORKL | 2024-05-13 |
| Mandiant M-Trends 2025 Reportreport | Related to | Handalaactor | — | ORKL | 2025-04-24 |
| Threat Horizons H1 2025report | Related to | ALPHV / BlackCatactor | — | ORKL | 2025-01-16 |
| 2023-05-22 - Bluenoroff’s RustBucket campaignreport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2023-06-04 |
| Israel-Hamas War in Cyber February 2024 Tool of First Resortreport | Related to | Arid Viper (APT-C-23 / Desert Falcon)actor | — | ORKL | 2024-02-08 |
| To the past and beyond: Andariel's latest arsenal and cyberattacksreport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2026-01-16 |
| Modern Asia APT groups TTPsreport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2023-11-09 |
| Mandiant M-Trends 2025 Reportreport | Related to | Agrius (Agonizing Serpens / BlackShadow)actor | — | ORKL | 2025-04-24 |
| Exposing DPRK's Cyber Syndicate and Hidden IT Workforcereport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2025-05-14 |
| ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilitiesreport | Related to | Poloniumactor | — | ORKL | 2023-11-03 |
| DECEPTIVEDEVELOPMENT: FROM PRIMITIVE CRYPTO THEFT TO SOPHISTICATED AI-BASED DECEPTIONreport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2025-09-16 |
| Lazarus covets COVID-19-related intelligencereport | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | ORKL | 2024-01-04 |
| Mandiant M-Trends 2025 Reportreport | Related to | Cl0pactor | — | ORKL | 2025-04-24 |
| Warlock · MeshAgentcampaign | Related to | Sinobiactor | — | Correlated cluster | 2026-09-03 |
| Rhysida · Qilincampaign | Related to | The Gentlemenactor | — | Correlated cluster | 2026-09-22 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Correlated cluster | 2026-09-16 |
| payload · XMRigcampaign | Related to | Cavern Manticoreactor | — | Correlated cluster | 2026-09-03 |
| Rhysida · Qilincampaign | Related to | Qilin (fka Agenda)actor | — | Correlated cluster | 2026-09-22 |
| UNC1549 / TA455 · NightLedgercampaign | Related to | UNC1549 / TA455actor | — | Correlated cluster | 2026-08-12 |
| payload · XMRigcampaign | Related to | HEXANE (Lyceum)actor | — | Correlated cluster | 2026-09-03 |
| Cavern Manticore · Caverncampaign | Related to | Cavern Manticoreactor | — | Correlated cluster | 2026-07-08 |
| payload · Amateracampaign | Related to | payloadactor | — | Correlated cluster | 2026-09-23 |
| Rhysida · Qilincampaign | Related to | Rhysidaactor | — | Correlated cluster | 2026-09-22 |
| payload · XMRigcampaign | Related to | OilRig (APT34)actor | — | Correlated cluster | 2026-09-03 |
| payload · XMRigcampaign | Related to | payloadactor | — | Correlated cluster | 2026-09-03 |
| payload · Amateracampaign | Related to | Void Manticore (Storm-0842)actor | — | Correlated cluster | 2026-09-23 |
| UNC1549 / TA455 · NightLedgercampaign | Related to | CyberAv3ngersactor | — | Correlated cluster | 2026-08-12 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · ZshBucketcampaign | Related to | Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor | — | Correlated cluster | 2026-08-26 |
| Rhysida · Qilincampaign | Related to | DragonForceactor | — | Correlated cluster | 2026-09-22 |
| Cavern Manticore · Caverncampaign | Related to | OilRig (APT34)actor | — | Correlated cluster | 2026-07-08 |
| Cavern Manticore · Caverncampaign | Related to | HEXANE (Lyceum)actor | — | Correlated cluster | 2026-07-08 |
| Warlock · MeshAgentcampaign | Related to | Warlockactor | — | Correlated cluster | 2026-09-03 |
| payload · XMRigcampaign | Related to | payloadactor | — | Correlated cluster | 2026-08-26 |
| Trojanized PDF softwarecampaign | Related to | CVE-2026-61925cve | — | Correlated cluster | 2026-08-17 |
| CVE-2026-81963campaign | Related to | CVE-2026-68876cve | — | Correlated cluster | 2026-09-08 |
| Dysphoriacampaign | Related to | CVE-2026-59309cve | — | Correlated cluster | 2026-08-24 |