Strongest relationships 201 total
Ordered by how much the evidence supports a claim: shared infrastructure first, then shared reporting, then tooling and techniques.
- infrastructure — 56 shared indicatorsreporting — 2 reports cite bothsoftware — shares HOPLIGHT, ECCENTRICBANDWAGON
- infrastructure — 31 shared indicators
- infrastructure — 25 shared indicators
- infrastructure — 12 shared indicators
- infrastructure — 11 shared indicators
- infrastructure — 10 shared indicators
- infrastructure — 8 shared indicators
- infrastructure — 7 shared indicators
- infrastructure — 7 shared indicators
- infrastructure — 5 shared indicatorsreporting — 1 report cite both
- infrastructure — 4 shared indicators
- infrastructure — 4 shared indicators
- infrastructure — 4 shared indicators
- infrastructure — 4 shared indicatorsreporting — 2 reports cite both
- infrastructure — 3 shared indicators
- infrastructure — 3 shared indicators
- infrastructure — 3 shared indicatorssoftware — shares reGeorg, Tor
- infrastructure — 3 shared indicators
- infrastructure — 3 shared indicators
- infrastructure — 3 shared indicators
- infrastructure — 3 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicatorsreporting — 1 report cite both
- infrastructure — 2 shared indicatorsreporting — 2 reports cite both
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
- infrastructure — 2 shared indicators
Nothing matches that filter.
Showing the 40 strongest of 201. All of them, with their evidence, are in graph.json.
One group's neighbourhood
Everything related to a single group, which is the readable unit here — the full graph is one component of 116 groups and would not be.
Most connected
Not a ranking of importance — a group is here because a lot has been published about it that overlaps with something else.
- 21 links
- 19 links
- 17 links
- 13 links
- 12 links
- 12 links
- 11 links
- 10 links
- 9 links
- 8 links
- 8 links
- 8 links
How a relationship is decided
infrastructure — the same domain or address is attributed to both groups. The strongest signal here and a rare one: 268 of 154,910 values touch more than one group. Anything shared by eight or more groups is treated as hosting or a sinkhole and dropped.
reporting — the same write-up cites both. Corroborating, not conclusive; a survey naming a dozen actors links none of them, which is why the same eight-group cut applies.
software — shared named malware or tooling, after discarding anything commodity. Mimikatz, Cobalt Strike, PsExec and certutil appear under a quarter of all profiled groups; two actors both using one says nothing.
technique — overlap of published ATT&CK techniques as Jaccard, not a raw count. T1566.001 is attributed to 54 of 95 profiled groups. Only four pairs in the whole corpus clear the bar, and technique overlap reflects how much a group has been researched as much as what it does.
Attribution is inherited from Maltrail and MITRE ATT&CK, not independently assessed, and one actor can only relate to another through what has been published about both. Absence of a relationship is not evidence of anything.