APT knowledge graph
The same curated dataset as the feed, visualized as connections: which threat actors are reported operating from which regions, and targeting which sectors and regions — drawn only from what each source post actually states. Drag nodes, scroll to zoom, click a node to see its posts.
Node size reflects how many sourced connections a threat actor, origin, sector or region has in this dataset — not a measure of real-world activity or severity. Edges are drawn only from fields the original source post explicitly states; nothing here is inferred attribution.
Frequently asked questions
What connects the nodes in this graph?
Every edge comes from a real, sourced threat-intel post: a threat actor connects to a suspected origin, target sector, or target region only when the original vendor post explicitly states that fact. There is no inferred or estimated attribution in the graph.
Why does a threat actor not appear on the graph?
Only posts naming a specific threat actor contribute nodes and edges here. A post covering general malware or ransomware trends without naming an actor won’t show up in the graph — it still appears in the filterable feed.
Does node size mean the actor is more dangerous?
No. Node size reflects how many sourced connections that node has in this specific dataset — a curation artifact, not a severity or threat-level ranking.
Is this the same data as the APT feed?
Yes — the graph and the feed are built from the exact same curated dataset, just visualized two different ways. Click a node here to see its underlying posts, or browse everything with filters on the feed page.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.