Threat Actor Map

Graph-based visualization of APT groups, TTPs, infrastructure, and campaign relationships | Shadow313 NEXUS

Threat Actor Graph 47 Actors · 312 IOCs

Tracked Actors

Nation-States

1,847

TTP Mappings

Nation-State Actors High Confidence

Russia — SVR/GRU/FSB

APT28 (Fancy Bear), APT29 (Cozy Bear), Sandworm. Primary targets: Government, Defense, Energy. Signature TTPs: T1195.002, T1078, T1573.002

China — MSS/PLA

APT41 (Winnti), APT10, APT40. Primary targets: Technology, Healthcare, Defense. Signature TTPs: T1190, T1059.006, T1048

North Korea — RGB/Lazarus

Lazarus Group, BlueNoroff, Andariel. Primary targets: Financial, Crypto, Defense. Signature TTPs: T1566.001, T1486, T1083

Iran — IRGC/MOIS

APT33 (Elfin), APT34 (OilRig), APT35. Primary targets: Energy, Government, Telecom. Signature TTPs: T1190, T1059.001, T1071.001

Shared Infrastructure Clusters C2 Analysis

Cluster C2-ALPHA (Lazarus + BlueNoroff)
Shared C2: 185.220.101.42 | 91.207.175.33 | 45.138.16.89
Shared tools: FASTCash JAR, Mimikatz variant, custom SWIFT injector

Cluster C2-BETA (APT29 + APT28)
Shared infrastructure: Tor exit nodes, compromised VPS in 12 countries
Shared tools: Cobalt Strike, custom implants, SUNBURST-variant