// Active Threat Landscape

CYBER
OPS

APT groups, ICS attacks, nation-state implants, and the infrastructure wars being fought below the threshold of conventional conflict.

Global Threat Posture

Threat Environment

140+
Active APT Groups
23
Nation-State Actors
16
Critical Sectors Targeted
∞
Zero-Days Hoarded
Operations & Analysis

Active Fronts

⚡
ICS / SCADA Attacks
Industrial control systems run power grids, water treatment, and pipeline infrastructure. They were never designed for adversarial environments. Sandworm proved what happens when they meet a capable state actor.
// NotPetya — 2017 — Estimated damage
TARGET: Maersk, Merck, FedEx, Mondelez
VECTOR: M.E.Doc supply chain compromise
DAMAGE: ~$10 billion USD
STATUS: Attributed to Sandworm / GRU Unit 74455
🕷️
Commercial Spyware
Pegasus, Predator, Hermit. The commoditisation of zero-click exploits means sophisticated surveillance tools are no longer exclusive to superpowers. The ecosystem is now global, and deeply uncomfortable.
// Pegasus iMessage zero-click
VECTOR: Forced-entry, zero interaction
ACCESS: Microphone, camera, messages, GPS
VENDOR: NSO Group (IL) / licensed to 45+ govts
// Citizen Lab tracks active deployments
🔌
Supply Chain Compromise
SolarWinds taught us that the most trusted software can become the most dangerous vector. Backdooring updates pushes attacker access to every downstream customer simultaneously — elegant and brutal.
// SolarWinds SUNBURST — 2020
ACTOR: APT29 / Cozy Bear / SVR
REACH: 18,000+ installations compromised
TARGETS: Treasury, DHS, CISA, Pentagon
// Persisted 9 months undetected
🌊
Pre-Positioning
Volt Typhoon doesn't attack immediately. It hides in critical infrastructure, building persistence for activation during a crisis. This is deterrence-era cyber: not destruction now, but the credible threat of it later.
// Volt Typhoon — PRC — 2023-present
ACTOR: PLA-linked, MSS-assessed
TARGETS: US water, comms, power, transport
METHOD: Living-off-the-land (LOTL)
// Purpose: Crisis activation, not espionage
Threat Actors

APT Tracker

Open-source tracking of known advanced persistent threat groups. Attributions are public record — sourced from government advisories, private security research, and indictments.

Group Nation Primary Targets Known For Threat Level
Sandworm Russia (GRU) Energy, Ukraine critical infra NotPetya, Ukraine power grid attacks Critical
Lazarus Group DPRK Financial, crypto, defence WannaCry, $1.7B crypto heists Critical
APT29 / Cozy Bear Russia (SVR) Government, think tanks, pharma SolarWinds, COVID vaccine research Critical
Volt Typhoon China (PLA) US critical infrastructure LOTL persistence, pre-positioning Critical
APT28 / Fancy Bear Russia (GRU) Elections, NATO, media DNC breach, election interference High
APT40 / TEMP.Periscope China (MSS) Naval, maritime, research Naval R&D theft, COVID data ops High
Turla / Venomous Bear Russia (FSB) Diplomatic, defence ministries Novel implants, satellite C2 High
MuddyWater Iran (MOIS) Middle East governments, telecoms Spearphishing, custom RATs Medium

// SOURCES: CISA ADVISORIES, NSA PUBLICATIONS, MITRE ATT&CK, CROWDSTRIKE, MANDIANT THREAT INTELLIGENCE

$ cat recommended_reading.txt # cyberwar shelf
→ "Countdown to Zero Day" — Kim Zetter (Stuxnet)
→ "Sandworm" — Andy Greenberg (GRU Unit 74455)
→ "The Perfect Weapon" — David Sanger (US cyber policy)
→ "This Is How They Tell Me the World Ends" — Nicole Perlroth (0-days)
→ "Fancy Bear Goes Phishing" — Scott Shapiro (hacker theory)
→ Full bookshelf →