Global Threat Infrastructure
Nation-state C2 activity · Real-time IOC geo-distribution
10,164High-conf IPs
60Countries
40Attack paths
21,602Actor IOCs
17,088Persistent IPs
23APT Groups
Actors
Russia
China
North Korea
Iran
C2 Density
Critical
High
Medium
Low
Scroll to zoom · Drag to pan
Top C2 Countriesby high-conf IPs
1🇺🇸United States2,185
6,767 total
2🇨🇳China1,646
2,725 total
3🇭🇰Hong Kong1,062
1,636 total
4🇩🇪Germany794
1,654 total
5🇳🇱The Netherlands612
738 total
6🇸🇬Singapore377
972 total
7🇫🇷France352
798 total
8🇬🇧United Kingdom267
767 total
9🇳🇱Netherlands234
836 total
10🇯🇵Japan194
490 total
11🇷🇺Russia192
279 total
12🇨🇦Canada169
555 total
13🇧🇷Brazil164
640 total
14🇮🇳India142
801 total
15🇨🇭Switzerland133
215 total
Nation-State ActorsIOC · groups · routes
🇷🇺Russia11,924
8 APT groups20 attack routes
Top targets
→🇺🇸United States786
→🇨🇳China736
→🇭🇰Hong Kong373
TurlaSandwormGamaredonAPT28+2
🇰🇵North Korea7,846
4 APT groups14 attack routes
Top targets
→🇨🇳China442
→🇺🇸United States433
→🇭🇰Hong Kong160
KimsukyAPT37APT38Lazarus Group
🇨🇳China1,648
6 APT groups6 attack routes
Top targets
→🇺🇸United States244
→🇭🇰Hong Kong77
→🇩🇪Germany69
APT10Salt TyphoonVolt TyphoonAPT41+2
🇮🇷Iran184
3 APT groups0 attack routes
Top targets
MuddyWaterAPT34APT35
🇸🇩SD0
1 APT groups0 attack routes
Top targets
Anonymous Sudan
🇺🇦UA0
1 APT groups0 attack routes
Top targets
FIN7
Attack Routesorigin → C2 infra
🇷🇺RU→🇺🇸United States786
🇷🇺RU→🇨🇳China736
🇰🇵KP→🇨🇳China442
🇰🇵KP→🇺🇸United States433
🇷🇺RU→🇭🇰Hong Kong373
🇨🇳CN→🇺🇸United States244
🇷🇺RU→🇩🇪Germany233
🇷🇺RU→🇳🇱The Netherlands199
🇰🇵KP→🇭🇰Hong Kong160
🇰🇵KP→🇩🇪Germany155
🇷🇺RU→🇸🇬Singapore150
🇰🇵KP→🇳🇱The Netherlands136
🇷🇺RU→🇫🇷France107
🇷🇺RU→🇬🇧United Kingdom93
🇰🇵KP→🇸🇬Singapore82
🇨🇳CN→🇭🇰Hong Kong77
🇷🇺RU→🇨🇦Canada76
🇷🇺RU→🇯🇵Japan74
🇷🇺RU→🇳🇱Netherlands72
🇨🇳CN→🇩🇪Germany69
Shared Infrastructuremulti-actor C2
🇺🇸1463
United States
RUKPCN
🇨🇳1178
China
RUKP
🇭🇰610
Hong Kong
RUKPCN
🇳🇱511
The Netherlands
RUKPCN
🇩🇪457
Germany
RUKPCN
🇸🇬273
Singapore
RUKPCN
🇫🇷207
France
RUKPCN
🇬🇧128
United Kingdom
RUKP