Observed threat map● refreshed daily
United Arab Emirates — 7 observedUnited Arab Emirates — no actors placed hereAfghanistanAfghanistan — no actors placed hereAlbania — 3 observedAlbania — no actors placed hereArmeniaArmenia — no actors placed hereAngola — 1 observed (below the 3 shading threshold)Angola — no actors placed hereArgentina — 21 observedArgentina — no actors placed hereAustria — 6 observedAustria — no actors placed hereAustralia — 23 observedAustralia — no actors placed hereAzerbaijan — 1 observed (below the 3 shading threshold)Azerbaijan — no actors placed hereBosnia and HerzegovinaBosnia and Herzegovina — no actors placed hereBangladesh — 1 observed (below the 3 shading threshold)Bangladesh — no actors placed hereBelgium — 7 observedBelgium — no actors placed hereBurkina FasoBurkina Faso — no actors placed hereBulgaria — 2 observed (below the 3 shading threshold)Bulgaria — no actors placed hereBurundiBurundi — no actors placed hereBeninBenin — no actors placed hereBruneiBrunei — no actors placed hereBoliviaBolivia — no actors placed hereBrazil — 27 observedBrazil — no actors placed hereThe BahamasThe Bahamas — no actors placed hereBhutanBhutan — no actors placed hereBotswanaBotswana — no actors placed hereBelarusBelarus — no actors placed hereBelize — 1 observed (below the 3 shading threshold)Belize — no actors placed hereCanada — 34 observedCanada — no actors placed hereDemocratic Republic of the CongoDemocratic Republic of the Congo — no actors placed hereCentral African RepublicCentral African Republic — no actors placed hereRepublic of the CongoRepublic of the Congo — no actors placed hereSwitzerland — 17 observedSwitzerland — no actors placed hereIvory Coast — 1 observed (below the 3 shading threshold)Ivory Coast — no actors placed hereChile — 9 observedChile — no actors placed hereCameroonCameroon — no actors placed herePeople's Republic of China — 10 observedPeople's Republic of China — no actors placed hereColombia — 5 observedColombia — no actors placed hereCosta Rica — 1 observed (below the 3 shading threshold)Costa Rica — no actors placed hereCubaCuba — no actors placed hereCyprus — 3 observedCyprus — no actors placed hereCzech Republic — 13 observedCzech Republic — no actors placed hereGermany — 62 observedGermany — no actors placed hereDjiboutiDjibouti — no actors placed hereDenmark — 3 observedDenmark — no actors placed hereDominican RepublicDominican Republic — no actors placed hereAlgeriaAlgeria — no actors placed hereEcuador — 1 observed (below the 3 shading threshold)Ecuador — no actors placed hereEstoniaEstonia — no actors placed hereEgypt — 2 observed (below the 3 shading threshold)Egypt — no actors placed hereWestern SaharaWestern Sahara — no actors placed hereEritreaEritrea — no actors placed hereSpain — 23 observedSpain — no actors placed hereEthiopiaEthiopia — no actors placed hereFinland — 7 observedFinland — no actors placed hereFijiFiji — no actors placed hereFalkland IslandsFalkland Islands — no actors placed hereFrance — 29 observedFrance — no actors placed hereGabon — 1 observed (below the 3 shading threshold)Gabon — no actors placed hereUnited Kingdom — 55 observedUnited Kingdom — no actors placed hereGeorgiaGeorgia — no actors placed hereGhana — 1 observed (below the 3 shading threshold)Ghana — no actors placed hereGreenlandGreenland — no actors placed hereThe GambiaThe Gambia — no actors placed hereGuineaGuinea — no actors placed hereEquatorial GuineaEquatorial Guinea — no actors placed hereGreece — 2 observed (below the 3 shading threshold)Greece — no actors placed hereGuatemalaGuatemala — no actors placed hereGuinea-BissauGuinea-Bissau — no actors placed hereGuyanaGuyana — no actors placed hereHonduras — 1 observed (below the 3 shading threshold)Honduras — no actors placed hereCroatia — 1 observed (below the 3 shading threshold)Croatia — no actors placed hereHaiti — 1 observed (below the 3 shading threshold)Haiti — no actors placed hereHungary — 6 observedHungary — no actors placed hereIndonesia — 13 observedIndonesia — no actors placed hereIreland — 4 observedIreland — no actors placed hereIsrael — 7 observedIsrael — no actors placed hereIndia — 28 observedIndia — no actors placed hereIraq — 1 observed (below the 3 shading threshold)Iraq — no actors placed hereIran — 1 observed (below the 3 shading threshold)Iran — no actors placed hereIceland — 1 observed (below the 3 shading threshold)Iceland — no actors placed hereItaly — 49 observedItaly — no actors placed hereJamaica — 1 observed (below the 3 shading threshold)Jamaica — no actors placed hereJordan — 1 observed (below the 3 shading threshold)Jordan — no actors placed hereJapan — 17 observedJapan — no actors placed hereKenya — 1 observed (below the 3 shading threshold)Kenya — no actors placed hereKyrgyzstanKyrgyzstan — no actors placed hereCambodiaCambodia — no actors placed hereNorth KoreaNorth Korea — no actors placed hereSouth Korea — 7 observedSouth Korea — no actors placed hereKuwaitKuwait — no actors placed hereKazakhstan — 1 observed (below the 3 shading threshold)Kazakhstan — no actors placed hereLaos — 1 observed (below the 3 shading threshold)Laos — no actors placed hereLebanonLebanon — no actors placed hereSri LankaSri Lanka — no actors placed hereLiberiaLiberia — no actors placed hereLesothoLesotho — no actors placed hereLithuania — 2 observed (below the 3 shading threshold)Lithuania — no actors placed hereLuxembourgLuxembourg — no actors placed hereLatvia — 2 observed (below the 3 shading threshold)Latvia — no actors placed hereLibyaLibya — no actors placed hereMorocco — 2 observed (below the 3 shading threshold)Morocco — no actors placed hereMoldova — 1 observed (below the 3 shading threshold)Moldova — no actors placed hereMontenegroMontenegro — no actors placed hereMadagascarMadagascar — no actors placed hereNorth Macedonia — 1 observed (below the 3 shading threshold)North Macedonia — no actors placed hereMaliMali — no actors placed hereMyanmar — 3 observedMyanmar — no actors placed hereMongoliaMongolia — no actors placed hereMauritaniaMauritania — no actors placed hereMalawiMalawi — no actors placed hereMexico — 25 observedMexico — no actors placed hereMalaysia — 8 observedMalaysia — no actors placed hereMozambiqueMozambique — no actors placed hereNamibiaNamibia — no actors placed hereNew CaledoniaNew Caledonia — no actors placed hereNigerNiger — no actors placed hereNigeria — 5 observedNigeria — no actors placed hereNicaraguaNicaragua — no actors placed hereNetherlands — 11 observedNetherlands — no actors placed hereNorway — 2 observed (below the 3 shading threshold)Norway — no actors placed hereNepalNepal — no actors placed hereNew Zealand — 3 observedNew Zealand — no actors placed hereOmanOman — no actors placed herePanamaPanama — no actors placed herePeru — 9 observedPeru — no actors placed herePapua New Guinea — 1 observed (below the 3 shading threshold)Papua New Guinea — no actors placed herePhilippines — 12 observedPhilippines — no actors placed herePakistan — 2 observed (below the 3 shading threshold)Pakistan — no actors placed herePoland — 16 observedPoland — no actors placed herePuerto RicoPuerto Rico — no actors placed herePalestinePalestine — no actors placed herePortugal — 8 observedPortugal — no actors placed hereParaguayParaguay — no actors placed hereQatarQatar — no actors placed hereRomania — 3 observedRomania — no actors placed hereSerbiaSerbia — no actors placed hereRussia — 3 observedRussia — no actors placed hereRwandaRwanda — no actors placed hereSaudi Arabia — 6 observedSaudi Arabia — no actors placed hereSolomon IslandsSolomon Islands — no actors placed hereSudanSudan — no actors placed hereSweden — 12 observedSweden — no actors placed hereSloveniaSlovenia — no actors placed hereSlovakia — 1 observed (below the 3 shading threshold)Slovakia — no actors placed hereSierra LeoneSierra Leone — no actors placed hereSenegalSenegal — no actors placed hereSomaliaSomalia — no actors placed hereSurinameSuriname — no actors placed hereSouth SudanSouth Sudan — no actors placed hereEl SalvadorEl Salvador — no actors placed hereSyriaSyria — no actors placed hereEswatiniEswatini — no actors placed hereChadChad — no actors placed hereFrench Southern and Antarctic LandsFrench Southern and Antarctic Lands — no actors placed hereTogoTogo — no actors placed hereThailand — 10 observedThailand — no actors placed hereTajikistanTajikistan — no actors placed hereEast TimorEast Timor — no actors placed hereTurkmenistanTurkmenistan — no actors placed hereTunisiaTunisia — no actors placed hereTurkey — 18 observedTurkey — no actors placed hereTrinidad and Tobago — 1 observed (below the 3 shading threshold)Trinidad and Tobago — no actors placed hereTaiwan — 14 observedTaiwan — no actors placed hereTanzania — 1 observed (below the 3 shading threshold)Tanzania — no actors placed hereUkraineUkraine — no actors placed hereUgandaUganda — no actors placed hereUnited States of America — 463 observedUnited States of America — no actors placed hereUruguay — 2 observed (below the 3 shading threshold)Uruguay — no actors placed hereUzbekistanUzbekistan — no actors placed hereVenezuelaVenezuela — no actors placed hereVietnam — 6 observedVietnam — no actors placed hereVanuatuVanuatu — no actors placed hereKosovoKosovo — no actors placed hereYemen — 1 observed (below the 3 shading threshold)Yemen — no actors placed hereSouth Africa — 12 observedSouth Africa — no actors placed hereZambiaZambia — no actors placed hereZimbabweZimbabwe — no actors placed here 2010 — Operation Aurora against Google and 20+ US companies (CN → US)2010 — Stuxnet sabotage of Natanz uranium enrichment (US → IR) — no state has ever acknowledged this operation2011 — RSA SecurID seed compromise and the Lockheed Martin follow-on (CN → US)2013 — DarkSeoul wiper against South Korean banks and broadcasters (KP → KR)2014 — Las Vegas Sands destructive attack (Iran, DNI-attributed) (IR → US)2014 — Indictment of five PLA Unit 61398 officers (CN → US)2014 — Sony Pictures Entertainment hack (KP → US)2015 — Anthem health-insurance breach (CN → US)2015 — TV5Monde broadcast blackout (RU → FR)2015 — German Bundestag network compromise (RU → DE)2015 — US Office of Personnel Management breach (CN → US)2015 — Ukrainian power-grid attacks (Sandworm) (RU → UA)2016 — Bangladesh Bank SWIFT heist (KP → BD)2016 — GRU operation against the DNC and the 2016 US election (RU → US)2016 — Industroyer attack on the Kyiv transmission substation (RU → UA)2017 — WannaCry global ransomware outbreak (KP → GB)2017 — NotPetya destructive wiper (RU → UA)2017 — NotPetya destructive wiper (RU → DK)2017 — NotPetya destructive wiper (RU → US)2017 — NotPetya destructive wiper (RU → GB)2017 — NotPetya destructive wiper (RU → FR)2017 — Triton attack on a Saudi petrochemical safety system (RU → SA)2018 — Olympic Destroyer at the Pyeongchang Winter Olympics (RU → KR)2018 — Norwegian county governor offices and Visma intrusion (CN → NO)2018 — Marriott / Starwood guest reservation breach (CN → US)2020 — Burisma Holdings phishing campaign (RU → UA)2020 — Attempted manipulation of Israeli water treatment controls (IR → IL)2020 — Shahid Rajaee port traffic disruption (IL → IR) — no state has ever acknowledged this operation2020 — Norwegian Parliament (Storting) email compromise (RU → NO)2020 — SolarWinds Orion supply chain compromise (RU → US)2021 — Microsoft Exchange Server mass exploitation (HAFNIUM) (CN → US)2021 — Stortinget Microsoft Exchange Server compromise (CN → NO)2021 — Irish Health Service Executive ransomware shutdown (RU → IE)2021 — JBS meat processing ransomware shutdown (RU → US)2021 — JBS meat processing ransomware shutdown (RU → CA)2021 — JBS meat processing ransomware shutdown (RU → AU)2021 — Compromise of New Zealand's Parliamentary Service (CN → NZ)2021 — Iran national fuel distribution disruption (IL → IR) — no state has ever acknowledged this operation2021 — Campaign against Pakistan's Ministry of Defence (IN → PK)2022 — Viasat KA-SAT satellite modem wiper (AcidRain) (RU → UA)2022 — Viasat KA-SAT satellite modem wiper (AcidRain) (RU → DE)2022 — Ronin Bridge cryptocurrency theft (KP → VN)2022 — Costa Rica government ransomware and national emergency (RU → CR)2022 — Intrusion into Uzbekistan's state hydropower operator (KZ → UZ)2022 — Denial-of-service campaign against Estonian state and financial services (RU → EE)2022 — Denial-of-service against Norwegian state digital services (RU → NO)2022 — Destructive attacks on the Government of Albania (HomeLand Justice) (IR → AL)2022 — NSA TAO intrusion into Northwestern Polytechnical University (US → CN)2022 — Medibank Private health data theft and extortion (RU → AU)2023 — CNCERT report of US intelligence theft from a Chinese technology firm (US → CN)2023 — Coordinated intrusion into 22 Danish energy operators (RU → DK)2023 — Storm-0558 forged-token access to government email (CN → US)2023 — Anonymous Sudan denial-of-service campaign and US indictment (SD → US)2023 — Anonymous Sudan denial-of-service campaign and US indictment (SD → GB)2023 — CyberLink software supply chain compromise (KP → TW)2023 — LockBit ransomware against ICBC Financial Services (RU → CN)2023 — CyberAv3ngers against US water utility control systems (IR → US)2023 — Kyivstar telecom outage (Solntsepyok / Sandworm front) (RU → UA)2024 — Midnight Blizzard access to Microsoft corporate email (RU → US)2024 — Volt Typhoon US critical-infrastructure pre-positioning (CN → US)2024 — Ukrainian military intelligence operations against Russian state systems (UA → RU)2024 — Synnovis pathology ransomware and London hospital disruption (RU → GB)2024 — CNCERT report of US intelligence theft from a Chinese materials firm (US → CN)2024 — Salt Typhoon intrusion into US telecommunications carriers (CN → US)2025 — Risevatnet dam floodgate manipulation, Bremanger (RU → NO)2025 — Bank Sepah and Nobitex destruction during the Israel-Iran exchange (IL → IR) — no state has ever acknowledged this operation2025 — SharePoint ToolShell mass exploitation (CN → US)2026 — Salt Typhoon compromise of Norwegian network devices (CN → NO)Albania — 1 landmark event, 2022Australia — 2 landmark events, 2021–2022Bangladesh — 1 landmark event, 2016Canada — 1 landmark event, 2021Chile — 1 landmark event, 2018People's Republic of China — 4 landmark events, 2022–2024Costa Rica — 1 landmark event, 2022Germany — 3 landmark events, 2014–2022Denmark — 2 landmark events, 2017–2023Estonia — 1 landmark event, 2022France — 2 landmark events, 2015–2017United Kingdom — 7 landmark events, 2015–2025Georgia — 1 landmark event, 2008Ireland — 1 landmark event, 2021Israel — 2 landmark events, 2013–2020Iran — 4 landmark events, 2010–2025South Korea — 2 landmark events, 2013–2018Netherlands — 2 landmark events, 2020–2026Norway — 7 landmark events, 2018–2026New Zealand — 1 landmark event, 2021Pakistan — 1 landmark event, 2021Poland — 1 landmark event, 2023Serbia — 1 landmark event, 2024Russia — 1 landmark event, 2024Saudi Arabia — 2 landmark events, 2012–2017Thailand — 1 landmark event, 2021Taiwan — 1 landmark event, 2023Ukraine — 6 landmark events, 2015–2023United States of America — 34 landmark events, 2010–2025Uzbekistan — 1 landmark event, 2022Vietnam — 1 landmark event, 2022 Palestine — WIRTE: documented targeting of people inside this country (assessed evidence)Daggerfly reached its own nationals in India. The Tibetan exile community in India, reached through a watering-hole on a site serving the Monlam festival and through trojanised Tibetan-language translation software.People's Republic of China — Daggerfly: documented targeting of people inside this country (assessed evidence)Russia — APT28: documented targeting of people inside this country (attributed evidence)Magic Hound reached its own nationals in United Kingdom. Staff of Iran International, the London-based Persian-language broadcaster. Anchor Azadeh Shafiee was impersonated by the operators to reach the accounts of a relative and of a PraMagic Hound reached its own nationals in Czech Republic. A Prague-based Iranian filmmaker, approached through an impersonation of the Iran International anchor.Magic Hound reached its own nationals in Germany. An Iranian-born German academic, sent a fraudulent email impersonating Wall Street Journal correspondent Farnaz Fassihi and then asked to enter a Google password.Iran — Magic Hound: documented targeting of people inside this country (attributed evidence)APT32 reached its own nationals in Germany. Bui Thanh Hieu, a pro-democracy blogger exiled in Germany since 2013, targeted with spyware on four occasions between February 2018 and December 2019.Vietnam — APT32: documented targeting of people inside this country (forensic evidence)Palestine — Molerats: documented targeting of people inside this country (assessed evidence)United Arab Emirates — Stealth Falcon: documented targeting of people inside this country (forensic evidence)People's Republic of China — Axiom: documented targeting of people inside this country (assessed evidence)PROMETHIUM reached its own nationals in Belgium. Turkish citizens living in western Europe. Microsoft observed the operators spying on 'Turkish citizens living in Turkey and various other European countries'; the 2016 reporting oPROMETHIUM reached its own nationals in Italy. Turkish citizens living in western Europe, per the same Microsoft finding and the same 2016 victim geography.Turkey — PROMETHIUM: documented targeting of people inside this country (forensic evidence)Iran — Ferocious Kitten: documented targeting of people inside this country (assessed evidence)NEODYMIUM reached its own nationals in Belgium. Turkish citizens living in western Europe. Microsoft observed the operators spying on 'Turkish citizens living in Turkey and various other European countries'; the 2016 reporting oNEODYMIUM reached its own nationals in Italy. Turkish citizens living in western Europe, per the same Microsoft finding and the same 2016 victim geography.Turkey — NEODYMIUM: documented targeting of people inside this country (forensic evidence)Palestine — APT-C-23: documented targeting of people inside this country (assessed evidence)
Observed: last 90 days · Landmark: 2008–2026 3–56–78–1112–2223+
Domestic surveillance

Victims observed in our sources, not all attacks everywhere. Under 3 observed victims a country is listed on the shelf rather than shaded. Low counts mean "not yet seen here".

Explore the interactive map on security-resilience.ai →