Threat actors

Every MITRE ATT&CK intrusion set, projected deterministically into a cited card — tradecraft heatmap, named arsenal, attributed campaigns, and a coarse editorial threat tier (our classification, not MITRE’s). Public-record-derived only: the projection reads only ATT&CK data, never engagement or pentest data. Every claim on every card links to its source.

Threat tier is our rule-based editorial call over ATT&CK intrusion-set type + description prose — labeled as such on every card, never presented as a MITRE field. Origin/sponsor is asserted only where a real government advisory backs it; otherwise it is a stated coverage gap.