groups.js

export const GROUP_TYPES = [
  'ransomware',
  'banking-theft',
  'carding',
  'financial-fraud',
  'bec-fraud',
  'crypto-crime',
  'cybercrime',
  'darknet-market',
  'state-linked-theft',
  'white-hat',
  'hacktivist',
  'hybrid',
  'access-brokerage',
];

export const TYPE_META = {
  ransomware: {
    label: 'Ransomware',
    color: '#ff4d73',
    bg: 'rgba(255, 77, 115, 0.14)',
    border: 'rgba(255, 77, 115, 0.28)',
  },
  'banking-theft': {
    label: 'Banking Theft',
    color: '#ff9d42',
    bg: 'rgba(255, 157, 66, 0.14)',
    border: 'rgba(255, 157, 66, 0.28)',
  },
  carding: {
    label: 'Carding',
    color: '#f5c842',
    bg: 'rgba(245, 200, 66, 0.14)',
    border: 'rgba(245, 200, 66, 0.28)',
  },
  'financial-fraud': {
    label: 'Financial Fraud',
    color: '#ff7b4a',
    bg: 'rgba(255, 123, 74, 0.14)',
    border: 'rgba(255, 123, 74, 0.28)',
  },
  'bec-fraud': {
    label: 'BEC / Fraud',
    color: '#ffd166',
    bg: 'rgba(255, 209, 102, 0.14)',
    border: 'rgba(255, 209, 102, 0.28)',
  },
  'crypto-crime': {
    label: 'Crypto Crime',
    color: '#c4a8ff',
    bg: 'rgba(196, 168, 255, 0.14)',
    border: 'rgba(196, 168, 255, 0.28)',
  },
  cybercrime: {
    label: 'Cybercrime',
    color: '#38c9e0',
    bg: 'rgba(56, 201, 224, 0.14)',
    border: 'rgba(56, 201, 224, 0.28)',
  },
  'darknet-market': {
    label: 'Darknet Market',
    color: '#b9ff66',
    bg: 'rgba(185, 255, 102, 0.14)',
    border: 'rgba(185, 255, 102, 0.28)',
  },
  'state-linked-theft': {
    label: 'State-linked Theft',
    color: '#8e8bff',
    bg: 'rgba(142, 139, 255, 0.14)',
    border: 'rgba(142, 139, 255, 0.28)',
  },
  'white-hat': {
    label: 'White Hat',
    color: '#49c8ff',
    bg: 'rgba(73, 200, 255, 0.14)',
    border: 'rgba(73, 200, 255, 0.28)',
  },
  hacktivist: {
    label: 'Hacktivist',
    color: '#5fe08f',
    bg: 'rgba(95, 224, 143, 0.14)',
    border: 'rgba(95, 224, 143, 0.28)',
  },
  hybrid: {
    label: 'Hybrid',
    color: '#ff6f91',
    bg: 'rgba(255, 111, 145, 0.14)',
    border: 'rgba(255, 111, 145, 0.28)',
  },
  'access-brokerage': {
    label: 'Access Brokerage',
    color: '#72a8ff',
    bg: 'rgba(114, 168, 255, 0.14)',
    border: 'rgba(114, 168, 255, 0.28)',
  },
};

export const ORIGIN_METHOD_NOTE =
  'Origins reflect public attribution for malicious actors and official organization origin for defensive groups. When reporting is only country-level, the pin is anchored to the national capital for map readability.';

export const GROUPS = [
  {
    id: 'andariel',
    name: 'Andariel',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Silent Chollima', 'PLUTONIUM', 'Onyx Sleet'],
    tags: ['bank theft', 'crypto theft', 'subgroup'],
    knownFor: 'Conducting destructive and espionage-linked intrusions while also carrying out financially motivated attacks against ATMs, banks, and cryptocurrency organizations.',
    attribution: 'MITRE ATT&CK tracks Andariel as a North Korean state-sponsored subgroup of Lazarus that has also conducted cyber financial operations.',
    sourceLabel: 'MITRE ATT&CK, updated Sep 2024',
  },
  {
    id: 'anonymous',
    name: 'Anonymous',
    type: 'hacktivist',
    country: 'No fixed origin',
    city: 'Decentralized',
    lat: null,
    lng: null,
    originPrecision: 'No fixed origin / decentralized collective',
    firstSeen: 2003,
    scope: 'Global',
    aliases: ['Anons'],
    tags: ['decentralized', 'hacktivism', 'leaderless collective'],
    knownFor: 'Coordinating high-profile hacktivist actions, website disruptions, leaks, and symbolic cyber campaigns against governments, companies, and institutions around the world.',
    attribution: 'Public reporting consistently describes Anonymous as a decentralized international hacktivist collective with no fixed hierarchy or stable geographic origin.',
    sourceLabel: 'Harvard Cybersecurity Wiki / Britannica',
  },
  {
    id: 'antisec',
    name: 'AntiSec',
    type: 'hacktivist',
    country: 'No fixed origin',
    city: 'Decentralized',
    lat: null,
    lng: null,
    originPrecision: 'No fixed origin / decentralized collective',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Operation AntiSec'],
    tags: ['decentralized', 'hacktivism', 'movement'],
    knownFor: 'Coordinating anti-security and anti-surveillance themed hacking campaigns, leaks, and defacements under a broader Anonymous- and LulzSec-linked banner.',
    attribution: 'Public reporting and the movement’s own statements describe AntiSec as a loose collaborative operation associated with Anonymous and LulzSec rather than a single geographically rooted organization.',
    sourceLabel: 'Wired / public reporting',
  },
  {
    id: 'applejeus',
    name: 'AppleJeus',
    type: 'crypto-crime',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['trojanized apps', 'crypto theft', 'fake trading software'],
    knownFor: 'Posing as legitimate cryptocurrency tools and trading platforms to infect victims and facilitate theft tied to North Korean cyber operations.',
    attribution: 'CISA, FBI, and Treasury describe AppleJeus as North Korean malicious cyber activity used to facilitate cryptocurrency theft; the atlas maps that activity to North Korea at country level.',
    sourceLabel: 'CISA / FBI / Treasury, Feb 2021',
  },
  {
    id: 'apt-c-36',
    name: 'APT-C-36',
    type: 'state-linked-theft',
    country: 'Colombia',
    city: 'Bogota',
    lat: 4.711,
    lng: -74.0721,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Regional',
    aliases: ['Blind Eagle'],
    tags: ['South America', 'espionage', 'phishing'],
    knownFor: 'Running espionage-oriented campaigns that primarily target Colombian government institutions and key private-sector organizations in finance, energy, and manufacturing.',
    attribution: 'MITRE ATT&CK tracks APT-C-36 as a suspected South America espionage group focused mainly on Colombian institutions; the atlas uses Colombia as the clearest regional origin inference and pins to Bogota.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'apt28',
    name: 'APT28',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2004,
    scope: 'Global',
    aliases: ['Fancy Bear', 'Sofacy', 'Forest Blizzard', 'STRONTIUM'],
    tags: ['GRU-linked', 'espionage', 'influence ops'],
    knownFor: 'Running one of the most recognizable Russian military cyber programs, including espionage, credential theft, and influence-linked intrusion activity.',
    attribution: 'MITRE ATT&CK tracks APT28 as a Russian state-sponsored group commonly linked to the GRU; the map uses a country-level Russia attribution pinned to Moscow.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'apt29',
    name: 'APT29',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2008,
    scope: 'Global',
    aliases: ['Cozy Bear', 'Midnight Blizzard', 'The Dukes'],
    tags: ['espionage', 'supply chain'],
    knownFor: 'Conducting long-running espionage campaigns against governments, diplomatic targets, and major enterprises, including some of the most widely reported supply-chain intrusions.',
    attribution: 'MITRE ATT&CK identifies APT29 as a Russian state-sponsored espionage group; the map uses Russia at country level and pins to Moscow for readability.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'apt38',
    name: 'APT38',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['Bluenoroff', 'BeagleBoyz', 'Sapphire Sleet'],
    tags: ['bank heists', 'SWIFT theft'],
    knownFor: 'Specializing in financial cyber operations against banks, casinos, exchanges, and ATM/SWIFT infrastructure worldwide.',
    attribution: 'MITRE ATT&CK attributes APT38 to North Korea and describes it as a group focused on financial theft.',
    sourceLabel: 'MITRE ATT&CK, updated Jan 2025',
  },
  {
    id: 'apt41',
    name: 'APT41',
    type: 'hybrid',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Wicked Panda', 'Brass Typhoon', 'BARIUM'],
    tags: ['espionage + profit', 'supply chain'],
    knownFor: 'Mixing state-sponsored espionage with financially motivated intrusions, including targeting software supply chains and commercial sectors.',
    attribution: 'MITRE ATT&CK assesses APT41 as a Chinese state-sponsored group that also conducts financially motivated operations.',
    sourceLabel: 'MITRE ATT&CK, updated Jun 2025',
  },
  {
    id: 'bianlian',
    name: 'BianLian',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['data extortion', 'healthcare targeting'],
    knownFor: 'Running ransomware and later primarily data-extortion campaigns against organizations across critical infrastructure and professional services sectors.',
    attribution: 'CISA, FBI, and partner agencies assess BianLian is likely based in Russia and operates with Russia-based affiliates.',
    sourceLabel: 'CISA / FBI / ACSC, Nov 2024',
  },
  {
    id: 'blackbyte',
    name: 'BlackByte',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['Hecamede'],
    tags: ['RaaS', 'critical infrastructure targeting'],
    knownFor: 'Operating a ransomware program that gained attention for attacks on critical infrastructure and for quickly iterating its malware after public decryptors appeared.',
    attribution: 'MITRE ATT&CK tracks BlackByte as a prominent ransomware actor; public reporting frequently treats the operation as Russian-speaking or Russia-linked, and the atlas reflects that as a country-level inference rather than a settled legal finding.',
    sourceLabel: 'MITRE ATT&CK / public reporting',
  },
  {
    id: 'business-club',
    name: 'Business Club',
    type: 'financial-fraud',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: ['GameOver Zeus', 'GOLD EVERGREEN'],
    tags: ['bank fraud', 'botnet operations', 'wire theft'],
    knownFor: 'Stealing banking credentials at massive scale through Zeus variants and using infected systems to enable large international wire-fraud operations.',
    attribution: 'DOJ and FBI reporting tied GameOver Zeus to Evgeniy Bogachev and a gang of cyber criminals based in Russia and Ukraine; this atlas uses Russia as the primary country-level origin for a simplified map pin.',
    sourceLabel: 'DOJ / FBI, 2014-2015',
  },
  {
    id: 'cert-cc',
    name: 'CERT Coordination Center',
    type: 'white-hat',
    country: 'United States',
    city: 'Pittsburgh',
    lat: 40.4406,
    lng: -79.9959,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 1988,
    scope: 'Global',
    aliases: ['CERT/CC'],
    tags: ['incident coordination', 'vulnerability disclosure'],
    knownFor: 'Coordinating vulnerability disclosure, publishing security research, and developing methods and tools that improve software and network resilience.',
    attribution: 'The CERT/CC identifies itself as part of Carnegie Mellon\'s Software Engineering Institute, and its public organization materials locate it in Pittsburgh, Pennsylvania.',
    sourceLabel: 'CERT/CC / SEI',
  },
  {
    id: 'cert-br',
    name: 'CERT.br',
    type: 'white-hat',
    country: 'Brazil',
    city: 'Sao Paulo',
    lat: -23.5558,
    lng: -46.6396,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 1997,
    scope: 'Regional',
    aliases: [],
    tags: ['national CSIRT', 'incident coordination', 'Brazil'],
    knownFor: 'Coordinating national incident response in Brazil while publishing statistics, running sensor projects, and supporting community knowledge transfer.',
    attribution: 'CERT.br describes itself as Brazil\'s national CSIRT of last resort maintained by NIC.br; the atlas uses Sao Paulo as the organization origin point.',
    sourceLabel: 'CERT.br official site',
  },
  {
    id: 'cisa',
    name: 'CISA',
    type: 'white-hat',
    country: 'United States',
    city: 'Washington, DC',
    lat: 38.9072,
    lng: -77.0369,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'National',
    aliases: ['Cybersecurity and Infrastructure Security Agency'],
    tags: ['critical infrastructure', 'advisories'],
    knownFor: 'Publishing joint advisories, incident guidance, and defensive resources for critical infrastructure owners, governments, and private-sector defenders.',
    attribution: 'CISA is the U.S. Cybersecurity and Infrastructure Security Agency; the pin uses the agency\'s official Washington, DC main address for map readability.',
    sourceLabel: 'CISA / USAGov',
  },
  {
    id: 'cisco-talos',
    name: 'Cisco Talos',
    type: 'white-hat',
    country: 'United States',
    city: 'San Jose',
    lat: 37.3382,
    lng: -121.8863,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['threat intelligence', 'incident response', 'malware research'],
    knownFor: 'Providing some of the most widely cited public malware analysis, incident response research, and defensive threat intelligence in the industry.',
    attribution: 'Cisco describes Talos as its threat intelligence team; the pin uses Cisco\'s official San Jose headquarters as the organization origin.',
    sourceLabel: 'Cisco official site',
  },
  {
    id: 'cosmic-lynx',
    name: 'Cosmic Lynx',
    type: 'financial-fraud',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['BEC', 'invoice fraud', 'M&A pretexting'],
    knownFor: 'Running high-value business email compromise schemes that impersonate executives and outside counsel to trigger fraudulent payments.',
    attribution: 'Agari\'s threat dossier describes Cosmic Lynx as a Russia-based BEC cybercriminal organization targeting large multinational companies.',
    sourceLabel: 'Agari / Fortra, Jul 2020',
  },
  {
    id: 'crowdstrike-intelligence',
    name: 'CrowdStrike Intelligence',
    type: 'white-hat',
    country: 'United States',
    city: 'Austin',
    lat: 30.2672,
    lng: -97.7431,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['Falcon Adversary Intelligence'],
    tags: ['adversary profiles', 'threat intelligence', 'research'],
    knownFor: 'Maintaining one of the most visible public actor-naming and adversary-profiling systems used across the security industry.',
    attribution: 'CrowdStrike markets Falcon Adversary Intelligence as part of its threat intelligence platform, and recent official releases identify Austin, Texas as the company headquarters location used here.',
    sourceLabel: 'CrowdStrike official site',
  },
  {
    id: 'cyberav3ngers',
    name: 'CyberAv3ngers',
    type: 'hacktivist',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['Soldiers of Solomon'],
    tags: ['PLC defacement', 'IRGC-linked'],
    knownFor: 'Claiming and conducting disruptive operations against industrial control environments, especially Unitronics PLC and HMI targets.',
    attribution: 'MITRE ATT&CK tracks CyberAv3ngers as a suspected Iranian IRGC-affiliated group active in politically motivated disruption campaigns.',
    sourceLabel: 'MITRE ATT&CK / CISA',
  },
  {
    id: 'danabot',
    name: 'DanaBot Organization',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Novosibirsk',
    lat: 55.0084,
    lng: 82.9357,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['DanaBot operators'],
    tags: ['banking trojan', 'fraud infrastructure'],
    knownFor: 'Operating malware that infected hundreds of thousands of machines and enabled fraud, credential theft, and ransomware delivery.',
    attribution: 'The 2025 U.S. indictment describes DanaBot as controlled by a Russia-based cybercrime organization and names operators from Novosibirsk.',
    sourceLabel: 'DOJ, May 2025',
  },
  {
    id: 'eset-research',
    name: 'ESET Research',
    type: 'white-hat',
    country: 'Slovakia',
    city: 'Bratislava',
    lat: 48.1486,
    lng: 17.1077,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['malware research', 'disruption support', 'threat intelligence'],
    knownFor: 'Publishing influential technical research and frequently participating in multinational disruption efforts against malware and financial crime operations.',
    attribution: 'ESET identifies Bratislava as its headquarters, and the atlas uses that location for ESET Research as the company’s research organization origin.',
    sourceLabel: 'ESET official site',
  },
  {
    id: 'evil-corp',
    name: 'Evil Corp',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Indrik Spider', 'Manatee Tempest', 'DEV-0243', 'UNC2165', 'Dridex crew'],
    tags: ['Dridex', 'BitPaymer', 'WastedLocker'],
    knownFor: 'Large-scale credential theft, bank fraud, and later ransomware and extortion activity tied to the Dridex, BitPaymer, WastedLocker, and Hades ecosystems.',
    attribution: 'U.S. Treasury and MITRE ATT&CK reporting describe Evil Corp, also tracked as Indrik Spider, as a Russia-based cybercriminal organization operating from Moscow and evolving from banking malware into major ransomware operations.',
    sourceLabel: 'U.S. Treasury / MITRE ATT&CK',
  },
  {
    id: 'fin5',
    name: 'FIN5',
    type: 'carding',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2008,
    scope: 'Global',
    aliases: [],
    tags: ['card theft', 'PII theft', 'hospitality targeting'],
    knownFor: 'Stealing payment card and personal data from hospitality, gaming, and retail-adjacent targets as part of a long-running financially motivated intrusion program.',
    attribution: 'MITRE ATT&CK describes FIN5 as a financially motivated group whose operators likely speak Russian; the atlas represents that recurring public attribution trend with a country-level Russia pin.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'fin6',
    name: 'FIN6',
    type: 'carding',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Skeleton Spider', 'Magecart Group 6', 'Camouflage Tempest'],
    tags: ['POS theft', 'carding', 'retail targeting'],
    knownFor: 'Specializing in payment-card theft and monetization, especially through PoS compromises and follow-on underground sales of stolen data.',
    attribution: 'MITRE ATT&CK tracks FIN6 as a major cybercrime group; open reporting often places its ecosystem in the Russian-speaking cybercrime scene, which this atlas reflects as a cautious country-level Russia inference.',
    sourceLabel: 'MITRE ATT&CK / public reporting',
  },
  {
    id: 'fin7',
    name: 'FIN7',
    type: 'carding',
    country: 'Ukraine',
    city: 'Kyiv',
    lat: 50.4501,
    lng: 30.5234,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['Carbon Spider', 'GOLD NIAGARA', 'Carbanak-linked'],
    tags: ['POS intrusions', 'front company'],
    knownFor: 'Stealing payment-card data from retail and hospitality targets before expanding into big-game hunting ransomware operations.',
    attribution: 'MITRE tracks FIN7 as financially motivated and says part of the group operated through the Combi Security front company; DOJ cases charged multiple Ukrainian nationals.',
    sourceLabel: 'MITRE ATT&CK / DOJ',
  },
  {
    id: 'gamaredon-group',
    name: 'Gamaredon Group',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Regional',
    aliases: ['Shuckworm', 'Primitive Bear', 'Armageddon', 'ACTINIUM', 'DEV-0157', 'Aqua Blizzard'],
    tags: ['Eastern Europe', 'espionage', 'Ukraine targeting'],
    knownFor: 'Conducting high-volume, persistent espionage operations against military, law enforcement, and civil-society targets in Ukraine through fast-iterating malware and lures.',
    attribution: 'MITRE ATT&CK and public Ukrainian government attribution describe Gamaredon Group as a suspected Russian espionage actor later publicly tied to the FSB.',
    sourceLabel: 'MITRE ATT&CK, updated Oct 2025',
  },
  {
    id: 'gold-barondale',
    name: 'GOLD BARONDALE',
    type: 'access-brokerage',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['opportunistic exploitation', 'initial access'],
    knownFor: 'Compromising internet-facing systems at scale and monetizing intrusions after opportunistic scanning and exploitation.',
    attribution: 'Secureworks assesses with moderate confidence that GOLD BARONDALE is based in China.',
    sourceLabel: 'Secureworks CTU',
  },
  {
    id: 'gold-galleon',
    name: 'GOLD GALLEON',
    type: 'bec-fraud',
    country: 'Nigeria',
    city: 'Abuja',
    lat: 9.0765,
    lng: 7.3986,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['maritime BEC', 'credential theft'],
    knownFor: 'Running BEC schemes against shipping and maritime organizations, often intercepting invoices and payment instructions.',
    attribution: 'Secureworks assesses with high confidence that GOLD GALLEON is based in Nigeria.',
    sourceLabel: 'Secureworks CTU, Apr 2018 / profile',
  },
  {
    id: 'gold-parakeet',
    name: 'GOLD PARAKEET',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: ['NetWalker operators'],
    tags: ['NetWalker', 'RaaS', 'double extortion'],
    knownFor: 'Operating the NetWalker ransomware program and evolving it into a ransomware-as-a-service model with large-scale data-theft extortion.',
    attribution: 'Secureworks attributes GOLD PARAKEET to Russian cyber threat actors with moderate confidence; the atlas keeps that wording cautious and uses a country-level Russia pin.',
    sourceLabel: 'Secureworks CTU',
  },
  {
    id: 'gold-skyline',
    name: 'GOLD SKYLINE',
    type: 'bec-fraud',
    country: 'Nigeria',
    city: 'Abuja',
    lat: 9.0765,
    lng: 7.3986,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: ['Wire-Wire Group 1'],
    tags: ['BEC', 'wire fraud'],
    knownFor: 'Stealing high-value wire transfers through business email compromise, spoofing, and social engineering.',
    attribution: 'Secureworks describes GOLD SKYLINE as a financially motivated group operating from Nigeria.',
    sourceLabel: 'Secureworks CTU',
  },
  {
    id: 'gold-symphony',
    name: 'GOLD SYMPHONY',
    type: 'access-brokerage',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['Buer Loader', 'malware-as-a-service'],
    knownFor: 'Developing and selling the Buer Loader malware-as-a-service ecosystem used to deliver follow-on payloads for financially motivated intrusions.',
    attribution: 'Secureworks assesses with high confidence that GOLD SYMPHONY is likely based in Russia, which this atlas represents with a country-level Moscow pin.',
    sourceLabel: 'Secureworks CTU',
  },
  {
    id: 'gold-waterfall',
    name: 'GOLD WATERFALL',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['DarkSide operators', 'BlackMatter operators'],
    tags: ['RaaS', 'double extortion', 'Russian-language'],
    knownFor: 'Creating and operating the DarkSide and BlackMatter ransomware families, including high-profile extortion campaigns against critical enterprises.',
    attribution: 'Secureworks says GOLD WATERFALL advertises in Russian, requires affiliates to speak Russian, and excludes Russia and nearby allies from targeting; the atlas maps that activity to Russia at country level.',
    sourceLabel: 'Secureworks CTU',
  },
  {
    id: 'google-threat-intelligence',
    name: 'Google Threat Intelligence',
    type: 'white-hat',
    country: 'United States',
    city: 'Mountain View',
    lat: 37.3861,
    lng: -122.0839,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['threat intelligence', 'zero-days', 'research'],
    knownFor: 'Publishing prominent frontline reporting on state and criminal actors, zero-day exploitation trends, and threat activity affecting global enterprises and governments.',
    attribution: 'Google Cloud currently markets this work under the Google Threat Intelligence brand, with GTIG research and Mandiant intelligence offerings presented inside that umbrella; the pin uses Google\'s official Mountain View headquarters as the organization origin.',
    sourceLabel: 'Google Cloud',
  },
  {
    id: 'gorgon-group',
    name: 'Gorgon Group',
    type: 'hybrid',
    country: 'Pakistan',
    city: 'Islamabad',
    lat: 33.6844,
    lng: 73.0479,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Regional',
    aliases: [],
    tags: ['criminal + targeted', 'phishing'],
    knownFor: 'Running mixed campaigns that blend financially motivated intrusions with more targeted operations against government and business victims.',
    attribution: 'MITRE ATT&CK assesses the group as Pakistan-based or otherwise connected to Pakistan.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'grandoreiro',
    name: 'Grandoreiro',
    type: 'banking-theft',
    country: 'Brazil',
    city: 'Brasilia',
    lat: -15.7939,
    lng: -47.8828,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Regional',
    aliases: ['Grandoreiro operation'],
    tags: ['banking trojan', 'phishing'],
    knownFor: 'Targeting banks in Latin America and Europe with malware that supports manual fraud, screen blocking, and operator-driven theft.',
    attribution: 'ESET and Brazil’s Federal Police publicly tied the operation to Brazilian operators during the 2024 disruption effort.',
    sourceLabel: 'ESET / Brazil Federal Police',
  },
  {
    id: 'guildma',
    name: 'Guildma',
    type: 'banking-theft',
    country: 'Brazil',
    city: 'Brasilia',
    lat: -15.7939,
    lng: -47.8828,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: ['Astaroth-linked family'],
    tags: ['banking trojan', 'credential theft'],
    knownFor: 'Stealing banking and account credentials at high volume in Brazil and across Latin America through email-delivered malware.',
    attribution: 'ESET identifies Guildma as one of the most impactful Latin American banking trojans and reports concentrated activity against Brazil.',
    sourceLabel: 'ESET, Mar 2020',
  },
  {
    id: 'huntress',
    name: 'Huntress',
    type: 'white-hat',
    country: 'United States',
    city: 'Columbia',
    lat: 39.2037,
    lng: -76.861,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['managed detection', 'threat hunting', 'community reporting'],
    knownFor: 'Combining managed detection with rapid public writeups and incident guidance aimed especially at organizations without large internal security teams.',
    attribution: 'Huntress official releases identify the company with Columbia, Maryland, which this atlas uses as the organization origin point.',
    sourceLabel: 'Huntress official site',
  },
  {
    id: 'hydra-market',
    name: 'Hydra Market',
    type: 'darknet-market',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: ['Hydra'],
    tags: ['darknet marketplace', 'criminal services'],
    knownFor: 'Serving Russian-speaking criminal users with illicit goods, stolen data, money-laundering services, and hacking tools.',
    attribution: 'The DOJ described Hydra as the largest darknet market at the time of its 2022 seizure and linked it to a Russian resident.',
    sourceLabel: 'DOJ, Apr 2022',
  },
  {
    id: 'insikt-group',
    name: 'Insikt Group',
    type: 'white-hat',
    country: 'United States',
    city: 'Somerville',
    lat: 42.3876,
    lng: -71.0995,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['threat research', 'OSINT', 'intelligence reports'],
    knownFor: 'Producing widely cited intelligence on cybercriminal ecosystems, state activity, vulnerabilities, and geopolitical risk through Recorded Future.',
    attribution: 'Recorded Future describes Insikt Group as its premier intelligence team and lists a Somerville, Massachusetts office on its official contact page.',
    sourceLabel: 'Recorded Future',
  },
  {
    id: 'jpcert-cc',
    name: 'JPCERT/CC',
    type: 'white-hat',
    country: 'Japan',
    city: 'Tokyo',
    lat: 35.6762,
    lng: 139.6503,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 1996,
    scope: 'Regional',
    aliases: [],
    tags: ['CSIRT', 'coordination', 'Asia Pacific'],
    knownFor: 'Serving as Japan\'s long-running incident coordination center and playing a central role in regional CSIRT collaboration, vulnerability handling, and threat analysis.',
    attribution: 'JPCERT/CC identifies itself as Japan\'s first CSIRT and lists its office address in Tokyo, which the atlas uses as its organization origin.',
    sourceLabel: 'JPCERT/CC official site',
  },
  {
    id: 'lapsus',
    name: 'LAPSUS$',
    type: 'hybrid',
    country: 'Brazil',
    city: 'Brasilia',
    lat: -15.7939,
    lng: -47.8828,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['DEV-0537', 'Strawberry Tempest'],
    tags: ['extortion', 'social engineering', 'data theft'],
    knownFor: 'Using aggressive social engineering, insider recruitment, SIM swapping, and public leak tactics to hit globally recognized technology and telecom targets.',
    attribution: 'Public reporting and arrests have linked prominent LAPSUS$ members to Brazil and the UK; this atlas uses Brazil as the strongest country-level origin inference and pins to Brasilia for consistency.',
    sourceLabel: 'MITRE ATT&CK / public reporting',
  },
  {
    id: 'lazarus-group',
    name: 'Lazarus Group',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['HIDDEN COBRA', 'Diamond Sleet', 'ZINC'],
    tags: ['crypto theft', 'state-backed'],
    knownFor: 'Conducting destructive attacks, espionage, and high-value cryptocurrency theft campaigns attributed to North Korea.',
    attribution: 'MITRE ATT&CK tracks Lazarus as a North Korean state-sponsored group tied to the Reconnaissance General Bureau.',
    sourceLabel: 'MITRE ATT&CK',
  },
  {
    id: 'lockbit',
    name: 'LockBit',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: ['LockBitSupp', 'GOLD MYSTIC'],
    tags: ['RaaS', 'double extortion'],
    knownFor: 'Operating one of the most prolific ransomware-as-a-service programs on record, with thousands of victims across more than 100 countries.',
    attribution: 'U.S. prosecutors identified Russian national Dmitry Khoroshev as LockBit’s alleged developer and administrator in 2024.',
    sourceLabel: 'DOJ, May 2024',
  },
  {
    id: 'lulzsec',
    name: 'LulzSec',
    type: 'hacktivist',
    country: 'No fixed origin',
    city: 'Decentralized',
    lat: null,
    lng: null,
    originPrecision: 'No fixed origin / decentralized collective',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Lulz Security'],
    tags: ['decentralized', 'hacktivism', 'splinter collective'],
    knownFor: 'Carrying out a fast, high-profile run of disruptive hacks, leaks, and humiliating breaches against media, gaming, government, and security targets during 2011.',
    attribution: 'Public reporting describes LulzSec as a short-lived hacking collective and an offshoot of the broader Anonymous ecosystem, with members in multiple countries rather than a stable shared origin.',
    sourceLabel: 'Wired / public reporting',
  },
  {
    id: 'machete',
    name: 'Machete',
    type: 'state-linked-theft',
    country: 'Venezuela',
    city: 'Caracas',
    lat: 10.4806,
    lng: -66.9036,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Regional',
    aliases: ['APT-C-43', 'El Machete'],
    tags: ['Latin America', 'espionage', 'government targeting'],
    knownFor: 'Conducting sustained Spanish-language espionage against governments, military organizations, and telecom and power-sector targets across Latin America.',
    attribution: 'MITRE ATT&CK describes Machete as a suspected Spanish-speaking espionage group with a particular emphasis on Venezuela, which this atlas uses as a country-level origin inference.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'malteiro',
    name: 'Malteiro',
    type: 'banking-theft',
    country: 'Brazil',
    city: 'Brasilia',
    lat: -15.7939,
    lng: -47.8828,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Regional',
    aliases: [],
    tags: ['MaaS', 'Mispadu'],
    knownFor: 'Operating a Malware-as-a-Service model around the Mispadu banking trojan for fraud and credential theft across Latin America and Europe.',
    attribution: 'MITRE ATT&CK describes Malteiro as a financially motivated criminal group that is likely based in Brazil.',
    sourceLabel: 'MITRE ATT&CK, Mar 2024',
  },
  {
    id: 'mario-kart',
    name: 'Mario Kart',
    type: 'access-brokerage',
    country: 'Russia',
    city: 'Tolyatti',
    lat: 53.5078,
    lng: 49.4204,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2017,
    scope: 'Global',
    aliases: ['TA551', 'Shathak', 'GOLD CABIN'],
    tags: ['botnet sales', 'spam delivery'],
    knownFor: 'Building a spam-delivered botnet and selling access to other actors who used that access for ransomware extortion.',
    attribution: 'DOJ described Mario Kart as a Russia-based cybercriminal group and tied a co-manager to Tolyatti, Russia.',
    sourceLabel: 'DOJ, Mar 2026',
  },
  {
    id: 'medusa-group',
    name: 'Medusa Group',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['Spearwing', 'Medusa Actors'],
    tags: ['RaaS', 'double extortion'],
    knownFor: 'Operating a rapidly growing ransomware program that blends credential theft, exploit-driven access, and double extortion against critical-sector victims.',
    attribution: 'MITRE ATT&CK documents Medusa Group as a major ransomware actor; because public reporting on origin is mixed, this atlas uses a cautious Russia/CIS-oriented country inference commonly reflected in vendor reporting.',
    sourceLabel: 'MITRE ATT&CK / public reporting',
  },
  {
    id: 'microsoft-threat-intelligence',
    name: 'Microsoft Threat Intelligence Center',
    type: 'white-hat',
    country: 'United States',
    city: 'Redmond',
    lat: 47.674,
    lng: -122.1215,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['threat intelligence', 'disruption', 'research'],
    knownFor: 'Publishing widely used actor tracking, malware analysis, disruption reporting, and intelligence-led guidance consumed across the security industry.',
    attribution: 'Microsoft describes its threat analysis and threat intelligence work as part of its security operations; the pin uses Microsoft\'s official Redmond headquarters as the organization origin.',
    sourceLabel: 'Microsoft official site',
  },
  {
    id: 'moneytaker',
    name: 'MoneyTaker',
    type: 'financial-fraud',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['SWIFT theft', 'card processing', 'bank intrusions'],
    knownFor: 'Targeting banks, card-processing systems, and interbank transfer infrastructure to steal funds and operational documentation for follow-on attacks.',
    attribution: 'Group-IB described MoneyTaker as a Russian-speaking targeted attack group; this atlas simplifies that reporting to a country-level Russia origin pin for map readability.',
    sourceLabel: 'Group-IB, Dec 2017',
  },
  {
    id: 'moonstone-sleet',
    name: 'Moonstone Sleet',
    type: 'hybrid',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: ['Storm-1789'],
    tags: ['espionage + extortion', 'fake companies'],
    knownFor: 'Combining espionage tradecraft with financially motivated operations, including social engineering, trojanized software, and ransomware deployment.',
    attribution: 'MITRE ATT&CK tracks Moonstone Sleet as a North Korean-linked threat actor executing both financially motivated attacks and espionage operations.',
    sourceLabel: 'MITRE ATT&CK, Oct 2024',
  },
  {
    id: 'moses-staff',
    name: 'Moses Staff',
    type: 'hacktivist',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Regional',
    aliases: ['DEV-0500', 'Marigold Sandstorm'],
    tags: ['wiper-like attacks', 'leak-and-damage'],
    knownFor: 'Combining data leaks, destructive encryption, and politically motivated attacks without following a conventional ransom model.',
    attribution: 'MITRE ATT&CK identifies Moses Staff as a suspected Iranian threat group whose operations are assessed as politically motivated.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2024',
  },
  {
    id: 'muddywater',
    name: 'MuddyWater',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Regional',
    aliases: ['Earth Vetala', 'MERCURY', 'Static Kitten', 'Seedworm', 'TEMP.Zagros', 'Mango Sandstorm', 'TA450'],
    tags: ['Middle East', 'espionage', 'MOIS-linked'],
    knownFor: 'Using broad phishing and PowerShell-heavy intrusion tradecraft against government, telecom, defense, and energy-sector organizations across the Middle East and beyond.',
    attribution: 'MITRE ATT&CK assesses MuddyWater to be a subordinate element within Iran\'s Ministry of Intelligence and Security, and the atlas maps that activity to Tehran at country level.',
    sourceLabel: 'MITRE ATT&CK, updated Oct 2025',
  },
  {
    id: 'mustard-tempest',
    name: 'Mustard Tempest',
    type: 'access-brokerage',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: ['DEV-0206', 'TA569', 'GOLD PRELUDE', 'UNC1543'],
    tags: ['SocGholish', 'IAB', 'fake updates'],
    knownFor: 'Operating the SocGholish ecosystem and brokering access into victim environments that later fed major ransomware and follow-on intrusion operations.',
    attribution: 'MITRE ATT&CK identifies Mustard Tempest as an initial access broker; open reporting commonly places it in the Russian-speaking cybercrime ecosystem, which this atlas represents as a country-level Russia inference.',
    sourceLabel: 'MITRE ATT&CK / public reporting',
  },
  {
    id: 'nemesis-market',
    name: 'Nemesis Market',
    type: 'darknet-market',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['Nemesis'],
    tags: ['dark web', 'criminal services'],
    knownFor: 'Selling illegal drugs and cybercrime services such as stolen data, fake documents, counterfeit currency, and malware.',
    attribution: 'DOJ charged the marketplace’s founder and operator as a Tehran-based Iranian national in 2025.',
    sourceLabel: 'DOJ, Apr 2025',
  },
  {
    id: 'oilrig',
    name: 'OilRig',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Regional',
    aliases: ['APT34', 'COBALT GYPSY', 'Helix Kitten', 'Hazel Sandstorm', 'EUROPIUM', 'TA452'],
    tags: ['Middle East', 'espionage', 'supply chain'],
    knownFor: 'Targeting government, financial, telecom, and energy-sector organizations in the Middle East with phishing, credential theft, and supply-chain compromise activity.',
    attribution: 'MITRE ATT&CK describes OilRig as a suspected Iranian threat group operating on behalf of the Iranian government, which this atlas maps to Tehran at country level.',
    sourceLabel: 'MITRE ATT&CK, updated Jan 2025',
  },
  {
    id: 'patchwork',
    name: 'Patchwork',
    type: 'state-linked-theft',
    country: 'India',
    city: 'New Delhi',
    lat: 28.6139,
    lng: 77.209,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: ['Hangover Group', 'Dropping Elephant', 'Chinastrats', 'MONSOON', 'Operation Hangover'],
    tags: ['South Asia', 'espionage', 'government targeting'],
    knownFor: 'Targeting diplomatic and government-linked organizations through regional espionage campaigns that reuse and adapt a broad mix of publicly available tooling.',
    attribution: 'MITRE ATT&CK says Patchwork has not been definitively attributed but that circumstantial evidence suggests the group may be a pro-Indian or Indian entity; the atlas uses India as a cautious country-level origin inference.',
    sourceLabel: 'MITRE ATT&CK, updated Oct 2025',
  },
  {
    id: 'play',
    name: 'Play',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: ['PlayCrypt', 'Balloonfly'],
    tags: ['closed group', 'double extortion'],
    knownFor: 'Running fast-moving enterprise ransomware and extortion campaigns that have hit business, government, healthcare, and critical infrastructure targets.',
    attribution: 'MITRE ATT&CK tracks Play as a major ransomware group; when origin is described in open reporting it is often discussed as Russia- or CIS-linked, which this atlas treats as a cautious country-level inference.',
    sourceLabel: 'MITRE ATT&CK / public reporting',
  },
  {
    id: 'project-zero',
    name: 'Project Zero',
    type: 'white-hat',
    country: 'United States',
    city: 'Mountain View',
    lat: 37.3861,
    lng: -122.0839,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['zero-day research', 'responsible disclosure'],
    knownFor: 'Researching high-impact vulnerabilities and publishing detailed analysis intended to improve the safety and security of widely used hardware and software.',
    attribution: 'Project Zero describes itself as Google\'s team of security researchers focused on zero-day vulnerabilities; the pin uses Google\'s official Mountain View global headquarters as the organization origin.',
    sourceLabel: 'Project Zero / Google',
  },
  {
    id: 'rapid7-labs',
    name: 'Rapid7 Labs',
    type: 'white-hat',
    country: 'United States',
    city: 'Boston',
    lat: 42.3601,
    lng: -71.0589,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['internet telemetry', 'threat research', 'open data'],
    knownFor: 'Sharing trusted open-source research, internet-scale exposure findings, and threat landscape reporting through projects like Sonar and Lorelei.',
    attribution: 'Rapid7 presents Rapid7 Labs as its cybersecurity research arm, and official company materials describe Rapid7 as Boston-headquartered.',
    sourceLabel: 'Rapid7 official site',
  },
  {
    id: 'sandworm',
    name: 'Sandworm Team',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Voodoo Bear', 'Seashell Blizzard', 'IRIDIUM'],
    tags: ['destructive ops', 'critical infrastructure'],
    knownFor: 'Launching some of the world’s most notorious disruptive and destructive cyber operations, including activity tied to attacks on critical infrastructure and wiper campaigns.',
    attribution: 'MITRE ATT&CK tracks Sandworm Team as a Russian state-sponsored threat group associated with the GRU; the map uses a country-level Russia attribution pinned to Moscow.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'secureworks-ctu',
    name: 'Secureworks CTU',
    type: 'white-hat',
    country: 'United States',
    city: 'Atlanta',
    lat: 33.749,
    lng: -84.388,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2010,
    scope: 'Global',
    aliases: ['Counter Threat Unit'],
    tags: ['threat intelligence', 'incident response', 'research'],
    knownFor: 'Tracking hundreds of threat groups and publishing durable naming, attribution, and intrusion-analysis work through its Counter Threat Unit research team.',
    attribution: 'Secureworks describes CTU as its dedicated threat research team, and longstanding official materials identify the company with Atlanta, Georgia.',
    sourceLabel: 'Secureworks official site',
  },
  {
    id: 'sentinellabs',
    name: 'SentinelLABS',
    type: 'white-hat',
    country: 'United States',
    city: 'Mountain View',
    lat: 37.3861,
    lng: -122.0839,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['security research', 'adversary tracking', 'malware analysis'],
    knownFor: 'Publishing fast-moving research on malware, exploit chains, cybercrime operations, and state-linked campaigns through an open community-focused research platform.',
    attribution: 'SentinelOne describes SentinelLABS as its open research venue and identifies Mountain View, California as the company headquarters used for this map pin.',
    sourceLabel: 'SentinelOne / SentinelLABS',
  },
  {
    id: 'sidecopy',
    name: 'SideCopy',
    type: 'state-linked-theft',
    country: 'Pakistan',
    city: 'Islamabad',
    lat: 33.6844,
    lng: 73.0479,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Regional',
    aliases: [],
    tags: ['South Asia', 'espionage', 'credential theft'],
    knownFor: 'Mimicking Sidewinder-style infection chains to target government and military personnel across South Asia with lures, malware loaders, and credential harvesting.',
    attribution: 'MITRE ATT&CK identifies SideCopy as a Pakistani threat group that has primarily targeted South Asian countries since at least 2019.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'sidewinder',
    name: 'Sidewinder',
    type: 'state-linked-theft',
    country: 'India',
    city: 'New Delhi',
    lat: 28.6139,
    lng: 77.209,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Regional',
    aliases: ['T-APT-04', 'Rattlesnake'],
    tags: ['South Asia', 'espionage', 'military targeting'],
    knownFor: 'Running long-running espionage campaigns across Asia with a strong focus on military, government, and business targets in neighboring countries.',
    attribution: 'MITRE ATT&CK tracks Sidewinder as a suspected Indian threat actor group active since at least 2012.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2024',
  },
  {
    id: 'silverterrier',
    name: 'SilverTerrier',
    type: 'bec-fraud',
    country: 'Nigeria',
    city: 'Abuja',
    lat: 9.0765,
    lng: 7.3986,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['BEC', 'financial theft'],
    knownFor: 'Stealing money through business email compromise and malware-enabled fraud targeting education, manufacturing, and technology victims.',
    attribution: 'MITRE ATT&CK describes SilverTerrier as a Nigerian threat group active since 2014 and tied to financial-theft campaigns.',
    sourceLabel: 'MITRE ATT&CK, updated Sep 2023',
  },
  {
    id: 'ta505',
    name: 'TA505',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['Cl0p', 'Hive0065', 'Spandex Tempest', 'CHIMBORAZO'],
    tags: ['Cl0p', 'malspam', 'loader ecosystem'],
    knownFor: 'Driving major cybercrime spam waves and later large-scale Cl0p ransomware and extortion activity against enterprise victims worldwide.',
    attribution: 'MITRE ATT&CK tracks TA505 as a major cybercrime group; open reporting broadly describes the operation as Russian-speaking, and the atlas reflects that as a country-level Russia origin inference.',
    sourceLabel: 'MITRE ATT&CK / public reporting',
  },
  {
    id: 'team-cymru',
    name: 'Team Cymru',
    type: 'white-hat',
    country: 'United States',
    city: 'Lake Mary',
    lat: 28.7589,
    lng: -81.3178,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 1998,
    scope: 'Global',
    aliases: [],
    tags: ['threat intel', 'BGP security', 'collective defense'],
    knownFor: 'Supplying widely used internet intelligence, botnet visibility, routing security expertise, and operational support to defenders and service providers.',
    attribution: 'Team Cymru\'s official contact and press materials place the organization in Lake Mary, Florida, which the atlas uses as its origin pin.',
    sourceLabel: 'Team Cymru official site',
  },
  {
    id: 'shadowserver-foundation',
    name: 'The Shadowserver Foundation',
    type: 'white-hat',
    country: 'United States',
    city: 'Pleasanton',
    lat: 37.6624,
    lng: -121.8747,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2004,
    scope: 'Global',
    aliases: [],
    tags: ['internet telemetry', 'sinkholing', 'free reporting'],
    knownFor: 'Providing large-scale public-benefit telemetry, daily network exposure reporting, and support for defenders, CERTs, and law enforcement worldwide.',
    attribution: 'Shadowserver\'s official fact sheet lists U.S. offices in California; the atlas uses Pleasanton, California from the current fact sheet as the organization origin point.',
    sourceLabel: 'Shadowserver official fact sheet',
  },
  {
    id: 'tradertraitor',
    name: 'TraderTraitor',
    type: 'crypto-crime',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: ['Jade Sleet', 'UNC4899'],
    tags: ['blockchain theft', 'job lures', 'crypto firms'],
    knownFor: 'Targeting blockchain companies and exchanges with fake recruiting approaches, trojanized applications, and follow-on theft of private keys and digital assets.',
    attribution: 'A 2022 joint CISA, FBI, and Treasury advisory identifies TraderTraitor as North Korean state-sponsored activity used to steal cryptocurrency from blockchain organizations.',
    sourceLabel: 'CISA / FBI / Treasury, Apr 2022',
  },
  {
    id: 'transparent-tribe',
    name: 'Transparent Tribe',
    type: 'state-linked-theft',
    country: 'Pakistan',
    city: 'Islamabad',
    lat: 33.6844,
    lng: 73.0479,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Regional',
    aliases: ['APT36', 'Mythic Leopard', 'ProjectM', 'COPPER FIELDSTONE'],
    tags: ['South Asia', 'espionage', 'defense targeting'],
    knownFor: 'Conducting sustained espionage activity against diplomatic, defense, and research targets in India and Afghanistan through lures and custom malware.',
    attribution: 'MITRE ATT&CK describes Transparent Tribe as a suspected Pakistan-based threat group active since at least 2013, which this atlas maps to Islamabad at country level.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2024',
  },
  {
    id: 'trickbot',
    name: 'TrickBot Group',
    type: 'access-brokerage',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: ['Trickbot operators'],
    tags: ['malware platform', 'ransomware enablement'],
    knownFor: 'Running a malware ecosystem used to steal money, compromise networks, and hand access to ransomware crews.',
    attribution: 'Treasury and DOJ actions in 2023 described Trickbot as a Russia-based cybercrime group with links to Russian intelligence services.',
    sourceLabel: 'U.S. Treasury / DOJ, Sep 2023',
  },
  {
    id: 'turla',
    name: 'Turla',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2004,
    scope: 'Global',
    aliases: ['Snake', 'Venomous Bear', 'Secret Blizzard'],
    tags: ['FSB-linked', 'espionage'],
    knownFor: 'Sustained espionage operations against governments, diplomats, journalists, and defense-related targets over roughly two decades.',
    attribution: 'MITRE ATT&CK and DOJ reporting associate Turla with Russian state activity; the map uses Russia at country level and pins to Moscow.',
    sourceLabel: 'MITRE ATT&CK / DOJ',
  },
  {
    id: 'unit-42',
    name: 'Unit 42',
    type: 'white-hat',
    country: 'United States',
    city: 'Santa Clara',
    lat: 37.3541,
    lng: -121.9552,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['threat intelligence', 'incident response', 'consulting'],
    knownFor: 'Publishing influential adversary tracking, malware analysis, and incident response reporting while supporting frontline breach investigations.',
    attribution: 'Palo Alto Networks describes Unit 42 as its threat intelligence and security consulting organization; the pin uses Palo Alto Networks\' Santa Clara headquarters.',
    sourceLabel: 'Palo Alto Networks',
  },
  {
    id: 'xenotime',
    name: 'Xenotime',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['TEMP.Veles', 'TRITON actors'],
    tags: ['ICS attacks', 'safety system sabotage', 'energy targeting', 'TRITON malware'],
    knownFor: 'Deploying the TRITON/TRISIS malware against safety instrumented systems at a Saudi Arabian petrochemical facility — the first publicly known attack designed to disable industrial safety controls and potentially cause catastrophic physical damage.',
    attribution: 'Mandiant/FireEye and the U.S. government attributed Xenotime to the Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM), a Russian government-owned technical research institute in Moscow.',
    sourceLabel: 'Mandiant / CISA / DOE, 2018–2022',
  },
  {
    id: 'chaos-computer-club',
    name: 'Chaos Computer Club',
    type: 'hacktivist',
    country: 'Germany',
    city: 'Hamburg',
    lat: 53.5753,
    lng: 10.0153,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 1981,
    scope: 'Global',
    aliases: ['CCC'],
    tags: ['security research', 'privacy advocacy', 'hacktivism', 'grey hat'],
    knownFor: 'Operating as one of the world\'s oldest and largest hacker collectives, conducting high-profile intrusions to expose security failures, advocating for digital privacy, and shaping European hacker culture and policy for over four decades.',
    attribution: 'The Chaos Computer Club is a publicly registered German association headquartered in Hamburg, widely recognized as Europe\'s most influential hacker collective since its founding in 1981.',
    sourceLabel: 'CCC official / NordVPN / public reporting',
  },
  {
    id: 'anonymous-sudan',
    name: 'Anonymous Sudan',
    type: 'hacktivist',
    country: 'Sudan',
    city: 'Khartoum',
    lat: 15.5007,
    lng: 32.5599,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: ['Storm-1359'],
    tags: ['DDoS', 'pro-Sudanese', 'Killnet-linked', 'hacktivism'],
    knownFor: 'Launching high-volume DDoS campaigns against Microsoft, Scandinavian Airlines, U.S. hospitals, and dozens of government and commercial targets worldwide while claiming Sudanese nationalist motivations.',
    attribution: 'Claimed to be a Sudanese hacktivist group; multiple security firms assess the group has links to Russian hacktivist ecosystem actors including Killnet, though Sudanese origin is not fully ruled out. Two Sudanese nationals were indicted by the U.S. DOJ in 2024.',
    sourceLabel: 'DOJ, Oct 2024 / Business Insider Africa / Microsoft',
  },
  {
    id: 'indian-cyber-force',
    name: 'Indian Cyber Force',
    type: 'hacktivist',
    country: 'India',
    city: 'New Delhi',
    lat: 28.6139,
    lng: 77.209,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Regional',
    aliases: ['ICF'],
    tags: ['DDoS', 'defacement', 'pro-India', 'patriotic hacktivism'],
    knownFor: 'Conducting politically motivated DDoS attacks and website defacements against Pakistani, Chinese, and other adversarial targets, operating as one of India\'s most active patriotic hacktivist collectives.',
    attribution: 'Indian Cyber Force is a self-identified Indian patriotic hacktivist group; public reporting describes it as conducting retaliatory and politically motivated attacks rather than neutral white-hat activity.',
    sourceLabel: 'Radware / public reporting',
  },
  {
    id: 'hitcon',
    name: 'HITCON',
    type: 'white-hat',
    country: 'Taiwan',
    city: 'Taipei',
    lat: 25.033,
    lng: 121.5654,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2005,
    scope: 'Regional',
    aliases: ['Hacks in Taiwan Conference', 'HITCON CTF Team'],
    tags: ['CTF', 'APT defense', 'vulnerability research', 'security community'],
    knownFor: 'Operating Taiwan\'s premier white hat security community, running one of the most respected CTF teams in international competition, and providing frontline defensive research against the persistent APT campaigns targeting Taiwan\'s critical infrastructure and semiconductor industry.',
    attribution: 'HITCON is publicly described as Taiwan\'s most prominent ethical hacking and security research community, founded in Taipei and recognized for top-tier CTF competition results including placements at DEF CON.',
    sourceLabel: 'Taipei Times / public reporting',
  },
  {
    id: 'cti-league',
    name: 'CTI League',
    type: 'white-hat',
    country: null,
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No fixed origin / decentralized volunteer network',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['Cyber Threat Intelligence League'],
    tags: ['threat disruption', 'healthcare defense', 'volunteer', 'cybercriminal disruption'],
    knownFor: 'Coordinating volunteer threat intelligence analysts worldwide to actively disrupt cybercriminal operations, most notably protecting hospital and healthcare infrastructure from ransomware and exploitation campaigns during the COVID-19 pandemic and beyond.',
    attribution: 'CTI League is a volunteer-driven international network of security professionals founded in 2020; public reporting describes its members as actively disrupting real-world criminal cyber operations rather than conducting defensive research alone.',
    sourceLabel: 'Information Age / ACS / public reporting',
  },
  {
    id: 'vadokrist',
    name: 'Vadokrist',
    type: 'banking-theft',
    country: 'Brazil',
    city: 'Brasilia',
    lat: -15.7939,
    lng: -47.8828,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Regional',
    aliases: [],
    tags: ['banking trojan', 'Brazil-focused'],
    knownFor: 'Targeting Brazilian financial institutions through spam-delivered malware with backdoor functionality and shared Latin American banking-trojan tradecraft.',
    attribution: 'ESET reported Vadokrist as specifically focused on Brazil and grouped it with other regional banking-trojan operators.',
    sourceLabel: 'ESET, Jan 2021',
  },
  {
    id: 'volatile-cedar',
    name: 'Volatile Cedar',
    type: 'hacktivist',
    country: 'Lebanon',
    city: 'Beirut',
    lat: 33.8938,
    lng: 35.5018,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Lebanese Cedar'],
    tags: ['political', 'web intrusion'],
    knownFor: 'Targeting institutions and private organizations through web compromise and politically motivated intrusion campaigns.',
    attribution: 'MITRE ATT&CK describes Volatile Cedar as a Lebanese threat group motivated by political and ideological interests.',
    sourceLabel: 'MITRE ATT&CK, updated Apr 2025',
  },
  {
    id: 'wizard-spider',
    name: 'Wizard Spider',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: ['GOLD BLACKBURN', 'Grim Spider', 'FIN12'],
    tags: ['TrickBot', 'Ryuk', 'Conti'],
    knownFor: 'Building the TrickBot ecosystem and running major ransomware campaigns against hospitals, enterprises, and public-sector targets.',
    attribution: 'MITRE ATT&CK tracks Wizard Spider as a Russia-based financially motivated threat group.',
    sourceLabel: 'MITRE ATT&CK, updated Mar 2025',
  },
  {
    id: 'aeroblade',
    name: 'AeroBlade',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'aggah',
    name: 'Aggah',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'agrius',
    name: 'Agrius',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Agrius to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'allanite',
    name: 'Allanite',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'alphv',
    name: 'ALPHV',
    type: 'ransomware',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['BlackCat Gang'],
    tags: ['ransomware', 'double extortion', 'RaaS'],
    knownFor: 'Operating ransomware campaigns and extortion operations against enterprise and critical-sector victims.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'scattered-spider',
    name: 'Scattered Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'anchor-panda',
    name: 'Anchor Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['APT 14'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Anchor Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'angry-likho',
    name: 'Angry Likho',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'antlion',
    name: 'Antlion',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Antlion to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'aoqin-dragon',
    name: 'Aoqin Dragon',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Aoqin Dragon to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-3',
    name: 'APT 3',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: ['Gothic Panda', 'Buckeye'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 3 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-4',
    name: 'APT 4',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: ['Maverick Panda', 'Wisp Team'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 4 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-5',
    name: 'APT 5',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: ['Keyhole Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 5 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-6',
    name: 'APT 6',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 6 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-12',
    name: 'APT 12',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Numbered Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 12 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-16',
    name: 'APT 16',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: ['SVCMONDR'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 16 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-17',
    name: 'APT 17',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Deputy Dog', 'Elderwood', 'Sneaky Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 17 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-18',
    name: 'APT 18',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Dynamite Panda', 'Wekby'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 18 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-19',
    name: 'APT 19',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['Deep Panda', 'C0d0so0'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 19 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-20',
    name: 'APT 20',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['Violin Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT 20 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-freybug',
    name: 'Earth Freybug',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Freybug to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-longzhi',
    name: 'Earth Longzhi',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Longzhi to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt-c-60',
    name: 'APT-C-60',
    type: 'state-linked-theft',
    country: 'South Korea',
    city: 'Seoul',
    lat: 37.5665,
    lng: 126.978,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to South Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes APT-C-60 to South Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'aquatic-panda',
    name: 'Aquatic Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Aquatic Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'atlascross',
    name: 'AtlasCross',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'avivore',
    name: 'AVIVORE',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes AVIVORE to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'awaken-likho',
    name: 'Awaken Likho',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'axiom',
    name: 'Axiom',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2008,
    scope: 'Global',
    aliases: ['Group 72'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Axiom to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bad-magic',
    name: 'Bad Magic',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['RedStinger'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bahamut',
    name: 'Bahamut',
    type: 'state-linked-theft',
    country: 'Middle East',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Regional attribution only',
    firstSeen: 2016,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Middle East.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'berserk-bear',
    name: 'Berserk Bear',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: ['Dragonfly 2.0'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Berserk Bear to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'the-big-bang',
    name: 'The Big Bang',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bitter',
    name: 'Bitter',
    type: 'state-linked-theft',
    country: 'South Asia',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Regional attribution only',
    firstSeen: 2013,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to South Asia.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'blackgear',
    name: 'Blackgear',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Blackgear to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'blackoasis',
    name: 'BlackOasis',
    type: 'state-linked-theft',
    country: 'Middle East',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Regional attribution only',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Middle East.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'blacktech',
    name: 'BlackTech',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: ['Circuit Panda', 'Radio Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes BlackTech to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'blackwood',
    name: 'Blackwood',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Blackwood to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'blue-termite',
    name: 'Blue Termite',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['Cloudy Omega'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Blue Termite to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bookworm',
    name: 'Bookworm',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Bookworm to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'boss-spider',
    name: 'Boss Spider',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: ['Gold Lowell'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Boss Spider to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bronze-butler',
    name: 'Bronze Butler',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2006,
    scope: 'Global',
    aliases: ['Tick', 'RedBaldNight', 'Stalker Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Bronze Butler to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bronze-highland',
    name: 'Bronze Highland',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Bronze Highland to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bronze-starlight',
    name: 'Bronze Starlight',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Bronze Starlight to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'buhtrap',
    name: 'Buhtrap',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: ['Ratopak Spider'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Buhtrap to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cadelle',
    name: 'Cadelle',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cadelle to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cadet-blizzard',
    name: 'Cadet Blizzard',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cadet Blizzard to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'callisto-group',
    name: 'Callisto Group',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'calypso',
    name: 'Calypso',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Calypso to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'carderbee',
    name: 'Carderbee',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Carderbee to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cardinallizard',
    name: 'CardinalLizard',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes CardinalLizard to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'careto',
    name: 'Careto',
    type: 'state-linked-theft',
    country: 'Spain',
    city: 'Madrid',
    lat: 40.4168,
    lng: -3.7038,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: ['The Mask'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Spain.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Careto to Spain; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ceranakeeper',
    name: 'CeranaKeeper',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes CeranaKeeper to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'chamelgang',
    name: 'ChamelGang',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes ChamelGang to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'chimera',
    name: 'Chimera',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Chimera to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cia',
    name: 'CIA',
    type: 'state-linked-theft',
    country: 'United States',
    city: 'Washington, DC',
    lat: 38.9072,
    lng: -77.0369,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 1947,
    scope: 'Global',
    aliases: [],
    tags: ['nation-state', 'CNO', 'zero-days'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to United States.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes CIA to United States; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'longhorn',
    name: 'Longhorn',
    type: 'state-linked-theft',
    country: 'United States',
    city: 'Washington, DC',
    lat: 38.9072,
    lng: -77.0369,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['The Lamberts'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to United States.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Longhorn to United States; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'circus-spider',
    name: 'Circus Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'clever-kitten',
    name: 'Clever Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Clever Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cloudsorcerer',
    name: 'CloudSorcerer',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cobalt-group',
    name: 'Cobalt Group',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cobalt Group to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cold-river',
    name: 'Cold River',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cold River to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'confucius',
    name: 'Confucius',
    type: 'state-linked-theft',
    country: 'India',
    city: 'New Delhi',
    lat: 28.6139,
    lng: 77.209,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to India.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Confucius to India; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'copykittens',
    name: 'CopyKittens',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['Slayer Kitten'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes CopyKittens to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'corkow',
    name: 'Corkow',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Metel'],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Corkow to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cosmic-leopard',
    name: 'Cosmic Leopard',
    type: 'state-linked-theft',
    country: 'Pakistan',
    city: 'Islamabad',
    lat: 33.6844,
    lng: 73.0479,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['Operation Celestial Force'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Pakistan.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cosmic Leopard to Pakistan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'costaricto',
    name: 'CostaRicto',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'covellite',
    name: 'Covellite',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to North Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Covellite to North Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'curious-gorge',
    name: 'Curious Gorge',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Curious Gorge to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cutting-kitten',
    name: 'Cutting Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['TG-2889'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cutting Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cyber-berkut',
    name: 'Cyber Berkut',
    type: 'hacktivist',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cyber Berkut to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cyber-caliphate-army-cca',
    name: 'Cyber Caliphate Army (CCA)',
    type: 'hacktivist',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Non-state terrorist organization',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['United Cyber Caliphate (UCC)'],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dalbit',
    name: 'Dalbit',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Dalbit to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dark-caracal',
    name: 'Dark Caracal',
    type: 'state-linked-theft',
    country: 'Lebanon',
    city: 'Beirut',
    lat: 33.8938,
    lng: 35.5018,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Lebanon.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Dark Caracal to Lebanon; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'darkcasino',
    name: 'DarkCasino',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'darkhotel',
    name: 'DarkHotel',
    type: 'state-linked-theft',
    country: 'South Korea',
    city: 'Seoul',
    lat: 37.5665,
    lng: 126.978,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to South Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes DarkHotel to South Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'darkhydrus',
    name: 'DarkHydrus',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: ['LazyMeerkat'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes DarkHydrus to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dark-pink',
    name: 'Dark Pink',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'darkuniverse',
    name: 'DarkUniverse',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'deceptikons',
    name: 'Deceptikons',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['DeathStalker'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'desert-falcons',
    name: 'Desert Falcons',
    type: 'state-linked-theft',
    country: 'Gaza',
    city: 'Gaza City',
    lat: 31.5017,
    lng: 34.4668,
    originPrecision: 'Territory-level attribution',
    firstSeen: 2011,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Gaza.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dnspionage',
    name: 'DNSpionage',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes DNSpionage to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'domestic-kitten',
    name: 'Domestic Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Domestic Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'donot-team',
    name: 'Donot Team',
    type: 'state-linked-theft',
    country: 'India',
    city: 'New Delhi',
    lat: 28.6139,
    lng: 77.209,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to India.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Donot Team to India; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'doppel-spider',
    name: 'Doppel Spider',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Doppel Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dragonok',
    name: 'DragonOK',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes DragonOK to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dragonspark',
    name: 'DragonSpark',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes DragonSpark to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dustsquad',
    name: 'DustSquad',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['Golden Falcon'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes DustSquad to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dust-storm',
    name: 'Dust Storm',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Dust Storm to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-alux',
    name: 'Earth Alux',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Alux to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-ammit',
    name: 'Earth Ammit',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Ammit to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-baxia',
    name: 'Earth Baxia',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Baxia to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-berberoka',
    name: 'Earth Berberoka',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Berberoka to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-krahang',
    name: 'Earth Krahang',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Krahang to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-kurma',
    name: 'Earth Kurma',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Kurma to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-lamia',
    name: 'Earth Lamia',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Lamia to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-lusca',
    name: 'Earth Lusca',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Lusca to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-minotaur',
    name: 'Earth Minotaur',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Minotaur to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'earth-wendigo',
    name: 'Earth Wendigo',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Earth Wendigo to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'elephant-beetle',
    name: 'Elephant Beetle',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'emissary-panda',
    name: 'Emissary Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: ['APT 27', 'LuckyMouse', 'Bronze Union'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Emissary Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'empiremonkey',
    name: 'EmpireMonkey',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['CobaltGoblin'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'equation-group',
    name: 'Equation Group',
    type: 'state-linked-theft',
    country: 'United States',
    city: 'Washington, DC',
    lat: 38.9072,
    lng: -77.0369,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2001,
    scope: 'Global',
    aliases: [],
    tags: ['nation-state', 'CNO', 'zero-days'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to United States.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Equation Group to United States; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'evilnum',
    name: 'Evilnum',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ferocious-kitten',
    name: 'Ferocious Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Ferocious Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'fin4',
    name: 'FIN4',
    type: 'state-linked-theft',
    country: 'Romania',
    city: 'Bucharest',
    lat: 44.4268,
    lng: 26.1025,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Regional',
    aliases: ['Wolf Spider'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Romania.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes FIN4 to Romania; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'fin8',
    name: 'FIN8',
    type: 'banking-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'apt9',
    name: 'APT9',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'fin10',
    name: 'FIN10',
    type: 'banking-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'fin11',
    name: 'FIN11',
    type: 'banking-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'fin13',
    name: 'FIN13',
    type: 'banking-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'fishing-elephant',
    name: 'Fishing Elephant',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'flax-typhoon',
    name: 'Flax Typhoon',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Flax Typhoon to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'flying-kitten',
    name: 'Flying Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: ['Ajax Security Team'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Flying Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'funnydream',
    name: 'FunnyDream',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes FunnyDream to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gallium',
    name: 'Gallium',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Gallium to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gallmaker',
    name: 'Gallmaker',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gangnam-industrial-style',
    name: 'Gangnam Industrial Style',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gchq',
    name: 'GCHQ',
    type: 'state-linked-theft',
    country: 'United Kingdom',
    city: 'London',
    lat: 51.5074,
    lng: -0.1278,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 1919,
    scope: 'Global',
    aliases: [],
    tags: ['nation-state', 'CNO', 'zero-days'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to United Kingdom.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes GCHQ to United Kingdom; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gcman',
    name: 'GCMAN',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes GCMAN to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gelsemium',
    name: 'Gelsemium',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Gelsemium to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ghostnet',
    name: 'GhostNet',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Snooping Dragon'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes GhostNet to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'goblin-panda',
    name: 'Goblin Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['Cycldek', 'Conimes'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Goblin Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'goldenjackal',
    name: 'GoldenJackal',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'grayling',
    name: 'Grayling',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'greencharlie',
    name: 'GreenCharlie',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes GreenCharlie to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'group5',
    name: 'Group5',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Group5 to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'hades',
    name: 'Hades',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Hades to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'hafnium',
    name: 'Hafnium',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Hafnium to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'harvester',
    name: 'Harvester',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'hexane',
    name: 'Hexane',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Hexane to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'hidden-lynx',
    name: 'Hidden Lynx',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['Aurora Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Hidden Lynx to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'homeland-justice',
    name: 'HomeLand Justice',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes HomeLand Justice to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'honeybee',
    name: 'Honeybee',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'hurricane-panda',
    name: 'Hurricane Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Hurricane Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'hydrochasma',
    name: 'Hydrochasma',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'iamtheking',
    name: 'IAmTheKing',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes IAmTheKing to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'icefog',
    name: 'Icefog',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Dagger Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Icefog to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'inception-framework',
    name: 'Inception Framework',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Cloud Atlas'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Inception Framework to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'indigozebra',
    name: 'IndigoZebra',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes IndigoZebra to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'indra',
    name: 'Indra',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'infy',
    name: 'Infy',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: ['Prince of Persia'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Infy to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'invisimole',
    name: 'InvisiMole',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes InvisiMole to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ironhusky',
    name: 'IronHusky',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes IronHusky to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'itg18',
    name: 'ITG18',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes ITG18 to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'karkadann',
    name: 'Karkadann',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ke3chang',
    name: 'Ke3chang',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: ['Vixen Panda', 'APT 15', 'GREF', 'Playful Dragon'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Ke3chang to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'kimsuky',
    name: 'Kimsuky',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Velvet Chollima'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to North Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Kimsuky to North Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lancefly',
    name: 'Lancefly',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-contagious-interview',
    name: 'Operation Contagious Interview',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to North Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Contagious Interview to North Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lazyscripter',
    name: 'LazyScripter',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lead',
    name: 'Lead',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Lead to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'leafminer',
    name: 'Leafminer',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: ['Raspite'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Leafminer to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'leetmx',
    name: 'leetMX',
    type: 'state-linked-theft',
    country: 'Mexico',
    city: 'Mexico City',
    lat: 19.4326,
    lng: -99.1332,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Mexico.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes leetMX to Mexico; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'libyan-scorpions',
    name: 'Libyan Scorpions',
    type: 'state-linked-theft',
    country: 'Libya',
    city: 'Tripoli',
    lat: 32.904,
    lng: 13.1805,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Libya.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Libyan Scorpions to Libya; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lightbasin',
    name: 'LightBasin',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes LightBasin to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lookback',
    name: 'LookBack',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: ['TA410'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lotus-blossom',
    name: 'Lotus Blossom',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Spring Dragon', 'Thrip'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Lotus Blossom to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lucky-cat',
    name: 'Lucky Cat',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Lucky Cat to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'luminousmoth',
    name: 'LuminousMoth',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes LuminousMoth to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lurk',
    name: 'Lurk',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Lurk to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'mabna-institute',
    name: 'Mabna Institute',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['Cobalt Dickens', 'Silent Librarian'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Mabna Institute to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'madi',
    name: 'Madi',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Madi to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta455',
    name: 'TA455',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['Smoke Sandstorm'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TA455 to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'magic-kitten',
    name: 'Magic Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Magic Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'malkamak',
    name: 'MalKamak',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes MalKamak to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'mallard-spider',
    name: 'Mallard Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2008,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'mikroceen',
    name: 'Mikroceen',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Mikroceen to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'moafee',
    name: 'Moafee',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Moafee to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'molerats',
    name: 'Molerats',
    type: 'state-linked-theft',
    country: 'Gaza',
    city: 'Gaza City',
    lat: 31.5017,
    lng: 34.4668,
    originPrecision: 'Territory-level attribution',
    firstSeen: 2012,
    scope: 'Regional',
    aliases: ['Extreme Jackal', 'Gaza Cybergang'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Gaza.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'moustachedbouncer',
    name: 'MoustachedBouncer',
    type: 'state-linked-theft',
    country: 'Belarus',
    city: 'Minsk',
    lat: 53.9045,
    lng: 27.5615,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Belarus.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes MoustachedBouncer to Belarus; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'mustang-panda',
    name: 'Mustang Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Bronze President'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Mustang Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'mysterious-elephant',
    name: 'Mysterious Elephant',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'naikon',
    name: 'Naikon',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: ['Lotus Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Naikon to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'nazar',
    name: 'Nazar',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2008,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Nazar to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'nb65',
    name: 'NB65',
    type: 'hacktivist',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'neodymium',
    name: 'Neodymium',
    type: 'state-linked-theft',
    country: 'Turkey',
    city: 'Ankara',
    lat: 39.9334,
    lng: 32.8597,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Turkey.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Neodymium to Turkey; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'nettraveler',
    name: 'NetTraveler',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2004,
    scope: 'Global',
    aliases: ['APT 21', 'Hammer Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes NetTraveler to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'night-dragon',
    name: 'Night Dragon',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Night Dragon to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'nightshade-panda',
    name: 'Nightshade Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['APT 9', 'Group 27'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Nightshade Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'nineblog',
    name: 'NineBlog',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes NineBlog to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'nitro',
    name: 'Nitro',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Covert Grove'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Nitro to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'oilalpha',
    name: 'OilAlpha',
    type: 'state-linked-theft',
    country: 'Yemen',
    city: 'Sanaa',
    lat: 15.5527,
    lng: 48.5164,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Yemen.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes OilAlpha to Yemen; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'greenbug',
    name: 'Greenbug',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: ['Volatile Kitten'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Greenbug to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'oldgremlin',
    name: 'OldGremlin',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes OldGremlin to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'oniondog',
    name: 'OnionDog',
    type: 'state-linked-theft',
    country: 'South Korea',
    city: 'Seoul',
    lat: 37.5665,
    lng: 126.978,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to South Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes OnionDog to South Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'opera1er',
    name: 'OPERA1ER',
    type: 'financial-fraud',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['BEC', 'financial fraud', 'wire theft'],
    knownFor: 'Pursuing BEC, wire fraud, and financial-theft operations for criminal profit.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-armor-piercer',
    name: 'Operation Armor Piercer',
    type: 'state-linked-theft',
    country: 'Pakistan',
    city: 'Islamabad',
    lat: 33.6844,
    lng: 73.0479,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Pakistan.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Armor Piercer to Pakistan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-bandidos',
    name: 'Operation Bandidos',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-black-atlas',
    name: 'Operation Black Atlas',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-bugdrop',
    name: 'Operation BugDrop',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation BugDrop to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-comando',
    name: 'Operation Comando',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-crimson-palace',
    name: 'Operation Crimson Palace',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Crimson Palace to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-digital-eye',
    name: 'Operation Digital Eye',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Digital Eye to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-diplomatic-specter',
    name: 'Operation Diplomatic Specter',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Diplomatic Specter to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-domino',
    name: 'Operation Domino',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: ['Operation Kremlin'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Domino to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-dragon-castling',
    name: 'Operation Dragon Castling',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Dragon Castling to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-earth-kitsune',
    name: 'Operation Earth Kitsune',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to North Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Earth Kitsune to North Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-electric-powder',
    name: 'Operation Electric Powder',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-emailthief',
    name: 'Operation EmailThief',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['TEMP_Heretic'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation EmailThief to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-epic-manchego',
    name: 'Operation Epic Manchego',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-ghostwriter',
    name: 'Operation Ghostwriter',
    type: 'state-linked-theft',
    country: 'Belarus',
    city: 'Minsk',
    lat: 53.9045,
    lng: 27.5615,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Belarus.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Ghostwriter to Belarus; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-ghoul',
    name: 'Operation Ghoul',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-groundbait',
    name: 'Operation Groundbait',
    type: 'state-linked-theft',
    country: 'Ukraine',
    city: 'Kyiv',
    lat: 50.4501,
    lng: 30.5234,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2008,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Ukraine.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Groundbait to Ukraine; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-harvest',
    name: 'Operation Harvest',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Harvest to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-jacana',
    name: 'Operation Jacana',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Jacana to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-layover',
    name: 'Operation Layover',
    type: 'financial-fraud',
    country: 'Nigeria',
    city: 'Abuja',
    lat: 9.0765,
    lng: 7.3986,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['BEC', 'financial fraud', 'wire theft'],
    knownFor: 'Pursuing BEC, wire fraud, and financial-theft operations for criminal profit.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Layover to Nigeria; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-liberalface',
    name: 'Operation LiberalFace',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: ['MirrorFace'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation LiberalFace to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-manul',
    name: 'Operation Manul',
    type: 'state-linked-theft',
    country: 'Kazakhstan',
    city: 'Astana',
    lat: 51.1801,
    lng: 71.446,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Kazakhstan.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Manul to Kazakhstan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-olympic-games',
    name: 'Operation Olympic Games',
    type: 'state-linked-theft',
    country: 'United States',
    city: 'Washington, DC',
    lat: 38.9072,
    lng: -77.0369,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2007,
    scope: 'Global',
    aliases: [],
    tags: ['nation-state', 'CNO', 'zero-days'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to United States.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Olympic Games to United States; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-parliament',
    name: 'Operation Parliament',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-poisoned-news',
    name: 'Operation Poisoned News',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['TwoSail Junk'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Poisoned News to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-poison-needles',
    name: 'Operation Poison Needles',
    type: 'state-linked-theft',
    country: 'Ukraine',
    city: 'Kyiv',
    lat: 50.4501,
    lng: 30.5234,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Ukraine.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Poison Needles to Ukraine; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-potao-express',
    name: 'Operation Potao Express',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-pseudomanuscrypt',
    name: 'Operation PseudoManuscrypt',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation PseudoManuscrypt to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-red-signature',
    name: 'Operation Red Signature',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Red Signature to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-restylink',
    name: 'Operation RestyLink',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-rusticweb',
    name: 'Operation RusticWeb',
    type: 'state-linked-theft',
    country: 'Pakistan',
    city: 'Islamabad',
    lat: 33.6844,
    lng: 73.0479,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Pakistan.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation RusticWeb to Pakistan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-rusty-flag',
    name: 'Operation Rusty Flag',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-shady-rat',
    name: 'Operation Shady RAT',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2006,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Shady RAT to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-salmonslalom',
    name: 'Operation SalmonSlalom',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2025,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation SalmonSlalom to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-signsight',
    name: 'Operation SignSight',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-silent-skimmer',
    name: 'Operation Silent Skimmer',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-slow-tempest',
    name: 'Operation SLOW#TEMPEST',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation SLOW#TEMPEST to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-spalax',
    name: 'Operation Spalax',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-tainted-love',
    name: 'Operation Tainted Love',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Tainted Love to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-titan-rain',
    name: 'Operation Titan Rain',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2003,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Titan Rain to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-triangulation',
    name: 'Operation Triangulation',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-viceleaker',
    name: 'Operation ViceLeaker',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-wizardopium',
    name: 'Operation WizardOpium',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to North Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation WizardOpium to North Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'orangeworm',
    name: 'Orangeworm',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'packrat',
    name: 'Packrat',
    type: 'state-linked-theft',
    country: 'Latin America',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Regional attribution only',
    firstSeen: 2008,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Latin America.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'parisite',
    name: 'Parisite',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: ['Fox Kitten', 'Pioneer Kitten'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Parisite to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'passcv',
    name: 'PassCV',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes PassCV to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'pinchy-spider',
    name: 'Pinchy Spider',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['Gold Southfield'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Pinchy Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'pittytiger',
    name: 'PittyTiger',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Pitty Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes PittyTiger to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'platinum',
    name: 'Platinum',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Platinum to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'plushdaemon',
    name: 'PlushDaemon',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes PlushDaemon to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'poison-carp',
    name: 'Poison Carp',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['Evil Eye'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Poison Carp to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'polonium',
    name: 'Polonium',
    type: 'state-linked-theft',
    country: 'Lebanon',
    city: 'Beirut',
    lat: 33.8938,
    lng: 35.5018,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Lebanon.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Polonium to Lebanon; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'poseidon-group',
    name: 'Poseidon Group',
    type: 'state-linked-theft',
    country: 'Brazil',
    city: 'Brasilia',
    lat: -15.7939,
    lng: -47.8828,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2005,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Brazil.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Poseidon Group to Brazil; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'powerpool',
    name: 'PowerPool',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'promethium',
    name: 'Promethium',
    type: 'state-linked-theft',
    country: 'Turkey',
    city: 'Ankara',
    lat: 39.9334,
    lng: 32.8597,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['StrongPity'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Turkey.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Promethium to Turkey; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'pusikurac',
    name: 'Pusikurac',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'rampant-kitten',
    name: 'Rampant Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Rampant Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'rancor',
    name: 'Rancor',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Rancor to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'raticate',
    name: 'RATicate',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'redalpha',
    name: 'RedAlpha',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes RedAlpha to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'redcurl',
    name: 'RedCurl',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'reddelta',
    name: 'RedDelta',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes RedDelta to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'redecho',
    name: 'RedEcho',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes RedEcho to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'redfoxtrot',
    name: 'RedFoxtrot',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes RedFoxtrot to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'redgolf',
    name: 'RedGolf',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes RedGolf to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'redhotel',
    name: 'RedHotel',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['TAG-22'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes RedHotel to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'revengehotels',
    name: 'RevengeHotels',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'riddle-spider',
    name: 'Riddle Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'roaming-tiger',
    name: 'Roaming Tiger',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Roaming Tiger to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'rocket-kitten',
    name: 'Rocket Kitten',
    type: 'crypto-crime',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Newscaster', 'NewsBeef'],
    tags: ['cryptomining', 'financial theft'],
    knownFor: 'Targeting cryptocurrency platforms and mining infrastructure for financial gain.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Rocket Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'rtm',
    name: 'RTM',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes RTM to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'safe',
    name: 'Safe',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Safe to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'saintbear',
    name: 'SaintBear',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: ['Lorec53'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes SaintBear to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'salt-typhoon',
    name: 'Salt Typhoon',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['GhostEmperor'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Salt Typhoon to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'samurai-panda',
    name: 'Samurai Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Samurai Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sandcat',
    name: 'SandCat',
    type: 'state-linked-theft',
    country: 'Uzbekistan',
    city: 'Tashkent',
    lat: 41.2995,
    lng: 69.2401,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Uzbekistan.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes SandCat to Uzbekistan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sandman',
    name: 'Sandman',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Sandman to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'scarab',
    name: 'Scarab',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Scarab to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'scarlet-mimic',
    name: 'Scarlet Mimic',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Scarlet Mimic to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sea-turtle',
    name: 'Sea Turtle',
    type: 'hacktivist',
    country: 'Turkey',
    city: 'Ankara',
    lat: 39.9334,
    lng: 32.8597,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Sea Turtle to Turkey; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'shadow-academy',
    name: 'Shadow Academy',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'shadow-network',
    name: 'Shadow Network',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Shadow Network to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'shaggypanther',
    name: 'ShaggyPanther',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes ShaggyPanther to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sharppanda',
    name: 'SharpPanda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['Sharp Dragon'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes SharpPanda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'shroudedsnooper',
    name: 'ShroudedSnooper',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'siesta',
    name: 'Siesta',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Siesta to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'silence',
    name: 'Silence',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: ['Contract Crew'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sima',
    name: 'Sima',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Sima to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'slingshot',
    name: 'Slingshot',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2012,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'snowglobe',
    name: 'Snowglobe',
    type: 'state-linked-theft',
    country: 'France',
    city: 'Paris',
    lat: 48.8566,
    lng: 2.3522,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Animal Farm'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to France.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Snowglobe to France; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sowbug',
    name: 'Sowbug',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'space-pirates',
    name: 'Space Pirates',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Space Pirates to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sphinx',
    name: 'Sphinx',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sprite-spider',
    name: 'Sprite Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: ['Gold Dupont'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'stealth-falcon',
    name: 'Stealth Falcon',
    type: 'state-linked-theft',
    country: 'UAE',
    city: 'Abu Dhabi',
    lat: 24.4539,
    lng: 54.3773,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Regional',
    aliases: ['FruityArmor'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to UAE.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Stealth Falcon to UAE; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'stone-panda',
    name: 'Stone Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2006,
    scope: 'Global',
    aliases: ['APT 10', 'menuPass'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Stone Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'storm-0558',
    name: 'Storm-0558',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Storm-0558 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'strider',
    name: 'Strider',
    type: 'state-linked-theft',
    country: 'United States',
    city: 'Washington, DC',
    lat: 38.9072,
    lng: -77.0369,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['ProjectSauron'],
    tags: ['nation-state', 'CNO', 'zero-days'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to United States.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Strider to United States; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'suckfly',
    name: 'Suckfly',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Suckfly to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'suncrypt-gang',
    name: 'SunCrypt Gang',
    type: 'ransomware',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['ransomware', 'double extortion', 'RaaS'],
    knownFor: 'Operating ransomware campaigns and extortion operations against enterprise and critical-sector victims.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'sweed',
    name: 'Sweed',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'syrian-electronic-army-sea',
    name: 'Syrian Electronic Army (SEA)',
    type: 'hacktivist',
    country: 'Syria',
    city: 'Damascus',
    lat: 33.5138,
    lng: 36.2765,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Regional',
    aliases: ['Deadeye Jackal'],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Syrian Electronic Army (SEA) to Syria; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'goldmouse',
    name: 'Goldmouse',
    type: 'state-linked-theft',
    country: 'Syria',
    city: 'Damascus',
    lat: 33.5138,
    lng: 36.2765,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Regional',
    aliases: ['APT-C-27'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Syria.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Goldmouse to Syria; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'pat-bear',
    name: 'Pat Bear',
    type: 'state-linked-theft',
    country: 'Syria',
    city: 'Damascus',
    lat: 33.5138,
    lng: 36.2765,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: ['APT-C-37'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Syria.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Pat Bear to Syria; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta2101',
    name: 'TA2101',
    type: 'ransomware',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: ['Maze Team'],
    tags: ['ransomware', 'double extortion', 'RaaS'],
    knownFor: 'Operating ransomware campaigns and extortion operations against enterprise and critical-sector victims.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta2541',
    name: 'TA2541',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta2552',
    name: 'TA2552',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta2722',
    name: 'TA2722',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta413',
    name: 'TA413',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TA413 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta428',
    name: 'TA428',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TA428 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta459',
    name: 'TA459',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TA459 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta530',
    name: 'TA530',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta555',
    name: 'TA555',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta558',
    name: 'TA558',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tag-28',
    name: 'TAG-28',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TAG-28 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tag-38',
    name: 'TAG-38',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TAG-38 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tag-100',
    name: 'TAG-100',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TAG-100 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'taidoor',
    name: 'Taidoor',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2008,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Taidoor to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'taskmasters',
    name: 'TaskMasters',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TaskMasters to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'teamspy-crew',
    name: 'TeamSpy Crew',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TeamSpy Crew to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'telebots',
    name: 'TeleBots',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TeleBots to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'temper-panda',
    name: 'Temper Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['admin@338'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Temper Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tempting-cedar-spyware',
    name: 'Tempting Cedar Spyware',
    type: 'state-linked-theft',
    country: 'Lebanon',
    city: 'Beirut',
    lat: 33.8938,
    lng: 35.5018,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Lebanon.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Tempting Cedar Spyware to Lebanon; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'temp-veles',
    name: 'TEMP.Veles',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TEMP.Veles to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'terbium',
    name: 'Terbium',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2012,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'thewizards',
    name: 'TheWizards',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes TheWizards to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tidrone',
    name: 'TIDRONE',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tiny-spider',
    name: 'Tiny Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'toddycat',
    name: 'ToddyCat',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes ToddyCat to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tomiris',
    name: 'Tomiris',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tonto-team',
    name: 'Tonto Team',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2009,
    scope: 'Global',
    aliases: ['HartBeat', 'Karma Panda'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Tonto Team to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tortilla',
    name: 'Tortilla',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tortoiseshell',
    name: 'Tortoiseshell',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['Imperial Kitten'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Tortoiseshell to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tracer-kitten',
    name: 'Tracer Kitten',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Tracer Kitten to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'traveling-spider',
    name: 'Traveling Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tropical-scorpius',
    name: 'Tropical Scorpius',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: ['RomCom'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Tropical Scorpius to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'tropic-trooper',
    name: 'Tropic Trooper',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: ['Pirate Panda', 'APT 23', 'KeyBoy'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Tropic Trooper to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'turbine-panda',
    name: 'Turbine Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: ['APT 26', 'Shell Crew', 'WebMasters', 'KungFu Kittens'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Turbine Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'twisted-panda',
    name: 'Twisted Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Twisted Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ultrarank',
    name: 'UltraRank',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc215',
    name: 'UNC215',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes UNC215 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc2447',
    name: 'UNC2447',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc2891',
    name: 'UNC2891',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc3886',
    name: 'UNC3886',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes UNC3886 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc4191',
    name: 'UNC4191',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes UNC4191 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc5221',
    name: 'UNC5221',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Global',
    aliases: ['UTA0178'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes UNC5221 to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unfading-sea-haze',
    name: 'Unfading Sea Haze',
    type: 'hacktivist',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Unfading Sea Haze to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'urpage',
    name: 'Urpage',
    type: 'state-linked-theft',
    country: 'Middle East',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Regional attribution only',
    firstSeen: 2018,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Middle East.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'velvet-ant',
    name: 'Velvet Ant',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Velvet Ant to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'vendetta',
    name: 'Vendetta',
    type: 'state-linked-theft',
    country: 'Turkey',
    city: 'Ankara',
    lat: 39.9334,
    lng: 32.8597,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['TA2719'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Turkey.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Vendetta to Turkey; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'venom-spider',
    name: 'Venom Spider',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: ['Golden Chickens'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Venom Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'vicious-panda',
    name: 'Vicious Panda',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Vicious Panda to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'viking-spider',
    name: 'Viking Spider',
    type: 'ransomware',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['ransomware', 'double extortion', 'RaaS'],
    knownFor: 'Operating ransomware campaigns and extortion operations against enterprise and critical-sector victims.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'void-arachne',
    name: 'Void Arachne',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Void Arachne to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'void-blizzard',
    name: 'Void Blizzard',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Void Blizzard to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'void-balaur',
    name: 'Void Balaur',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'volt-typhoon',
    name: 'Volt Typhoon',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Volt Typhoon to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'wassonite',
    name: 'Wassonite',
    type: 'state-linked-theft',
    country: 'North Korea',
    city: 'Pyongyang',
    lat: 39.0392,
    lng: 125.7625,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to North Korea.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Wassonite to North Korea; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'the-white-company',
    name: 'The White Company',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'whitefly',
    name: 'Whitefly',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Mofang'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'wicked-spider',
    name: 'Wicked Spider',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: ['APT 22'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Wicked Spider to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'wildcard',
    name: 'WildCard',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'wildpressure',
    name: 'WildPressure',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'windshift',
    name: 'WindShift',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'winter-vivern',
    name: 'Winter Vivern',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'wip26',
    name: 'WIP26',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2022,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'wirte-group',
    name: 'WIRTE Group',
    type: 'state-linked-theft',
    country: 'Middle East',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Regional attribution only',
    firstSeen: 2018,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Middle East.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'worok',
    name: 'Worok',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Worok to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'xdspy',
    name: 'XDSpy',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'xhunt',
    name: 'xHunt',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes xHunt to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'yorotrooper',
    name: 'YoroTrooper',
    type: 'state-linked-theft',
    country: 'Kazakhstan',
    city: 'Astana',
    lat: 51.1801,
    lng: 71.446,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2022,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Kazakhstan.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes YoroTrooper to Kazakhstan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'zoopark',
    name: 'ZooPark',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: '8220-gang',
    name: '8220 Gang',
    type: 'crypto-crime',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['cryptomining', 'financial theft'],
    knownFor: 'Targeting cryptocurrency platforms and mining infrastructure for financial gain.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes 8220 Gang to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'achilles',
    name: 'Achilles',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'altdos',
    name: 'ALTDOS',
    type: 'hacktivist',
    country: 'Singapore',
    city: 'Singapore',
    lat: 1.3521,
    lng: 103.8198,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['Desorden'],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes ALTDOS to Singapore; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'andromeda-spider',
    name: 'Andromeda Spider',
    type: 'state-linked-theft',
    country: 'Belarus',
    city: 'Minsk',
    lat: 53.9045,
    lng: 27.5615,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Belarus.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Andromeda Spider to Belarus; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'avalanche',
    name: 'Avalanche',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2006,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Avalanche to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bamboo-spider',
    name: 'Bamboo Spider',
    type: 'ransomware',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: ['TA544'],
    tags: ['ransomware', 'double extortion', 'RaaS'],
    knownFor: 'Operating ransomware campaigns and extortion operations against enterprise and critical-sector victims.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'bismuth',
    name: 'Bismuth',
    type: 'state-linked-theft',
    country: 'Vietnam',
    city: 'Hanoi',
    lat: 21.0285,
    lng: 105.8542,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Vietnam.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Bismuth to Vietnam; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'boson-spider',
    name: 'Boson Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'circles',
    name: 'Circles',
    type: 'darknet-market',
    country: 'Israel',
    city: 'Tel Aviv',
    lat: 32.0853,
    lng: 34.7818,
    originPrecision: 'City-level attribution from public reporting',
    firstSeen: 2015,
    scope: 'Regional',
    aliases: [],
    tags: ['surveillance tools', 'illicit services'],
    knownFor: 'Providing commercial surveillance tools, exploit services, or illicit marketplace infrastructure.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Circles to Israel; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'coralraider',
    name: 'CoralRaider',
    type: 'state-linked-theft',
    country: 'Vietnam',
    city: 'Hanoi',
    lat: 21.0285,
    lng: 105.8542,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Vietnam.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes CoralRaider to Vietnam; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cron',
    name: 'Cron',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2015,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cron to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'cyber-fighters-of-izz-ad-din-al-qassam',
    name: 'Cyber fighters of Izz Ad-Din Al Qassam',
    type: 'state-linked-theft',
    country: 'Iran',
    city: 'Tehran',
    lat: 35.6892,
    lng: 51.389,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: ['Fraternal Jackal'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Iran.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Cyber fighters of Izz Ad-Din Al Qassam to Iran; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dark-basin',
    name: 'Dark Basin',
    type: 'state-linked-theft',
    country: 'India',
    city: 'New Delhi',
    lat: 28.6139,
    lng: 77.209,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to India.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Dark Basin to India; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'dungeon-spider',
    name: 'Dungeon Spider',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['ransomware', 'double extortion', 'RaaS'],
    knownFor: 'Operating ransomware campaigns and extortion operations against enterprise and critical-sector victims.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Dungeon Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'fxmsp',
    name: 'Fxmsp',
    type: 'cybercrime',
    country: 'Kazakhstan',
    city: 'Astana',
    lat: 51.1801,
    lng: 71.446,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Regional',
    aliases: [],
    tags: ['data theft', 'extortion', 'credential market'],
    knownFor: 'Executing data theft, credential harvesting, and criminal extortion operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Fxmsp to Kazakhstan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gambleforce',
    name: 'GambleForce',
    type: 'state-linked-theft',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to China.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes GambleForce to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'gnosticplayers',
    name: 'Gnosticplayers',
    type: 'cybercrime',
    country: 'Pakistan',
    city: 'Islamabad',
    lat: 33.6844,
    lng: 73.0479,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['data theft', 'extortion', 'credential market'],
    knownFor: 'Executing data theft, credential harvesting, and criminal extortion operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Gnosticplayers to Pakistan; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'guru-spider',
    name: 'Guru Spider',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2014,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Guru Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'hacking-team',
    name: 'Hacking Team',
    type: 'darknet-market',
    country: 'Italy',
    city: 'Rome',
    lat: 41.9028,
    lng: 12.4964,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2003,
    scope: 'Global',
    aliases: [],
    tags: ['surveillance tools', 'illicit services'],
    knownFor: 'Providing commercial surveillance tools, exploit services, or illicit marketplace infrastructure.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Hacking Team to Italy; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'handala-hack-team',
    name: 'Handala Hack Team',
    type: 'hacktivist',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'infraud-organization',
    name: 'Infraud Organization',
    type: 'financial-fraud',
    country: 'Various',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'Multi-country criminal organization',
    firstSeen: 2010,
    scope: 'Global',
    aliases: [],
    tags: ['BEC', 'financial fraud', 'wire theft'],
    knownFor: 'Pursuing BEC, wire fraud, and financial-theft operations for criminal profit.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'karakurt',
    name: 'Karakurt',
    type: 'cybercrime',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2021,
    scope: 'Global',
    aliases: [],
    tags: ['data theft', 'extortion', 'credential market'],
    knownFor: 'Executing data theft, credential harvesting, and criminal extortion operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'lunar-spider',
    name: 'Lunar Spider',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2019,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Lunar Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'monty-spider',
    name: 'Monty Spider',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2012,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Monty Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'mummy-spider',
    name: 'Mummy Spider',
    type: 'banking-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2014,
    scope: 'Global',
    aliases: ['TA542'],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'narwhal-spider',
    name: 'Narwhal Spider',
    type: 'banking-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2007,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'netsec',
    name: 'NetSec',
    type: 'state-linked-theft',
    country: 'Spain',
    city: 'Madrid',
    lat: 40.4168,
    lng: -3.7038,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Global',
    aliases: ['USDoD'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Spain.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes NetSec to Spain; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ourmine',
    name: 'OurMine',
    type: 'hacktivist',
    country: 'Saudi Arabia',
    city: 'Riyadh',
    lat: 24.7136,
    lng: 46.6753,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Regional',
    aliases: [],
    tags: ['hacktivism', 'disruption', 'defacement'],
    knownFor: 'Carrying out politically motivated disruptions, defacements, and data leak operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes OurMine to Saudi Arabia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'op-windigo',
    name: 'Operation Windigo',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Operation Windigo to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'pacha-group',
    name: 'Pacha Group',
    type: 'crypto-crime',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['cryptomining', 'financial theft'],
    knownFor: 'Targeting cryptocurrency platforms and mining infrastructure for financial gain.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Pacha Group to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'parinacota',
    name: 'Parinacota',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'planetary-reef',
    name: 'Planetary Reef',
    type: 'state-linked-theft',
    country: 'Indonesia',
    city: 'Jakarta',
    lat: -6.2088,
    lng: 106.8456,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2020,
    scope: 'Regional',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Indonesia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Planetary Reef to Indonesia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'resumelooters',
    name: 'ResumeLooters',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2023,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'retefe-gang',
    name: 'Retefe Gang',
    type: 'state-linked-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: ['Operation Emmental'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Russia.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Retefe Gang to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'roaming-mantis',
    name: 'Roaming Mantis',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'salty-spider',
    name: 'Salty Spider',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2003,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Salty Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'scully-spider',
    name: 'Scully Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: ['TA547'],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'shadow-brokers',
    name: 'Shadow Brokers',
    type: 'darknet-market',
    country: 'United States',
    city: 'Washington, DC',
    lat: 38.9072,
    lng: -77.0369,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['surveillance tools', 'illicit services'],
    knownFor: 'Providing commercial surveillance tools, exploit services, or illicit marketplace infrastructure.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Shadow Brokers to United States; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'shinyhunters',
    name: 'ShinyHunters',
    type: 'cybercrime',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['data theft', 'extortion', 'credential market'],
    knownFor: 'Executing data theft, credential harvesting, and criminal extortion operations.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'shark-spider',
    name: 'Shark Spider',
    type: 'banking-theft',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['banking malware', 'financial theft', 'credential theft'],
    knownFor: 'Executing financially motivated banking malware, credential theft, and fraud operations.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Shark Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'smoky-spider',
    name: 'Smoky Spider',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2011,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta511',
    name: 'TA511',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2018,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta516',
    name: 'TA516',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'ta554',
    name: 'TA554',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2017,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc1878',
    name: 'UNC1878',
    type: 'state-linked-theft',
    country: 'Unknown',
    city: null,
    lat: null,
    lng: null,
    originPrecision: 'No confirmed attribution',
    firstSeen: 2020,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Unknown.',
    attribution: 'No confirmed national attribution published; classified as unknown origin pending further research.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'unc5537',
    name: 'UNC5537',
    type: 'state-linked-theft',
    country: 'Canada',
    city: 'Ottawa',
    lat: 45.4215,
    lng: -75.6972,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2024,
    scope: 'Global',
    aliases: [],
    tags: ['espionage', 'targeted intrusion', 'phishing'],
    knownFor: 'Conducting state-sponsored intrusion and espionage campaigns attributed to Canada.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes UNC5537 to Canada; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'yanbian-gang',
    name: 'Yanbian Gang',
    type: 'crypto-crime',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2013,
    scope: 'Global',
    aliases: [],
    tags: ['cryptomining', 'financial theft'],
    knownFor: 'Targeting cryptocurrency platforms and mining infrastructure for financial gain.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Yanbian Gang to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'yingmob',
    name: 'Yingmob',
    type: 'crypto-crime',
    country: 'China',
    city: 'Beijing',
    lat: 39.9042,
    lng: 116.4074,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2016,
    scope: 'Global',
    aliases: [],
    tags: ['cryptomining', 'financial theft'],
    knownFor: 'Targeting cryptocurrency platforms and mining infrastructure for financial gain.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Yingmob to China; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  },
  {
    id: 'zombie-spider',
    name: 'Zombie Spider',
    type: 'ransomware',
    country: 'Russia',
    city: 'Moscow',
    lat: 55.7558,
    lng: 37.6173,
    originPrecision: 'Country-level attribution pinned to capital',
    firstSeen: 2010,
    scope: 'Global',
    aliases: [],
    tags: ['ransomware', 'double extortion', 'RaaS'],
    knownFor: 'Operating ransomware campaigns and extortion operations against enterprise and critical-sector victims.',
    attribution: 'ETDA Threat Actor Encyclopedia attributes Zombie Spider to Russia; country-level geo used for map pin.',
    sourceLabel: 'ETDA Threat Actor Encyclopedia',
  }
];
export function getTypeMeta(type) {
  return TYPE_META[type] ?? TYPE_META.hybrid;
}

export function hasMapLocation(group) {
  return Number.isFinite(group.lat) && Number.isFinite(group.lng);
}

export function getLocationLabel(group) {
  if (!hasMapLocation(group)) return group.originPrecision;
  return `${group.city}, ${group.country}`;
}

export function getDisplayName(group) {
  const parts = [group.name, ...(group.aliases ?? [])]
    .flatMap((value) => String(value).split(/\s+\/\s+/))
    .map((value) => value.trim())
    .filter(Boolean);

  const uniqueParts = [];
  const seen = new Set();

  for (const part of parts) {
    const key = part.toLowerCase();
    if (seen.has(key)) continue;
    seen.add(key);
    uniqueParts.push(part);
  }

  return uniqueParts.join(', ');
}

export function scopeWeight(scope) {
  if (scope === 'Global') return 3;
  if (scope === 'Regional') return 2;
  return 1;
}