What changed across countries, sectors and attack types.
This public view focuses on aggregate pressure, campaign movement and attack-type shifts. Defanged live items remain available as context, not the main story.
Domains defanged for safety. Specific brand names withheld. Why?
Pressure movement worth watching now.
Active waves · by lifecycle
Names withheld for operational reasons. Why?
Attack type movement
Pressure trend
Trend rows are public-safe aggregates from the dashboard rollup. Why?
Notable developments
Notable items are named only when safe; raw evidence and active operational details stay authenticated.
Most active kit families
Country and sector relations
Evidence examples, without raw files.
Public cards show safe artifact categories, redacted summaries and source readiness. Raw samples, ransomware, credentials, leak archives and working operational indicators stay inside authenticated workspaces.
Every public claim traces back to source runs and evidence policy.
Opening provenance badge...
Spotted a phishing URL?
Check or report it in under a minute. Public submissions do not expose identifying citizen information on this dashboard.
Quarterly landscape report
A board-readable narrative built from the public dashboard: sectors, geography, kit evolution, citizen reporting impact, disruption outcomes and next-quarter scenarios.