Analytical Insights on Actors

Annual Number of Actors

Year-by-year growth of publicly tracked threat actors, reflecting the expanding scope of DPRK cyber operations and research community coverage.

Cluster Size Distribution

Number of aliases grouped under each cluster leader, indicating the degree of naming fragmentation caused by different CTI vendors tracking the same group.

Clusters by Actor Count

Top clusters ranked by number of associated aliases, revealing which groups attract the most naming diversity across the CTI community.

Clusters by Report Count

Top clusters ranked by total CTI reports documenting their activity, indicating research focus and operational visibility.

Clusters by Incident Count

Top clusters ranked by confirmed incidents, indicating which groups have been attributed to the most real-world operations.

Naming Companies by Actor Count

CTI vendors ranked by the number of distinct threat actors they have named and attributed, reflecting breadth of tracking coverage.

Annual Report Count by Cluster

Year-by-year count of published reports tagged to each major cluster (top 10 by total), including all aliases. Shows which groups have driven intelligence output over time.

Intelligence Coverage Curve

For each cluster, cumulative percentage of its reports accessible as you learn more of its code names, sorted by report volume within each cluster. Shows which single name unlocks the most intelligence and where diminishing returns begin.