ADVERSARY TRACKING

Know the hand
before it's played.

We cluster activity into named adversaries and track how each one operates — their tooling, infrastructure, and targets — so your defenses are tuned to the threats actually coming for your sector.

ADVERSARY · TD-G07 “IRONVEIL”ACTIVE
MOTIVE
Espionage
NEXUS
State
SINCE
2019
OBSERVED TTPs · BY TACTIC
IA
EXE
PER
DEF
CRD
LAT
EXF
12 campaigns · 240 samplestargets · energy, gov
HOW IT WORKS

Activity becomes a named threat.

01
Attribute

Cluster overlapping activity into tracked, named adversaries.

02
Profile

Map their TTPs, tooling, and infrastructure as it evolves.

03
Anticipate

Model the likely next move against your sector and stack.

04
Hunt

Turn each profile into a proactive hunt across your environment.

ATTRIBUTION

Four facets. One actor.

Adversary, infrastructure, capability, and victim pivot off one another until the indicators converge on a single actor.

WHAT WE TRACK

The full picture on every actor.

Actor profiles

Aliases, motivation, nexus, and the sectors each group goes after.

TTP evolution

How techniques shift over time, mapped against the ATT&CK matrix.

Infrastructure

C2, domains, and hosting patterns tracked and turned into blocks.

Campaign timelines

Who they hit, when, and how — so you see the pattern, not one event.
// ADVERSARY TRACKING

Know the hand
before it's played.

We cluster activity into named adversaries and track how each one operates — their tooling, infrastructure, and targets — so your defenses are tuned to the threats actually coming for your sector.

ADVERSARY · TD-G07 “IRONVEIL”ACTIVE
MOTIVE
Espionage
NEXUS
State
SINCE
2019
OBSERVED TTPs · BY TACTIC
IA
EXE
PER
DEF
CRD
LAT
EXF
12 campaigns · 240 samplestargets · energy, gov
// TRACKING PIPELINE

Activity becomes a named threat.

PIPELINE · PER-ACTORTRACKING
01AttributeCluster overlapping activity into tracked, named adversaries.CLUSTERED
02ProfileMap their TTPs, tooling, and infrastructure as it evolves.MAPPED
03AnticipateModel the likely next move against your sector and stack.MODELED
04HuntTurn each profile into a proactive hunt across your environment.HUNTED
// ADVERSARY WATCH · LIVE

The full picture on every actor.

ADVERSARYLATEST ACTIVITYSECTORSTATUS
TD-G07 · IRONVEILspear-phish wave against grid opsENERGYACTIVE
TD-G14 · DUSKMOTHnew C2 infrastructure registeredFINANCETRACKING
TD-G02 · SALTWINDtooling overlap with TD-G07GOVLINKED
TD-G21 · GLASSHOOKdormant 40 days, infra parkedRETAILQUIET