Interactive version at the bottom of the blog post
Recently a data matrix of tool use by Russian threat actors by BushidoUK aka Will Thomas caught my eye. When I see data like this, I immediately want to know:
- How many unique threat actors are there?
- How many unique tools are listed?
- How many tools are in each category?
- Which tools are used by many threat actors, and which are only used by one?
- Which threat actors use the same tools?
Below is a vis.js network visualisation of that data. It's interactive, so give it a try with these notes:
- Threat actors are orange dots.
- Tools are boxes, and linked to the threat actors using them.
- Hover to see connections.
- Tool colour represents tool class.
- Tools used by many actors are near the centre of the graph, those used by one one are on the outside.
- Scroll in and out with your mouse.
Many thanks to Will for this great data set!
Interactive APT tool matrix explorer
.webp)
