worldmonitor/src/config/apt-groups.ts

import type { APTGroup } from '@/types';

export const APT_GROUPS: APTGroup[] = [
  // === RUSSIA ===
  {
    id: 'apt28',
    name: 'APT28',
    aka: 'Fancy Bear / Forest Blizzard / Sednit',
    sponsor: 'Russia (GRU Unit 26165)',
    lat: 55.75, lon: 37.6,
    mitreId: 'G0007', mitreUrl: 'https://attack.mitre.org/groups/G0007/',
    description: 'GRU-linked group active since 2004. Compromised the DNC and Hillary Clinton campaign in 2016. Targets governments, military, and defense contractors across NATO countries.',
    tactics: ['Initial Access', 'Persistence', 'Credential Access', 'Exfiltration'],
    targetSectors: ['Government', 'Defense', 'NATO', 'Energy', 'Media'],
    active: true,
  },
  {
    id: 'apt29',
    name: 'APT29',
    aka: 'Cozy Bear / Midnight Blizzard / NOBELIUM',
    sponsor: 'Russia (SVR)',
    lat: 55.8, lon: 37.3,
    mitreId: 'G0016', mitreUrl: 'https://attack.mitre.org/groups/G0016/',
    description: 'SVR foreign intelligence group responsible for the SolarWinds supply chain compromise. Specializes in stealthy long-term access to diplomatic and government targets.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Think Tanks', 'Healthcare', 'Technology', 'Diplomatic'],
    active: true,
  },
  {
    id: 'sandworm',
    name: 'Sandworm Team',
    aka: 'Voodoo Bear / BlackEnergy / APT44',
    sponsor: 'Russia (GRU Unit 74455)',
    lat: 55.7, lon: 37.5,
    mitreId: 'G0034', mitreUrl: 'https://attack.mitre.org/groups/G0034/',
    description: 'Most destructive nation-state actor on record. Responsible for Ukraine power grid attacks, NotPetya ($10B damages), and Olympic Destroyer. Specializes in wiper malware against critical infrastructure.',
    tactics: ['Initial Access', 'Execution', 'Impact', 'Defense Evasion', 'Lateral Movement'],
    targetSectors: ['Energy', 'Critical Infrastructure', 'Government', 'Finance', 'Transportation'],
    active: true,
  },
  {
    id: 'turla',
    name: 'Turla',
    aka: 'Snake / Uroburos / Venomous Bear',
    sponsor: 'Russia (FSB)',
    lat: 55.75, lon: 37.62,
    mitreId: 'G0010', mitreUrl: 'https://attack.mitre.org/groups/G0010/',
    description: 'Highly sophisticated FSB group active since the 1990s. Known for hijacking satellite links for C2 and compromising other APT infrastructure to piggyback on their access.',
    tactics: ['Persistence', 'Command and Control', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Defense', 'Embassies', 'Research', 'Military'],
    active: true,
  },
  {
    id: 'dragonfly',
    name: 'Dragonfly',
    aka: 'Berserk Bear / Energetic Bear / Ghost Blizzard',
    sponsor: 'Russia (FSB Center 16)',
    lat: 55.6, lon: 37.4,
    mitreId: 'G0035', mitreUrl: 'https://attack.mitre.org/groups/G0035/',
    description: 'FSB group targeting energy and ICS sectors since 2010 via supply chain, spearphishing, and drive-by attacks. Has pre-positioned for potential disruptive attacks on Western power grids.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection'],
    targetSectors: ['Energy', 'ICS', 'Defense', 'Aviation', 'Government'],
    active: true,
  },
  {
    id: 'gamaredon',
    name: 'Gamaredon Group',
    aka: 'Primitive Bear / ACTINIUM / Armageddon',
    sponsor: 'Russia (FSB Center 18)',
    lat: 44.95, lon: 34.1,
    mitreId: 'G0047', mitreUrl: 'https://attack.mitre.org/groups/G0047/',
    description: 'FSB group operating from occupied Crimea targeting Ukrainian government, military, and NGOs since 2013 with high-volume, persistent campaigns.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'NGO', 'Law Enforcement'],
    active: true,
  },
  {
    id: 'temp_veles',
    name: 'TEMP.Veles',
    aka: 'XENOTIME',
    sponsor: 'Russia (CNIIHM)',
    lat: 55.5, lon: 37.3,
    mitreId: 'G0088', mitreUrl: 'https://attack.mitre.org/groups/G0088/',
    description: 'Russia-based group that deployed TRITON malware against industrial safety systems (SIS) at a Middle East petrochemical facility — the first malware designed to directly attack safety instrumented systems.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'],
    targetSectors: ['Oil & Gas', 'ICS', 'Critical Infrastructure'],
    active: false,
  },
  {
    id: 'ember_bear',
    name: 'Ember Bear',
    aka: 'Cadet Blizzard / UAC-0056 / DEV-0586',
    sponsor: 'Russia (GRU Unit 29155)',
    lat: 55.6, lon: 37.7,
    mitreId: 'G1003', mitreUrl: 'https://attack.mitre.org/groups/G1003/',
    description: 'GRU Unit 29155 responsible for WhisperGate destructive wiper attacks against Ukraine in January 2022, just weeks before the full invasion. Also targets European critical infrastructure.',
    tactics: ['Initial Access', 'Execution', 'Impact', 'Defense Evasion'],
    targetSectors: ['Government', 'Telecommunications', 'Critical Infrastructure'],
    active: true,
  },
  {
    id: 'saint_bear',
    name: 'Saint Bear',
    aka: 'Storm-0587 / Lorec53 / TA471',
    sponsor: 'Russia (GRU-linked)',
    lat: 55.65, lon: 37.55,
    mitreId: 'G1031', mitreUrl: 'https://attack.mitre.org/groups/G1031/',
    description: 'Russian-nexus actor active since 2021 primarily targeting Ukraine and Georgia with Saint Bot RAT and OutSteel infostealer. Distinct from Ember Bear despite some overlap.',
    tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'NGO'],
    active: true,
  },
  {
    id: 'star_blizzard',
    name: 'Star Blizzard',
    aka: 'SEABORGIUM / Callisto Group / COLDRIVER',
    sponsor: 'Russia (FSB)',
    lat: 59.95, lon: 30.3,
    mitreId: 'G1033', mitreUrl: 'https://attack.mitre.org/groups/G1033/',
    description: 'FSB-linked espionage and influence group active since 2019, conducting persistent phishing and credential theft against NATO governments, academia, defense, and think tanks.',
    tactics: ['Initial Access', 'Credential Access', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Academia', 'Defense', 'NGO', 'Think Tanks'],
    active: true,
  },
  {
    id: 'allanite',
    name: 'ALLANITE',
    aka: 'Palmetto Fusion',
    sponsor: 'Russia (suspected)',
    lat: 55.4, lon: 37.2,
    mitreId: 'G1000', mitreUrl: 'https://attack.mitre.org/groups/G1000/',
    description: 'Suspected Russian group primarily targeting US and UK electric utility sectors. Maintains ICS access for intelligence gathering without yet exhibiting destructive capabilities.',
    tactics: ['Initial Access', 'Persistence', 'Collection'],
    targetSectors: ['Energy', 'Electric Utilities', 'ICS'],
    active: true,
  },
  {
    id: 'indrik_spider',
    name: 'Indrik Spider',
    aka: 'Evil Corp / Manatee Tempest',
    sponsor: 'Russia (Criminal)',
    lat: 55.5, lon: 37.8,
    mitreId: 'G0119', mitreUrl: 'https://attack.mitre.org/groups/G0119/',
    description: 'Russia-based cybercriminal group behind Dridex banking trojan and multiple ransomware strains. Sanctioned by US Treasury in 2019 but continues operating under new brand names.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact', 'Exfiltration'],
    targetSectors: ['Finance', 'Healthcare', 'Government', 'Manufacturing'],
    active: true,
  },
  {
    id: 'nomadic_octopus',
    name: 'Nomadic Octopus',
    aka: 'DustSquad',
    sponsor: 'Russia (suspected)',
    lat: 55.3, lon: 37.9,
    mitreId: 'G0133', mitreUrl: 'https://attack.mitre.org/groups/G0133/',
    description: 'Russian-speaking espionage group primarily targeting Central Asian governments, diplomatic missions, and individuals since 2014 using Android and Windows malware.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Diplomatic', 'NGO'],
    active: true,
  },
  {
    id: 'inception',
    name: 'Inception',
    aka: 'Inception Framework / Cloud Atlas',
    sponsor: 'Russia (suspected)',
    lat: 55.2, lon: 37.1,
    mitreId: 'G0100', mitreUrl: 'https://attack.mitre.org/groups/G0100/',
    description: 'Cyber espionage group active since 2014 primarily targeting Russia, but also active in the US, Europe, Asia, Africa, and the Middle East across multiple industries and government entities.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Finance', 'Energy', 'Research'],
    active: true,
  },
  {
    id: 'redcurl',
    name: 'RedCurl',
    aka: 'RedCurl',
    sponsor: 'Russia (suspected)',
    lat: 55.9, lon: 37.8,
    mitreId: 'G1039', mitreUrl: 'https://attack.mitre.org/groups/G1039/',
    description: 'Russian-speaking corporate espionage group active since 2018 targeting travel, insurance, and banking companies in Ukraine, Canada, and the UK for intellectual property and financial data theft.',
    tactics: ['Initial Access', 'Discovery', 'Collection', 'Exfiltration'],
    targetSectors: ['Travel', 'Insurance', 'Banking', 'Legal'],
    active: true,
  },

  // === CHINA ===
  {
    id: 'apt1',
    name: 'APT1',
    aka: 'Comment Crew / Comment Panda',
    sponsor: 'China (PLA Unit 61398)',
    lat: 31.2, lon: 121.5,
    mitreId: 'G0006', mitreUrl: 'https://attack.mitre.org/groups/G0006/',
    description: 'PLA Unit 61398 exposed by Mandiant in 2013. Conducted massive IP theft against 141 organizations over 7 years, exfiltrating terabytes of data across 20 industries.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Aerospace', 'Defense', 'Energy', 'Telecommunications', 'Manufacturing'],
    active: false,
  },
  {
    id: 'apt3',
    name: 'APT3',
    aka: 'Gothic Panda / Buckeye / UPS Team',
    sponsor: 'China (MSS)',
    lat: 23.1, lon: 113.3,
    mitreId: 'G0022', mitreUrl: 'https://attack.mitre.org/groups/G0022/',
    description: 'MSS group responsible for Operation Clandestine Fox. Was found repurposing NSA TAO hacking tools before the Shadow Brokers leak. Shifted focus to Hong Kong political organizations by 2015.',
    tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Defense Evasion', 'Exfiltration'],
    targetSectors: ['Aerospace', 'Defense', 'Construction', 'Engineering', 'Technology'],
    active: false,
  },
  {
    id: 'apt5',
    name: 'APT5',
    aka: 'Mulberry Typhoon / Keyhole Panda / UNC2630',
    sponsor: 'China (MSS)',
    lat: 39.9, lon: 116.3,
    mitreId: 'G1023', mitreUrl: 'https://attack.mitre.org/groups/G1023/',
    description: 'China-based espionage actor active since 2007 targeting telecoms, aerospace, and defense with advanced tradecraft and zero-day exploits against networking devices.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Telecommunications', 'Aerospace', 'Defense'],
    active: true,
  },
  {
    id: 'apt10',
    name: 'menuPass',
    aka: 'APT10 / Stone Panda / Cicada',
    sponsor: 'China (MSS Tianjin)',
    lat: 39.1, lon: 117.2,
    mitreId: 'G0045', mitreUrl: 'https://attack.mitre.org/groups/G0045/',
    description: 'MSS group conducting Cloud Hopper — a global attack on managed service providers to gain upstream access to hundreds of client organizations simultaneously across 45+ countries.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Managed Service Providers', 'Healthcare', 'Defense', 'Aviation', 'Satellite'],
    active: true,
  },
  {
    id: 'apt12',
    name: 'APT12',
    aka: 'IXESHE / Numbered Panda / DynCalc',
    sponsor: 'China',
    lat: 39.9, lon: 116.4,
    mitreId: 'G0005', mitreUrl: 'https://attack.mitre.org/groups/G0005/',
    description: 'China-attributed threat group targeting media outlets, high-tech companies, and multiple governments using spearphishing campaigns.',
    tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'],
    targetSectors: ['Media', 'Technology', 'Government'],
    active: false,
  },
  {
    id: 'apt16',
    name: 'APT16',
    aka: 'APT16',
    sponsor: 'China',
    lat: 31.2, lon: 121.4,
    mitreId: 'G0023', mitreUrl: 'https://attack.mitre.org/groups/G0023/',
    description: 'China-based group that launched spearphishing campaigns targeting Japanese and Taiwanese organizations.',
    tactics: ['Initial Access', 'Execution', 'Collection'],
    targetSectors: ['Government', 'Technology'],
    active: false,
  },
  {
    id: 'apt17',
    name: 'APT17',
    aka: 'Deputy Dog',
    sponsor: 'China',
    lat: 39.9, lon: 116.5,
    mitreId: 'G0025', mitreUrl: 'https://attack.mitre.org/groups/G0025/',
    description: 'China-based group targeting US government entities, defense industry, law firms, IT companies, mining companies, and NGOs.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Defense', 'Law Firms', 'Mining', 'NGO'],
    active: false,
  },
  {
    id: 'apt18',
    name: 'APT18',
    aka: 'Dynamite Panda / TG-0416',
    sponsor: 'China',
    lat: 30.6, lon: 104.1,
    mitreId: 'G0026', mitreUrl: 'https://attack.mitre.org/groups/G0026/',
    description: 'Threat group active since at least 2009 targeting technology, manufacturing, human rights groups, government, and medical sectors.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Technology', 'Manufacturing', 'Healthcare', 'Government', 'Human Rights'],
    active: false,
  },
  {
    id: 'apt19',
    name: 'APT19',
    aka: 'Codoso / C0d0so0 / Sunshop Group',
    sponsor: 'China',
    lat: 39.9, lon: 116.2,
    mitreId: 'G0073', mitreUrl: 'https://attack.mitre.org/groups/G0073/',
    description: 'Chinese group targeting defense, finance, energy, pharma, telecoms, education, manufacturing, and legal services. In 2017 targeted seven law and investment firms.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Exfiltration'],
    targetSectors: ['Defense', 'Finance', 'Energy', 'Pharmaceutical', 'Legal'],
    active: false,
  },
  {
    id: 'apt30',
    name: 'APT30',
    aka: 'APT30',
    sponsor: 'China (suspected)',
    lat: 22.5, lon: 114.1,
    mitreId: 'G0013', mitreUrl: 'https://attack.mitre.org/groups/G0013/',
    description: 'Suspected Chinese government-associated group. Shares some characteristics with Naikon but appears to be a distinct entity.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Defense', 'Technology'],
    active: false,
  },
  {
    id: 'apt32',
    name: 'APT32',
    aka: 'OceanLotus / Canvas Cyclone / BISMUTH',
    sponsor: 'Vietnam',
    lat: 21.0, lon: 105.8,
    mitreId: 'G0050', mitreUrl: 'https://attack.mitre.org/groups/G0050/',
    description: 'Suspected Vietnam-based group active since 2014 targeting foreign governments, dissidents, and journalists with strategic web compromises and a strong focus on Southeast Asia.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Media', 'Dissidents', 'Manufacturing', 'Hospitality'],
    active: true,
  },
  {
    id: 'apt40',
    name: 'Leviathan',
    aka: 'APT40 / BRONZE MOHAWK / Gingham Typhoon',
    sponsor: 'China (MSS Hainan)',
    lat: 20.0, lon: 110.3,
    mitreId: 'G0065', mitreUrl: 'https://attack.mitre.org/groups/G0065/',
    description: 'MSS Hainan bureau group targeting maritime, naval defense, and aviation. Actively exploits newly disclosed vulnerabilities within days of publication. Indicted by US DOJ in 2021.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Naval Defense', 'Maritime', 'Aviation', 'Research', 'Government'],
    active: true,
  },
  {
    id: 'apt41',
    name: 'APT41',
    aka: 'Double Dragon / Wicked Panda / BARIUM',
    sponsor: 'China (MSS)',
    lat: 38.0, lon: 118.0,
    mitreId: 'G0096', mitreUrl: 'https://attack.mitre.org/groups/G0096/',
    description: 'Dual-purpose Chinese group conducting state-sponsored espionage and financially motivated cybercrime. Unique in targeting healthcare and tech for IP theft alongside ransomware operations.',
    tactics: ['Initial Access', 'Execution', 'Privilege Escalation', 'Collection', 'Exfiltration'],
    targetSectors: ['Healthcare', 'Telecommunications', 'Technology', 'Finance', 'Government'],
    active: true,
  },
  {
    id: 'hafnium',
    name: 'HAFNIUM',
    aka: 'Silk Typhoon',
    sponsor: 'China (MSS)',
    lat: 39.9, lon: 116.4,
    mitreId: 'G0125', mitreUrl: 'https://attack.mitre.org/groups/G0125/',
    description: 'Responsible for the 2021 Microsoft Exchange Server zero-day exploitation affecting 250,000+ servers globally. Targets US defense contractors, law firms, and infectious disease researchers.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Defense Evasion', 'Exfiltration'],
    targetSectors: ['Defense Contractors', 'Law Firms', 'Research', 'NGO', 'Government'],
    active: true,
  },
  {
    id: 'volt_typhoon',
    name: 'Volt Typhoon',
    aka: 'Bronze Silhouette / Vanguard Panda',
    sponsor: 'China (PLA)',
    lat: 32.0, lon: 118.8,
    mitreId: 'G1017', mitreUrl: 'https://attack.mitre.org/groups/G1017/',
    description: 'Pre-positioning group focused on US critical infrastructure for potential disruption in a Taiwan conflict. Uses living-off-the-land techniques exclusively, leaving minimal forensic traces.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Command and Control', 'Impact'],
    targetSectors: ['Critical Infrastructure', 'Energy', 'Water', 'Telecommunications', 'Transportation'],
    active: true,
  },
  {
    id: 'salt_typhoon',
    name: 'Salt Typhoon',
    aka: 'Salt Typhoon',
    sponsor: 'China (PRC State-backed)',
    lat: 39.9, lon: 116.5,
    mitreId: 'G1045', mitreUrl: 'https://attack.mitre.org/groups/G1045/',
    description: 'PRC state-backed actor responsible for numerous compromises of major US telecommunications and internet service providers since 2019, including wiretapping systems.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Telecommunications', 'ISP', 'Government'],
    active: true,
  },
  {
    id: 'mustang_panda',
    name: 'Mustang Panda',
    aka: 'TA416 / RedDelta / BRONZE PRESIDENT / EARTH PRETA',
    sponsor: 'China',
    lat: 30.6, lon: 104.0,
    mitreId: 'G0129', mitreUrl: 'https://attack.mitre.org/groups/G0129/',
    description: 'China-based espionage group active since 2012 using tailored phishing lures against governments, diplomatic organizations, religious institutions, and NGOs globally.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Diplomatic', 'NGO', 'Religious', 'Research'],
    active: true,
  },
  {
    id: 'axiom',
    name: 'Axiom',
    aka: 'Group 72',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 116.3,
    mitreId: 'G0001', mitreUrl: 'https://attack.mitre.org/groups/G0001/',
    description: 'Suspected Chinese espionage group targeting aerospace, defense, government, manufacturing, and media sectors since at least 2008.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Aerospace', 'Defense', 'Government', 'Manufacturing', 'Media'],
    active: false,
  },
  {
    id: 'deep_panda',
    name: 'Deep Panda',
    aka: 'Shell Crew / Black Vine / KungFu Kittens',
    sponsor: 'China',
    lat: 31.2, lon: 121.3,
    mitreId: 'G0009', mitreUrl: 'https://attack.mitre.org/groups/G0009/',
    description: 'Suspected Chinese group attributed to the Anthem healthcare breach affecting 80M Americans. Also known as Black Vine. Some overlap with APT19.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Healthcare', 'Defense', 'Finance', 'Government', 'Telecommunications'],
    active: false,
  },
  {
    id: 'gallium',
    name: 'GALLIUM',
    aka: 'Granite Typhoon',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 116.2,
    mitreId: 'G0093', mitreUrl: 'https://attack.mitre.org/groups/G0093/',
    description: 'Cyberespionage group active since 2012 known for Operation Soft Cell — a long-term campaign targeting global telecommunications providers for subscriber data collection.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'],
    targetSectors: ['Telecommunications', 'Finance', 'Government'],
    active: true,
  },
  {
    id: 'ke3chang',
    name: 'Ke3chang',
    aka: 'APT15 / Vixen Panda / NICKEL / Nylon Typhoon',
    sponsor: 'China',
    lat: 39.9, lon: 116.6,
    mitreId: 'G0004', mitreUrl: 'https://attack.mitre.org/groups/G0004/',
    description: 'Chinese group active since 2010 targeting oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Oil & Gas', 'Government', 'Diplomatic', 'Military', 'NGO'],
    active: true,
  },
  {
    id: 'naikon',
    name: 'Naikon',
    aka: 'Naikon',
    sponsor: 'China (PLA Unit 78020)',
    lat: 30.6, lon: 104.1,
    mitreId: 'G0019', mitreUrl: 'https://attack.mitre.org/groups/G0019/',
    description: 'PLA Chengdu unit primarily targeting Southeast Asian governments and militaries as well as UN bodies since at least 2010.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'UN Bodies', 'ASEAN'],
    active: true,
  },
  {
    id: 'elderwood',
    name: 'Elderwood',
    aka: 'Elderwood Gang / Sneaky Panda',
    sponsor: 'China',
    lat: 39.9, lon: 116.1,
    mitreId: 'G0066', mitreUrl: 'https://attack.mitre.org/groups/G0066/',
    description: 'Suspected Chinese group responsible for the 2009 Google intrusion (Operation Aurora). Targets defense, supply chain, human rights NGOs, and IT service providers.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Defense', 'Supply Chain', 'Human Rights', 'IT Services'],
    active: false,
  },
  {
    id: 'blacktech',
    name: 'BlackTech',
    aka: 'Palmerworm',
    sponsor: 'China (suspected)',
    lat: 25.03, lon: 121.5,
    mitreId: 'G0098', mitreUrl: 'https://attack.mitre.org/groups/G0098/',
    description: 'Suspected Chinese group primarily targeting Taiwan, Japan, and Hong Kong organizations in media, construction, engineering, electronics, and financial sectors since 2013.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Media', 'Construction', 'Engineering', 'Electronics', 'Finance'],
    active: true,
  },
  {
    id: 'bronze_butler',
    name: 'BRONZE BUTLER',
    aka: 'REDBALDKNIGHT / Tick',
    sponsor: 'China',
    lat: 39.9, lon: 116.7,
    mitreId: 'G0060', mitreUrl: 'https://attack.mitre.org/groups/G0060/',
    description: 'Chinese-origin group active since 2008 primarily targeting Japanese organizations in government, biotechnology, electronics manufacturing, and industrial chemistry.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Biotechnology', 'Electronics', 'Industrial Chemistry'],
    active: true,
  },
  {
    id: 'threat_group_3390',
    name: 'Threat Group-3390',
    aka: 'APT27 / Iron Tiger / LuckyMouse / Linen Typhoon',
    sponsor: 'China',
    lat: 39.9, lon: 116.8,
    mitreId: 'G0027', mitreUrl: 'https://attack.mitre.org/groups/G0027/',
    description: 'Chinese group using strategic web compromises since at least 2010 targeting aerospace, government, defense, technology, energy, manufacturing, and gambling sectors.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Aerospace', 'Government', 'Defense', 'Technology', 'Energy'],
    active: true,
  },
  {
    id: 'putter_panda',
    name: 'Putter Panda',
    aka: 'APT2 / MSUpdater',
    sponsor: 'China (PLA Unit 61486)',
    lat: 31.3, lon: 121.4,
    mitreId: 'G0024', mitreUrl: 'https://attack.mitre.org/groups/G0024/',
    description: 'Chinese threat group attributed to PLA Unit 61486 of the 3rd General Staff Department targeting government and defense organizations.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Defense', 'Satellite', 'Aerospace'],
    active: false,
  },
  {
    id: 'lotus_blossom',
    name: 'Lotus Blossom',
    aka: 'DRAGONFISH / Spring Dragon / Bilbug / Thrip',
    sponsor: 'China',
    lat: 22.5, lon: 114.0,
    mitreId: 'G0030', mitreUrl: 'https://attack.mitre.org/groups/G0030/',
    description: 'Long-standing Chinese threat group targeting Asian governments and related organizations since at least 2009, including digital certificate issuers.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Defense', 'Telecommunications', 'Digital Certificates'],
    active: true,
  },
  {
    id: 'aquatic_panda',
    name: 'Aquatic Panda',
    aka: 'Aquatic Panda',
    sponsor: 'China (suspected)',
    lat: 30.6, lon: 104.2,
    mitreId: 'G0143', mitreUrl: 'https://attack.mitre.org/groups/G0143/',
    description: 'Suspected Chinese group with dual intelligence collection and industrial espionage missions, primarily targeting telecoms, technology, and government since 2020.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Telecommunications', 'Technology', 'Government'],
    active: true,
  },
  {
    id: 'chimera',
    name: 'Chimera',
    aka: 'Chimera',
    sponsor: 'China (suspected)',
    lat: 25.03, lon: 121.4,
    mitreId: 'G0114', mitreUrl: 'https://attack.mitre.org/groups/G0114/',
    description: 'Suspected Chinese group targeting Taiwan semiconductor industry and airline data since at least 2018 using Cobalt Strike and living-off-the-land techniques.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'],
    targetSectors: ['Semiconductor', 'Airline', 'Technology'],
    active: true,
  },
  {
    id: 'earth_lusca',
    name: 'Earth Lusca',
    aka: 'TAG-22 / Charcoal Typhoon / CHROMIUM',
    sponsor: 'China (suspected)',
    lat: 22.3, lon: 114.2,
    mitreId: 'G1006', mitreUrl: 'https://attack.mitre.org/groups/G1006/',
    description: 'Chinese espionage group active since 2019 targeting governments, media, gambling, COVID-19 research, and cryptocurrency platforms across 20+ countries.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Media', 'Gambling', 'Research', 'Cryptocurrency'],
    active: true,
  },
  {
    id: 'cinnamon_tempest',
    name: 'Cinnamon Tempest',
    aka: 'DEV-0401 / Emperor Dragonfly / BRONZE STARLIGHT',
    sponsor: 'China',
    lat: 39.9, lon: 116.9,
    mitreId: 'G1021', mitreUrl: 'https://attack.mitre.org/groups/G1021/',
    description: 'Chinese group deploying multiple ransomware strains based on leaked Babuk source code since 2021, likely motivated by IP theft rather than financial gain.',
    tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact'],
    targetSectors: ['Technology', 'Manufacturing', 'Healthcare', 'Government'],
    active: true,
  },
  {
    id: 'daggerfly',
    name: 'Daggerfly',
    aka: 'Evasive Panda / BRONZE HIGHLAND',
    sponsor: 'China (PRC-linked)',
    lat: 30.6, lon: 104.3,
    mitreId: 'G1034', mitreUrl: 'https://attack.mitre.org/groups/G1034/',
    description: 'PRC-linked APT active since 2012 targeting individuals, government/NGO entities, and telecoms in Asia and Africa, exclusively using MgBot malware.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'NGO', 'Telecommunications'],
    active: true,
  },
  {
    id: 'admin338',
    name: 'admin@338',
    aka: 'admin@338',
    sponsor: 'China',
    lat: 39.9, lon: 116.1,
    mitreId: 'G0018', mitreUrl: 'https://attack.mitre.org/groups/G0018/',
    description: 'China-based group using newsworthy events as lures to deliver publicly available RATs like PoisonIvy, primarily targeting financial, economic, and trade policy organizations.',
    tactics: ['Initial Access', 'Execution', 'Collection'],
    targetSectors: ['Finance', 'Trade Policy', 'Government', 'Think Tanks'],
    active: false,
  },
  {
    id: 'aoqin_dragon',
    name: 'Aoqin Dragon',
    aka: 'Aoqin Dragon',
    sponsor: 'China (suspected)',
    lat: 22.3, lon: 114.1,
    mitreId: 'G1007', mitreUrl: 'https://attack.mitre.org/groups/G1007/',
    description: 'Suspected Chinese espionage group active since 2013 primarily targeting government, education, and telecoms in Australia, Cambodia, Hong Kong, Singapore, and Vietnam.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Education', 'Telecommunications'],
    active: true,
  },
  {
    id: 'backdoor_diplomacy',
    name: 'BackdoorDiplomacy',
    aka: 'BackdoorDiplomacy',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 116.4,
    mitreId: 'G0135', mitreUrl: 'https://attack.mitre.org/groups/G0135/',
    description: 'Cyber espionage group active since 2017 targeting Ministries of Foreign Affairs and telecom companies in Africa, Europe, Middle East, and Asia.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Foreign Affairs', 'Telecommunications', 'Government'],
    active: true,
  },
  {
    id: 'dragonok',
    name: 'DragonOK',
    aka: 'DragonOK',
    sponsor: 'China',
    lat: 39.9, lon: 117.0,
    mitreId: 'G0017', mitreUrl: 'https://attack.mitre.org/groups/G0017/',
    description: 'Chinese group targeting Japanese organizations with phishing. Uses PlugX, PoisonIvy, and FormerFirstRat. Thought to have direct or indirect relationship with Moafee.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Technology', 'Manufacturing'],
    active: false,
  },
  {
    id: 'gallmaker',
    name: 'Gallmaker',
    aka: 'Gallmaker',
    sponsor: 'Unknown (Middle East)',
    lat: 33.3, lon: 44.4,
    mitreId: 'G0084', mitreUrl: 'https://attack.mitre.org/groups/G0084/',
    description: 'Cyberespionage group active since at least 2017 targeting victims in the Middle East, with a focus on defense, military, and government sectors.',
    tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'],
    targetSectors: ['Defense', 'Military', 'Government'],
    active: false,
  },
  {
    id: 'indigozebra',
    name: 'IndigoZebra',
    aka: 'IndigoZebra',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 116.5,
    mitreId: 'G0136', mitreUrl: 'https://attack.mitre.org/groups/G0136/',
    description: 'Suspected Chinese cyber espionage group targeting Central Asian governments since at least 2014.',
    tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Diplomatic'],
    active: false,
  },
  {
    id: 'luminousmoth',
    name: 'LuminousMoth',
    aka: 'LuminousMoth',
    sponsor: 'China',
    lat: 39.9, lon: 116.3,
    mitreId: 'G1014', mitreUrl: 'https://attack.mitre.org/groups/G1014/',
    description: 'Chinese-speaking espionage group active since 2020 targeting high-profile government entities in Myanmar, Philippines, Thailand, and Southeast Asia.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Diplomatic'],
    active: true,
  },
  {
    id: 'moafee',
    name: 'Moafee',
    aka: 'Moafee',
    sponsor: 'China (Guangdong)',
    lat: 23.1, lon: 113.2,
    mitreId: 'G0002', mitreUrl: 'https://attack.mitre.org/groups/G0002/',
    description: 'Chinese group from Guangdong with overlapping TTPs and custom tools with DragonOK, suggesting a direct or indirect relationship.',
    tactics: ['Initial Access', 'Execution', 'Collection'],
    targetSectors: ['Government', 'Technology'],
    active: false,
  },
  {
    id: 'mofang',
    name: 'Mofang',
    aka: 'Mofang',
    sponsor: 'China (likely)',
    lat: 39.9, lon: 116.6,
    mitreId: 'G0103', mitreUrl: 'https://attack.mitre.org/groups/G0103/',
    description: 'Likely Chinese group known for imitating victim infrastructure. Targeting government and critical infrastructure in Myanmar plus military, automobile, and weapons industries since 2012.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Critical Infrastructure', 'Military', 'Automobile'],
    active: false,
  },
  {
    id: 'pitty_tiger',
    name: 'PittyTiger',
    aka: 'PittyTiger',
    sponsor: 'China',
    lat: 39.9, lon: 116.7,
    mitreId: 'G0011', mitreUrl: 'https://attack.mitre.org/groups/G0011/',
    description: 'Chinese group using multiple malware types for command and control to maintain persistent access to victim networks.',
    tactics: ['Initial Access', 'Persistence', 'Command and Control'],
    targetSectors: ['Government', 'Defense', 'Technology'],
    active: false,
  },
  {
    id: 'rancor',
    name: 'Rancor',
    aka: 'Rancor',
    sponsor: 'China (suspected)',
    lat: 22.3, lon: 114.2,
    mitreId: 'G0075', mitreUrl: 'https://attack.mitre.org/groups/G0075/',
    description: 'Threat group leading targeted campaigns against Southeast Asia using politically-motivated lures to deliver malicious documents.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Military', 'Political Organizations'],
    active: true,
  },
  {
    id: 'redecho',
    name: 'RedEcho',
    aka: 'RedEcho',
    sponsor: 'China (PRC-linked)',
    lat: 39.9, lon: 116.2,
    mitreId: 'G1042', mitreUrl: 'https://attack.mitre.org/groups/G1042/',
    description: 'PRC-linked actor with long-running intrusions into Indian critical infrastructure. Associated with ShadowPad malware and overlaps with APT41.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Critical Infrastructure', 'Energy', 'Government'],
    active: true,
  },
  {
    id: 'rocke',
    name: 'Rocke',
    aka: 'Iron Cybercrime Group',
    sponsor: 'China (suspected)',
    lat: 30.6, lon: 104.4,
    mitreId: 'G0106', mitreUrl: 'https://attack.mitre.org/groups/G0106/',
    description: 'Suspected Chinese cryptojacking group stealing victim system resources for cryptocurrency mining using the email address rocke@live.cn.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'],
    targetSectors: ['Cloud', 'Technology', 'General'],
    active: false,
  },
  {
    id: 'scarlet_mimic',
    name: 'Scarlet Mimic',
    aka: 'Scarlet Mimic',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 116.3,
    mitreId: 'G0029', mitreUrl: 'https://attack.mitre.org/groups/G0029/',
    description: 'Group targeting minority rights activists. Motivations appear aligned with the Chinese government. Some IP overlap with Putter Panda.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Civil Society', 'Human Rights', 'Minority Groups'],
    active: false,
  },
  {
    id: 'suckfly',
    name: 'Suckfly',
    aka: 'Suckfly',
    sponsor: 'China',
    lat: 39.9, lon: 117.0,
    mitreId: 'G0039', mitreUrl: 'https://attack.mitre.org/groups/G0039/',
    description: 'China-based threat group active since at least 2014 conducting targeted intrusion campaigns.',
    tactics: ['Initial Access', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Technology', 'Defense'],
    active: false,
  },
  {
    id: 'ta459',
    name: 'TA459',
    aka: 'TA459',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 116.6,
    mitreId: 'G0062', mitreUrl: 'https://attack.mitre.org/groups/G0062/',
    description: 'China-linked group targeting Russia, Belarus, Mongolia, and other countries using spearphishing with RATs.',
    tactics: ['Initial Access', 'Execution', 'Collection'],
    targetSectors: ['Government', 'Military', 'Finance'],
    active: false,
  },
  {
    id: 'thrip',
    name: 'Thrip',
    aka: 'Thrip',
    sponsor: 'China',
    lat: 22.5, lon: 114.1,
    mitreId: 'G0076', mitreUrl: 'https://attack.mitre.org/groups/G0076/',
    description: 'Espionage group targeting satellite communications, telecoms, and defense contractors in the US and Southeast Asia using both custom malware and living-off-the-land techniques.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Satellite', 'Telecommunications', 'Defense'],
    active: true,
  },
  {
    id: 'toddycat',
    name: 'ToddyCat',
    aka: 'ToddyCat',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 116.3,
    mitreId: 'G1022', mitreUrl: 'https://attack.mitre.org/groups/G1022/',
    description: 'Sophisticated group active since 2020 using custom loaders and multi-stage infection chains against government and military targets in Europe and Asia.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Technology'],
    active: true,
  },
  {
    id: 'tonto_team',
    name: 'Tonto Team',
    aka: 'Earth Akhlut / CactusPete / Karma Panda',
    sponsor: 'China (suspected)',
    lat: 39.9, lon: 117.1,
    mitreId: 'G0131', mitreUrl: 'https://attack.mitre.org/groups/G0131/',
    description: 'Suspected Chinese state-sponsored espionage group targeting Russia, Japan, South Korea, and US entities in government, military, finance, and energy sectors.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Finance', 'Energy'],
    active: true,
  },

  // === NORTH KOREA ===
  {
    id: 'lazarus',
    name: 'Lazarus Group',
    aka: 'Hidden Cobra / ZINC / Diamond Sleet',
    sponsor: 'North Korea (RGB)',
    lat: 39.0, lon: 125.75,
    mitreId: 'G0032', mitreUrl: 'https://attack.mitre.org/groups/G0032/',
    description: 'DPRK group responsible for the Sony Pictures hack, $81M Bangladesh Bank heist, and WannaCry. Primary mission is sanctions evasion through cryptocurrency theft to fund the weapons program.',
    tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact', 'Exfiltration'],
    targetSectors: ['Finance', 'Cryptocurrency', 'Defense', 'Media', 'Critical Infrastructure'],
    active: true,
  },
  {
    id: 'kimsuky',
    name: 'Kimsuky',
    aka: 'Velvet Chollima / Emerald Sleet / APT43 / TA427',
    sponsor: 'North Korea (RGB)',
    lat: 39.0, lon: 125.8,
    mitreId: 'G0094', mitreUrl: 'https://attack.mitre.org/groups/G0094/',
    description: 'DPRK intelligence collection group targeting Korean Peninsula policy experts, nuclear specialists, and sanctions officials. Uses highly tailored spearphishing posing as journalists and academics.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration', 'Reconnaissance'],
    targetSectors: ['Government', 'Think Tanks', 'Nuclear Research', 'Defense', 'Academia'],
    active: true,
  },
  {
    id: 'apt37',
    name: 'APT37',
    aka: 'Reaper / ScarCruft / InkySquid / Ricochet Chollima',
    sponsor: 'North Korea (RGB)',
    lat: 37.5, lon: 126.9,
    mitreId: 'G0067', mitreUrl: 'https://attack.mitre.org/groups/G0067/',
    description: 'DPRK group targeting South Korean defectors, journalists, and human rights activists using zero-day exploits in Hangul Word Processor and Android mobile malware.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Human Rights', 'Defectors', 'Media', 'Government', 'Healthcare'],
    active: true,
  },
  {
    id: 'apt38',
    name: 'APT38',
    aka: 'Bluenoroff / Stardust Chollima / Sapphire Sleet',
    sponsor: 'North Korea (RGB)',
    lat: 39.0, lon: 125.7,
    mitreId: 'G0082', mitreUrl: 'https://attack.mitre.org/groups/G0082/',
    description: 'DPRK financial crime unit responsible for over $2B in theft from global banks via SWIFT network manipulation. Focus on long-term bank network infiltration before executing large transfers.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Lateral Movement', 'Impact'],
    targetSectors: ['Banking', 'Financial Institutions', 'SWIFT Network', 'Cryptocurrency'],
    active: true,
  },
  {
    id: 'andariel',
    name: 'Andariel',
    aka: 'Silent Chollima / PLUTONIUM / Onyx Sleet',
    sponsor: 'North Korea (RGB)',
    lat: 39.0, lon: 125.6,
    mitreId: 'G0138', mitreUrl: 'https://attack.mitre.org/groups/G0138/',
    description: 'North Korean group primarily targeting South Korean government agencies, military, and domestic companies since 2009. Also conducts cyber financial operations against ATMs and cryptocurrency exchanges.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Finance', 'Cryptocurrency', 'Defense'],
    active: true,
  },
  {
    id: 'applejeus',
    name: 'AppleJeus',
    aka: 'Gleaming Pisces / Citrine Sleet / UNC4736',
    sponsor: 'North Korea (RGB)',
    lat: 39.0, lon: 125.9,
    mitreId: 'G1049', mitreUrl: 'https://attack.mitre.org/groups/G1049/',
    description: 'DPRK group responsible for the 3CX supply chain attack. Deploys malicious cryptocurrency software to compromise high-value financial targets and generate revenue for the regime.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Exfiltration'],
    targetSectors: ['Cryptocurrency', 'Finance', 'Technology'],
    active: true,
  },
  {
    id: 'moonstone_sleet',
    name: 'Moonstone Sleet',
    aka: 'Storm-1789',
    sponsor: 'North Korea',
    lat: 38.9, lon: 125.7,
    mitreId: 'G1036', mitreUrl: 'https://attack.mitre.org/groups/G1036/',
    description: 'DPRK-linked actor executing financial and espionage operations. Notable for creating fake companies and personas to interact with targets, and delivering malware via fully functional games.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Technology', 'Defense', 'Cryptocurrency', 'Finance'],
    active: true,
  },
  {
    id: 'contagious_interview',
    name: 'Contagious Interview',
    aka: 'DeceptiveDevelopment / Tenacious Pungsan / DEV#POPPER',
    sponsor: 'North Korea',
    lat: 39.1, lon: 125.8,
    mitreId: 'G1052', mitreUrl: 'https://attack.mitre.org/groups/G1052/',
    description: 'North Korea-aligned group active since 2023 targeting software developers and cryptocurrency professionals with fake job interview lures that deliver cross-platform malware.',
    tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'],
    targetSectors: ['Technology', 'Cryptocurrency', 'Finance'],
    active: true,
  },

  // === IRAN ===
  {
    id: 'apt33',
    name: 'APT33',
    aka: 'Elfin / Peach Sandstorm / HOLMIUM',
    sponsor: 'Iran (IRGC)',
    lat: 34.0, lon: 53.0,
    mitreId: 'G0064', mitreUrl: 'https://attack.mitre.org/groups/G0064/',
    description: 'Iranian group targeting aerospace, energy, and petrochemical sectors since 2013. Known for Shamoon malware deployments against Saudi Arabia and spearphishing US defense contractors.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Impact'],
    targetSectors: ['Aerospace', 'Energy', 'Petrochemical', 'Government', 'Defense'],
    active: true,
  },
  {
    id: 'apt34',
    name: 'OilRig',
    aka: 'APT34 / Helix Kitten / Hazel Sandstorm / EUROPIUM',
    sponsor: 'Iran (MOIS)',
    lat: 35.7, lon: 51.4,
    mitreId: 'G0049', mitreUrl: 'https://attack.mitre.org/groups/G0049/',
    description: 'Iranian MOIS group conducting long-term espionage against Middle East financial, government, and energy sectors. Known for DNS hijacking and LinkedIn-based recruitment phishing.',
    tactics: ['Initial Access', 'Persistence', 'Credential Access', 'Collection', 'Command and Control'],
    targetSectors: ['Financial', 'Government', 'Energy', 'Telecoms', 'Chemical'],
    active: true,
  },
  {
    id: 'apt35',
    name: 'Magic Hound',
    aka: 'APT35 / Charming Kitten / Mint Sandstorm / TA453',
    sponsor: 'Iran (IRGC)',
    lat: 35.6, lon: 51.3,
    mitreId: 'G0059', mitreUrl: 'https://attack.mitre.org/groups/G0059/',
    description: 'IRGC-linked group conducting long-term social engineering campaigns since 2014 against government/military personnel, academics, journalists, and international organizations like WHO.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Academia', 'Media', 'Healthcare'],
    active: true,
  },
  {
    id: 'apt39',
    name: 'APT39',
    aka: 'Remix Kitten / Chafer / ITG07',
    sponsor: 'Iran (MOIS)',
    lat: 35.5, lon: 52.0,
    mitreId: 'G0087', mitreUrl: 'https://attack.mitre.org/groups/G0087/',
    description: 'Iranian MOIS group focused on tracking dissidents and monitoring individuals of interest to the regime across 30+ countries using custom backdoors.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration', 'Reconnaissance'],
    targetSectors: ['Telecommunications', 'Travel', 'Government', 'Dissidents', 'Media'],
    active: true,
  },
  {
    id: 'apt42',
    name: 'APT42',
    aka: 'APT42',
    sponsor: 'Iran (IRGC)',
    lat: 35.8, lon: 51.5,
    mitreId: 'G1044', mitreUrl: 'https://attack.mitre.org/groups/G1044/',
    description: 'Iranian-sponsored espionage group focused on Middle East targets since 2015, using spearphishing and PINEFLOWER Android malware to collect and exfiltrate data.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Civil Society', 'Media', 'Diplomatic'],
    active: true,
  },
  {
    id: 'muddywater',
    name: 'MuddyWater',
    aka: 'Static Kitten / Seedworm / MERCURY / Mango Sandstorm',
    sponsor: 'Iran (MOIS)',
    lat: 32.4, lon: 53.7,
    mitreId: 'G0069', mitreUrl: 'https://attack.mitre.org/groups/G0069/',
    description: 'MOIS subordinate element targeting government, telecom, defense, and oil & gas organizations across Middle East, Asia, Africa, Europe, and North America since 2017.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Defense Evasion', 'Command and Control'],
    targetSectors: ['Government', 'Telecoms', 'Defense', 'Oil & Gas', 'Airlines'],
    active: true,
  },
  {
    id: 'agrius',
    name: 'Agrius',
    aka: 'Pink Sandstorm / AMERICIUM / Agonizing Serpens',
    sponsor: 'Iran (MOIS)',
    lat: 35.7, lon: 51.5,
    mitreId: 'G1030', mitreUrl: 'https://attack.mitre.org/groups/G1030/',
    description: 'Iranian MOIS-linked group active since 2020 conducting ransomware and wiper operations primarily targeting Israeli organizations for destructive effect rather than financial gain.',
    tactics: ['Initial Access', 'Execution', 'Defense Evasion', 'Impact'],
    targetSectors: ['Government', 'Finance', 'Healthcare', 'Technology'],
    active: true,
  },
  {
    id: 'ajax_security',
    name: 'Ajax Security Team',
    aka: 'Operation Woolen-Goldfish / Rocket Kitten / Flying Kitten',
    sponsor: 'Iran',
    lat: 35.6, lon: 51.2,
    mitreId: 'G0130', mitreUrl: 'https://attack.mitre.org/groups/G0130/',
    description: 'Iranian group active since 2010, transitioning from website defacement to malware-based espionage targeting the US defense industrial base and Iranian anti-censorship technology users.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Defense', 'Government', 'Civil Society'],
    active: false,
  },
  {
    id: 'cleaver',
    name: 'Cleaver',
    aka: 'Threat Group 2889 / TG-2889',
    sponsor: 'Iran',
    lat: 35.7, lon: 51.3,
    mitreId: 'G0003', mitreUrl: 'https://attack.mitre.org/groups/G0003/',
    description: 'Iranian actors responsible for Operation Cleaver targeting critical infrastructure across 16 countries, including aviation, energy, defense, and transportation.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Critical Infrastructure', 'Aviation', 'Energy', 'Defense', 'Transportation'],
    active: false,
  },
  {
    id: 'copykittens',
    name: 'CopyKittens',
    aka: 'CopyKittens',
    sponsor: 'Iran',
    lat: 35.5, lon: 51.4,
    mitreId: 'G0052', mitreUrl: 'https://attack.mitre.org/groups/G0052/',
    description: 'Iranian cyber espionage group operating since at least 2013 responsible for Operation Wilted Tulip targeting Israel, Saudi Arabia, Turkey, the US, Jordan, and Germany.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Defense', 'Research', 'Technology'],
    active: false,
  },
  {
    id: 'curium',
    name: 'CURIUM',
    aka: 'Crimson Sandstorm / TA456 / Tortoise Shell / Yellow Liderc',
    sponsor: 'Iran (IRGC)',
    lat: 35.4, lon: 51.2,
    mitreId: 'G1012', mitreUrl: 'https://attack.mitre.org/groups/G1012/',
    description: 'Iranian group investing months building social media relationships with targets before deploying malware. Targets IT service providers in the Middle East since at least 2018.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['IT Services', 'Government', 'Defense'],
    active: true,
  },
  {
    id: 'cyberav3ngers',
    name: 'CyberAv3ngers',
    aka: 'Soldiers of Soloman',
    sponsor: 'Iran (IRGC)',
    lat: 35.7, lon: 51.6,
    mitreId: 'G1027', mitreUrl: 'https://attack.mitre.org/groups/G1027/',
    description: 'IRGC-affiliated group that globally targeted Unitronics PLCs in 2023, attacking water/wastewater facilities, energy, and healthcare sectors with defacement and disruption.',
    tactics: ['Initial Access', 'Execution', 'Impact'],
    targetSectors: ['Water', 'Energy', 'Healthcare', 'Manufacturing', 'ICS'],
    active: true,
  },
  {
    id: 'ferocious_kitten',
    name: 'Ferocious Kitten',
    aka: 'Ferocious Kitten',
    sponsor: 'Iran',
    lat: 35.5, lon: 51.3,
    mitreId: 'G0137', mitreUrl: 'https://attack.mitre.org/groups/G0137/',
    description: 'Iranian threat group primarily targeting Persian-speaking individuals inside Iran with surveillance and monitoring capabilities since at least 2015.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Dissidents', 'Civil Society', 'Journalists'],
    active: true,
  },
  {
    id: 'fox_kitten',
    name: 'Fox Kitten',
    aka: 'Pioneer Kitten / UNC757 / RUBIDIUM / Lemon Sandstorm',
    sponsor: 'Iran (suspected government nexus)',
    lat: 35.6, lon: 51.4,
    mitreId: 'G0117', mitreUrl: 'https://attack.mitre.org/groups/G0117/',
    description: 'Iranian-nexus group active since 2017 targeting oil & gas, government, defense, healthcare, and manufacturing in the Middle East, North Africa, Europe, Australia, and North America.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Oil & Gas', 'Government', 'Defense', 'Healthcare', 'Manufacturing'],
    active: true,
  },
  {
    id: 'group5',
    name: 'Group5',
    aka: 'Group5',
    sponsor: 'Iran (suspected)',
    lat: 35.3, lon: 51.0,
    mitreId: 'G0043', mitreUrl: 'https://attack.mitre.org/groups/G0043/',
    description: 'Iranian-nexus group targeting Syrian opposition via spearphishing and watering holes, using Android RAT DroidJack and njRAT for surveillance.',
    tactics: ['Initial Access', 'Execution', 'Collection'],
    targetSectors: ['Civil Society', 'Political Opposition', 'Journalists'],
    active: false,
  },
  {
    id: 'hexane',
    name: 'HEXANE',
    aka: 'Lyceum / Siamesekitten / Spirlin',
    sponsor: 'Iran',
    lat: 35.4, lon: 51.3,
    mitreId: 'G1001', mitreUrl: 'https://attack.mitre.org/groups/G1001/',
    description: 'Iranian cyber espionage group targeting oil & gas, telecoms, aviation, and ISPs in the Middle East and Africa since at least 2017.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Oil & Gas', 'Telecommunications', 'Aviation', 'ISP'],
    active: true,
  },
  {
    id: 'leafminer',
    name: 'Leafminer',
    aka: 'Raspite',
    sponsor: 'Iran',
    lat: 35.2, lon: 51.2,
    mitreId: 'G0077', mitreUrl: 'https://attack.mitre.org/groups/G0077/',
    description: 'Iranian threat group targeting government organizations and businesses in the Middle East since early 2017 using custom malware and watering hole attacks.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Finance', 'Energy'],
    active: false,
  },
  {
    id: 'moses_staff',
    name: 'Moses Staff',
    aka: 'DEV-0500 / Marigold Sandstorm',
    sponsor: 'Iran (politically motivated)',
    lat: 35.8, lon: 51.6,
    mitreId: 'G1009', mitreUrl: 'https://attack.mitre.org/groups/G1009/',
    description: 'Suspected Iranian group primarily targeting Israeli companies since 2021, leaking stolen data and encrypting networks without a ransom demand for purely destructive political effect.',
    tactics: ['Initial Access', 'Execution', 'Defense Evasion', 'Impact', 'Exfiltration'],
    targetSectors: ['Government', 'Finance', 'Energy', 'Manufacturing', 'Utilities'],
    active: true,
  },
  {
    id: 'silent_librarian',
    name: 'Silent Librarian',
    aka: 'TA407 / COBALT DICKENS',
    sponsor: 'Iran (IRGC / Mabna Institute)',
    lat: 35.6, lon: 51.5,
    mitreId: 'G0122', mitreUrl: 'https://attack.mitre.org/groups/G0122/',
    description: 'Iranian group affiliated with the Mabna Institute conducting credential phishing against universities and research institutions worldwide on behalf of the IRGC.',
    tactics: ['Initial Access', 'Credential Access', 'Collection', 'Exfiltration'],
    targetSectors: ['Academia', 'Research', 'Government'],
    active: true,
  },
  {
    id: 'polonium',
    name: 'POLONIUM',
    aka: 'Plaid Rain',
    sponsor: 'Lebanon (Iran-coordinated)',
    lat: 33.9, lon: 35.5,
    mitreId: 'G1005', mitreUrl: 'https://attack.mitre.org/groups/G1005/',
    description: 'Lebanon-based group primarily targeting Israeli organizations since 2022. Coordinates operations with Iranian MOIS based on victim overlap and shared techniques.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Manufacturing', 'IT', 'Defense', 'Healthcare', 'Finance'],
    active: true,
  },

  // === MIDDLE EAST ===
  {
    id: 'apt_c23',
    name: 'APT-C-23',
    aka: 'Mantis / Arid Viper / Desert Falcon / Two-tailed Scorpion',
    sponsor: 'Palestinian (Hamas-linked)',
    lat: 31.5, lon: 34.5,
    mitreId: 'G1028', mitreUrl: 'https://attack.mitre.org/groups/G1028/',
    description: 'Group active since 2014 primarily targeting Israeli military assets. Has developed Android and iOS mobile spyware since 2017 for surveillance of targets across the Middle East.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Military', 'Government', 'Defense', 'Civil Society'],
    active: true,
  },
  {
    id: 'molerats',
    name: 'Molerats',
    aka: 'Operation Molerats / Gaza Cybergang',
    sponsor: 'Palestine (Hamas-linked)',
    lat: 31.5, lon: 34.4,
    mitreId: 'G0021', mitreUrl: 'https://attack.mitre.org/groups/G0021/',
    description: 'Arabic-speaking politically-motivated group operating since 2012, targeting Middle East, European, and US entities with politically themed lures.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Finance', 'Media', 'NGO'],
    active: true,
  },
  {
    id: 'dark_caracal',
    name: 'Dark Caracal',
    aka: 'Dark Caracal',
    sponsor: 'Lebanon (GDGS)',
    lat: 33.9, lon: 35.5,
    mitreId: 'G0070', mitreUrl: 'https://attack.mitre.org/groups/G0070/',
    description: 'Threat group attributed to the Lebanese General Directorate of General Security conducting global mobile and desktop surveillance operations since at least 2012.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Military', 'Government', 'Finance', 'Manufacturing', 'Utilities'],
    active: true,
  },
  {
    id: 'darkhydrus',
    name: 'DarkHydrus',
    aka: 'DarkHydrus',
    sponsor: 'Iran (suspected)',
    lat: 35.3, lon: 51.1,
    mitreId: 'G0079', mitreUrl: 'https://attack.mitre.org/groups/G0079/',
    description: 'Threat group targeting government agencies and educational institutions in the Middle East since 2016 using open-source tools and DNS tunneling for C2.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Command and Control'],
    targetSectors: ['Government', 'Education'],
    active: false,
  },
  {
    id: 'blackoasis',
    name: 'BlackOasis',
    aka: 'BlackOasis',
    sponsor: 'Middle East (government customer)',
    lat: 25.2, lon: 55.3,
    mitreId: 'G0063', mitreUrl: 'https://attack.mitre.org/groups/G0063/',
    description: 'Middle Eastern group believed to be a customer of Gamma Group (FinSpy). Targets UN figures, opposition bloggers, activists, regional journalists, and think tanks.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['UN', 'Civil Society', 'Journalists', 'Think Tanks'],
    active: true,
  },
  {
    id: 'bouncing_golf',
    name: 'Bouncing Golf',
    aka: 'Bouncing Golf',
    sponsor: 'Middle East (suspected)',
    lat: 25.0, lon: 45.0,
    mitreId: 'G0097', mitreUrl: 'https://attack.mitre.org/groups/G0097/',
    description: 'Cyberespionage campaign targeting Middle Eastern countries with Android malware capable of stealing sensitive data from mobile devices.',
    tactics: ['Initial Access', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Telecoms'],
    active: false,
  },
  {
    id: 'stealth_falcon',
    name: 'Stealth Falcon',
    aka: 'Project Raven',
    sponsor: 'UAE (suspected government)',
    lat: 24.5, lon: 54.4,
    mitreId: 'G0038', mitreUrl: 'https://attack.mitre.org/groups/G0038/',
    description: 'UAE government-linked group conducting targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Journalists', 'Activists', 'Dissidents', 'Government'],
    active: true,
  },
  {
    id: 'sea_turtle',
    name: 'Sea Turtle',
    aka: 'Teal Kurma / Marbled Dust / Cosmic Wolf / SILICON',
    sponsor: 'Turkey',
    lat: 39.9, lon: 32.9,
    mitreId: 'G1041', mitreUrl: 'https://attack.mitre.org/groups/G1041/',
    description: 'Turkey-linked group active since 2017 conducting DNS hijacking operations against registrars and DNS providers to intercept credentials for government and security targets.',
    tactics: ['Initial Access', 'Credential Access', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Telecoms', 'ISP', 'Defense', 'Media'],
    active: true,
  },
  {
    id: 'promethium',
    name: 'PROMETHIUM',
    aka: 'StrongPity',
    sponsor: 'Turkey (suspected)',
    lat: 39.9, lon: 32.8,
    mitreId: 'G0056', mitreUrl: 'https://attack.mitre.org/groups/G0056/',
    description: 'Espionage group focused since 2012 on Turkish targets and their perceived enemies, using trojanized software installers delivered via ISP-level interception.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Military', 'Political Opposition'],
    active: true,
  },
  {
    id: 'neodymium',
    name: 'NEODYMIUM',
    aka: 'NEODYMIUM',
    sponsor: 'Turkey (suspected)',
    lat: 39.9, lon: 32.7,
    mitreId: 'G0055', mitreUrl: 'https://attack.mitre.org/groups/G0055/',
    description: 'Activity group with a 2016 campaign heavily targeting Turkish victims. Closely associated with PROMETHIUM and reportedly linked to BlackOasis operations.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Military', 'Civil Society'],
    active: false,
  },

  // === SOUTH/SOUTHEAST ASIA ===
  {
    id: 'sidewinder',
    name: 'Sidewinder',
    aka: 'T-APT-04 / Rattlesnake',
    sponsor: 'India (suspected)',
    lat: 28.6, lon: 77.2,
    mitreId: 'G0121', mitreUrl: 'https://attack.mitre.org/groups/G0121/',
    description: 'Suspected Indian threat actor active since 2012, targeting government, military, and business entities primarily in Pakistan, China, Nepal, and Afghanistan.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Business', 'Police'],
    active: true,
  },
  {
    id: 'patchwork',
    name: 'Patchwork',
    aka: 'Hangover Group / Dropping Elephant / MONSOON',
    sponsor: 'India (suspected)',
    lat: 28.6, lon: 77.3,
    mitreId: 'G0040', mitreUrl: 'https://attack.mitre.org/groups/G0040/',
    description: 'Suspected Indian group first observed in 2015. Targets diplomatic and government agencies globally. Notable for copy-pasting large amounts of code from online forums.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Diplomatic', 'Think Tanks', 'Military'],
    active: true,
  },
  {
    id: 'confucius',
    name: 'Confucius',
    aka: 'Confucius APT',
    sponsor: 'South Asia (India suspected)',
    lat: 28.5, lon: 77.1,
    mitreId: 'G0142', mitreUrl: 'https://attack.mitre.org/groups/G0142/',
    description: 'Cyber espionage group primarily targeting military personnel, high-profile personalities, and government organizations in South Asia since 2013, with similarities to Patchwork.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Military', 'Government', 'Business'],
    active: true,
  },
  {
    id: 'bitter',
    name: 'BITTER',
    aka: 'T-APT-17',
    sponsor: 'South Asia (suspected)',
    lat: 33.7, lon: 73.1,
    mitreId: 'G1002', mitreUrl: 'https://attack.mitre.org/groups/G1002/',
    description: 'Suspected South Asian group active since 2013 targeting government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Energy', 'Engineering'],
    active: true,
  },
  {
    id: 'sidecopy',
    name: 'SideCopy',
    aka: 'SideCopy',
    sponsor: 'Pakistan (suspected)',
    lat: 33.7, lon: 73.0,
    mitreId: 'G1008', mitreUrl: 'https://attack.mitre.org/groups/G1008/',
    description: 'Pakistani group mimicking Sidewinder infection chains to target Indian and Afghan government personnel since 2019. Named for its deliberate copying of a rival group\'s techniques.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Defense', 'Military'],
    active: true,
  },
  {
    id: 'gorgon_group',
    name: 'Gorgon Group',
    aka: 'Gorgon Group',
    sponsor: 'Pakistan (suspected)',
    lat: 33.7, lon: 73.2,
    mitreId: 'G0078', mitreUrl: 'https://attack.mitre.org/groups/G0078/',
    description: 'Pakistan-connected group mixing criminal and targeted operations against government organizations in the UK, Spain, Russia, and the US.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Exfiltration'],
    targetSectors: ['Government', 'Finance', 'Technology'],
    active: true,
  },
  {
    id: 'platinum',
    name: 'PLATINUM',
    aka: 'PLATINUM',
    sponsor: 'Unknown (SE Asia focus)',
    lat: 13.7, lon: 100.5,
    mitreId: 'G0068', mitreUrl: 'https://attack.mitre.org/groups/G0068/',
    description: 'Activity group active since 2009 targeting governments and related organizations in South and Southeast Asia with sophisticated techniques including abuse of hotpatching.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Defense Evasion', 'Lateral Movement'],
    targetSectors: ['Government', 'Defense', 'Intelligence'],
    active: false,
  },

  // === SOUTH KOREA ===
  {
    id: 'darkhotel',
    name: 'Darkhotel',
    aka: 'DUBNIUM / Zigzag Hail',
    sponsor: 'South Korea (suspected)',
    lat: 37.5, lon: 127.0,
    mitreId: 'G0012', mitreUrl: 'https://attack.mitre.org/groups/G0012/',
    description: 'Suspected South Korean group targeting traveling executives via hotel Wi-Fi networks and spearphishing since at least 2004.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Business Executives', 'Defense', 'Electronics', 'Pharmaceutical', 'Automotive'],
    active: true,
  },
  {
    id: 'higaisa',
    name: 'Higaisa',
    aka: 'Higaisa',
    sponsor: 'South Korea (suspected)',
    lat: 37.5, lon: 127.1,
    mitreId: 'G0126', mitreUrl: 'https://attack.mitre.org/groups/G0126/',
    description: 'Suspected South Korean origin group primarily targeting North Korea since 2009 but also operating in China, Japan, Russia, and Poland.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Political Organizations', 'NGO'],
    active: false,
  },

  // === AFRICA ===
  {
    id: 'silverterrier',
    name: 'SilverTerrier',
    aka: 'SilverTerrier',
    sponsor: 'Nigeria (Criminal)',
    lat: 9.1, lon: 7.4,
    mitreId: 'G0083', mitreUrl: 'https://attack.mitre.org/groups/G0083/',
    description: 'Nigerian business email compromise (BEC) group active since 2014 targeting high technology, higher education, and manufacturing organizations using commodity malware.',
    tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'],
    targetSectors: ['Technology', 'Education', 'Manufacturing'],
    active: true,
  },

  // === EASTERN EUROPE / CRIMINAL ===
  {
    id: 'fin7',
    name: 'FIN7',
    aka: 'GOLD NIAGARA / Carbon Spider / Sangria Tempest',
    sponsor: 'Criminal (Eastern Europe)',
    lat: 50.4, lon: 30.5,
    mitreId: 'G0046', mitreUrl: 'https://attack.mitre.org/groups/G0046/',
    description: 'Sophisticated criminal group responsible for over $3B in theft from 100+ US companies. Operated a fake cybersecurity company to recruit penetration testers. Now operates ransomware.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Retail', 'Restaurant', 'Hospitality', 'Finance', 'Healthcare'],
    active: true,
  },
  {
    id: 'fin6',
    name: 'FIN6',
    aka: 'Skeleton Spider / ITG08 / TAAL / Camouflage Tempest',
    sponsor: 'Criminal',
    lat: 50.0, lon: 30.0,
    mitreId: 'G0037', mitreUrl: 'https://attack.mitre.org/groups/G0037/',
    description: 'Cybercrime group specializing in stealing and selling payment card data from point-of-sale systems in the hospitality and retail sectors. Pivoted to ransomware deployment.',
    tactics: ['Initial Access', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Hospitality', 'Retail', 'Finance'],
    active: true,
  },
  {
    id: 'fin8',
    name: 'FIN8',
    aka: 'Syssphinx',
    sponsor: 'Criminal',
    lat: 50.0, lon: 36.0,
    mitreId: 'G0061', mitreUrl: 'https://attack.mitre.org/groups/G0061/',
    description: 'Financially motivated group targeting hospitality, retail, entertainment, insurance, and financial sectors since 2016. Switched to ransomware deployment in 2021.',
    tactics: ['Initial Access', 'Lateral Movement', 'Collection', 'Exfiltration', 'Impact'],
    targetSectors: ['Hospitality', 'Retail', 'Finance', 'Insurance'],
    active: true,
  },
  {
    id: 'carbanak',
    name: 'Carbanak',
    aka: 'Anunak',
    sponsor: 'Criminal (Russia-linked)',
    lat: 55.0, lon: 37.0,
    mitreId: 'G0008', mitreUrl: 'https://attack.mitre.org/groups/G0008/',
    description: 'Cybercriminal group using Carbanak malware to target financial institutions since 2013. Responsible for over $1B in losses from banks via fraudulent wire transfers.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Banking', 'Finance'],
    active: true,
  },
  {
    id: 'cobalt_group',
    name: 'Cobalt Group',
    aka: 'GOLD KINGSWOOD / Cobalt Spider',
    sponsor: 'Criminal',
    lat: 50.4, lon: 30.5,
    mitreId: 'G0080', mitreUrl: 'https://attack.mitre.org/groups/G0080/',
    description: 'Financially motivated group targeting financial institutions via ATM systems, card processing, payment systems, and SWIFT since 2016. Primarily targeting banks in Eastern Europe, Central Asia, and SE Asia.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Impact'],
    targetSectors: ['Banking', 'ATM', 'Payment Systems'],
    active: true,
  },
  {
    id: 'ta505',
    name: 'TA505',
    aka: 'Hive0065 / Spandex Tempest / CHIMBORAZO',
    sponsor: 'Criminal (Russia-linked)',
    lat: 55.0, lon: 38.0,
    mitreId: 'G0092', mitreUrl: 'https://attack.mitre.org/groups/G0092/',
    description: 'Prolific criminal group known for massive email campaigns distributing Dridex and Clop ransomware. Responsible for some of the largest malware distribution campaigns ever recorded.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Command and Control', 'Exfiltration'],
    targetSectors: ['Finance', 'Retail', 'Healthcare', 'Manufacturing', 'Government'],
    active: true,
  },
  {
    id: 'silence',
    name: 'Silence',
    aka: 'Whisper Spider',
    sponsor: 'Criminal (Russia)',
    lat: 55.7, lon: 37.9,
    mitreId: 'G0091', mitreUrl: 'https://attack.mitre.org/groups/G0091/',
    description: 'Financially motivated group targeting financial institutions since 2016. Has compromised Russian Central Bank automated systems, ATMs, and card processing infrastructure.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Impact'],
    targetSectors: ['Banking', 'ATM', 'Card Processing'],
    active: true,
  },
  {
    id: 'indrik_spider2',
    name: 'Wizard Spider',
    aka: 'GOLD BLACKBURN / TEMP.MixMaster',
    sponsor: 'Criminal (Russia)',
    lat: 55.6, lon: 37.5,
    mitreId: 'G0102', mitreUrl: 'https://attack.mitre.org/groups/G0102/',
    description: 'Russian cybercriminal group operating TrickBot banking trojan and Ryuk/Conti ransomware. One of the most prolific ransomware operators targeting hospitals, schools, and businesses.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Lateral Movement', 'Impact'],
    targetSectors: ['Healthcare', 'Finance', 'Government', 'Manufacturing', 'Education'],
    active: true,
  },
  {
    id: 'gold_southfield',
    name: 'GOLD SOUTHFIELD',
    aka: 'Pinchy Spider',
    sponsor: 'Criminal (Russia)',
    lat: 55.3, lon: 37.2,
    mitreId: 'G0115', mitreUrl: 'https://attack.mitre.org/groups/G0115/',
    description: 'Financially motivated group operating REvil Ransomware-as-a-Service since 2018, conducting high-value attacks including the Kaseya supply chain attack affecting 1,500 organizations.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'],
    targetSectors: ['Technology', 'Finance', 'Healthcare', 'Government'],
    active: false,
  },
  {
    id: 'lapsus',
    name: 'LAPSUS$',
    aka: 'DEV-0537 / Strawberry Tempest',
    sponsor: 'Criminal (UK/Brazil)',
    lat: 51.5, lon: -0.1,
    mitreId: 'G1004', mitreUrl: 'https://attack.mitre.org/groups/G1004/',
    description: 'Young cybercriminal group specializing in social engineering and large-scale data extortion without ransomware. Compromised Microsoft, Okta, NVIDIA, Samsung, and Uber.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Technology', 'Telecommunications', 'Government', 'Healthcare'],
    active: false,
  },
  {
    id: 'scattered_spider',
    name: 'Scattered Spider',
    aka: 'Roasted 0ktapus / Octo Tempest / UNC3944',
    sponsor: 'Criminal (US/UK)',
    lat: 37.8, lon: -122.4,
    mitreId: 'G1015', mitreUrl: 'https://attack.mitre.org/groups/G1015/',
    description: 'Native English-speaking group active since 2022 using advanced social engineering and help-desk impersonation to bypass MFA and compromise enterprise cloud environments. Hit MGM and Caesars.',
    tactics: ['Initial Access', 'Persistence', 'Privilege Escalation', 'Defense Evasion', 'Exfiltration'],
    targetSectors: ['Hospitality', 'Gaming', 'Retail', 'Telecommunications', 'Finance'],
    active: true,
  },
  {
    id: 'darkvisnya',
    name: 'DarkVishnya',
    aka: 'DarkVishnya',
    sponsor: 'Criminal (Eastern Europe)',
    lat: 52.2, lon: 21.0,
    mitreId: 'G0105', mitreUrl: 'https://attack.mitre.org/groups/G0105/',
    description: 'Financially motivated group attacking Eastern European financial institutions in 2017-2018 by physically planting malicious hardware devices inside bank offices.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Banking', 'Finance'],
    active: false,
  },
  {
    id: 'gcman',
    name: 'GCMAN',
    aka: 'GCMAN',
    sponsor: 'Criminal',
    lat: 55.0, lon: 37.5,
    mitreId: 'G0036', mitreUrl: 'https://attack.mitre.org/groups/G0036/',
    description: 'Threat group targeting banks with the purpose of transferring money to e-currency services using custom malware and legitimate sysadmin tools.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Exfiltration'],
    targetSectors: ['Banking', 'Finance'],
    active: false,
  },
  {
    id: 'rtm',
    name: 'RTM',
    aka: 'RTM',
    sponsor: 'Criminal (Russia)',
    lat: 55.5, lon: 37.5,
    mitreId: 'G0048', mitreUrl: 'https://attack.mitre.org/groups/G0048/',
    description: 'Russian cybercriminal group primarily targeting users of remote banking systems in Russia and neighboring countries since at least 2015 using the RTM banking trojan.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Banking', 'Finance', 'Remote Banking'],
    active: true,
  },
  {
    id: 'fin4',
    name: 'FIN4',
    aka: 'FIN4',
    sponsor: 'Criminal (financial insider trading)',
    lat: 40.7, lon: -74.0,
    mitreId: 'G0085', mitreUrl: 'https://attack.mitre.org/groups/G0085/',
    description: 'Financially motivated group targeting confidential information for insider trading in healthcare and pharmaceutical companies since 2013. Focused solely on credential harvesting via phishing.',
    tactics: ['Initial Access', 'Credential Access', 'Collection'],
    targetSectors: ['Healthcare', 'Pharmaceutical', 'Finance'],
    active: false,
  },
  {
    id: 'fin5',
    name: 'FIN5',
    aka: 'FIN5',
    sponsor: 'Criminal (Russia-linked)',
    lat: 50.0, lon: 36.0,
    mitreId: 'G0053', mitreUrl: 'https://attack.mitre.org/groups/G0053/',
    description: 'Financially motivated group targeting PII and payment card data in restaurant, gaming, and hotel industries since at least 2008.',
    tactics: ['Initial Access', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Restaurant', 'Gaming', 'Hospitality'],
    active: false,
  },
  {
    id: 'fin10',
    name: 'FIN10',
    aka: 'FIN10',
    sponsor: 'Criminal',
    lat: 49.0, lon: -98.0,
    mitreId: 'G0051', mitreUrl: 'https://attack.mitre.org/groups/G0051/',
    description: 'Financially motivated group targeting North American organizations since 2013 via extortion using stolen data rather than ransomware.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Gaming', 'Mining', 'Natural Resources', 'Finance'],
    active: false,
  },
  {
    id: 'fin13',
    name: 'FIN13',
    aka: 'Elephant Beetle',
    sponsor: 'Criminal (Latin America)',
    lat: -14.2, lon: -51.9,
    mitreId: 'G1016', mitreUrl: 'https://attack.mitre.org/groups/G1016/',
    description: 'Financially motivated group targeting financial, retail, and hospitality industries in Mexico and Latin America since 2016 using custom tooling for fraud operations.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection', 'Exfiltration'],
    targetSectors: ['Finance', 'Retail', 'Hospitality'],
    active: true,
  },
  {
    id: 'akira',
    name: 'Akira',
    aka: 'GOLD SAHARA / Howling Scorpius',
    sponsor: 'Criminal',
    lat: 50.0, lon: 18.0,
    mitreId: 'G1024', mitreUrl: 'https://attack.mitre.org/groups/G1024/',
    description: 'Ransomware group active since March 2023 using double extortion. Targets business, government, critical infrastructure, and healthcare with ESXi-capable variants overlapping with Conti.',
    tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact', 'Exfiltration'],
    targetSectors: ['Business', 'Government', 'Critical Infrastructure', 'Healthcare'],
    active: true,
  },
  {
    id: 'blackbyte',
    name: 'BlackByte',
    aka: 'Hecamede',
    sponsor: 'Criminal',
    lat: 50.0, lon: 20.0,
    mitreId: 'G1043', mitreUrl: 'https://attack.mitre.org/groups/G1043/',
    description: 'Ransomware group active since 2021 targeting critical infrastructure entities in North America using double extortion. Initially had a universal decryptor due to a shared encryption key.',
    tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact'],
    targetSectors: ['Critical Infrastructure', 'Healthcare', 'Government'],
    active: true,
  },
  {
    id: 'play',
    name: 'Play',
    aka: 'Play',
    sponsor: 'Criminal',
    lat: 50.0, lon: 22.0,
    mitreId: 'G1040', mitreUrl: 'https://attack.mitre.org/groups/G1040/',
    description: 'Ransomware group active since 2022 deploying Playcrypt ransomware against business, government, healthcare, and media in North America, South America, and Europe.',
    tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact', 'Exfiltration'],
    targetSectors: ['Business', 'Government', 'Healthcare', 'Media'],
    active: true,
  },
  {
    id: 'inc_ransom',
    name: 'INC Ransom',
    aka: 'GOLD IONIC',
    sponsor: 'Criminal',
    lat: 50.0, lon: 24.0,
    mitreId: 'G1032', mitreUrl: 'https://attack.mitre.org/groups/G1032/',
    description: 'Ransomware and data extortion group active since July 2023 targeting industrial, healthcare, and education sectors in the US and Europe.',
    tactics: ['Initial Access', 'Lateral Movement', 'Impact', 'Exfiltration'],
    targetSectors: ['Industrial', 'Healthcare', 'Education'],
    active: true,
  },
  {
    id: 'medusa_group',
    name: 'Medusa Group',
    aka: 'Spearwing',
    sponsor: 'Criminal',
    lat: 50.0, lon: 26.0,
    mitreId: 'G1051', mitreUrl: 'https://attack.mitre.org/groups/G1051/',
    description: 'RaaS operation active since 2021 employing living-off-the-land techniques and double extortion. Opportunistic targeting across all sectors globally.',
    tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact', 'Exfiltration'],
    targetSectors: ['Healthcare', 'Education', 'Government', 'Industrial'],
    active: true,
  },
  {
    id: 'storm0501',
    name: 'Storm-0501',
    aka: 'Storm-0501',
    sponsor: 'Criminal',
    lat: 50.0, lon: 28.0,
    mitreId: 'G1053', mitreUrl: 'https://attack.mitre.org/groups/G1053/',
    description: 'Financially motivated criminal group active since 2021 conducting ransomware operations using multiple RaaS platforms including LockBit, BlackCat, and Embargo.',
    tactics: ['Initial Access', 'Lateral Movement', 'Defense Evasion', 'Impact'],
    targetSectors: ['Healthcare', 'Government', 'Manufacturing'],
    active: true,
  },
  {
    id: 'storm1811',
    name: 'Storm-1811',
    aka: 'Storm-1811',
    sponsor: 'Criminal',
    lat: 50.0, lon: 30.0,
    mitreId: 'G1046', mitreUrl: 'https://attack.mitre.org/groups/G1046/',
    description: 'Criminal entity linked to Black Basta ransomware. Uses email overloading and fake IT help-desk calls to trick employees into installing remote access tools.',
    tactics: ['Initial Access', 'Execution', 'Lateral Movement', 'Impact'],
    targetSectors: ['Healthcare', 'Finance', 'Manufacturing', 'Government'],
    active: true,
  },
  {
    id: 'exotic_lily',
    name: 'EXOTIC LILY',
    aka: 'EXOTIC LILY',
    sponsor: 'Criminal (Russia-linked)',
    lat: 55.2, lon: 37.6,
    mitreId: 'G1011', mitreUrl: 'https://attack.mitre.org/groups/G1011/',
    description: 'Initial access broker closely linked with Wizard Spider, deploying Conti and Diavol ransomware. Targets IT, cybersecurity, and healthcare sectors via spearphishing since 2021.',
    tactics: ['Initial Access', 'Execution'],
    targetSectors: ['IT', 'Cybersecurity', 'Healthcare'],
    active: true,
  },
  {
    id: 'evilnum',
    name: 'Evilnum',
    aka: 'Evilnum',
    sponsor: 'Criminal',
    lat: 52.0, lon: 20.0,
    mitreId: 'G0120', mitreUrl: 'https://attack.mitre.org/groups/G0120/',
    description: 'Financially motivated group active since 2018 targeting financial technology companies, particularly those dealing with trading and investment platforms in Europe.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['FinTech', 'Finance', 'Investment'],
    active: true,
  },
  {
    id: 'ta551',
    name: 'TA551',
    aka: 'GOLD CABIN / Shathak',
    sponsor: 'Criminal',
    lat: 54.0, lon: 18.0,
    mitreId: 'G0127', mitreUrl: 'https://attack.mitre.org/groups/G0127/',
    description: 'Financially motivated group active since 2018 distributing malware via email campaigns in English, German, Italian, and Japanese targeting organizations for ransomware deployment.',
    tactics: ['Initial Access', 'Execution', 'Persistence'],
    targetSectors: ['Finance', 'Healthcare', 'Manufacturing'],
    active: true,
  },
  {
    id: 'teamtnt',
    name: 'TeamTNT',
    aka: 'TeamTNT',
    sponsor: 'Criminal',
    lat: 51.0, lon: 10.0,
    mitreId: 'G0139', mitreUrl: 'https://attack.mitre.org/groups/G0139/',
    description: 'Cloud and container-focused threat group active since 2019 targeting exposed Docker APIs and Kubernetes clusters to deploy cryptocurrency miners.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'],
    targetSectors: ['Cloud', 'Container Infrastructure', 'Technology'],
    active: true,
  },
  {
    id: 'blue_mockingbird',
    name: 'Blue Mockingbird',
    aka: 'Blue Mockingbird',
    sponsor: 'Criminal (unknown)',
    lat: 40.0, lon: -100.0,
    mitreId: 'G0108', mitreUrl: 'https://attack.mitre.org/groups/G0108/',
    description: 'Cluster deploying Monero cryptocurrency-mining DLL payloads on Windows systems, exploiting MSSQL servers since December 2019.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Impact'],
    targetSectors: ['Technology', 'General'],
    active: true,
  },

  // === SOUTH AMERICA ===
  {
    id: 'apt_c36',
    name: 'APT-C-36',
    aka: 'Blind Eagle',
    sponsor: 'South America (Colombia/Venezuela)',
    lat: 4.7, lon: -74.1,
    mitreId: 'G0099', mitreUrl: 'https://attack.mitre.org/groups/G0099/',
    description: 'Suspected South American espionage group active since 2018 targeting Colombian government, financial, petroleum, and manufacturing organizations.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Government', 'Finance', 'Petroleum', 'Manufacturing'],
    active: true,
  },
  {
    id: 'machete',
    name: 'Machete',
    aka: 'APT-C-43 / El Machete',
    sponsor: 'South America (Venezuela suspected)',
    lat: 10.5, lon: -66.9,
    mitreId: 'G0095', mitreUrl: 'https://attack.mitre.org/groups/G0095/',
    description: 'Suspected Spanish-speaking group active since 2010 primarily targeting Latin American government and military intelligence services, with a focus on Venezuela.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Intelligence', 'Military', 'Utilities'],
    active: true,
  },
  {
    id: 'malteiro',
    name: 'Malteiro',
    aka: 'Malteiro',
    sponsor: 'Brazil (Criminal)',
    lat: -15.8, lon: -47.9,
    mitreId: 'G1026', mitreUrl: 'https://attack.mitre.org/groups/G1026/',
    description: 'Brazil-based criminal group active since 2019 operating Mispadu banking trojan as Malware-as-a-Service, primarily targeting victims in Latin America and Europe.',
    tactics: ['Initial Access', 'Execution', 'Collection', 'Exfiltration'],
    targetSectors: ['Finance', 'Retail', 'General'],
    active: true,
  },
  {
    id: 'poseidon_group',
    name: 'Poseidon Group',
    aka: 'Poseidon Group',
    sponsor: 'Brazil',
    lat: -15.8, lon: -47.8,
    mitreId: 'G0033', mitreUrl: 'https://attack.mitre.org/groups/G0033/',
    description: 'Portuguese-speaking group active since 2005 exfiltrating data and blackmailing victim companies into contracting them as a security firm.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Finance', 'Energy', 'Government', 'Manufacturing'],
    active: false,
  },

  // === MISCELLANEOUS / UNKNOWN ORIGIN ===
  {
    id: 'equation',
    name: 'Equation',
    aka: 'Equation Group',
    sponsor: 'USA (NSA/TAO suspected)',
    lat: 38.9, lon: -77.0,
    mitreId: 'G0020', mitreUrl: 'https://attack.mitre.org/groups/G0020/',
    description: 'Extremely sophisticated group employing multiple RATs and zero-days. Known for the ability to overwrite hard disk drive firmware — a capability beyond any known threat actor. Tools leaked by Shadow Brokers.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Telecoms', 'Finance', 'Energy'],
    active: false,
  },
  {
    id: 'strider',
    name: 'Strider',
    aka: 'ProjectSauron',
    sponsor: 'Unknown (nation-state)',
    lat: 50.0, lon: 15.0,
    mitreId: 'G0041', mitreUrl: 'https://attack.mitre.org/groups/G0041/',
    description: 'Highly sophisticated group active since 2011 targeting Russia, China, Sweden, Belgium, Iran, and Rwanda. Uses custom modular malware platform tailored to each victim.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Military', 'Telecoms', 'Finance'],
    active: false,
  },
  {
    id: 'orangeworm',
    name: 'Orangeworm',
    aka: 'Orangeworm',
    sponsor: 'Unknown',
    lat: 37.0, lon: -95.0,
    mitreId: 'G0071', mitreUrl: 'https://attack.mitre.org/groups/G0071/',
    description: 'Group targeting healthcare organizations in the US, Europe, and Asia since 2015 for corporate espionage, implanting Kwampirs backdoor in radiology and imaging software.',
    tactics: ['Initial Access', 'Persistence', 'Lateral Movement', 'Collection'],
    targetSectors: ['Healthcare', 'Pharmaceutical', 'IT Services', 'Manufacturing'],
    active: false,
  },
  {
    id: 'moustached_bouncer',
    name: 'MoustachedBouncer',
    aka: 'MoustachedBouncer',
    sponsor: 'Belarus (suspected)',
    lat: 53.9, lon: 27.6,
    mitreId: 'G1019', mitreUrl: 'https://attack.mitre.org/groups/G1019/',
    description: 'Cyberespionage group active since 2014 exclusively targeting foreign embassies in Belarus, leveraging ISP-level adversary-in-the-middle attacks.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Diplomatic', 'Embassies'],
    active: true,
  },
  {
    id: 'metador',
    name: 'Metador',
    aka: 'Metador',
    sponsor: 'Unknown (nation-state suspected)',
    lat: 25.0, lon: 45.0,
    mitreId: 'G1013', mitreUrl: 'https://attack.mitre.org/groups/G1013/',
    description: 'Mysterious threat group first reported in 2022 targeting a limited number of telecoms, ISPs, and universities in the Middle East and Africa with advanced custom malware.',
    tactics: ['Initial Access', 'Persistence', 'Defense Evasion', 'Collection'],
    targetSectors: ['Telecommunications', 'ISP', 'Academia'],
    active: true,
  },
  {
    id: 'sowbug',
    name: 'Sowbug',
    aka: 'Sowbug',
    sponsor: 'Unknown (Asia-Pacific)',
    lat: -6.2, lon: 106.8,
    mitreId: 'G0054', mitreUrl: 'https://attack.mitre.org/groups/G0054/',
    description: 'Threat group conducting targeted attacks against government entities in South America and Southeast Asia since at least 2015 using the Felismus RAT.',
    tactics: ['Initial Access', 'Persistence', 'Collection', 'Exfiltration'],
    targetSectors: ['Government', 'Diplomatic'],
    active: false,
  },
  {
    id: 'lazykscripter',
    name: 'LazyScripter',
    aka: 'LazyScripter',
    sponsor: 'Unknown',
    lat: 30.0, lon: 31.0,
    mitreId: 'G0140', mitreUrl: 'https://attack.mitre.org/groups/G0140/',
    description: 'Threat group mainly targeting the airlines industry since at least 2018 using open-source toolsets and IATA-themed lures.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Airlines', 'Aviation'],
    active: true,
  },
  {
    id: 'ta2541',
    name: 'TA2541',
    aka: 'TA2541',
    sponsor: 'Criminal',
    lat: 30.0, lon: 30.0,
    mitreId: 'G1018', mitreUrl: 'https://attack.mitre.org/groups/G1018/',
    description: 'Cybercriminal group targeting aviation, aerospace, transportation, manufacturing, and defense since 2017 with high-volume commodity RAT campaigns using aviation-themed lures.',
    tactics: ['Initial Access', 'Execution', 'Persistence', 'Collection'],
    targetSectors: ['Aviation', 'Aerospace', 'Defense', 'Transportation', 'Manufacturing'],
    active: true,
  },
  {
    id: 'the_white_company',
    name: 'The White Company',
    aka: 'The White Company',
    sponsor: 'Unknown (state-sponsored suspected)',
    lat: 33.7, lon: 73.0,
    mitreId: 'G0089', mitreUrl: 'https://attack.mitre.org/groups/G0089/',
    description: 'Likely state-sponsored group conducting Operation Shaheen against Pakistani government and military organizations in 2017-2018 with custom evasion capabilities.',
    tactics: ['Initial Access', 'Execution', 'Defense Evasion', 'Collection'],
    targetSectors: ['Government', 'Military'],
    active: false,
  },
  {
    id: 'inception',
    name: 'Inception',
    aka: 'Cloud Atlas / Inception Framework',
    sponsor: 'Unknown (Russia suspected)',
    lat: 55.0, lon: 37.0,
    mitreId: 'G0100', mitreUrl: 'https://attack.mitre.org/groups/G0100/',
    description: 'Cyber espionage group primarily targeting Russia, but also US, Europe, Middle East, and Africa. Uses cloud services like OneDrive for C2 to evade detection.',
    tactics: ['Initial Access', 'Persistence', 'Command and Control', 'Collection'],
    targetSectors: ['Government', 'Military', 'Finance', 'Energy'],
    active: true,
  },
];