See where the reports lead.

India

• CERT-In advisory CIAD-2026-0049 — The stored title and parties identify Indian organizations as the targets. The victims remain unnamed; this is country-level coverage only.

United States

• Anthropic investigation of unintended model actions — The report identifies affected federal, state and local US government websites, including a Philadelphia Police Department tip form. Other unnamed cases are not located by this marker.

United States, Western Europe

• Black Lotus Labs: Canto Incognito — Lumen places the main concentrations of compromised victim servers in the United States and Western Europe. These are affected-host regions, not the operator location; the full victim population is broader.

South Korea

• CrowdStrike ARTEX investigation — The primary investigation identifies financial organizations in South Korea as campaign targets. Country-level placement does not identify any particular organization or site.

Canada

• Canadian government statement — The statement identifies suspicious requests targeting Government of Canada public websites. It reports no indication of compromised government systems; the marker denotes targeted services, not a proven breach.

United States, Australia

• Transluce public-data investigation — The three intrusion-attempt targets are Data USA, the University of New Mexico digital library and the Australian Institute of Health and Welfare. US and Australian service locations are shown; the reported probes did not establish nonpublic-data access.

Ukraine, Europe, Middle East, Southeast Asia, North Africa

• Anthropic September 2026 report: GTG-20006 — This section describes Ukrainian targets, wider European and Middle Eastern targeting, a Southeast Asian maritime-government target, and an intrusion into a North African government authority. Only Ukraine is named as a victim country.

China, Southeast Asia

• Anthropic September 2026 report: GTG-10007 — The GTG-10007 section places hands-on intrusions primarily against domestic Chinese victims and describes citizen-record retrieval from a Southeast Asian government agency. Operator cities and separate reconnaissance regions are not plotted.

United States, United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, Switzerland, Italy, Taiwan, Singapore, Netherlands, South Africa, Sweden, Brazil, Malaysia, Denmark, Ireland, New Zealand, Argentina, India, Cambodia, Chile, Finland, Greece, Japan, Puerto Rico, Austria, Botswana, Bulgaria, China, Colombia, Ecuador, Estonia, Kazakhstan, Lithuania, Mexico, Namibia, Nigeria, Pakistan, Philippines, Poland, Romania, Saudi Arabia, Sri Lanka, Zimbabwe

• GreyNoise PaperCut victim-country table — The victim-country table lists affected instances in these 48 countries and territories. The separate attacker exclusion list is not used. Each marker represents one campaign report associated with that area, not a victim count.

United States, Canada, United Kingdom, Australia, India, France

• Microsoft EvilTokens disruption report — Microsoft identifies the United States, Canada, United Kingdom, Australia, India and France as the highest concentrations of victim activity within a worldwide campaign. These six countries are documented concentrations, not complete coverage.

South Asia, Latin America, Caribbean, West Africa, Northern Europe, Southeast Asia

• Amazon FortiGate geographic distribution — Amazon reports compromised-device concentrations in South Asia, Latin America, the Caribbean, West Africa, Northern Europe and Southeast Asia, among other regions. More than 55 countries were affected; no country list is provided.

Broad international scope; individual locations not assigned.

• Anthropic AI espionage disclosure — The report describes roughly 30 global organizational targets without a usable victim-country breakdown. No country is assigned from the suspected actor attribution.