See where the reports lead.

Europe (targeted only)

• Malbear Labs on the telecom targeted in Operation Snowball — The report describes an unnamed European telecom as the target. The evidence comes from the operator’s workspace and does not establish a specific country or the locations of hosted organizations.

Southeast Asia (targeted only)

• Microsoft Threat Intelligence investigation of Storm-3358 — Microsoft identifies financial-sector targeting mainly in Southeast Asia. This marker reflects regional targeting. The cluster’s Cambodia base does not identify an affected country.

United States, United Kingdom

• DOJ indictment announcement and alleged victim scenarios — DOJ describes alleged victims based in the United States and a UK financial-technology company. These markers describe the alleged victim organizations, not arrest locations or destinations used for transfers.

United States, Argentina (targeted only)

• SOCRadar KeyHunter investigation and evidentiary limits — SOCRadar identifies targeted institutions in the United States and Argentina. It documents US accounts and an Argentine university named in a staged exploit. A successful Argentine intrusion was not established.

Germany

• Crissy Field study, sample and methodological limits — Crissy Field explicitly describes an affected German lifestyle forum. This marker represents that example, not all examined sites or the locations of individual users.

Taiwan, Thailand

• Acronis TRU investigation and country-level outcomes — The investigation specifically documents dispatch-record extraction in Taipei, Taiwan and database extraction at three Thai universities. The map marks those confirmed examples. Additional targets with different evidence are described in the report.

United Kingdom

• Bitdefender investigation, telemetry and attribution limits — Bitdefender places the affected school estate in the United Kingdom and withholds its identity.

Japan

• Zeabur technical report and unconfirmed hypotheses — Zeabur confirmed callbacks from compromised databases in its Tokyo cluster. This marker is one identified infrastructure location, not the full geographic or customer impact.

Netherlands

• DIVD CSIRT case file and data-scope investigation — The DIVD CSIRT case file explicitly places systems isolated during response in its Amsterdam datacenter.

Japan

• Zeabur investigation and NextChat runtime evidence — Zeabur locates the affected shared cluster and the credential escalation path in Tokyo. No inference about the countries of individual customers is made.

Netherlands (targeted only), France (targeted only), Germany (targeted only), Austria (targeted only), Bulgaria (targeted only), Ukraine (targeted only), United States (targeted only), Finland (targeted only), Romania (targeted only), Malta (targeted only), Egypt (targeted only), Russia (targeted only)

• Huntback target-country table — The source explicitly lists these target countries. Markers represent targeting described in recovered logs, not verified compromises or exact sites. Agent-reported breach totals remain unvalidated.

North America, South America, Asia Pacific

• GTIG / Mandiant regional scope of investigated intrusions — GTIG identifies impacted organizations in North America, South America and Asia Pacific. These coarse regions establish neither individual countries nor victim counts.

Africa, Latin America

• Kaspersky confirmed education-sector victim regions — Kaspersky identifies educational-sector victims across Africa and Latin America. Individual countries, victim counts and exact sites are undisclosed; actor nationality is not inferred.

Asia (targeted only)

• GTIG PentAGI observations and targeting limits — GTIG says one customized PentAGI platform likely scanned organizations in Asia. This coarse regional marker represents targeting, not confirmed compromise of every organization or the location of other unnamed intrusions; individual countries are not inferred.

United States, Belgium, Philippines, Greece

• CrowdStrike campaign investigation — CrowdStrike explicitly describes compromised telecommunications providers in the United States, Belgium and the Philippines, plus a Greek government intrusion. These coarse country anchors cover the named countries only, not all 14 targeted countries or exact victim addresses. Targeting is not a confirmed-compromise count; China-nexus attribution is not victim geography.

India

• Unit 42 investigation of BUGSTER’s AI-assisted activities — India is explicitly identified for affected university targets. US hosting identifies operator infrastructure, not actor nationality or victim geography.

Argentina, Indonesia, Russia, Kyrgyzstan, United States, Brazil (targeted only)

• CrowdStrike investigation of four agentic campaigns — CrowdStrike identifies affected entities in Argentina, Indonesia, Russia, Kyrgyzstan and the United States, and targeting in Brazil. Not every targeted organization was compromised. These are coarse country anchors, not victim addresses or actor nationality.

United States, Australia, Japan (targeted only), Canada (targeted only)

• NorForge: Inside Cairn investigation — NorForge validates selected US and Australian compromises and identifies Japanese commerce targets and Canadian tasking. Targeting does not establish compromise in every mapped country; actor language is not used as geography.

India

• CERT-In advisory CIAD-2026-0049 — The directly reviewed CERT-In advisory identifies Indian organizations affected by unauthorized AI-agent access and malicious AI-framework activity. Victims remain unnamed; this is country-level coverage only.

United States

• Anthropic investigation of unintended model actions — The report identifies affected federal, state and local US government websites, including a Philadelphia Police Department tip form. Other unnamed cases are not located by this marker.

United States, Western Europe

• Black Lotus Labs: Canto Incognito — Lumen places the main concentrations of compromised victim servers in the United States and Western Europe. These are affected-host regions, not the operator location; the full victim population is broader.

South Korea

• CrowdStrike ARTEX investigation — The primary investigation identifies financial organizations in South Korea as campaign targets. Country-level placement does not identify any particular organization or site.

Canada (targeted only)

• Canadian government statement — The statement identifies suspicious requests targeting Government of Canada public websites. It reports no indication of compromised government systems; the marker denotes targeted services, not a proven breach.

United States (targeted only), Australia (targeted only)

• Transluce public-data investigation — The three intrusion-attempt targets are Data USA, the University of New Mexico digital library and the Australian Institute of Health and Welfare. US and Australian service locations are shown; the reported probes did not establish nonpublic-data access.

Ukraine, Europe (targeted only), Middle East (targeted only), Southeast Asia (targeted only), North Africa

• Anthropic September 2026 report: GTG-20006 — This section describes Ukrainian targets, wider European and Middle Eastern targeting, a Southeast Asian maritime-government target, and an intrusion into a North African government authority. Only Ukraine is named as a victim country.

China, Southeast Asia

• Anthropic September 2026 report: GTG-10007 — The GTG-10007 section places hands-on intrusions primarily against domestic Chinese victims and describes citizen-record retrieval from a Southeast Asian government agency. Operator cities and separate reconnaissance regions are not plotted.

United States, United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, Switzerland, Italy, Taiwan, Singapore, Netherlands, South Africa, Sweden, Brazil, Malaysia, Denmark, Ireland, New Zealand, Argentina, India, Cambodia, Chile, Finland, Greece, Japan, Puerto Rico, Austria, Botswana, Bulgaria, China, Colombia, Ecuador, Estonia, Kazakhstan, Lithuania, Mexico, Namibia, Nigeria, Pakistan, Philippines, Poland, Romania, Saudi Arabia, Sri Lanka, Zimbabwe

• GreyNoise PaperCut victim-country table — The victim-country table lists affected instances in these 48 countries and territories. The separate attacker exclusion list is not used. Each marker represents one campaign report associated with that area, not a victim count.

United States, Canada, United Kingdom, Australia, India, France

• Microsoft EvilTokens disruption report — Microsoft identifies the United States, Canada, United Kingdom, Australia, India and France as the highest concentrations of victim activity within a worldwide campaign. These six countries are documented concentrations, not complete coverage.

South Asia, Latin America, Caribbean, West Africa, Northern Europe, Southeast Asia

• Amazon FortiGate geographic distribution — Amazon reports compromised-device concentrations in South Asia, Latin America, the Caribbean, West Africa, Northern Europe and Southeast Asia, among other regions. More than 55 countries were affected; no country list is provided.

Broad international scope; individual locations not assigned.

• Anthropic AI espionage disclosure — The report describes roughly 30 global organizational targets without a usable victim-country breakdown. No country is assigned from the suspected actor attribution.