Unattributed, Contested or Non-State
No state organ named on the record: unattributed intrusions, contested or reciprocal attributions, and non-state armed groups
- State organ
- None named
- MITRE ATT&CK groups
- No ATT&CK group
- Attribution basis
- No state organ named on the record.
Mission Type
Varies: unattributed espionage and sabotage, election targeting, reciprocal regional operations, non-state espionage
Primary Sectors
Operational Period
Various
Attributed Cases
5
Attributed Cases
Activity Timeline
Attribution Basis
How firmly each operation is tied to this actor, and by whom. Confidence reflects the weight of public evidence, not intelligence-community ground truth (see methodology §08).
Attributed by Academic/Private Sector · Consequences: No Formal Response
Attributed by Contested/Unknown, Academic/Private Sector · Consequences: Public Naming
Attributed by Contested/Unknown · Consequences: No Formal Response
Attributed by Academic/Private Sector · Consequences: No Formal Response
Attributed by Contested/Unknown · Consequences: No Formal Response
Why Attribution Fails
The cases below share one feature: no confident, consensus attribution exists. Attribution uncertainty is not a single problem but several. The Atlas sorts these cases into three failure modes — a derived analytic categorisation based on each record's confidence level and attribution detail, not an external ruling.
No formal political attribution
5 casesTechnical suspicion may exist, but no government has made a formal public attribution — often because diplomatic equities outweigh accountability.
TTP Pattern Summary
Cases here share no toolset. They range from a remote intrusion into a water plant control system (Oldsmar) and intrusions into a national parliament (Australia) to reciprocal espionage between India- and Pakistan-linked groups and mobile surveillance by a Hamas-linked group (APT-C-23).
Behavioural Signature
The common feature is the absence of an on-record attribution to a named state organ. That absence limits the governance responses available, which is why these cases are grouped rather than assigned to a state.
Governance Footprint
Responses in this group are mostly domestic and regulatory (Oldsmar prompted water-sector guidance) or absent. Criminal ransomware cases, previously grouped here, now have their own profile.