The 30-day view points to a clear conclusion: activity does not spread evenly, it concentrates around a small set of countries with strong corroboration. Notmining's latest Attack Correlation Report identifies 152 clusters, 16546 correlated publications, 2172 actors or users, and 185 countries, with a visible layer where public-facing exposure, defacement, DDoS, ransomware, and cyberattack signals coexist.
Strategic reading
The report runs in Many TA -> One Target mode and uses country as the primary dimension. That does more than count posts: it shows where different actors converge on the same geography and when that convergence starts to look like sustained operational pressure.
The first useful reading of the month is this: out of 152 detected clusters, only 10 enter the visible layer and 142 remain outside it because of thresholding. That matters. It means there is plenty of background activity, but the real analytical weight concentrates in a much smaller set of priority nodes.
- 152 clusters matched the current thresholds.
- 16546 publications were grouped into correlated activity.
- 2172 actors or users were represented in the clustered sample.
- 185 countries were linked to clustered activity.
- 8034 points was the highest score in the current result set.
The report is not meant to provide final attribution. Its value lies in prioritization. When multiple sources, authors, and incident types accumulate around the same country, the output is not a final verdict, but it is far more valuable than a single isolated post or a flat chronological feed.
Countries under highest pressure
United States leads the 30-day window with a score of 8034, 556 linked actors, 2209 supporting publications, and confirmed activity until 2026-06-01 17:52. The striking detail is not just cluster leadership, but persistence: on its own, it concentrates roughly 13% of all clustered publications in scope.
Behind the United States, pressure remains especially visible in several countries that combine volume, recurrence, and author diversity:
- Russia: score 4142, 283 actors, and 847 publications, with strong weight from General Intel and Defacement.
- Colombia: score 3418, 243 actors, and 1418 publications, where General Intel, Defacement, Ransomware, and DDoS Target stand out.
- British Indian Ocean Territory: score 2656, 179 actors, and 803 publications, with a mix of General Intel, Cyberattack, Ransomware, Defacement, and DDoS Target.
- France: score 2598, 186 actors, and 861 publications, adding visible pressure across Western Europe.
Taken together, the United States, Russia, Colombia, and the British Indian Ocean Territory account for 5277 publications, roughly 32% of all clustered activity in scope. That makes the picture far more interesting than any isolated number: a significant share of the month is concentrated around just a handful of geographies.
Dominant patterns
The most recurrent operational themes in the visible clusters were General Intel, Defacement, DDoS Target, and Ransomware, with Cyberattack also surfacing in some of the top nodes. That matters because the month does not leave a single dominant storyline. Instead, it shows a mixed pressure surface where public-facing exposure, demonstrative activity, disruptive attacks, and extortion coexist.
The interesting detail here is that DDoS Target no longer sits at the edge of the visible output. Over 30 days, it enters the priority layer and, in some geographies, overlaps with Cyberattack, suggesting that pressure against exposed assets and visible targets gains consistency when the temporal window is expanded. Excluding Alliance still makes sense: useful context, but not a decisive operational driver by itself.
When the same country appears with hundreds of actors, thousands of publications, and very recent activity, the right reading is not “more noise” but “more signal density”. That density is what turns accumulation into a pattern worth following.
What Stands Out Most
If the report is reduced to four useful takeaways, these are the ones that stand out most in the 30-day window:
- The United States clearly dominates the current monthly sample and acts as the main concentration node of the period.
- Russia and Colombia form the next pressure layer with enough recurrence and diversity to rule out isolated spikes.
- The British Indian Ocean Territory and France widen the geographic reading and show that concentration is not limited to the countries that usually dominate the conversation.
- The combined weight of Defacement, DDoS, Ransomware, and Cyberattack shows that the visible layer is not just exposure or chatter, but a mix of disruption, extortion, and reputational pressure.
Overall, the 30-day window reflects a landscape where pressure does not disappear: it consolidates around a few very visible nodes. That is what makes the report interesting. Not the absolute volume by itself, but the way that volume concentrates, repeats, and ends up drawing a much clearer operational map.