Six Groups, Ten Citations: The South Asian Blind Spot in MITRE ATT&CK
MITRE ATT&CK v19.2 documents 176 threat groups and 4,628 group-to-technique mappings. Six of those groups are South Asian: Patchwork, SideWinder, Confucius, SideCopy, BITTER and Transparent Tribe. Between them they carry two to ten citations each. DoNot Team, Mysterious Elephant, Bahamut and Urpage are absent from the framework entirely, despite years of public reporting on all four.
That gap matters more than it looks, and we measured it.
Using all 41 archived Enterprise ATT&CK versions alongside the ORKL threat report library — 29,456 reports covering 1,926 actors — we compare how much a group is publicly reported against how much of it reaches the framework, broken down by region. We report the coverage deficit for South Asian actors relative to East Asian and Middle Eastern ones, and what it implies for anyone treating ATT&CK coverage as a proxy for defensive readiness in this part of the world.
We also test whether regional TTP clustering is real rather than assumed. Mean pairwise Jaccard similarity between South Asian groups’ technique sets is 0.230, against a global baseline of 0.078 across all documented groups — roughly three times the background rate, and consistently above cross-regional pairs. That signal is confounded by shared vendor reporting, since the same handful of vendors write up most of these actors using shared vocabulary. We treat the confound as part of the study, not a footnote.
Underneath both questions sits a methodological problem the field has not addressed. ATT&CK restructures itself. Between v18 and v19 alone, 117 group-used techniques changed tactic assignment and eleven technique IDs vanished. Naive version diffing produces spectacular false findings — techniques appearing to leap from zero to eighty-five adopters when sub-techniques were merely introduced. We release a version-normalisation method so longitudinal ATT&CK work can measure adversaries instead of the framework’s own churn.
Throughout, we report attribution labels as dataset metadata with provenance and disagreement, never as our own claim.
APT MITRE ATT&CK STIX data, all 41 versions · ATT&CK v19 restructure · ORKL threat report library (29,456 reports) · MISP galaxy threat actors · ETDA Threat Group Cards · Rahman & Williams, ATT&CK technique co-occurrence · Saha et al., From IOCs to Group Profiles · The CTI Echo Chamber, 2026