Public data catalogue
Only deliberately public, source-linked HECAVEX datasets and static APIs appear here. Schema, freshness, licence and limitations travel with each entry.
Labs publications
Selected public-source observations concerning Lithuania, Latvia and Estonia.
Freshness: manual review after source, correction or related-research changes; individual observations retain their dates.
Boundary: not an exhaustive incident census, prevalence measure or live feed.
Published case graphs separating observations, reproducible derivations, assessments and limitations.
Freshness: reviewed when released evidence, transformations or analytical boundaries change.
Boundary: time-bounded cases; relationships do not establish actor identity beyond the stated evidence.
Browser-ready active techniques, groups and official group-to-technique procedure relationships.
Freshness: regenerated after a reviewed upstream version update; not synchronized in real time.
Boundary: MITRE ATT&CK remains authoritative; these records are reference material, not HECAVEX attribution.
Source-linked technique evidence selected from reviewed public APT Notes profiles.
Freshness: rebuilt after substantive APT Notes evidence or ATT&CK mapping review.
Boundary: a compact publication layer, not a substitute for cited sources or evidence of defensive coverage.
Product-neutral analyst guides, engineering candidates, validation templates and publication governance.
Freshness: lifecycle and review-due state are published in governance and package records.
Boundary: not deployable rules and not proof that an environment detects the mapped behaviour.
Selected free and free-tier research resources with practical use and evidence cautions.
Freshness: the date records manual review, not continuous provider monitoring.
Boundary: provider access, terms and limits can change; inclusion is not endorsement.
Across HECAVEX
Curated actor research records with sources, confidence and review dates. generated_at records build time and every actor carries last_reviewed; there is no continuous update SLA.
Potential Lithuanian phishing and impersonation candidates. generatedAt and coverage metadata expose publication and sampled-collector freshness; failed or delayed collection is not a benign verdict.