path: root/countries_motives_sectors_tables.py

#!/usr/bin/env python3

# SPDX-License-Identifier: CC0-1.0
#
# Copyright (C) 2024, 2025 Wojtek Kosior <koszko@koszko.org>

import yaml
import sys

origin_labels = {
    "China": "China",
    "Iran": "Iran",
    "NorthKorea": "North Korea",
    "Russia": "Russia"
}

type_keys = {
    "country": "countries",
    "sector": "sectors",
    "motive": "motives"
}

trait_label_makers = {
    "country": (lambda country:
                {
                    "usa": "USA",
                    "uk": "UK",
                    "southkorea": "South Korea",
                    "saudiarabia": "Saudi Arabia",
                    "uae": "UAE",
                    "hongkong": "Hong Kong",
                    "northkorea": "North Korea"
                }.get(country, country[0].upper() + country[1:])),
    "sector": (lambda sector:
               {
                   "it": "IT",
                   "ngos": "NGOs",
                   "thinktanks": "think-tanks",
                   "bitcoinexchanges": "cryptocurrency",
                   "lawenforcement": "law enforcement"
               }.get(sector, sector)),
    "motive": (lambda motive:
               {
                   "informationtheftandespionage": "information theft and espionage",
                   "sabotageanddestruction": "sabotage and destruction",
                   "financialcrime": "financial crime"
               }[motive])
}

trait_filters = {
    "country": (lambda country, score:
                score >= 10 and country not in [
                    "europe", "eastasia", "others", "south", "worldwide",
                    "middleeast", "korea"
                ]),
    "sector": (lambda sector, score:
               score >= 10 and sector not in [
                   "sejonginstitute", "ministryofunification",
                   "koreainstitutefordefenseanalyses",
                   "chineseinstitutionsabroad"
                ]),
    "motive": (lambda motive, score: True)
}

def read_APT_data(yaml_path):
    if yaml_path:
        with open(yaml_path) as inp:
            return yaml.safe_load(inp)
    else:
        return yaml.safe_load(sys.stdin)

gpd_country_names = {
    "USA": "United States of America",
    "UK": "United Kingdom",
    "UAE": "United Arab Emirates",
    "Southafrica": "South Africa",
    "Newzealand": "New Zealand"
}

class Point:
    def __init__(self, x, y):
        self.x = x
        self.y = y

other_coords = {
    "Hong Kong": Point(114., 22.4),
    "Bahrain": Point(50.1, 26.2),
    "Singapore": Point(103.77, 1.21)
}

chart_colors = ["#af0000", "#dae84d", "#009f00", "#0000af"]

def plot_map(countries, targeting_percentages, dst_path="dst.svg"):
    import geopandas as gpd
    import matplotlib.pyplot as plt
    from matplotlib.colors import ListedColormap
    from matplotlib.patches import Patch
    import pandas as pd
    import math
    from pathlib import Path
    import os

    world = gpd.read_file(gpd.datasets.get_path('naturalearth_lowres'))
    world.plot(column='name', cmap=ListedColormap([[0.7, 0.7, 0.7]]))

    handles = [Patch(color=color, label=origin_label)
               for origin_label, color
               in zip(sorted(origin_labels.values()), chart_colors)]
    plt.legend(handles=handles, loc="lower right", fontsize="xx-small")
    plt.axis("off")
    plt.margins(x=0, y=0)
    plt.savefig("empty_world_map.svg", bbox_inches='tight', pad_inches=0)
    plt.close()

    os.system("head -n -1 empty_world_map.svg > target_map.svg")

    centroids = world.centroid
    centroid_list = pd.concat([world.name, centroids], axis=1)
    map_width = 357.12
    map_height = 172.521191
    paths_markup = []
    for country, percentages in zip(countries, targeting_percentages):
        country_label = trait_label_makers["country"](country)
        country_key = gpd_country_names.get(country_label, country_label)
        mask = centroid_list["name"] == country_key
        centroid_singleton_list = centroid_list[mask][0]
        if (len(centroid_singleton_list) == 1):
            point, = centroid_singleton_list
        else:
            point = other_coords.get(country_label, None)
            if not point:
                print(f"bad: {country_label}", file=sys.stderr)
                continue

        x = (point.x + 180) / 360 * map_width
        y = (-point.y + 90) / 180 * map_height
        # fix some vertical shift that occures for an unknown reason
        y -= 3.7
        radius = 4
        angle = math.pi * 3 / 2
        ratio = 2.

        for percentage, color in sorted(zip(percentages, chart_colors),
                                        key=lambda tup: tup[0],
                                        reverse=True):
            start_pos = [x+radius*math.cos(angle),
                         y+radius*math.sin(angle)]
            start_pos = " ".join(str(i) for i in start_pos)
            angle += percentage / 100 * math.pi / 2 * ratio
            end_pos = [x+radius*math.cos(angle),
                       y+radius*math.sin(angle)]
            end_pos = " ".join(str(i) for i in end_pos)
            paths_markup.append(f"""\
<path d="M{x} {y} {start_pos} A{radius} {radius} 0 0 1 {end_pos}Z"
      fill="{color}"/>
""")
    with open("target_map.svg", "a") as target_map:
        target_map.write("".join(paths_markup))
        target_map.write("""
 <defs>
   <style type="text/css">*{stroke-linejoin: round; stroke-linecap: butt}
   #PatchCollection_1 > path {stroke: #fff!important; stroke-width: 0.3!important;}
   </style>
 </defs>
</svg>""")

table_type = sys.argv[1] # "country", "sector" or "motive"

groups_data = read_APT_data(None if len(sys.argv) < 3 else sys.argv[2])

groups_by_origin = {}
groups_by_trait_by_origin = {}

# Hand-picked groups that appear not to be state-sponsored.
ignored_groups = [
    # We do not omit Wicked Spider because even tho it is not tagged as
    # state-sponsored in the PDF is seems to have ties with Chinese authorities.
    "Buhtrap", "Corkow", "FIN7", "Lurk", "MoneyTaker", "RTM", "Lunar Spider",
    "Rocke", "Wizard Spider", "TA505", "DoppelSpider", "Dungeon Spider",
    "GuruSpider", "Indrik Spider", "MontySpider", "OperationWindigo",
    "PachaGroup", "PinchySpider", "Rocke", "SaltySpider", "Yingmob",
    "ZombieSpider", "Avalanche", "Boss Spider", "CobaltGroup",
    "Cron", "GCMAN", "RetefeGang", "SharkSpider", "VenomSpider",
]

for group in groups_data["groups"]:
    if group["origin"] not in origin_labels or group["name"] in ignored_groups:
        continue

    origin = group["origin"]
    groups_by_origin[origin] = groups_by_origin.get(origin, []) + [group]

    groups_by_trait = groups_by_trait_by_origin.get(origin, {})
    for trait in group[type_keys[table_type]]:
        groups_by_trait[trait] = groups_by_trait.get(trait, []) + [group]
    groups_by_trait_by_origin[origin] = groups_by_trait

def trait_percent(trait, origin):
    return (100 * len(groups_by_trait_by_origin[origin].get(trait, [])) /
            len(groups_by_origin[origin]))

def trait_popularity_score(trait):
    return sum(trait_percent(trait, origin)
               for origin in groups_by_origin)

all_traits_set = set().union(*groups_by_trait_by_origin.values())
all_traits = sorted(((trait_popularity_score(trait), trait)
                     for trait in all_traits_set),
                    reverse=True)
all_traits = [trait for score, trait in all_traits
              if trait_filters[table_type](trait, score)]

all_origins = sorted(groups_by_origin)
all_origin_labels = [origin_labels[origin] for origin in all_origins]

origin_heads = ' & '.join(
    f"\\nohyphens{{\\bfseries {text}}}" for text in all_origin_labels
)
type_cap = table_type[0].upper() + table_type[1:]
head = f"""\
\\rowcolor{{gray!40}}
\\bfseries {type_cap} & {origin_heads} & \\bfseries total APT count \\\\"""

print("""\
{
\\footnotesize

\\begin{longtable}{>{\\raggedright\\arraybackslash}p{1.2in} p{0.76in} p{0.76in} p{0.76in} p{0.76in} >{\centering\\arraybackslash} p{0.65in} }

\\rowcolor{white}
\\caption{\\nexttabcaption} \\label{\\nexttablabel} \\\\""")
print(head)
print("\\endfirsthead")
print(head)
print("""
\\endhead

\\rowcolor{white}
\\multicolumn{6}{r}{\\textit{Continued on next page}} \\\\
\\endfoot

\\endlastfoot""")

all_percentages = []

for trait in all_traits:
    label = trait_label_makers[table_type](trait)
    group_count = sum([len(groups_by_trait_by_origin[origin].get(trait, []))
                       for origin in all_origins])

    percentages = [trait_percent(trait, origin) for origin in all_origins]
    all_percentages.append(percentages)
    group_precents_markup = ' & '.join(
        f"{round(percent)}\\% groups" for percent in percentages
    )

    print(f"{label} & {group_precents_markup} & {group_count} \\\\")

print("\\end{longtable}")
print("}")

if table_type == "country":
    plot_map(all_traits, all_percentages)