Agencies
Every agency on the site, grouped by mandate — foreign intelligence, signals & cyber, military, domestic security, law enforcement. Within each group, sorted by country then by name. Pages marked in progress have stub entries; full references are being written progressively.
Military intelligence · 15
Kommando Cyber- und Informationsraum
The Cyber and Information Domain Service of the German Bundeswehr — the sixth domain of the German armed forces, established 5 April 2017 as a co-equal service command with the army, navy, and air force. CIR consolidates the Bundeswehr's military computer-network-defence, offensive-cyber, signals-intelligence, electronic-warfare, and information-operations capability under a single unified command. Approximately 17,000 personnel as of 2024.
IRGC IO cyber operations
The principal cyber-operational arm attributed to the Islamic Revolutionary Guard Corps Intelligence Organisation — Iran's military-intelligence service, distinct from the civilian Ministry of Intelligence. The cluster is tracked across the threat-intelligence industry under multiple vendor labels including Charming Kitten, APT35, and Mint Sandstorm. Operations include sustained targeting of Iranian dissidents abroad, United States and Israeli government and academic targets, and the 2019–2020 operations against United States presidential-campaign personnel.
Military Intelligence Directorate
Israel's military-intelligence directorate, the largest of the three principal Israeli intelligence services, with primary responsibility for military intelligence and for signals intelligence through Unit 8200.
Lazarus Group
The umbrella threat-intelligence-industry designation for the cluster of cyber-operational activity attributed broadly to North Korea's Reconnaissance General Bureau. Treated here as a canonical entity in its own right — distinct from the institutional-unit pattern of the rest of the bestiary — because the institutional attribution within RGB is genuinely diffuse across Bureau 121, Lab 110, Bureau 180, Office 91, and additional sub-units, and because "Lazarus" has become the canonical referent in the forensic, journalistic, and indictment record in a way no single RGB sub-unit has.
RGB Bureau 121
The principal cyber-operational arm of North Korea's Reconnaissance General Bureau — the publicly-attested institutional source of a substantial share of the North-Korean-attributed cyber-operational footprint that the threat-intelligence industry tracks broadly under the Lazarus Group umbrella. Operates from forward bases inside China to circumvent the limited connectivity of the domestic DPRK network infrastructure.
GRU Unit 26165 (85th Main Special Service Centre)
The 85th Main Special Service Centre of the Russian Main Intelligence Directorate — the GRU's principal computer-network-exploitation and influence-operations unit. Indicted by the United States Department of Justice in July 2018 for the 2016 Democratic National Committee intrusion; tracked across the threat-intelligence industry as Fancy Bear, APT28, Forest Blizzard, and several other vendor labels.
GRU Unit 74455 (Main Centre for Special Technologies)
The Main Centre for Special Technologies of the Russian Main Intelligence Directorate — the GRU's destructive-cyber-operations unit. Responsible for the BlackEnergy / Industroyer attacks on the Ukrainian electricity grid, the NotPetya wiper attack of June 2017, the 2018 Olympic Destroyer attack against the Pyeongchang Winter Olympics opening, and VPNFilter. Indicted by the United States Department of Justice in October 2020 for six named officers.
Main Directorate of the General Staff
Russia's military-intelligence service, formally renamed the Main Directorate (GU) of the General Staff in 2010 but continuing in popular and journalistic use as the GRU. Subject to extensive Western-government attribution for cyber and direct-action operations since 2014.
Coast Guard Intelligence
The intelligence component of the United States Coast Guard, an Intelligence Community member since 2001. Maritime, port, and coastal-security focused.
Defense Intelligence Agency
The Department of Defense's foreign military-intelligence and all-source analytical service, supporting US combatant commands and the Joint Staff.
Marine Corps Intelligence Activity
The Marine Corps' intelligence component, headquartered at Quantico, Virginia. Provides expeditionary-intelligence support to Marine Corps operational units and serves as the Marine Corps' representative to the broader Intelligence Community.
Office of Naval Intelligence
The intelligence service of the United States Navy and the oldest continuously operating intelligence service of the United States Government, established by General Order No. 292 in 1882.
Sixteenth Air Force (Air Forces Cyber)
The United States Air Force's intelligence, surveillance, reconnaissance, and cyber-operations command, established October 2019 by the consolidation of the Twenty-Fifth Air Force (ISR) and the Twenty-Fourth Air Force (Cyber). The Air Force's Intelligence Community-component representation.
Space Force Intelligence
The intelligence component of the United States Space Force, admitted to the Intelligence Community on 8 January 2021. The most recent addition to the IC, focused on space-domain intelligence, foreign-space-system threat assessment, and intelligence support to Space Force operations.
United States Army Intelligence and Security Command
The United States Army's principal intelligence command, conducting signals, human, counter-intelligence, and information-operations missions in support of Army and theatre commanders worldwide.
How the index is organised
This index groups every intelligence agency on the site by mandate — foreign intelligence, signals & cyber, military, domestic security, law enforcement, with coordination services at the top. Within each group, entries are sorted by country and then by name. The grouping mirrors the per-country agency lists so the typology stays consistent across the site. Each card shows the agency's country of origin, its formal name and acronym, and a short editorial description. Click through to the agency page for the full reference entry — founding date, statutory basis, jurisdiction, parent ministry, headquarters, official channels, and a structured account of role, history, and notable operations footnoted to primary sources.
Coverage spans foreign-intelligence services (the CIA, SIS, DGSE, BND, GRU, SVR, MSS, RAW, and so on), domestic-security services (MI5, FBI, BfV, ASIO, DGSI), and signals-intelligence agencies (NSA, GCHQ, CSE, ASD, GCSB, FAPSI's successors). Entries marked in progress are stubs awaiting full reference treatment; they are kept on the index so the navigation between related services is preserved while the detailed text is written.
If you know the country but not the acronym, start at the Countries index. If you are looking for an operation, scandal, or theme that crosses agencies, see the Dossiers. The methodology page documents how operations are categorised as confirmed, alleged, or disputed.
