Google Threat Analysis Group (TAG)

https://blog.google/threat-analysis-group/

Google Threat Analysis Group — distinct from GTIG (Mandiant). Tracks state-aligned actors, commercial spyware vendors, election interference. Added 2026-05-08. The HTML landing only renders one featured report to WebFetch; fetch the Atom feed at https://blog.google/threat-analysis-group/rss/ for the dated post list. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → BROKEN FEED — websearch 'site:blog.google/threat-analysis-group 2026' to discover dated TAG posts, then webfetch the per-post https://blog.google/threat-analysis-group/<slug>/ URL (renders full body). The /security/rss/ feed exists but carries Android/consumer-fraud product posts, NOT the TAG threat-actor reports.. AVOID: Documented rss URL https://blog.google/threat-analysis-group/rss/ is dead (404) — do NOT use it. The section landing page (/threat-analysis-group/ and /technology/safety-security/threat-analysis-group) renders only one featured Android product post to WebFetch, not the TAG list — do NOT rely on the landing page for discovery. /security/rss/ and /technology/safety-security/rss/ are consumer-fraud feeds, not TAG.. | 2026-07-05 admiralty audit: B — Google's in-house threat team, original research; live, keep active. Discovery via WebSearch (section landing is nav-only to WebFetch; /threat-analysis-group/rss/ is dead). | 2026-07-14: WebFetch returned Google's general security-blog homepage rather than the TAG-specific feed; recipe likely needs a more specific URL. HTTP 200, not a fetch failure — kept active. | 2026-08-04 run: RECIPE GAP CONFIRMED — https://blog.google/threat-analysis-group/ resolves to Google's general security blog rather than a dated TAG-specific listing. Recency of TAG research cannot be established through this URL; needs a replacement discovery path.