Google Threat Analysis Group (TAG)

https://blog.google/security/

Google Threat Analysis Group, distinct from GTIG (Mandiant). Tracks state-aligned actors, commercial spyware vendors, election interference. Added 2026-05-08. The HTML landing only renders one featured report to WebFetch; fetch the Atom feed at https://blog.google/threat-analysis-group/rss/ for the dated post list. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → BROKEN FEED, websearch 'site:blog.google/threat-analysis-group 2026' to discover dated TAG posts, then webfetch the per-post https://blog.google/threat-analysis-group/<slug>/ URL (renders full body). The /security/rss/ feed exists but carries Android/consumer-fraud product posts, NOT the TAG threat-actor reports.. AVOID: Documented rss URL https://blog.google/threat-analysis-group/rss/ is dead (404), do NOT use it. The section landing page (/threat-analysis-group/ and /technology/safety-security/threat-analysis-group) renders only one featured Android product post to WebFetch, not the TAG list, do NOT rely on the landing page for discovery. /security/rss/ and /technology/safety-security/rss/ are consumer-fraud feeds, not TAG.. | 2026-07-05 admiralty audit: B, Google's in-house threat team, original research; live, keep active. Discovery via WebSearch (section landing is nav-only to WebFetch; /threat-analysis-group/rss/ is dead). | 2026-07-14: WebFetch returned Google's general security-blog homepage rather than the TAG-specific feed; recipe likely needs a more specific URL. HTTP 200, not a fetch failure, kept active. | 2026-08-04 run: RECIPE GAP CONFIRMED, https://blog.google/threat-analysis-group/ resolves to Google's general security blog rather than a dated TAG-specific listing. Recency of TAG research cannot be established through this URL; needs a replacement discovery path. | 2026-09-29: TAG blog folded into blog.google/security (threat-analysis-group/rss/ 404; landing = generic Security page). Quarterly TAG Bulletin renamed "Influence Operations Bulletin" (Q1 2026 dated 2026-05-08, Q2 2026 dated 2026-07-31, under /security/); TAG threat-actor research now ships as GTIG on cloud.google.com (see mandiant-gtig). Working recipe: feed https://blog.google/security/rss/ 15 (dated items, mostly Android/Chrome product security) then extract <post URL>. Sitemap https://blog.google/en-us/sitemap.xml (lastmod per URL) is a fallback discovery path. Low pipeline value; candidate for merge into mandiant-gtig. (2026-09-29T2134Z-audit) | 2026-10-11 (S3): the security feed https://blog.google/security/rss/ carried the Chrome ccTLD registry-hijack post of 2026-10-06 (cited by an entry of this run), so the earlier low-pipeline-value note is out of date. | 2026-10-20 (cleanup W6-03, 2026-10-11 audit recommendation 7 decided): keep separate from mandiant-gtig. The two feeds do not overlap: this one carries Google's product-security posts (Chrome, Android, the 2026-10-06 ccTLD registry hijack an entry cites), while TAG and Mandiant threat-actor research ships on the GTIG feed. Folding it would drop that content.