Google Threat Analysis Group (TAG)

https://blog.google/threat-analysis-group/

Google Threat Analysis Group — distinct from GTIG (Mandiant). Tracks state-aligned actors, commercial spyware vendors, election interference. Added 2026-05-08. The HTML landing only renders one featured report to WebFetch; fetch the Atom feed at https://blog.google/threat-analysis-group/rss/ for the dated post list. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → BROKEN FEED — websearch 'site:blog.google/threat-analysis-group 2026' to discover dated TAG posts, then webfetch the per-post https://blog.google/threat-analysis-group/<slug>/ URL (renders full body). The /security/rss/ feed exists but carries Android/consumer-fraud product posts, NOT the TAG threat-actor reports.. AVOID: Documented rss URL https://blog.google/threat-analysis-group/rss/ is dead (404) — do NOT use it. The section landing page (/threat-analysis-group/ and /technology/safety-security/threat-analysis-group) renders only one featured Android product post to WebFetch, not the TAG list — do NOT rely on the landing page for discovery. /security/rss/ and /technology/safety-security/rss/ are consumer-fraud feeds, not TAG..