In MITRE ATT&CK Enterprise data (version 19.2), groups whose descriptions name Russia or North Korea have a higher median number of mapped techniques (27 and 29.5) than groups naming China or Iran (15.5 and 17.5). All four sets share phishing and command interpreters. They differ most on data encrypted for impact (T1486), from 2.2 percent for China to 25 percent for North Korea.
- 15.5Median techniques, groups naming China (46 groups)Source: MITRE ATT&CK Enterprise STIX data, version 19.2
- 27Median techniques, groups naming Russia (21 groups)Source: MITRE ATT&CK Enterprise STIX data, version 19.2
- 17.5Median techniques, groups naming Iran (18 groups)Source: MITRE ATT&CK Enterprise STIX data, version 19.2
- 29.5Median techniques, groups naming North Korea (8 groups)Source: MITRE ATT&CK Enterprise STIX data, version 19.2
Method: how did we assign an origin to each group?
ATT&CK has no origin field. We read each group description and took the first country or state agency named in its first two sentences, using keyword rules. The result is the origin as described by ATT&CK text. It is not our own attribution, and we do not test it.
The dataset has 176 groups. For 66 of them the first two sentences name no country, so we left them out. Only four origins have enough groups to compare: China (46), Russia (21), Iran (18) and North Korea (8). Smaller sets exist, such as Pakistan with 5, but we do not compare them. Technique shares use groups that have technique links in the data. That is 46 for China, 20 for Russia, 18 for Iran and 8 for North Korea.
We counted, for each group, which techniques ATT&CK links to it. We then took the median count per origin and, for ten chosen techniques, the share of groups in each origin with a link. The ten techniques are a selection of common ones, not a full ranking. Group counts and shares are copied as stored, rounded to one decimal.
How many techniques does ATT&CK map for each origin?
We counted the techniques linked to each group, then took the median per origin. North Korea has the highest median at 29.5, followed by Russia at 27. Iran sits at 17.5 and China at 15.5. For comparison, the median across all groups is 16.
A larger median means ATT&CK maps more techniques to those groups. It does not mean those groups do more. Mapping depends on how much public reporting exists and how closely analysts have described each group. The groups with the most mapped techniques show this spread. Kimsuky (North Korea) has 87, APT28 (Russia) has 73, APT41 (China) has 66 and Sandworm Team (Russia) has 64. Volt Typhoon (China) has 58.
What do the four sets have in common?
Phishing (T1566) is mapped for more than half of the groups in every set: 52.2 percent for China, 75 for Russia, 55.6 for Iran and 100 for North Korea. Command and scripting interpreters (T1059) are mapped for 58.7, 85, 66.7 and 62.5 percent. User execution (T1204) is in the top lists for China (50 percent), Russia (80) and North Korea (87.5).
This fits the wider picture in the full dataset, where phishing is mapped for 57 percent of groups and command interpreters for 72.1 percent. Our sibling studies look at that shared core of techniques in more detail.
Where do the shares differ?
The table shows ten techniques we selected before comparing. Values are the share of groups in each set with a link to the technique.
| Technique | All groups | China | Russia | Iran | North Korea |
|---|---|---|---|---|---|
| T1566 Phishing | 57.0 | 52.2 | 75.0 | 55.6 | 100.0 |
| T1059 Command and Scripting Interpreter | 72.1 | 58.7 | 85.0 | 66.7 | 62.5 |
| T1105 Ingress Tool Transfer | 51.2 | 45.7 | 55.0 | 50.0 | 75.0 |
| T1190 Exploit Public-Facing Application | 26.7 | 34.8 | 35.0 | 38.9 | 12.5 |
| T1078 Valid Accounts | 38.4 | 37.0 | 50.0 | 44.4 | 25.0 |
| T1027 Obfuscated Files or Information | 54.1 | 50.0 | 50.0 | 55.6 | 87.5 |
| T1047 Windows Management Instrumentation | 24.4 | 28.3 | 35.0 | 27.8 | 12.5 |
| T1003 OS Credential Dumping | 33.7 | 45.7 | 45.0 | 55.6 | 25.0 |
| T1133 External Remote Services | 16.3 | 13.0 | 35.0 | 11.1 | 12.5 |
| T1486 Data Encrypted for Impact | 11.0 | 2.2 | 15.0 | 11.1 | 25.0 |
Three differences stand out. First, T1486 is mapped for 25 percent of North Korea groups, 15 percent for Russia, 11.1 percent for Iran and 2.2 percent for China. Second, exploiting public-facing applications (T1190) is mapped for 34.8, 35 and 38.9 percent of China, Russia and Iran groups, against 12.5 percent for North Korea. Third, OS credential dumping (T1003) is mapped for 55.6 percent of Iran groups and 25 percent of North Korea groups.
What are the most common techniques inside each set?
The leading technique differs by set. For China it is command interpreters (58.7 percent) and for Russia the same technique (85 percent). For Iran it is obtaining capabilities (T1588, 72.2 percent), and for North Korea it is phishing (100 percent). Iran also has credential dumping and obfuscated files at 55.6 percent each, level with phishing.
The North Korea set has eight groups, so one group changes a share by 12.5 points. A gap of a few points between sets is within that noise. Larger gaps, such as T1486 for China against the others, are easier to see, but they still rest on small sets. For two of those sets, see the profiles of Kimsuky and APT28, linked above, and our study of software shared across groups.
Limits: what can this data not show?
The origin is read from description text, with keyword rules, so a group can be placed under the wrong country or left out. The 66 groups with no country named may differ from the rest. ATT&CK maps techniques from public reporting, so a gap in mapping can reflect a gap in reporting. Eight or 18 groups is a small base for any share. Differences show what is publicly mapped. They do not show intent, capability or how often a technique is used.
The four sets together hold 93 groups, from 46 plus 21 plus 18 plus 8. The comparison covers about half of the 176 groups in the dataset. Correlation is not cause here. We make no claim about why the sets differ.
What questions does this raise?
For a team using ATT&CK to plan detection, one question follows from the shared core: how well are phishing and command interpreter activity covered, whatever origin a report names? Another: does a gap in one set, such as T1486 for China, reflect real differences or only what has been reported and mapped?