Threat attribution is the process of linking an attack or a campaign to the group or state believed to be behind it. It rests on evidence and is a judgment, not a proof. Different organizations can reach different conclusions about the same activity.
- Also Called3other namesCyber attribution · Attack attribution · Actor attribution
- Related Terms3linked entriesThreat actor · Indicator of compromise (IoC)
What Is Threat Attribution?
Threat attribution means naming who is believed to be behind malicious activity. The answer is usually a threat group, and sometimes a state or a unit inside a state. It is a judgment made from evidence, so it can be revised.
How Does Attribution Work?
CISA explains that organizations in the cybersecurity community that research advanced persistent threats assign names or numbers to groups upon discovery. Because more than one organization does this research and there may be overlaps, CISA says there can be multiple names for a single group. It also says there is no ultimate arbiter of naming conventions. CISA notes that several organizations keep their own group lists, including MITRE ATT&CK Groups, Mandiant’s APT Groups and Microsoft’s Threat Actor Naming Taxonomy.
MITRE describes groups as activity clusters that are tracked by a common name in the security community. It tracks naming overlaps as Associated Groups, and says it does not represent the names as exact overlaps and encourages analysts to do additional research. MITRE also says organizations’ group definitions may partially overlap with groups designated by other organizations and may disagree on specific activity. It adds that its data is a subset available through open source reporting.
Why Does It Matter?
This is general reasoning. Attribution can help a defender understand the likely goals and methods of the party behind an attack. Naming the wrong group could send a team towards the wrong defenses, which is why careful teams state how sure they are and what evidence they used.
How Should You Use Attribution?
- Read the source of every attribution. Note who made it and on what basis.
- Expect different names for the same group, and check alias lists before concluding two reports differ.
- Focus first on the behaviors seen in your own environment, such as the techniques used, because these are observed and not assumed.
- Use group reports from public bodies as input to detection and response work.
How Do Governments Express Confidence in Attribution?
Government assessments use fixed words for how likely a judgment is. The UK Professional Head of Intelligence Assessment publishes a Probability Yardstick with seven ranges. The guidance says assessments use these terms instead of numbers like 55%, so that readers do not take a judgment as more precise than the evidence allows.
| Term | Approximate probability |
|---|---|
| Remote chance | Above 0% to about 5% |
| Highly unlikely | About 10% to 20% |
| Unlikely | About 25% to 35% |
| Realistic possibility | About 40% to under 50% |
| Likely or probable | About 55% to 75% |
| Highly likely | About 80% to 90% |
| Almost certain | About 95% to under 100% |
The same UK guidance adds a separate analytical confidence rating of high, moderate or low. It reflects the information base, the analytical rigour and the complexity and volatility of the topic. Probability says how likely a statement is. Confidence says how sound the basis for that judgment is.
What Does a Real Attribution Statement Look Like?
On 16 July 2020 the UK NCSC and Canada’s Communications Security Establishment issued an advisory on APT29, also known as the Dukes or Cozy Bear. They assessed it as a cyber espionage group, almost certainly part of the Russian intelligence services.
The advisory said APT29 targeted organisations working on COVID-19 vaccines in Canada, the United States and the United Kingdom. It said this was highly likely done to steal information and intellectual property. The steps below use that statement as the example.
- Find who made the judgmentThe NCSC and CSE assessed. The US NSA agreed with the attribution. CISA endorsed the technical detail and mitigation advice.
- Match the words to a scaleUnder the UK yardstick, “almost certain” is about 95% to under 100% and “highly likely” is about 80% to 90%.
- Separate the claims“Part of the Russian intelligence services” is one claim. “Highly likely to steal vaccine information” is a separate claim about intent.
- Look for a confidence ratingUK assessments can add a high, moderate or low confidence rating with reasons. Note when it is missing.
- Compare with other listsOther bodies may use other names and group definitions, so check alias lists before you compare reports.
Is Attribution the Same as Identifying the Attacker?
Not exactly. Attribution usually points to a group or a sponsor, not to a named individual. Group names are labels used by the community to track a cluster of activity. A label is not an identity check.
Is Attribution the Same as Indicators of Compromise?
No. Indicators of compromise are technical clues found on a system or network, such as a file or an address. Attribution is the later step of deciding who may be responsible. Indicators can feed the process, but they rarely settle it alone.
Related terms on this site include threat actor, advanced persistent threat and tactics, techniques and procedures.
Related Pages in the Knowledge Hub
Sources
- CISA: CISA says organizations researching APTs assign names or numbers on discovery, there can be multiple names for a single APT, and there is no ultimate arbiter of….
- MITRE ATT&CK: MITRE says groups are activity clusters tracked by a common name, associated names are not exact overlaps, and organizations' group definitions may partially overlap….
- UK Government: Explaining Uncertainty in UK Intelligence Assessment, 24 March 2025: the seven term Probability Yardstick and the high, moderate and low confidence ratings.
- UK NCSC: advisory of 16 July 2020: the APT29 attribution, the NSA agreement and the CISA endorsement of the technical detail.
Also Called.
- NameCyber attribution
- NameAttack attribution
- NameActor attribution
Questions.
-
What is threat attribution?
Threat attribution means naming who is believed to be behind malicious activity. The answer is usually a threat group, and sometimes a state or a unit inside a state. It is a judgment made from evidence, so it can be revised.
-
Why does one threat group have several names?
CISA explains that more than one organization researches advanced persistent threats and assigns names, and there may be overlaps. So there can be multiple names for a single group, and there is no ultimate arbiter of naming conventions.
-
Is attribution the same as identifying the attacker?
Not exactly. Attribution usually points to a group or a sponsor, not to a named individual. Group names are labels used to track a cluster of activity, and a label is not an identity check.
-
How should defenders use attribution?
Read who made each attribution and on what basis, and check alias lists before concluding two reports differ. Focus first on the behaviors seen in your own environment, such as the techniques used.
-
What do "almost certain" and "highly likely" mean in an attribution?
In the UK Probability Yardstick, almost certain is about 95% to under 100% and highly likely is about 80% to 90%. These terms say how likely a judgment is. A separate confidence rating says how sound its basis is.
In Our Research
- 1 Threat actor Glossary term