Threat attribution is the process of linking an attack or a campaign to the group or state believed to be behind it. It rests on evidence and is a judgment, not a proof. Different organizations can reach different conclusions about the same activity.
- Also Called3other namesCyber attribution · Attack attribution · Actor attribution
- Related Terms3linked entriesThreat actor · Indicator of compromise (IoC)
What is threat attribution?
Threat attribution means naming who is believed to be behind malicious activity. The answer is usually a threat group, and sometimes a state or a unit inside a state. It is a judgment made from evidence, so it can be revised.
How does attribution work?
CISA explains that organizations in the cybersecurity community that research advanced persistent threats assign names or numbers to groups upon discovery. Because more than one organization does this research and there may be overlaps, CISA says there can be multiple names for a single group. It also says there is no ultimate arbiter of naming conventions. CISA notes that several organizations keep their own group lists, including MITRE ATT&CK Groups, Mandiant’s APT Groups and Microsoft’s Threat Actor Naming Taxonomy.
MITRE describes groups as activity clusters that are tracked by a common name in the security community. It tracks naming overlaps as Associated Groups, and says it does not represent the names as exact overlaps and encourages analysts to do additional research. MITRE also says organizations’ group definitions may partially overlap with groups designated by other organizations and may disagree on specific activity. It adds that its data is a subset available through open source reporting.
Why does it matter?
This is general reasoning. Attribution can help a defender understand the likely goals and methods of the party behind an attack. Naming the wrong group could send a team towards the wrong defenses, which is why careful teams state how sure they are and what evidence they used.
How should you use attribution?
- Read the source of every attribution. Note who made it and on what basis.
- Expect different names for the same group, and check alias lists before concluding two reports differ.
- Focus first on the behaviors seen in your own environment, such as the techniques used, because these are observed and not assumed.
- Use group reports from public bodies as input to detection and response work.
Is attribution the same as identifying the attacker?
Not exactly. Attribution usually points to a group or a sponsor, not to a named individual. Group names are labels used by the community to track a cluster of activity. A label is not an identity check.
Is attribution the same as indicators of compromise?
No. Indicators of compromise are technical clues found on a system or network, such as a file or an address. Attribution is the later step of deciding who may be responsible. Indicators can feed the process, but they rarely settle it alone.
Related terms on this site include threat actor, advanced persistent threat and tactics, techniques and procedures.
Related pages in the Knowledge Hub
Sources
- CISA: CISA says organizations researching APTs assign names or numbers on discovery, there can be multiple names for a single APT, and there is no ultimate arbiter of….
- MITRE ATT&CK: MITRE says groups are activity clusters tracked by a common name, associated names are not exact overlaps, and organizations' group definitions may partially overlap….
Also Called.
- NameCyber attribution
- NameAttack attribution
- NameActor attribution
Questions.
-
What is threat attribution?
Threat attribution means naming who is believed to be behind malicious activity. The answer is usually a threat group, and sometimes a state or a unit inside a state. It is a judgment made from evidence, so it can be revised.
-
Why does one threat group have several names?
CISA explains that more than one organization researches advanced persistent threats and assigns names, and there may be overlaps. So there can be multiple names for a single group, and there is no ultimate arbiter of naming conventions.
-
Is attribution the same as identifying the attacker?
Not exactly. Attribution usually points to a group or a sponsor, not to a named individual. Group names are labels used to track a cluster of activity, and a label is not an identity check.
-
How should defenders use attribution?
Read who made each attribution and on what basis, and check alias lists before concluding two reports differ. Focus first on the behaviors seen in your own environment, such as the techniques used.
In Our Research
- 1 Threat actor Glossary term