Threat Attribution and Campaign Tracking
Use malware code overlap, infrastructure reuse, and TTPs to attribute campaigns to known threat actors.
What is Threat Attribution?
Threat attribution attempts to identify who conducted an attack: a specific nation-state actor, criminal group, or hacktivist collective. Attribution informs strategic decisions (policy response, law enforcement), but high-confidence attribution is difficult and often remains classified intelligence.
Attribution Evidence Types
Attribution evidence spans: technical indicators (code similarity, shared infrastructure, C2 tooling), operational patterns (targeting, timing, industry focus), strategic context (geopolitical motive), human intelligence (actor statements, forum activity), and signals intelligence from government agencies.
All lessons in this course
- APT Lifecycle: Initial Access to Exfiltration
- Fileless Malware and Living-in-Memory Techniques
- C2 Over HTTPS and DNS Tunneling
- Threat Attribution and Campaign Tracking