What is Threat Actor Attribution?

Threat Actor Attribution is the analytical process of linking observed malicious cyber activities, such as an intrusion, a campaign, or a piece of malware, to a specific, identifiable entity. This process involves collecting and analyzing evidence like tactics, techniques, and procedures (TTPs), infrastructure, malware code similarities, and contextual intelligence to determine the responsible party. The primary goal is to answer the question, "Who is responsible for this activity?" with an assessed level of confidence. It is a foundational element of cyber threat intelligence that informs strategic and operational responses.

A. Identifying the motives of threat actors is a component of building a threat actor profile, but it is not the core definition of attribution, which focuses on identity.
B. Determining the geographical location of threat actors is a piece of evidence used in the attribution process, not the definition of the process itself.
D. Predicting future actions of threat actors is a function of predictive analysis within threat intelligence, which uses attribution as an input but is a separate activity.

1. National Institute of Standards and Technology (NIST). (2016). Special Publication 800-150: Guide to Cyber Threat Information Sharing.

Reference: Section 2.2.2, "Threat Information," discusses the components of threat intelligence, including information about the adversary. The document states, "Information about an adversary may include their identity, capabilities, infrastructure, and TTPs." The process of determining this identity is attribution.

2. Caltagirone, S., Pendergast, A., & Betz, C. (2013). The Diamond Model of Intrusion Analysis. Applied CTI. Center for Threat-Informed Defense.

Reference: Page 4, Section "Adversary." The model defines the "Adversary" as the "actor/organization responsible for utilizing a capability against the victim to achieve their intent." The process of identifying this adversary based on evidence from an event is attribution.

3. Cisco Talos Intelligence Group. (2018). Threat Attribution. Cisco Blogs.

Reference: In numerous threat intelligence reports, such as the analysis of the "VPNFilter" malware, Talos demonstrates attribution. The process is described as "the analytical process of assigning a particular attack to a particular threat actor." This aligns directly with associating malicious activities with a specific actor. For example, the report "VPNFilter Update - VPNFilter Attribution" explicitly details the evidence used to link the campaign to a specific state-sponsored actor.