# Threat Actor Attribution Methods

## Attribution Indicators

### Strong Indicators
| Indicator | Reliability | Caveats |
|-----------|------------|---------|
| Code signing certificates | High | Can be stolen |
| Shared C2 infrastructure | High | Can be shared/sold |
| Unique custom tooling | High | Can be leaked |
| Compiler/linker artifacts | Medium-High | Can be faked |
| Embedded language strings | Medium | Can be false flags |

### Weak Indicators (Corroborate Only)
| Indicator | Reliability | Caveats |
|-----------|------------|---------|
| Similar TTPs | Low | Widely documented, easily copied |
| Geographic targeting | Low | Multiple actors target same regions |
| Time-of-day activity | Low | Can be automated, proxy used |
| Malware family reuse | Low-Medium | Shared in underground markets |
| Geopolitical motivation | Low | Circumstantial |

## Attribution Methodology

### 1. Technical Attribution
- Code similarity with previously attributed tools
- Infrastructure overlap (shared servers, domains, certificates)
- Operational patterns (specific tool combinations, deployment methods)

### 2. Behavioral Attribution
- TTP consistency with known groups
- Victimology alignment
- Campaign timing and operational tempo

### 3. Infrastructure Attribution
- Domain registration patterns (registrar, privacy service, naming)
- Hosting preferences (specific providers, regions)
- SSL certificate patterns (issuer, validity, subject fields)
- Passive DNS history

## Important Caveats

1. **False flags exist**: Sophisticated actors deliberately plant attribution indicators
2. **Tools are shared**: Underground markets sell/share malware and infrastructure
3. **Confidence matters**: Always state confidence level (high/medium/low)
4. **Multiple hypotheses**: Consider alternative explanations
5. **Nation-state ≠ government**: Distinguish between geographic origin and government direction
6. **Attribution is political**: Technical attribution has geopolitical implications

## Confidence Framework

| Level | Definition |
|-------|-----------|
| **High** | Multiple independent strong indicators from different sources |
| **Medium** | Mix of strong and weak indicators, some corroboration |
| **Low** | Primarily weak indicators, limited corroboration |
| **Unknown** | Insufficient evidence for any attribution |