Threat Actor Profiling

Actor Naming Conventions

Every major CTI vendor uses a different naming system for threat actors, which creates confusion for analysts who read reports from multiple sources. When a Mandiant report about APT41 and a CrowdStrike report about WICKED PANDA describe the same actor group, recognizing the connection requires knowing the naming conventions. Understanding the logic behind each system makes cross-vendor correlation significantly easier.

Mandiant uses a numbered APT system: APT1 through APT43 (and beyond) with each number representing a distinct Chinese, Russian, Iranian, or North Korean state-sponsored group. The numbers have no inherent meaning beyond sequence of discovery and reporting. APT41 is notable for straddling the line between state-sponsored espionage and financially motivated cybercrime, operated by the same individuals under different mandates. Mandiant's naming convention prioritizes clarity and public attribution over codenames.

CrowdStrike uses an adversary codename system built around animal-country pairs. The country suffix indicates suspected nation-state affiliation: BEAR for Russia, PANDA for China, KITTEN for Iran, CHOLLIMA for North Korea, SPIDER for eCrime, BUFFALO for Vietnam, WOLF for Turkey, and JACKAL for hacktivist groups. The first word is unique to the actor cluster: COZY BEAR, FANCY BEAR, WICKED PANDA, CHARMING KITTEN. This system makes attribution immediately visible from the name itself.

Microsoft abandoned its previous ZINC/THALLIUM/STRONTIUM naming scheme in 2023 and adopted a weather-themed taxonomy. Nation-state actors use weather phenomena: Midnight Blizzard (formerly NOBELIUM, a Russian SVR group), Salt Typhoon (Chinese state-sponsored), Peach Sandstorm (Iranian MOIS). eCrime groups use storms: Scattered Spider, Lace Tempest. The system distinguishes category by weather type and country by a consistent keyword.

MITRE ATT&CK Groups use a G-number system (G0001 through Gnnn) alongside common names. G0016 is APT29, also tracked as Cozy Bear, Midnight Blizzard, and The Dukes. ATT&CK Group pages aggregate associated techniques, software, and campaigns across vendor reporting, making them the best single source for cross-vendor correlation. When you encounter an unfamiliar actor name, searching ATT&CK Groups for it usually reveals the full naming map.

Motivation and Intent

An actor's motivation shapes everything about how they operate: what they target, how patient they are, what risk they accept, and what success looks like for them. Attribution without motivation is incomplete. Knowing that an intrusion involves tools associated with APT41 is more useful when you understand that APT41 operates under two different mandates: strategic espionage on behalf of Chinese state interests, and financially motivated cybercrime on behalf of its operators personally.

Nation-state espionage is the most patient and most persistent category. These actors are funded by governments, operate on long time horizons, and prioritize access over speed. Their goal is typically data theft: intellectual property, government communications, strategic plans, or personal information that enables blackmail or recruitment. They tolerate long dwell times and invest in maintaining persistent access rather than rushing to exfiltration. Russian actors like APT29 are known for dwelling in environments for months or years while conducting careful, low-volume data collection to avoid detection.

Financially motivated cybercrime is the most common category by volume. It includes ransomware operators, business email compromise (BEC) groups, banking trojans, and crypto theft actors. Their goal is conversion of access to money as quickly as possible. Dwell time is typically shorter because extended presence increases risk of detection before monetization. North Korean actors present an interesting hybrid: state-sponsored groups like Lazarus conduct cryptocurrency theft as a revenue source for the DPRK government, blurring the line between nation-state and financially motivated actors.

Hacktivism involves actors motivated by political, ideological, or social goals. They target organizations for symbolic value, typically seeking to embarrass, disrupt, or expose perceived wrongdoing. The hacktivist category includes Anonymous-affiliated groups, pro-state influence operations, and groups tied to specific political conflicts. Their technical sophistication varies widely. Some hacktivist operations are conducted by highly capable actors using hacktivism as cover for state objectives.

Destructive operations aim to cause damage rather than steal data or generate revenue. These are the rarest and most severe category. Wiper malware campaigns, infrastructure attacks, and denial-of-service operations designed to cause physical damage fall here. NotPetya (attributed to Sandworm, a Russian GRU unit) encrypted critical infrastructure in Ukraine and caused collateral damage globally estimated at billions of dollars. The intent was disruption and destruction, not data theft.

The Diamond Model

The Diamond Model of Intrusion Analysis, developed by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz in 2013, provides a structured framework for describing and analyzing intrusion events. It is called the Diamond Model because its four core features form a diamond shape: adversary and victim on the vertical axis, capability and infrastructure on the horizontal axis.

The adversary is the individual, group, or organization conducting the intrusion. In practice, the adversary is often the element with the least certainty. Early in an investigation you may have strong evidence of capability and infrastructure but only working hypotheses about who the adversary is. The model accommodates this: you can build a complete analytical picture of an intrusion without confirmed adversary attribution, and add the adversary element as evidence develops.

Capability describes what the adversary can do: their toolset, techniques, and exploit development capacity. Capability includes both the malware or tools used in a specific intrusion and the broader set of techniques the actor has demonstrated across multiple campaigns. An actor who relies exclusively on commodity RATs has a different capability profile than one who develops custom implants and exploits zero-day vulnerabilities. Capability assessment directly informs detection strategy: actors with high technical capability require more behavioral detection, because they can easily defeat signature-based approaches.

Infrastructure encompasses the systems and services the adversary uses to conduct their operations: C2 servers, staging infrastructure, email accounts, VPN exit nodes, and any other technical resources involved in the attack. Infrastructure is the most volatile element of a threat actor profile because it changes with every campaign cycle. However, infrastructure patterns often persist: actors tend to use the same hosting providers, the same ASN ranges, the same domain registration habits, and the same certificate configurations across multiple campaigns. These patterns are what make infrastructure pivot analysis possible.

The victim is the targeted entity. In the Diamond Model, victim is not just a passive recipient of attack: understanding who is targeted and why reveals information about adversary motivation and intent. An actor who consistently targets defense contractors, research universities, and technology companies is demonstrating an interest in intellectual property. An actor who focuses on financial institutions and cryptocurrency exchanges has a different objective. Victim profiling helps organizations assess their own likelihood of being targeted and prioritize defensive resources accordingly.

Activity threading extends the model by linking multiple Diamond events into a campaign. A single intrusion produces one Diamond. A campaign produces many Diamonds linked by shared adversary, shared capability, or shared infrastructure. Threading these events together reveals the complete picture of how an actor operates over time, what their typical kill chain looks like, and where in that kill chain defenders have the best opportunities to interrupt the operation.

TTPs as Actor Fingerprints

Infrastructure changes. Tools get recompiled. Domains rotate. The one thing that is genuinely difficult for an actor to change is how they operate. The procedures an actor has developed, drilled, and automated across dozens of operations represent significant investment. Changing them requires retraining, retooling, and accepting reduced operational efficiency during the transition. As a result, TTP patterns are far more durable than any technical indicator, and TTP-level actor profiling produces intelligence that survives multiple campaign cycles.

Operation-specific TTPs are the specific technique implementations an actor uses in a given campaign: the exact PowerShell obfuscation pattern, the precise registry key used for persistence, the naming convention for dropped files, the timing patterns of C2 beaconing. These are observable in incident response forensics and sandbox analysis. They are highly specific and often unique to a particular actor or toolset variant.

Campaign-level TTPs are the broader patterns that persist across multiple operations: the actor always starts with spearphishing; they always move laterally using valid credentials stolen from a targeted system; they always stage data before exfiltration rather than exfiltrating in place. These patterns emerge from aggregating and comparing multiple incidents and reports over time. Campaign-level TTPs are what make intelligence-driven hunt hypotheses possible: if you know an actor consistently uses BITS jobs for lateral movement, you can hunt for unusual BITS activity in your environment before you have any evidence that actor is present.

Procedural fingerprints often outlast tool changes. When APT29 transitioned away from a particular implant family following public disclosure, their operational procedures remained largely consistent: the same spearphishing tactics, the same patience in initial reconnaissance, the same preference for living-off-the-land techniques during lateral movement. Defenders who focused only on the disclosed malware lost visibility. Defenders who focused on the procedural fingerprints maintained detection capability across the tool change.

Tool reuse creates a different kind of TTP fingerprint. Many actors use commercially available tools: Cobalt Strike, Metasploit, Mimikatz, BloodHound. Tool reuse alone does not indicate actor attribution because many distinct groups use the same tools. However, specific configurations of commercial tools can become fingerprints: a particular Cobalt Strike malleable C2 profile, a specific sleep jitter pattern, a consistent staging methodology. MITRE ATT&CK Software entries document which groups use which tools and in what configurations where known.

Attribution Challenges

Attribution is one of the most analytically difficult problems in threat intelligence, and it is one of the most frequently overstated. Vendors have commercial incentives to make confident attribution claims that generate press coverage and justify intelligence service pricing. Governments have political incentives to attribute attacks in ways that support policy objectives. Analysts who accept published attributions uncritically are not doing intelligence work; they are doing citation work.

False flags are a known adversary technique. Nation-state actors have deliberately planted code strings, language artifacts, and infrastructure indicators designed to implicate other nation-states. The Olympic Destroyer malware used in the 2018 Winter Olympics opening ceremony attack contained deliberate false flag elements pointing at North Korea, China, and Russia simultaneously. The actual attacker was Russian Sandworm. A single attribution data point, regardless of how specific it appears, is not sufficient for high-confidence attribution.

Shared tools and infrastructure create attribution confusion. When multiple distinct actor groups use the same bulletproof hosting provider, the same commercial malware kit, or the same open-source offensive tool, infrastructure and tool evidence alone cannot distinguish between them. This is a particular problem with commodity access brokers: an initial access broker may compromise an environment and sell access to multiple distinct actors. The forensic evidence of the initial access looks identical regardless of who ultimately purchased and used it.

Reporting bias shapes the public record. Vendors report what they can investigate. What they can investigate is shaped by which victims engage their IR services, which geographies they operate in, and which actor groups are active enough to produce sufficient incident data for analysis. Chinese and North Korean actors are heavily documented in the Western CTI ecosystem because they heavily target Western organizations. Russian actors in South America or Iranian actors targeting Gulf states are likely underreported in English-language CTI relative to their actual activity levels.

The appropriate response to attribution uncertainty is calibrated language. "Assessed with moderate confidence to be associated with APT29 based on overlapping infrastructure, tool configuration similarities, and targeting pattern consistency" is a different claim than "This is APT29." High-confidence attribution requires multiple independent evidence streams: unique tool attribution, infrastructure overlap with previously attributed activity, operational security failures that reveal actor identity, or direct confirmation from law enforcement or intelligence community partners. Most CTI attributions do not meet that bar, and the confidence should be expressed accordingly.

Building a Threat Actor Profile

A threat actor profile is a living document, not a static deliverable. It begins with what is known and evolves as new intelligence accumulates. The structure of a useful profile tracks the Diamond Model: who the actor is, what they do (capability and TTPs), what infrastructure they use, and who they target. Each element carries a confidence rating.

Start with the ATT&CK Groups page for the actor you are profiling. It aggregates technique mappings, associated software, and campaign references from across vendor reporting. Note which techniques are confirmed by multiple sources versus reported by a single vendor. High-confidence technique mappings from multiple independent sources are the most reliable profile elements. Single-source technique attributions should be flagged as lower confidence until corroborated.

Collect vendor reports and apply source analysis. Read each report with an awareness of what the vendor's collection limitations are. A managed security provider with visibility into specific industry verticals can document targeting patterns within those verticals but may miss activity in sectors where they have no customer base. Acknowledge these gaps in the profile rather than assuming absence of evidence means evidence of absence.

Document infrastructure patterns rather than specific infrastructure. Specific IPs and domains will change. The pattern of using certain ASNs, certain registrars, certain certificate providers, or certain hosting reseller chains may persist. Document these patterns as they are more durable and more useful for prospective hunting than individual IOCs that may already be retired by the time an analyst reads the profile.

Assess relevance to your organization directly. A comprehensive profile of an actor is academic unless it connects to your organization's threat surface. For each profiled actor, document: does our sector match their targeting history? Does our geography match their operational footprint? Do we hold data types consistent with their collection objectives? This relevance assessment is what transforms a research exercise into actionable prioritization.