Cyberattack attribution is the process of determining who is behind a cyberattack – a specific group, person or state – based on technical evidence, intelligence and context.
How attribution works
Analysts combine several layers of evidence:
- Technical – malware code similarities, reused infrastructure, indicators of compromise, compilation timestamps, language settings and coding mistakes.
- Behavioural – tactics, techniques and procedures mapped to MITRE ATT&CK, working hours and target selection.
- Strategic – who benefits, geopolitical context and intelligence from human or signals sources available to governments.
Security vendors track clusters of activity under their own names, so one actor may have several labels – APT28, for example, is also known as Fancy Bear. Models such as the Diamond Model of intrusion analysis help structure the evidence.
Why attribution matters
Knowing the adversary helps defenders predict their next moves and prioritise threat intelligence. For governments, attribution enables indictments, sanctions and diplomatic responses: the US publicly blamed North Korea for the 2014 Sony Pictures attack, and in 2018 the US, UK and allies attributed NotPetya to the Russian military.
Attribution is also difficult and sometimes deliberately misled. Attackers use false flags: the Olympic Destroyer malware that hit the 2018 Winter Olympics contained clues pointing to North Korea’s Lazarus Group, but was later attributed to the Russian GRU unit known as Sandworm. Shared tools, leaked malware and hired contractors further blur the picture, which is why serious analysts express attribution in levels of confidence.
Best practices
- Focus internal response on stopping the attack; attribution can come later.
- Preserve logs and forensic evidence for analysts and law enforcement.
- Treat single indicators with caution and look for multiple independent sources.
- Track APT profiles relevant to your sector.
