intel-analysis-actorprofile

--| | APT | Advanced Persistent Threat — well-resourced, sophisticated adversary (typically nation-state or sophisticated criminal) conducting long-term targeted operations | | TTPs | Tactics, Techniques, Procedures — behavioral fingerprint of an adversary group, more durable than IOCs which change frequently | | Aliases | Threat actors receive different names from different vendors (APT29 = Cozy Bear = The Dukes = Midnight Blizzard = YTTRIUM) | | Attribution | Process of associating an attack with a specific threat actor; requires multiple independent corroborating data points and carries inherent uncertainty | | Cluster | A group of related intrusion activity that may or may not be attributable to a single actor; used when attribution is uncertain | | Intrusion Set | STIX SDO type representing a grouped set of adversarial behaviors with common objectives, even if actor identity is unknown |

Tools & Systems

• MITRE ATT&CK Groups: Free, community-maintained database of 130+ documented adversary groups with referenced campaign reports
• Mandiant Advantage Threat Intelligence: Commercial platform with detailed APT profiles, malware families, and campaign analysis
• CrowdStrike Falcon Intelligence: Commercial feed with adversary-centric profiles and real-time attribution updates
• Recorded Future Threat Intelligence: Combines OSINT, dark web, and technical intelligence for adversary profiling
• OpenCTI: Graph-based visualization of threat actor relationships, tooling, and campaign linkages

Common Pitfalls

• IOC-centric profiles: Building profiles around IP addresses and domains rather than TTPs means the profile becomes stale within weeks as infrastructure rotates.
• Vendor alias confusion: Conflating two different threat actor groups due to shared malware or infrastructure leads to incorrect threat model assumptions.
• Binary attribution: Treating attribution as certain when it is probabilistic. Always qualify attribution confidence level (Low/Medium/High).
• Neglecting insider and criminal groups: Overemphasis on nation-state APTs while ignoring ransomware groups (Cl0p, LockBit, ALPHV) which represent higher probability threats for most organizations.
• Profile staleness: Adversary TTPs evolve. Profiles not updated quarterly may miss technique changes, new malware, or targeting shifts.