Introducing Unit 42’s Attribution Framework

Threat intelligence is essential for stakeholders to make informed security decisions, offering both tactical and strategic insights. Attribution provides value at multiple levels. Even without definitively identifying the specific actor or country of origin, various degrees of attribution can still yield valuable results. The Unit 42 Attribution Framework outlines three distinct levels:

• Activity clusters
• Temporary threat groups
• Named threat actors

Figure 1 illustrates these levels of attribution in a timeline from activity clusters to a named threat actor.

Attribution begins by assigning observed activity to a cluster, either by creating a new cluster or by linking the activity to a pre-existing one. During the investigation of threat activity or an intrusion, threat analysts gather various types of information, including:

• Infrastructure (e.g., IP addresses, domains, URLs)
• Capabilities (e.g., malware, tools, TTPs)
• Victims and targeting (e.g., organizations, industries, regions, temporal overlaps)

A single isolated event is usually not sufficient to form an activity cluster. While we sometimes allow singular observations to be activity clusters, in most cases we require at least two or preferably more, related events or observables. “Related” could mean:

• Shared indicators of compromise (IoCs)
• Similar TTPs
• Targeting the same organization or industry
• Occurring within a short time frame

Then we perform the following steps:

• Clearly articulate the rationale for grouping these events into a cluster
• Explain the shared characteristics and why we believe they are linked beyond coincidence

This justification is crucial for transparency and allows others to understand our reasoning.

For example, we might observe the following events:

• Event 1: A phishing email targeting a financial institution containing a malicious attachment with a file that has a specific SHA256 hash
• Event 2: A different financial institution reporting a malware infection with the same SHA256 hash
• Event 3: Open-source intelligence (OSINT) from a blog post linking this SHA256 hash to a suspected phishing campaign

These events would be sufficient to create an activity cluster. This example contains multiple related events (i.e., phishing and malware infection) with overlapping IoCs (i.e., SHA256 hash) and potential victim overlap (i.e., financial institutions). The OSINT provides additional context.

We name activity clusters based on their assessed motivation using the prefix CL- followed by a motivation tag and a unique number. Motivation tags are:

• UNK: Unknown motivation
• STA: State-sponsored motivation
• CRI: Crime-motivated
• MIX: A mix of STA and CRI

An example of a suspected state-sponsored activity cluster name would be CL-STA-0001.

What’s not needed for an activity cluster:

• High-confidence attribution: We don’t need to know who is behind the activity to create a cluster. Activity clusters are for grouping related activities, even if the actor is unknown.
• Complete attack lifecycle mapping: We don’t need to understand the full attack lifecycle at the cluster stage. We can form activity clusters based on partial information.

Temporary threat groups represent the second level of attribution. This concept allows us to elevate activity clusters to a more established category when we are confident a single actor is involved in the threat activity. This is true even when we lack sufficient information to attribute the activity to a named threat actor.

Establishing temporary threat groups enables more focused tracking and analysis of a threat actor’s operations while we develop the intelligence picture further.

As part of the attribution process, we must consider:

• The threat actor’s motivations — where possible — based on their activities (e.g., stealing sensitive data, destruction of systems, demanding ransom)
• Victimology
• Possible overlaps with known activity

Determining this motivation provides the label within the activity cluster or temporary threat group name, moving from the initial unknown (UNK) state to either cybercrime (CRI) or nation-state (STA), or MIX for a combination of the two. The CRI, STA and MIX labels apply to activity clusters and temporary threat groups, as we must know the motivation of a group prior to graduating to a named threat actor.

We leverage a set of minimum standards for each level of attribution to ensure analytical rigor, credibility and accuracy of our intelligence reporting.

Below, we outline some of the considerations that we have established to manage the promotion of activity through our Attribution Framework. We group these by type of analysis, and then describe how the considerations play out at each level of attribution.

• Activity clusters
  • Overlapping IoCs: Shared IP addresses, domain names, file hashes or other indicators.
• Temporary threat groups
  • Beyond IP addresses and domains: We focus on the relationships between infrastructure elements, such as shared hosting providers or registration patterns. We use these infrastructure pivots to uncover additional related activity.
  • Whois and (p)DNS records: We analyze Whois and (p)DNS records for suspicious domains. We look for patterns in registrant information and nameservers, as well as other details that might link seemingly disparate infrastructure.
  • Code similarities: If malware is involved, we go beyond hash comparisons. We analyze the code for similarities in structure, functionality and unique characteristics. We look for code reuse, shared libraries or other telltale signs of a common developer or codebase.
  • Tool configuration: We examine the configuration of any tools used by the actor. Unique configurations, custom modules or specific settings can be strong indicators of a single actor.
• Named threat actors
  • Infrastructure analysis: We conduct a thorough infrastructure analysis, linking the group’s activity to specific infrastructure elements (IP addresses, domains or servers). We demonstrate consistent use of this infrastructure over time and, ideally, link it exclusively to the group’s operations.
  • Malware analysis: If malware is involved, we perform in-depth analysis to identify unique code characteristics, shared codebases or links to other known malware families used by the group.

• Activity clusters
  • Common victims: Targeting organizations in the same industry or geographic region, or with similar profiles.
• Temporary threat groups
  • A deeper dive into victim profiles: We identify specific organizational characteristics, technologies used or types of data targeted that connect the victims. We look for patterns that extend beyond general classifications. For example: Is there a common vulnerability a threat actor is exploiting that could indicate the targeting is opportunistic, based on the victims’ attack surface?
  • Targeting motives: We investigate the underlying motives for the targeting. Does the choice of victims align with a particular objective, such as espionage, financial gain or disruption? Understanding the reason behind the targeting offers critical insights into the actor’s identity and aims.
• Named threat actors
  • Motivation and targeting patterns: We develop a clear understanding of the threat actor’s motivation and targeting patterns. What are their objectives (such as espionage, financial gain or disruption)? Who are their typical targets (industries, geographies, organizations)? A well-defined understanding of the threat actor’s motives and targets strengthens the attribution and provides valuable context.

• Activity clusters
  • Temporal proximity: Events occurring within a relatively short time frame.
• Temporary threat groups
  • Geopolitical or industry events: We correlate the activity timeline with external events, such as geopolitical developments or industry-specific conferences. Does the activity coincide with any events that might provide context or suggest a motive?
• Named threat actors
  • Sustained operations: We observe consistent and sustained activity from the threat actor for an extended period of time across multiple campaigns. This demonstrates a long-term commitment to the operations and reduces the likelihood of misattributing short-lived, opportunistic activity or false-flag operations.

OPSEC tracking: We analyze a threat actor’s OPSEC practices. Do they make consistent mistakes or exhibit unique patterns in their attempts to remain anonymous? These OPSEC fingerprints can be valuable for attribution. Notable mistakes include:

• Typos in code and commands
• Leaving a developer’s handle in code or file metadata
• Open infrastructure

Absence of contradictory evidence: We take care in the presence of contradictory evidence that could disprove the single threat actor hypothesis. For instance, drastic changes in an activity cluster’s TTPs or targeting might suggest multiple threat actors or a shift in operations. Such instances warrant further investigation before promoting an activity cluster to a temporary threat group.

Exceptionally high data volume: Promotion could be warranted if a significant volume of high-quality threat data becomes available earlier than our typical timelines. This could happen, for instance, after a major incident where extensive forensic analysis or threat intelligence gathering uncovers a wealth of information about a previously unknown actor. This accelerated timeline is justified when the data provides a comprehensive understanding of the actor’s TTPs, infrastructure and motivations. The activity cluster should exhibit activity across multiple vertices of the Diamond Model.

Data scarcity: If data remains scarce after an extended observation period, promotion to a temporary threat group could be premature. Continued monitoring and data collection are crucial in such scenarios. We exercise discretion to determine an appropriate time frame for further observation, weighing factors such as:

• The nature of the threat
• Potential impact
• Available intelligence sources

The objective is to collect sufficient data for confident attribution to a single actor before formally designating it as a temporary threat group.

Throughout the entire intelligence lifecycle, we regularly reevaluate the quality, validity and confidence levels of our threat intelligence. Before creating an activity cluster, promoting to a temporary threat group or formally naming a threat actor, we reassess our research and perform several checks to ensure the activity cluster is valid, meaningful and based on reliable information.

At that time, we did not have the Attribution Framework, so the articles do not mention activity clusters. However, we show that evolution in our 2023 Stately Taurus article where we assigned an activity cluster to the 2015 activity and linked it to Stately Taurus. Then in 2025, leveraging our Attribution Framework, we completed the link between Stately Taurus and Bookworm malware.

While analyzing Stately Taurus, we noted overlaps between parts of the threat actor’s infrastructure and systems used by a variant of Bookworm malware. Figure 2 maps SHA256 hashes associated with the Bookworm malware variant to the infrastructure used by Stately Taurus.

We added all the tracked IoCs, TTPs and other intelligence artifacts into our internal Attribution Framework scoresheet shown in Figure 3. We also provided details in the analysis column, including justifications to any changes of the default suggested score.

We implemented a small Attribution Framework Review Board to review findings. This board leverages members of multiple internal research teams to discuss the findings to ensure they are accurate. The review board also ensures that we have not overlooked any opportunities to build out the intelligence picture further before promoting an activity cluster to a temporary threat group or a temporary threat group to a named threat actor.

Conclusion

The Unit 42 Attribution Framework offers a structured approach to analyzing threat data. This methodology enables the attribution of observed activity to named threat actors, activity clusters or temporary threat groups with different levels of confidence. It is essential for long-term tracking and improves the efficiency of threat intelligence gathering and analysis.

We hope this framework offers our intelligence consumers sufficient transparency into our internal practices. Additionally, we hope it serves as a model for other threat research teams, contributing to the continued maturation of the threat intelligence profession.