Intelligence
What is Attribution?
Deciding who was behind activity. The judgement analysts most want to make and the one most often made on thin evidence.
Attribution is the judgement of who was behind an intrusion or campaign. It can be made at different levels: linking activity to a tracked cluster, to a named group, or to a country or organisation that directs it.
It is the conclusion readers most want and the one most often made on thin evidence. Shared malware, reused infrastructure and language strings can all be copied or faked, so careful analysts state attribution with an explicit confidence level and separate what the evidence shows from what it suggests.