Intelligence
What is Campaign?
A set of intrusions sharing techniques and infrastructure across several victims over time, rather than one isolated incident.
A campaign is a set of intrusions or attack attempts that share techniques, infrastructure, tooling or timing across several victims over a period of time. It is a step up from a single incident and a step below a full threat actor profile.
Grouping activity into a campaign lets analysts see intent and scale: who is being targeted, what the operator is after and how the operation changes week to week. A campaign can be tracked long before anyone knows who runs it.