Forest Global Training Partners

Cyber Risks · Cisco Talos

Defining a new methodology for modeling and tracking compartmentalized threats

Summary: Cisco Talos proposes extending the Diamond Model with a "Relationship Layer" to capture how multiple distinct threat actors divide work within a single intrusion, through arrangements such as outsourced malware development, rented traffic distribution services, and post-compromise access hand-offs. The article walks through a hypothetical four-actor scenario in which a financially motivated actor buys malware from a developer, pays a spam botnet operator per install, and sells access to a ransomware operator, and it notes that pivoting on shared infrastructure under the traditional model can wrongly attribute one actor's capabilities and victimology to another.

What's compelling: When a single intrusion can involve four separate actors with different motivations, attribution built on shared infrastructure or early-stage TTPs can point your incident response at the wrong adversary and misstate why you were targeted.

Read the original at Cisco Talos ↗

Topics
Threat Actors & Nation-State
Related