Attribution: A Puzzle
Summary: Cisco Talos researchers Martin Lee, Paul Rascagneres and Vitor Ventura examined two WellMess malware samples and found infrastructure and TTP pivots that pointed toward APT28 and DarkHotel, respectively, while the UK's NCSC attributed WellMess to APT29 in a report endorsed by Canada's CSE, the NSA and DHS CISA. The researchers note that the evidence is weak and that the links are incompatible with each other, with some possibly being false flags or coincidental.
Key Takeaway: The same WellMess samples produced three different attribution paths - APT28 via shared IP infrastructure, DarkHotel via a Sangfor VPN client filename, and APT29 via the NCSC's classified intelligence - and the researchers state they cannot confirm or refute the NCSC conclusion because its sources are not public. If your threat intelligence vendor hands you an attribution, ask which of those three paths it came from and whether the underlying evidence is available for you to check.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026