Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Introducing Unit 42’s Attribution Framework

Summary: Unit 42 introduced an Attribution Framework that uses the Diamond Model of Intrusion Analysis and the Admiralty System to assign default reliability and credibility scores to each piece of evidence, with analysts able to adjust them. Activity is tracked first as clusters (named CL- plus a motivation tag), elevated to temporary threat groups (TGR-) after at least six months of observation, and named as a threat actor only with high-confidence evidence across all four Diamond Model vertices.

What you should know: The framework requires at least six months of observation before a cluster becomes a temporary threat group, and a named attribution demands corroborated evidence from internal telemetry, trusted partners and OSINT - so a public name from Unit 42 carries that weight, and a wrong association could lead intelligence consumers to misprioritize security controls.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related