FieldP-08 · Machine, operator, sponsor
Attribute with Discipline
Say who did it only as far as the evidence reaches, and no further.
Step 1
Separate the Three Questions
Which machine, which human operator, which sponsoring organization. They are different claims needing different evidence and carrying different stakes.
Step 2
Rank Your Indicators by How Cheap They Are to Fake
Hashes, addresses and domains are trivially changed. Host and network artifacts cost more. Tools cost more again. Tradecraft — how an operator actually works — is the expensive thing to imitate.
Step 3
Assume False Flags Are Possible
In 2018 the Olympic Destroyer malware carried a forged compiler header crafted to look like a known North Korean group, and separate artifacts pointed at China-linked groups. The planted signals were the cheap ones.
Step 4
Weigh Operational Patterns
Working hours, language of the build environment, infrastructure reuse, mistakes repeated across operations. Patterns of behavior outlive any one indicator.
Step 5
Look for Non-Technical Evidence
Public attributions that hold up tend to rest on financial trails, procurement records, named units, and human error — not on malware alone.
Step 6
State Likelihood and Confidence Separately
“Very likely, with moderate confidence” is a real sentence. “Confirmed” usually is not.
Step 7
Write the Alternative
Name the scenario in which you are wrong and say what would demonstrate it.
How It Fails
Attribution by matching a hash to a blog post. Cheap indicators are the ones an adversary chooses to leave for you.