Attribution Discipline

Attribution is three claims, not one. Which machine, which human operator, which sponsoring organization. They require different evidence and carry wildly different stakes, and collapsing them is how a technical finding becomes a geopolitical assertion in a single sentence.

Rank every indicator by how cheap it is to fake, the ordering David Bianco published in 2013 as the Pyramid of Pain. Hashes, addresses and domains are trivially changed and often shared. Host and network artifacts cost more, because changing them means changing how the tool works. Tools cost more again. Tradecraft — how an operator works, their hours, their habits, their repeated mistakes — is the expensive thing, because changing it means retraining people.

Assume false flags are possible, because they are documented.

In 2018 the Olympic Destroyer malware carried a forged compiler header crafted to imitate a known North Korean group, while other artifacts pointed researchers at China-linked groups instead. Everything planted was drawn from the cheap end of the scale. Researchers worked back toward a different assessment through operational patterns, and still published it with qualified confidence.

The attributions that have held up publicly did not rest on malware. The 2018 indictment of twelve officers traced a shared cryptocurrency operation funding both a leak site and the spear-phishing infrastructure, named specific units, and tied a persona to searches performed shortly before its first post. People leave records; malware leaves copies.

State likelihood and confidence separately, and write down the scenario in which you are wrong. “Very likely, with moderate confidence” is a real sentence. “Confirmed” usually is not.