To attribute a cyber attack to a specific threat actor, analysts primarily look for:

Question

Options

• AThe language of comments in the malware code
• BThe sophistication of the attack vector
• CUnique identifiers in the malware payload
• DConsistencies in TTPs with previous attacks

• A
  5% (1)
• B
  20% (4)
• C
  10% (2)
• D
  65% (13)

Explanation

Attributing a cyber attack to a specific threat actor relies on consistencies in TTPs (Tactics, Techniques, and Procedures) because these behavioral patterns are deeply ingrained in how a group operates - their tooling choices, infrastructure patterns, and attack sequences form a recognizable "fingerprint" that persists across campaigns. Language in code comments (A) is easily faked or obfuscated and is considered a weak, spoofable indicator. Attack sophistication (B) only narrows the field broadly (e.g., nation-state vs. script kiddie) but doesn't identify who specifically. Unique payload identifiers (C) can help confirm a known tool, but malware is routinely reused, sold, or stolen, so a payload alone doesn't reliably point to the author.

Memory tip: Think of TTPs like a criminal's MO - a burglar might change their disguise (malware code) or tools (payload), but they almost always enter through the same type of window and at the same time of night. Analysts use the MITRE ATT&CK framework to map and compare these behavioral patterns across incidents.

No community discussion yet for this question.