Back doi.org

"Under false flag: using technical artifacts for cyber attack attribution"

doi.org • October 17, 2026

A false flag in the cyber domain is significantly different and much easier to carry out than in the physical world ( Goodman 2010 ). Cyber false flags refer to tactics applied by cunning perpetrators in covert cyber attacks to deceive or misguide attribution attempts including the attacker’s origin, identity, movement, and exploitation. It is typically very hard to conclusively attribute cyber attacks to their perpetrators and misdirection tactics can cause misattribution (permitting response and counterattack, which can lead to retaliation against the wrong party ( Wheeler and Larsen 2003 ; Philbin 2013 ; Harrington 2014 )).

False flag operations have long existed in the physical world ( Kearns et al. 2014 ), a tactic used to make an operation appear to have been planned and executed by someone other than the real perpetrator. Digging a little deeper into the concept of a false flag operation shows that the intent of the actor behind the operation is to do one of two things: (1) let a third party take the blame for malicious actions they did not carry out, or (2) hide own malicious actions behind someone else ( Morgan and Kelly 2019 ).

Cyber attribution ( Rid and Buchanan 2015 ) is not an easy task, and the existence of false flags make the situation even worse. However, attribution is a crucial task of nation states to carefully distinguish between the acts of criminal organizations and the acts of war of nation states. Wrong attribution can have devastating consequences, which leaves zero tolerance for failures.

It is therefore of utmost importance to get it right. An important prerequisite is to know common attack tools and techniques and understand which traces (typically artifacts) they potentially leave in a victim’s infrastructure (or even elsewhere, like at the premises of cloud providers and other external parties). Starting from there, it is further important to understand what questions during the investigations of an incident can be answered by studying these artifacts. And eventually, it is key to understand how reliable the conclusions based on the investigation of certain artifacts are. In fact, some artifacts could be spoofed, certain traces faked to point at other parties than the real adversary. In a complex technical system this is realistic; however, the complexity of today’s systems does it not only make hard for investigators to fetch the relevant data to achieve vital insights, but it also makes it hard for cunning attackers to consistently carry out false flags campaigns. This benefits the investigators. Eventually we must acknowledge that cyber attack attribution is challenging, but nevertheless important – and when done, it allows no room for mistakes. In this paper we take a closer look into this dilemma.

The contributions of this paper are:

Short survey on attack techniques: We outline common cyber weapons and attack techniques along the cyber kill chain. Every applied technique leaves different kinds of traces. In the early phase of an attack this might be information related to domain registration or bitcoin transactions used to rent a service in the dark net. During the actual attack, entries in log files of exploited machines may point to applied exploits or C&C traffic.

Relevant artifacts: For each phase in the kill chain different questions may be asked in the forensic investigations. We highlight some relevant example questions and connect them to typical artifacts produced through the application of aforementioned attack techniques. Profound knowledge artifacts that carry information an attack aids the attribution process.

Attribution process and issues with false flags: We outline what information is potentially derived during the attribution process through investigating the collected artifacts and the issues with identifying false flags. Especially, we take a closer look into how easily the discovered artifacts can be spoofed by attackers to disguise traces and their trustworthiness in course of an illustrative attribution scenario.

The remainder of this paper is organized as follows. “ Related work ” section provides an overview of related work, mainly around attributing APT attacks and discussions on false flag campaigns. “ Common cyber weapons in the kill chain ” section surveys the most prominent attack techniques along the cyber kill chain. “ Artifacts for the attribution process ” section discusses the critical questions being asked in course of investigations for the different phases of an APT attack, and highlights information sources and artifacts that may help attributing an attack correctly. “ Attribution and false flags ” section elaborates on the actual attribution process and the potential of spoofed artifacts in course of false flag campaigns. It further discusses an illustrative attribution scenario and demonstrates the application of methods presented in this paper. Finally, “ Conclusion and future work ” section concludes the paper.

Advanced persistent threats

APTs ( Tankard 2011 ) have been studied extensively since the appearance of Stuxnet ( Falliere et al. 2011 ). Some recent APTs, which we also investigate further in this paper (see “ Attribution and false flags ” section), are the Narwhal Spider APT, Grey Energy, Pro-Syrian Government Hackers, Octopus APT, and Darkhotel APT. These APTs represent a broad view on the different modes and ways attacker groups may work. They cover also the latest TTPs, the Narwhal Spider group uses for example a combination of steganography and malicious PowerShell ( Beatty 2019 ). Grey Energy is more stealthy and sophisticated, as his ancestor Black Energy resulting in the first publicly-reported blackout caused by cyber operation ( Cherepanov 2018 ). The Pro-Syrian Government Hackers differs from the other groups since they are directly political active. They spread a fake security tool in order to monitor and detect anti-government content and political-not-correct persons ( Galperin and Marquis-Boire 2012 ). The Octopus APT used one of the most popular Social Media application for spreading fake news to incite unrest. Darkhotel belongs to the full-scale surveillance campaigns. Darkhotel had been active for seven years in a number of luxury Asian hotels ( Woodier and Zingerle 2019 ). These five different cases form the basis of the survey trustworthy artifact types in this work.

In order to allow for a structured analysis, numerous models to distinguish the phases of APTs have been proposed, of which some of the popular ones are the Lockheed Martin cyber kill chain ( Yadav and Rao 2015 ; Hutchins et al. 2011 ) and the ATT&CK framework from MITRE ( MITRE 2019 ). We use these models to establish an approach for a structured analysis of artifacts created in course of cyber attacks that possibly aid the attribution process. In particular, we use the categories of known attack vectors to survey relevant artifacts usable for attribution purposes.

Cyber attack attribution

A prerequisite of cyber attribution is to discover the applied techniques, tools and procedures (TTPs). Based on that, the further goal is to identify the source of certain attacks that leads to the threat actor. Both topics, cyber attack investigation (i.e., get to know what happened) and threat actor attribution (i.e., get to know who did it) aims to serve as a basis for actions in law enforcement and national security (such as cyber war or terrorism). There is a wide range of literature on this topic with different approaches. It is often a mix of technical attack analysis and threat actor profiling, that sometimes leads to confusion. Numerous works have investigated the "art" of cyber attribution ( Tran 2018 ; Tsagourias and Farrell 2018 ; Rid and Buchanan 2015 ; Tsagourias 2012 ; Brenner 2006 ). For instance ( Tsagourias and Farrell 2018 ) outlines what data and information is most helpful in the attribution process to identify the perpetrator. They highlight that not only malware samples and their specific properties (such as compiler settings, language settings, certain re-occurring patterns and the like) are useful, but also information available outside the actually attacked infrastructure, including data on the command & control infrastructure. The latter includes knowledge of what IP addresses have been used, what domain names and registration information of these domains. This boils down to payment information for the referenced domains. Eventually ( Tsagourias and Farrell 2018 ) comes up with a categorization of data which distinguishes between physical persons, virtual personas, campaigns and infrastructure and tools. Paper ( Li 2014 ) extends this view specifically by DNS patterns, especially the association of domain names with IP addresses, which even extends the passive DNS ( Bilge et al. 2011 ) project.

One of the best known models is the Q-Model by Rid & Buchanan ( Rid and Buchanan 2015 ). They are looking for an answer to the question, whether attribution is a technical problem or not. Their model introduces multiple levels: strategic, operational, tactical and technical and communication, and several roles: from forensic investigators through national security officers to political leaders. The Q-Model helps analysts to ask the full range of relevant questions and put the investigation into context. It integrates both technical and non-technical information into competing hypotheses. This includes asking more challenging questions on different levels. The study ’Role and Challenges for Sufficient Cyber-Attack Attribution’ ( Hunker et al. 2008 ) summarizes the political, legal and technical challenges. A detailed description of legal issues is available in ’The Law of Attribution: Rules for Attributing the Source of a Cyber-Attack’ ( Tran 2018 ).

The Q-model ( Rid and Buchanan 2015 ) is of particular interest to us as it already itemizes the relevant questions to be answered in course of investigations. However, while this model provides a structured view on the questions it does not elaborate on how to answer them. We pick up from there and try to provide – at least for some of the questions – answers on which artifacts are the most relevant ones and which traces possibly lead to the attackers. In terms of attribution it is also important to note that the goal is usually not to associate individuals to cyber attacks but whole groups ( Lemay et al. 2018 ). Often the team members of these groups change and can hardly be identified, but it is important to understand the motives of a group and whether governments can be held accountable for their actions ( Tsagourias 2012 ).

Regarding threat actor attribution, the Hacker Profiling Projects provides one of the most complex models ( Chiesa et al. 2008 ). The research has four principal points of view: technological, social, psychological and criminological. Their profiling methodology contains the 4Ws: who, where, when, why. The resulting hacker profiles contain the following categories: Wanna Be, Script Kiddie, Cracker, Ethical Hacker, Skilled Hacker, Cyber-Warrior, Industrial Spy, Government agent, and Military hacker. The applied correlation standards cover the following aspects for each profile: modus operandi, lone hacker or group, selected targets, hacking career, hacker’s ethics, crashed or damaged systems, perception of illegality and effect of laws. The study of PWC developed other profile categories: governments, criminals, hacktivist. They distinguish the perpetrators on the motivation and the technical origin of the attack: cyber crime, cyber activism or cyber warfare. The study ’Cyber Attribution Using Unclassified Dat’ (Public-Private Analytic Exchange Program Team 2016 ) focuses on the Diamond Model and on accountability for investigation and prosecution based on cyber attribution. The results show that the cooperation between distinct communities (law enforcement, intelligence community, industry) is required for attribution, and there are no standardized tools in use. The Diamond Model appears again in the research of intrusion analysis ( Caltagirone et al. 2013 ).

The Cyber Attribution Model (CAM) ( Pahi and Skopik 2019 ), proposed as a response to the lack of other models to support the full attribution process, initially separates the two corner stones cyber attack analysis and threat actor profiling and brings them together in the attribution phase. In this paper we take a closer look into how this model can be populated with reliable technical data and outline the attribution process in course of an illustrative example.

The challenges related to false flags have been investigated before ( Pihelgas 2015 ). Especially ( Bartholomew and Guerrero-Saade 2016 ) takes a closer look into the problem and also surveys noteworthy actors in the field. Cyber Information sharing ( Skopik et al. 2016 ; Wagner et al. 2016 ) is a common means to gather important data to aid the attribution process, for instance, information on attackers, their capabilities, used TTPs and so on.

It is important to note that attack detection is very much different from attribution, in that sense that not all sources ( Zimmermann 2014 ; MITRE 2019 ) relevant to detect attacks ( Caltagirone et al. 2013 ) are also appropriate for attribution. In contrast to pure detection of attacks, attribution sets its focus to relating actions to actors. A particularly important piece are therefore actor profiles ( Chiesa et al. 2008 ) used to correlate identified actions to known capabilities and applied tactics and techniques of actor groups. The main problem of the attribution is a potential misattribution. Since the perpetrator attempt to cover up their tracks through a mixture of evasiveness, deception, and destruction of records or though false flags. This issue is well known among agencies and secret services. The NSA and NCSC released for instance a joint advisory APT group to avoid possible misattribution Footnote 1 . The information sharing, especially threat intelligence, is one essential aspect to detect false falgs. There are some initiatives worldwide, such as the Cybersecurity Information Sharing Act in the USA Footnote 2 , Cyber Security Information Sharing of ENISA Footnote 3 , or Cyber Information Exchange in the NATO Footnote 4 . The NATO Cooperative Cyber Defence Centre of Excellence is also aware of the issue and developed own definitions for false-flag, no-flag cyber operations ( Pihelgas 2015 ) and influence cyber operations ( Brangetto and Veenendaal 2016 ). Influence cyber operations are designed to influence the behaviour of a target audience. These false flag operations are part of the hybrid threats today, such as Russian aggression against Ukraine in 2014 and its intervention in Syria in 2015. One of the latest false flag operation is the TV5Hack (see “ Illustrative application of CAM to identify false flags ” section).

Common cyber weapons in the kill chain

Numerous initiatives attempt to structure the different attack techniques used in complex multi-stage APT attacks, including the Lockheed Martin cyber kill chain ( Yadav and Rao 2015 ) and the ATT&CK framework from MITRE ( MITRE 2019 ). While the latter is quite tool-centric and details the different stages of carrying out the actual attack, the first one also considers the preparation phases of an attack, including reconnaissance. We argue that even in these phases, when attackers prepare for a complex attack, traces may be left, such as the attempts to buy zero day exploits in the dark net, excessive scanning activities, social engineering attempts and the like. We therefore survey most common techniques along the cyber kill chain, which consists of the following phases:

1 Reconnaissance: First, attackers probe for a weakness. This might include harvesting login credentials or information useful in a phishing attack.

Reconnaissance: First, attackers probe for a weakness. This might include harvesting login credentials or information useful in a phishing attack.

2 Weaponization: This phase deals with building a deliverable payload, usually using an exploit within the target system and a backdoor to maintain long-term access.

Weaponization: This phase deals with building a deliverable payload, usually using an exploit within the target system and a backdoor to maintain long-term access.

3 Delivery: Then the attackers send the weaponized bundle to the victim, e.g., a malicious link in a legitimate-looking e-mail.

Delivery: Then the attackers send the weaponized bundle to the victim, e.g., a malicious link in a legitimate-looking e-mail.

4 Exploitation: Upon successful delivery, the initial intrusion takes place by executing code on the victim’s system. Installing a backdoor allows attackers to maintain permanent access, even if the initially exploited vulnerability is fixed.

Exploitation: Upon successful delivery, the initial intrusion takes place by executing code on the victim’s system. Installing a backdoor allows attackers to maintain permanent access, even if the initially exploited vulnerability is fixed.

5 Lateral Movement and Installation: Then, the attackers pivot through the system to find valuable resources. Once a particular target machine has been spotted, more sophisticated malware is dropped.

Lateral Movement and Installation: Then, the attackers pivot through the system to find valuable resources. Once a particular target machine has been spotted, more sophisticated malware is dropped.

6 Command & Control: This malware allows to create a channel where the attacker can control a system remotely.

Command & Control: This malware allows to create a channel where the attacker can control a system remotely.

7 Actions: Eventually the attackers remotely carry out their goal, e.g., to take over control or exfiltrate data.

Actions: Eventually the attackers remotely carry out their goal, e.g., to take over control or exfiltrate data.

In this section we survey frequently applied techniques to run through the cyber kill chain. In the section, we are going to investigate which actual traces the application of these techniques leaves and what artifacts need to be collected and studied to aid the attribution process. Notice that this list is far from being complete as this would certainly go beyond the scope of this paper. However, we surveyed prominent APT cases (cf. “ Related work ” section) from the past years and highlight the most frequently used techniques.

Step 1: reconnaissance

The execution of the reconnaissance phase is individually shaped to the attack and unique in every case. Here, the attacker attempts to acquire the required knowledge to better understand the victim’s infrastructure, discover weaknesses and vulnerabilities, including non-technical ones, and gather further knowledge that helps to find a path into the target organization. The latter could be quite tricky and often does not only include the actual target, but also vertical organizations, such as suppliers, customers and partner organizations. Common attack techniques are:

Social engineering: spear phishing ( Hadnagy 2010 ) to gather further information, baiting, i.e., the distribution of infected USB sticks (not for intrusion but information gathering), tailgating, e.g., testing for physical access as fake client ( Krombholz et al. 2015 ).

Passive scanning: intercepting traffic from/to the target network ( Bartlett et al. 2007 ), elaborating WiFi ranges and settings.

Active network scanning and enumeration: Banner grabbing ( Kang et al. 2017 ) of publicly facing services for subsequent vulnerability analysis, probing of (web) server capabilities, port scans to discover firewall settings for certain IP ranges ( Lyon 2009 ).

Step 2: weaponization

The weaponization mainly consists of building a deliverable payload that applies an exploit to place a backdoor. It further may include steps to build up a working external infrastructure, i.e., acquiring domains later being used to create command and control (C&C) capabilities. Common attack techniques are:

Set up a staged lab environment built to research vulnerabilities and evaluate numerous attack techniques ( Peterson 2013 ).

Evaluate standard-payloads , e.g. reverse shell ( Foster et al. 2015 ), keylogger ( Tuli and Sahu 2013 ), snapshot tools together with well-known demo code for vulnerabilities (depending on the target requirements and attacker capabilities).

Research zero days exploits ( Bilge and Dumitraş 2012 ), either developed individually (which is resource-intensive and requires access to copies/clones of the target equipment) or purchased on the black market (requires access to these sources; payment usually via electronic currencies). With respect to the latter, we must distinguish between buying bare proof-of-concepts which are further modified and compiled by the attacker v.s. full-fledged exploitation software.

Crafting a remote access trojan ( Haagman and Ghavalas 2005 ), typically bundled with an exploit to be dropped into the target environment.

Survey different delivery techniques , e.g., infected pdf, macros in docx, xlsx, scr files etc.

Preparation of external infrastructures , such as registration (or even reuse) of domain names, botnets ( Li et al. 2009 ) and cloud services to establish C&C capabilities compatible to the constructed payload.

After crafting the payload, the attackers either send the weaponized bundle to the victim, e.g., a malicious link in a legitimate-looking e-mail, or deploy it somewhere, where the victim is likely to pass by (e.g., a manipulated ad banner wich exploits a JavaScript vulnerability). Notice, sometimes the payload is not directly delivered to the target organization but rather to an associated organization, such as a partner company or sub contractor, to sneak into the supply chain. Common attack techniques are:

(Spear) Phishing ( Krombholz et al. 2015 ) tries to persuade employees to act in the interest of the attackers, e.g. click a link or download a software.

Infection of resources or services of an associated company or supplier, including subcontractors, partner companies or customers and exploit the trust relation between those entities and the actual target organization.

Watering hole attacks ( Krombholz et al. 2015 ) try to push malware onto a victim’s computer and exploit browser vulnerabilities, once they visit a particular Internet site.

WiFi and extended network infrastructure are means to get access to an otherwise well secured network segment.

Physical access to manipulate equipment directly or to drop malware via social engineering, e.g. baiting ( Hadnagy 2010 ).

"Traditional" criminal activities , such as bribery or blackmailing are old, but nevertheless an effective means to get initial access.

After the successful delivery of the payload, the initial intrusion takes place by executing code on the victim’s system. Installing a backdoor allows attackers to maintain permanent access, even if the initially exploited vulnerability is fixed. Common attack techniques are:

Exploits , such as the initial exploitation of a (Browser) vulnerability, a vulnerable plugin (for Java, Flash etc.), or a product used to view a manipulated file, e.g., MS Office, Adobe Acrobat and the like.

Backdoors , including the installation of a remote access trojan/tool (RAT) ( Haagman and Ghavalas 2005 ) which usually connects in reverse mode to the C&C server to pull commands from.

Cross-Site-Scripting (XSS) ( Vogt et al. 2007 ) exploited by specifically drafter requests to Web servers, may be used to bypass certain access controls and gain access to machines.

Step 5 to step 7: installation, command&Control, actions

Attack techniques employed in the later stages of the kill chain are quite diverse and manifold. MITRE did an excellent work summing them all up in their ATT&CK framework ( Strom et al. 2017 ; MITRE 2019 ). Thus, we will not go into further details of the single techniques applied once an attacker got initial access, but rather sum up their underlying tactics (cf. overview in Fig. 1 ).

Execution: The execution tactic represents techniques that result in execution of adversary-controlled code on a local or remote system. This tactic is often used in conjunction with initial access as the means of executing code once access is obtained, and lateral movement to expand access to remote systems on a network.

Persistence: Persistence is any access, action, or configuration change to a system that gives an adversary a persistent presence on that system. Adversaries will often need to maintain access to systems through interruptions such as system restarts, loss of credentials, or other failures that would require a remote access tool to restart or alternate backdoor for them to regain access.

Privilege Escalation: Privilege escalation is the result of actions that allows an adversary to obtain a higher level of permissions on a system or network. Certain tools or actions require a higher level of privilege to work and are likely necessary at many points throughout an operation. Adversaries can enter a system with unprivileged access and must take advantage of a system weakness to obtain local administrator or SYSTEM/root level privileges. A user account with administrator-like access can also be used. User accounts with permissions to access specific systems or perform specific functions necessary for adversaries to achieve their objective may also be considered an escalation of privilege.

Defense Evasion: Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation. Defense evasion may be considered a set of attributes the adversary applies to all other phases of the operation.

Credential Access: Credential access represents techniques resulting in access to or control over system, domain, or service credentials that are used within an enterprise environment. Adversaries will likely attempt to obtain legitimate credentials from users or administrator accounts (local system administrator or domain users with administrator access) to use within the network. This allows the adversary to assume the identity of the account, with all of that account’s permissions on the system and network, and makes it harder for defenders to detect the adversary. With sufficient access within a network, an adversary can create accounts for later use within the environment.

Discovery: Discovery consists of techniques that allow the adversary to gain knowledge the system and internal network. When adversaries gain access to a new system, they must orient themselves to what they now have control of and what benefits operating from that system give to their current objective or overall goals during the intrusion. The operating system provides many native tools that aid in this post-compromise information-gathering phase.

Lateral Movement: Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access tool.

Collection: Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.

Exfiltration: Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from a target network. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.

Command and Control: The command and control tactic represents how adversaries communicate with systems under their control within a target network. There are many ways an adversary can establish command and control with various levels of covertness, depending on system configuration and network topology.

Artifacts for the attribution process

Based on the overlook of attack techniques in “ Common cyber weapons in the kill chain ” section, we are going to investigate which types of artifacts are left by applying these techniques on the victim’s computers, which potentially aid the attribution process. Knowing, which traces attackers leave help to better understand which of them are quite unique and which can be spoofed or tampered with easily.

Reconnaissance artifacts

When investigating an attack, typical questions concerning its very beginning are centered on whether the attackers already left traces in form of suspicious behavior. This might include active scanning attempts on the network layer, profile mining activities on social networking sites, phishing for information gathering, faked visits including job interviews, password brute force attacks on externally facing services, e.g., Webmail and so on. Another important question to answer is whether attackers prepared for a direct attack or an indirect one, i.e., using a contractor or customer, to get into the target infrastructure. Typical artifacts and hints that may aid the attribution process:

Perimeter monitoring logs: Logs can reveal scanning attempts ( Kaushik et al. 2010 ) on layer 3 and 4 from a certain IP range and/or botnet which significantly exceed the usual noise ( Li et al. 2009 ).

Social networking statistics: Repeated visits of social network profiles (e.g., on ) used to view a number of target profiles (correlation of viewer information across company staff).

Identities: Numerous identities and personas used e.g., on social networking profiles to connect to company staff, phishing e-mail sender, fake identities to register domains, certificates used in communication (S/MIME, SSL), or to perform electronic payments (e.g. via bitcoins) ( Liao et al. 2016 ), etc.

Spelling: Typical or reoccurring spelling errors in phishing mails for information gathering; derived hints of the author’s mother tongue due to specific language mistakes ( Afroz et al. 2012 ).

Domains and DNS: Names and registration information of domains referred to in phishing mails; especially in case of reused domains (Passive DNS ( Bilge et al. 2011 )).

Weaponization artifacts

Insights from collected traces of the weaponization phase (i.e., the preparation of the first step of the attack) must not be underestimated. Eventually, getting a foot into the door usually turns out as one of the most critical parts of a cyber operation. Main questions here are centered on the initial penetration technique, i.e., how complex it was and how much effort it was for the attackers. Especially of interest is whether known vulnerabilities were exploited and known tools used, or entirely novel ones, probably developed specifically for the investigated attack. The two ends of the same scale are on the one side the application of known/reused "hacking tools" for well-known technologies and on the other side the usage of newly written exploits for quite exotic software. This allows drawing interesting conclusions the capabilities and resources of the attackers. Typical artifacts and hints that may aid the attribution process:

Malware analysis results: Forensic analysis of the initially deployed malware and/or RAT ( Alperovitch and et al. 2011 ) respectively, downloaded to or pushed towards a victim’s computer (see Section on Exploitation artifacts for details).

Urls and IDs: Download locations, URLs and IDs embedded in the malware.

In this phase the constructed weapon for the initial infection is being delivered. The focus of the investigation is therefore on the delivery path of Malware (e-Mail, IM, Internet forum, injection, drive-by download etc.) and connected traces, such as ids, addresses, names and urls. The latter provide a convenient means to associate new attacks with old ones. Typical artifacts and hints that may aid the attribution process:

Phishing e-mails: One of the most common delivery methods are still phishing e-mails ( Krombholz et al. 2015 ; Hadnagy 2010 ). Information the e-mail address (auto generated v.s. manually generated, legitimate v.s. spoofed address, language of address and domain), the e-mail content (grammar/language mistakes, salutation and sophistication level) provide hints on the modus operandi of the attacker. Of particular interest is if and how much insider knowledge was used, e.g., to craft a convincing mail that appears to come from a customer or contractor.

Identities, pseudonyms, and personas: These might reveal hints on the cultural background of the attackers.

Delivery method and path: Apart from e-mail, there are many other delivery methods, electronic ones (instant messenger, social networks, Web-based drive-by-download ( Cova et al. 2010 )) and physical ones (e.g., baiting ( Bowen et al. 2009 )), which might be used in different forms (e.g., embedded in another file)

Technical vulnerability exploited for delivery: The delivered malware usually uses technical vulnerabilities ( Kumar et al. 2006 ) to establish a foothold. However, also for the delivery, a technical vulnerability might be used, e.g., an injection attack.

Exploitation artifacts

Once malware was successfully delivered, it will be executed to establish foothold in the target infrastructure. Typically, some form of RAT is dropped and installed using a vulnerability. Questions are centered on this aspect, e.g., What vulnerability was exploited? How hard was it to exploit? How much background or even insider knowledge was likely required? How sophisticated was the exploit? Where multiple techniques applied? Another aspect that tells a lot the attacker is whether the malware hit a carefully selected machine or the infection rather took place by chance. Indicators for a targeted attack are when a rare vulnerability was exploited, or when the exploit was shaped to the environment, such as the rights of the logged-in user. Typical artifacts and hints that may aid the attribution process:

Malware attributes: A sample of the malware allows detailed forensic investigation ( Ligh et al. 2010 ). This might reveal common strings, such as variable names (depending on the programming language), embedded urls and ids, and the actual coding style. Deeper analysis might even reveal differences in coding style (e.g., how error handling is performed) and therefore allow assumptions on the circumstances this malware was produced in (e.g., division of labor, etc.). Depending on the programming language and the compiler further information such as personalized strings (e.g., paths on the development machine including user names) might be present. This is especially the case with interpreter languages, such as Python.

Malware metadata: This includes all information on the circumstances under which Malware was constructed and which can be extracted in many cases from a sample. For instance, compilation time and compiler version used (which might point to applied tool chains), the programming language used, language settings and region settings of the development platform.

Malware design: Deeper investigations may reveal information on the malware design, e.g. whether it is a novel monolithic piece of code or rather a compilation of different modules (e.g., initial exploit, reverse shell ( Foster et al. 2015 ), keylogger ( Tuli and Sahu 2013 ), cryptolocker ( Liao et al. 2016 ) etc. – perhaps purchased from numerous different sources). Furthermore, the application of anti-forensic and obfuscation techniques ( Harris 2006 ) is a good indicator for the sophistication level.

Malware functionality: The functionality corresponds to the design, but the actual question here is, whether the initial malware was a simple RAT or something more sophisticated, e.g., was able to use alternative infection vectors, disguise its operations and so on. Furthermore, features and settings specifically shaped to the victim’ machine(s) and their environment allows conclusions on how target-oriented the attack was ( Jarvis and Macdonald 2015 ).

Installation artifacts

After the initial infection, attackers and/or their malware respectively will start to scan the network and locate the actual resources of interest (lateral movement). This phase usually involves quite complex actions, which are carried out individually depending on the attacker and on the victim. Therefore, almost all relevant questions in an investigation concerning this phase focus on the applied tactics, techniques and procedures (TTPs), which are a vital means to associate observed behavior to concrete attackers. Notice that from behavior a lot can be inferred, such as if the attackers seemed to know what they were looking for and how long it took them to undertake certain steps, e.g., to pivot to the network segment and move on to further target machines Typical artifacts and hints that may aid the attribution process:

Hints on tactics, techniques and procedures (TTPs): Log files, close monitoring of the network and affected hosts as well as forensic investigation results of malware used (e.g., file remnants) and exploited machines (e.g., bash history, left tools) might reveal important information on the modus operandi, e.g., which tools where used in which order to execute which actions? Based on that also the very important question whether insider knowledge was likely required, can be answered to a greater detail ( Ligh et al. 2010 ).

Hints on organization and division of labor: From the observed behavior (e.g., timing of actions) of the attackers revealed by log files, bash histories, recorded user sessions and process behavior monitoring, often behavior profiles can be extracted which allow some assumptions on the number of people involved in an operation as well as their patterns of life (working hours, shifts, timezone etc.) ( Rid and Buchanan 2015 ). The application of shared scripts, reoccurring scanning methods and re-occurring tool parameters (e.g., in a reverse shell) can reveal information on how well a group is organized and their level of proficiency.

Hints on covert operations: Investigations whether log files were modified to hide tracks (and how to detect this), or techniques used to distract monitoring mechanisms give important insights on the sophistication level of the attack and if the operation was meant to stay below the radar for an extended period ( Gross 2011 ). Hiding tracks and avoiding collateral damage, which might lead to early detection, is resource-intensive and aids the construction of attacker profiles. Complex target verification ( Yadav and Rao 2015 ) when malware becomes active is key to avoid collateral damage but is complicated to achieve. Often only secret services have the capabilities and resources to carry this out on a high sophistication level.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Challenges in Cyber Attack Attribution and False Flag Operations Attribution in cybersecurity involves identifying the perpetrators of attacks, which is crucial for governments and organizations. The process is complicated by tactics such as false flag operations, where attackers mislead investigations to obscure their identity. These tactics can lead to misattribution, potentially resulting in wrongful retaliation against innocent parties. The articles highlight that while attribution is vital for understanding cyber threats, it requires significant resources and expertise. Investigators often rely on artifacts left behind during attacks to piece together the attacker's identity and motives. However, the presence of false flags complicates this process, making it harder to determine the true source of an attack. The articles emphasize the importance of accurate attribution for national security and the potential consequences of misattribution. 1 sources 46

Extracted Entities

"Under false flag: using technical artifacts for cyber attack attribution"

The full story

Extracted Entities

APT Groups (6)

MITRE ATT&CK (3)

Tools (1)