APT / Espionage: Mission Domain Intelligence Guide

The median intrusion that matters is not loud. It is a valid credential, a legitimate administrative tool and eleven months of patient mailbox collection against the six people who draft policy.

What APT / Espionage covers as a mission domain

APT and espionage work concerns intrusion sets whose objective is access and information rather than immediate profit. Analysts reconstruct campaigns from telemetry and artefacts, cluster related activity into intrusion sets, map behaviour to a common technique taxonomy, and assess who is likely responsible and why. The discipline is as much about victimology and timing as about malware: which sectors were targeted, in what sequence, and against which policy events. Attribution is a graded judgement built from capability, infrastructure, tradecraft and beneficiary, not a single conclusive artefact.

Sub-areas include initial access tradecraft against edge devices and identity providers, hands-on-keyboard lateral movement, long-term collection from mail and document stores, supply chain compromise of software vendors and managed service providers, and surveillance of journalists, dissidents and legal representatives using commercial spyware. Actors range from military and civilian services to contractors billing per target and moonlighting operators who blur into criminal activity.

Why it matters

Espionage intrusions transfer negotiating positions, prototype designs, source code and personal data on people who cannot afford exposure. The costs land unevenly: a defence supplier loses a decade of research, a law firm loses privilege, and a diaspora activist loses physical safety. Because these operations aim for persistence, the damage compounds silently, and organisations frequently discover a three-year presence only when a third party notifies them.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Edge appliance exploitation followed by credential harvesting, then a quiet period before any lateral movement begins
Reuse of code-signing certificates, TLS certificate fields or JARM fingerprints across command infrastructure registered weeks apart
Spearphishing lures tied to conference agendas, grant deadlines or policy consultations relevant only to the target's role
Living-off-the-land binaries executing with anomalous parent processes, particularly WMI, certutil or MSBuild from user contexts
Mailbox rules, delegated permissions or OAuth application consents granted to unfamiliar tenants shortly after a password reset
Operational relay networks built from compromised small office routers and edge devices, giving in-country source addresses
Archive staging in temporary directories with names mimicking system paths, sized to fit a single upload window
Compilation timestamps and operator activity clustering in a consistent working-hours band across many samples

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

MITRE ATT&CK — Common technique taxonomy plus documented group and software mappings for comparing intrusion sets
CISA and allied national CERT advisories — Government-validated technical detail, indicators and mitigations, often with joint attribution statements
Malpedia (Fraunhofer FKIE) — Curated malware family references with actor naming crosswalks and reference bibliographies
ETDA Threat Group Cards — Open crosswalk of vendor group names, aliases, targeted sectors and reported operations
VirusTotal and MalwareBazaar — Sample retrohunting, YARA matching and first-seen telemetry for pivoting on artefacts
Censys and Shodan — Internet-wide scan data for fingerprinting command infrastructure and exposed edge devices
Citizen Lab and Amnesty Security Lab reports — Forensically documented commercial spyware cases, targeting indicators and technical evidence involving civil society targets
MISP communities and sector ISACs — Structured indicator sharing with provenance, confidence tags and traffic light protocol handling

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Scope and timeline — Establish first evidence of access, the earliest reliable log horizon and the boundary of affected systems before drawing any conclusions about intent.
Extract and pivot — Pull artefacts, then pivot on infrastructure, certificates and code similarity to find related activity outside the current victim.
Cluster, do not name — Build an internal intrusion set from repeatable technical criteria. Attach vendor group names only after mapping alias conflicts.
Map behaviour to taxonomy — Record techniques observed with evidence references, and note what was searched for but not found, which shapes coverage claims.
Assess attribution in layers — Separate judgements about tooling, infrastructure operator, campaign sponsor and beneficiary state, each with its own confidence level.
Hunt retrospectively — Sweep historical telemetry for behavioural analytics rather than expired indicators, and record dwell time for the incident record.
Report and share — Notify affected parties, provide detections to the sector, and feed validated indicators back into shared platforms with handling markings.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

Threat Actor Intelligence — Tracking Adversary Groups Over Time
Cyber Intelligence — Adversary Activity in Networks and Systems
Malware Intelligence — Understanding Malicious Code
Vulnerability Intelligence — Weaknesses, Exploitation, and Prioritization
Certificate Intelligence — TLS Certificates and Certificate Transparency
Domain Intelligence — Domains, DNS, and Registration Intelligence
Technical Intelligence — Technology Capability, Design, and Exploitation
Signals Intelligence — Intelligence from Intercepted Communications and Emissions

Worked in these data points

Malware Family — A named class of related malicious software.
File Hash — Cryptographic fingerprint of a file, used for malware identification.
IP Address — Internet Protocol address identifying a device or server on a network.
Domain Name — Human-readable address that maps to IP infrastructure via DNS.
Detection Signature — A YARA/Sigma/Snort rule encoding detection logic for a malware family or behavior.
CVE / Vulnerability — Common Vulnerabilities and Exposures identifier for a known flaw.
TLS / JA3 Fingerprint — A hash of TLS client-hello parameters used to fingerprint clients, malware, and C2 frameworks.
SSL/TLS Certificate — A digital certificate binding a public key to an identity.

Adjacent mission domains

Inside the platform: where APT / Espionage lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

actor-profile.php — APT / Espionage dashboard
domain.php?d=apt — Mission domain hub
theater.php?d=apt — Threat theater view
hash-profile.php — Malware Family profile
ip-profile.php — IP Address profile
url-profile.php — Domain Name profile
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to APT / Espionage:

APT Intrusion Analysis — a step-checked workflow with the pivots, sources and handling rules already wired in.
Malware Triage — a step-checked workflow with the pivots, sources and handling rules already wired in.
Infrastructure Pivoting — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Correlate Infrastructure
Run Alert Rules
Detection Rules
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Scope and timeline is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Cluster, do not name turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Report and share feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses APT / Espionage

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence analysts use espionage intelligence for force protection, operational security and understanding what an adversary already knows. The practical outputs are a picture of which networks, contractors and personnel are targeted, what collection priorities that targeting reveals, and where compromise would degrade a capability. It feeds intelligence preparation of the operational environment, supports counterintelligence briefings before deployments and exercises, and informs supply chain assurance for defence programmes. Constraints are real: defensive cyber operations are bounded by authorities, active measures against infrastructure require separate legal cover, and any assessment reaching a targeting process must state confidence explicitly and identify the evidence that would falsify it.

🕵 National intelligence

A national service treats intrusion sets as collection targets in their own right. Requirements drive coverage of the sponsoring service, its contractor ecosystem, its infrastructure procurement and its tasking rhythm, and the analytic product fuses technical telemetry with human, signals and financial reporting. Classification is the constant friction: the most convincing evidence is often the least shareable, so products are drafted in tearlines from the outset with a releasable technical layer beneath a compartmented assessment. Dissemination decisions carry equities, since publishing an indicator can burn access. Value is judged by whether policy, defensive or disruption action followed, not by the volume of reporting.

👮 Law enforcement

Law enforcement builds prosecutions against named individuals for unauthorised access, wire fraud, identity theft and export or sanctions offences. That demands evidence rather than assessment: acquired logs under production orders, preserved images with documented chain of custody, subscriber records via mutual legal assistance, and expert testimony that can survive challenge on method. Indicators shared informally by industry have limited evidential value unless independently obtained. Investigators also weigh whether indictment, designation, infrastructure seizure or coordinated disruption produces the better outcome, and sequence victim notification so it does not compromise ongoing collection or alert the subject before restraint action.

🔍 Private investigation and corporate security

Private investigators and corporate security teams work the victim side: scoping compromise, supporting insurance and litigation, and advising boards on exposure. Typical products are dwell time reconstruction, data at risk assessments and third party notification support. A private actor may not access adversary infrastructure, take down or interfere with systems it does not own, or hack back in any form, and probing a third party host without authorisation is an offence in most jurisdictions. Passive collection, telemetry the client lawfully holds and commercial feeds are the working set. Reports should assume disclosure in litigation and regulatory review, so method and sourcing must be documented.

📰 Journalism and OSINT media

Journalists reporting espionage face sophisticated denial and the risk of amplifying an attribution they cannot check. Verification means obtaining technical material independently where possible, having it reviewed by an expert not connected to the original vendor, and distinguishing what a report demonstrates from what it asserts. Vendor naming is a marketing artefact and should be explained, not repeated as fact. Sources inside victim organisations face employment and legal consequences, so contact hygiene matters. Publication ethics include giving victims and named states a real opportunity to respond, avoiding identification of individual employees blamed internally, and not publishing detail that helps an adversary refine tradecraft.

🌍 NGO, humanitarian and human rights

Civil society organisations are among the most heavily targeted and least resourced victims. Practice is consent led: a device is only examined with informed permission, findings belong to the individual, and no case is published without agreement, because exposure can bring arrest or harm to family. Forensic documentation should follow a repeatable method so it can later support litigation or a UN mechanism. Referral to a specialist lab is usually better than improvised analysis. Duty of care runs to staff who become targets themselves, to translators, and to the psychological load of telling someone their phone has been monitored for two years.

🎓 University and research

Research on intrusion sets is limited by data access and by an incentive to accept vendor taxonomies uncritically. Good methodology defines the unit of analysis precisely, states how activity was clustered, and publishes the coding decisions that mapped observations to techniques. Reproducibility means sharing sample hashes, indicators and analysis scripts even when the samples themselves cannot be redistributed. Ethics review applies whenever research touches victim organisations, activists or personal data recovered from compromised systems. Cite primary technical reporting rather than aggregator summaries, and be explicit about survivorship bias, since the public record over represents intrusions that were detected and that a vendor chose to publish.

Playbook: working APT / Espionage end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish scope and time horizon

Fix the earliest reliable evidence of access, the retention limit of each telemetry source and the boundary of systems in scope. Record what logging did not exist, because that defines the ceiling on every later claim. Do not begin intent or attribution work until the timeline is stable. A good output is a dated evidence horizon per source, which lets you say honestly whether an absence of activity is a finding or a gap.

Phase 2 — Preserve to an evidential standard

Image systems, export logs with hashes and record custody from the first hour, even if criminal referral seems unlikely, because incident material frequently becomes litigation or prosecution evidence later. Preserve volatile data before remediation pressure closes the window. Keep working copies separate from the master evidence set. The output is an exhibit register that another examiner could pick up cold and reproduce your findings from.

Phase 3 — Triage artefacts and extract configuration

Move from file collection to understanding: identify loaders, implants and legitimate tooling abused, extract embedded configuration, and record command infrastructure, mutexes, keys and campaign identifiers. Distinguish what was executed from what was merely present. A good output is a structured artefact table linking each item to the host, the timestamp and the evidence that it ran, which becomes the spine of both detection and attribution work.

Phase 4 — Pivot on infrastructure

Take the extracted indicators outward: certificate fields and hashes, passive DNS history, hosting and registrar patterns, scan fingerprints and TLS configuration. Look for reuse across time rather than concurrent overlap alone. Record the pivot logic explicitly so someone else can judge its strength. Stop when the pivots start producing shared commodity infrastructure, because a bulletproof hosting provider is not an adversary relationship.

Phase 5 — Cluster before naming

Build an internal intrusion set from repeatable criteria: technique combinations, tooling lineage, infrastructure practice, targeting and timing. Give it a neutral internal label. Only after the cluster is stable should you map it to vendor group names, and then explicitly, showing which vendor cluster overlaps yours and where they diverge. The output should let a reader see that you did not inherit someone else's clustering decisions along with their name.

Phase 6 — Map behaviour to a common taxonomy

Record observed techniques against a shared technique framework with an evidence reference for each, and record what you specifically searched for and did not find. That negative record is what makes a coverage claim meaningful. Avoid mapping techniques you assume were used. A good output distinguishes observed, inferred and absent, which converts directly into detection gaps and hunting priorities. Review the mapping with the detection team, not only within the analysis function.

Phase 7 — Assess attribution in layers

Separate judgements about the malware developer, the infrastructure operator, the operating team, the tasking authority and the beneficiary. Each carries its own evidence and its own confidence. State which layer your reporting actually supports, since most technical evidence stops at the operator. This structure prevents the frequent slide from a solid tooling judgement to an unsupported claim about a government.

Phase 8 — Test for deception

Explicitly assess whether observed artefacts could be planted: borrowed tooling, foreign language strings, copied infrastructure practice, timestamps that fit a convenient timezone. Ask what an adversary wanting to be misattributed would leave behind, and check whether you are looking at exactly that. Record the deception assessment in the product. Analysts who skip this step publish the adversary's preferred story. Record the deception assessment even where you conclude there is no evidence of it.

Phase 9 — Build durable detection

Convert findings into behavioural analytics and hunting queries rather than indicator lists with a shelf life of days. Test detections against real telemetry for false positive rate before release, and document the assumptions each detection makes about logging coverage. A good output includes the query, the data source it needs, the expected noise level and the technique it covers. Version detection content so a later regression can be traced to a specific change.

Phase 10 — Hunt retrospectively

Sweep historical telemetry with the behavioural signatures rather than expired indicators, across the full estate and not only the systems already known to be affected. Record dwell time and the detection that eventually worked, since that is the number that drives investment. Expect to find earlier activity than the incident timeline assumed, and be prepared to reopen scope when you do.

Phase 11 — Notify, share and sequence

Notify affected parties and any third party victims found during pivoting, coordinate with law enforcement and national authorities where equities exist, and share validated content into sector channels with handling markings. Sequence carefully: public reporting before victim notification damages relationships and can compromise ongoing operations. The output is a disclosure plan with dates, owners and the reason for each ordering decision.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
MITRE ATT&CK	Open	Curated taxonomy of adversary techniques with group and software mappings and references to public reporting.	Common language for mapping observed behaviour and comparing intrusion sets across vendors.
Malpedia	Registration	Curated malware family library with actor naming crosswalks, references and unpacked sample corpora.	Resolving family identity and reconciling conflicting vendor names for the same tooling.
MalwareBazaar	Open	Community malware sample repository with tags, YARA matching and first seen timestamps.	Retro hunting for related samples and establishing when a family first appeared in the wild.
ThreatFox	Open	Open indicator exchange for command and control infrastructure with family attribution and confidence.	Rapid checks on whether an extracted command server is already documented and to which family.
VirusTotal	Licensed	Multi engine scanning plus retro hunt, relationship graphs and submission telemetry for files and domains.	Pivoting from a single artefact to related samples, infrastructure and submitter geography.
Censys	Registration	Internet wide scan data with certificate, service banner and historical host records.	Fingerprinting command infrastructure by service configuration and tracking it across relocations. Historical host records matter more than current ones.
Shodan	Registration	Scan derived index of exposed services, devices and edge appliances with historical views.	Identifying exposed edge devices matching the initial access pattern under investigation. Treat ownership attribution from scan data as provisional.
crt.sh certificate transparency search	Open	Searchable certificate transparency logs covering issued TLS certificates and their subject fields.	Discovering adversary domains through certificate naming patterns and issuance timing. Issuance timing often precedes operational use by weeks.
CISA advisories and joint publications	Open	Government validated technical detail, indicators and mitigations, often with allied co-sealing. Frequently issued jointly with allied agencies and industry partners.	Citable baseline for state linked activity and a check against your own clustering.
NCSC UK advisories	Open	United Kingdom technical advisories, attribution statements and defensive guidance. Published alongside sector specific mitigation and reporting guidance.	Corroborating attribution positions and aligning mitigations with recognised guidance. Useful when a public position is required rather than an internal one.
ETDA Threat Group Cards	Open	Open crosswalk of vendor group aliases, reported operations, tooling and targeted sectors.	Untangling alias conflicts before attaching an external name to an internal cluster.
Citizen Lab and Amnesty Security Lab reporting	Open	Forensic documentation of commercial spyware targeting civil society, with technical indicators and method.	Reference cases and indicator sets for mercenary spyware investigations involving journalists and activists.
MISP threat sharing communities	Registration	Structured indicator and event sharing with provenance, confidence tagging and distribution controls.	Receiving and contributing intrusion set data with handling markings intact. Provenance and confidence tags travel with each shared event.
NVD and vendor security advisories	Open	Vulnerability records with severity scoring, affected versions and references to patches. Includes references to advisories, patches and public exploitation reporting.	Establishing exploitation timelines for edge devices used as initial access. Pair with exploitation reporting to date the access window.
Google Project Zero and vendor threat blogs	Open	Technical analyses of exploitation chains, zero day usage and in the wild attack techniques.	Understanding exploit provenance and whether a chain is shared across multiple operators.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against APT / Espionage. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

YARA — Pattern matching for classifying and retro hunting malware families. Limitation: rules built on packed layers age quickly and generate noise if written against generic strings.
Sigma — Vendor neutral detection rules for log data, convertible to multiple SIEM query languages. Limitation: conversion is lossy and rules still require field mapping to local telemetry.
Ghidra or IDA Pro — Disassembly and decompilation for reverse engineering implants and extracting configuration. Limitation: heavily obfuscated or virtualised samples can consume days of analyst time.
Volatility — Memory forensics framework for recovering injected code, network state and process artefacts. Limitation: requires a memory capture taken before remediation and profile support for the OS build.
Velociraptor or comparable EDR hunting platform — Estate wide artefact collection and hunting across endpoints. Limitation: findings are limited by the retention and coverage of the underlying telemetry.
MISP — Structured storage and sharing of indicators, events and relationships with handling controls. Limitation: value depends entirely on the discipline of contributors and tagging hygiene.
Passive DNS services — Historical resolution records for pivoting between domains and hosting infrastructure. Limitation: coverage is partial and skewed to observed traffic, so gaps are not evidence.
Sandbox detonation services — Automated dynamic analysis producing behavioural reports and network captures. Limitation: targeted implants routinely detect analysis environments and behave benignly.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
Detection Rules — Generates YARA, Sigma and Snort/Suricata logic from the selected indicators, ready to deploy.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Cluster on the things an operator cannot cheaply change. Infrastructure procurement habits, build environment quirks and operational timing survive tooling changes, while file hashes and domains are refreshed between campaigns without effort.
Coverage of a technique framework is not detection. Mapping ninety techniques means nothing if the telemetry that would reveal them is not collected, so publish the logging assumptions alongside every coverage claim.
A shared implant usually means a shared supplier, not a shared operator. Quartermaster models are common in state ecosystems, and treating tooling overlap as identity merges distinct teams into one imaginary group.
Victimology carries more attribution weight than most technical indicators. A target set that only one government would find interesting is harder to fake than a language artefact or a compile timestamp.
Record what you looked for and did not find. Negative findings define the boundary of your claim and are the first thing a hostile reviewer will ask for, yet they almost never appear in incident reports.
Treat the first observed access as provisional. Nearly every mature investigation eventually pushes the start date earlier, so write timelines that degrade gracefully when the horizon moves rather than conclusions that depend on it.
Deception is cheapest at the artefact layer and most expensive at the operational layer. Weight evidence accordingly: a planted string costs nothing, sustained targeting of one narrow sector over three years costs a great deal.
Sequence publication against equities you may not be able to see. Before releasing infrastructure detail, check with law enforcement and national authorities, because an indicator you consider expired may be someone's live access.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on APT / Espionage is producing anything, and they are worth baselining before you change process or tooling.

Median dwell time from earliest evidence of access to detection, tracked over time rather than reported once per incident.
Proportion of intrusions detected by internal telemetry rather than external notification from a partner, vendor or law enforcement.
Share of published detections that are behavioural rather than atomic indicators, and the measured false positive rate of each.
Time from artefact extraction to deployed detection content validated against production telemetry. and the share of that content still firing after ninety days.
Number of additional victims identified through infrastructure pivoting and successfully notified, per campaign investigated. Notification quality should be tracked alongside the count.
Rate at which internal clusters are later revised or merged, which indicates whether clustering criteria are too loose or too tight.
Percentage of attribution statements that survive external technical review without material change. Track revisions and the reason each was required.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Accepting planted false flags such as deliberately embedded foreign-language strings or borrowed tooling as attribution evidence
Alias confusion, where four vendor names for overlapping activity are counted as four distinct adversaries in a single report
Building detection on indicators with a half-life of days while ignoring the durable behaviours underneath
Treating shared tooling from a common quartermaster as proof that two operations share an operator
Confusing coverage of a technique taxonomy with actual detection efficacy in the deployed telemetry
Rushing public attribution before victim notification, which can burn ongoing law enforcement or intelligence equities

Legal and ethical considerations

Collection must stay within the telemetry you are authorised to hold, and interaction with adversary infrastructure beyond passive observation risks unauthorised access offences in most jurisdictions. Preserve artefacts to an evidential standard early, because incident data frequently becomes prosecution material. Victim notification, regulatory breach reporting and coordinated vulnerability disclosure often run on conflicting clocks, so agree sequencing with counsel. Employee data pulled into an investigation remains personal data with its own lawful basis and retention obligations.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for APT / Espionage, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 8 intelligence disciplines, 8 data points, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How much evidence is enough to publish an attribution?

Enough to state which layer you are attributing and to name the evidence carrying each judgement. A public statement should distinguish the tooling developer, the infrastructure operator, the operating team and the sponsor, and give a confidence for each. Most technical investigations legitimately reach the operating team and no further. If the sponsor judgement rests only on target selection and working hours, publish it as an assessment with moderate confidence and say what would change it. Publishing a confident sponsor attribution on thin evidence damages credibility permanently and is very hard to walk back.

Should we interact with adversary infrastructure to learn more?

Passive observation is generally safe; anything active is not. Connecting to, authenticating against, scanning or downloading from a system you do not own can constitute unauthorised access under computer misuse legislation in most jurisdictions, regardless of intent. Interaction also tips off the operator, who may rotate infrastructure and destroy the trail you were following. If active steps genuinely matter, route them through law enforcement or a national authority with the appropriate powers, and document the decision. Private organisations that improvise here create legal exposure and lose evidential value simultaneously.

Why do vendors give the same group different names?

Because each vendor clusters on the telemetry it can see, and visibility differs. One vendor sees endpoint behaviour, another sees network infrastructure, a third sees email. Their clusters overlap partially, so the names are not synonyms even when reporting treats them as such. Some names also cover a tool rather than a team. The working practice is to maintain your own internally defined cluster with explicit criteria, then map external names to it as partial overlaps with documented differences, rather than adopting a vendor name and inheriting its boundary decisions unseen.

What should a victim organisation prioritise in the first forty eight hours?

Preservation, scope and containment sequencing, in that order. Capture volatile data and secure logs before retention windows expire or remediation overwrites them. Establish which identity infrastructure is affected, because credential and token compromise determines whether containment is possible at all. Resist the pressure to reset everything immediately, since uncoordinated remediation tips off an actor with persistence you have not yet found and destroys evidence. Agree a single decision owner, engage counsel early on notification clocks, and record decisions contemporaneously because they will be examined later.

How do we handle a civil society target who asks for help?

Refer to a specialist lab where possible, and if you assist directly, work from informed consent. Explain what an examination involves, what it can and cannot establish, and the risks of publication for them and their family. The individual owns the findings and decides on disclosure. Do not take custody of devices without a clear plan for return and preservation. Recognise the human dimension: telling someone their communications have been read for years has consequences, and support should be arranged before the finding is delivered.

Is indicator sharing still worth the effort?

Yes, but for pivoting rather than blocking. Atomic indicators expire quickly and blocklists built on them produce a false sense of coverage. Their real value is as seeds: a shared command server lets you check historical telemetry, discover an earlier compromise and identify other victims. Share with provenance, confidence and handling markings so recipients can judge weight, and pair every indicator release with the behavioural detection underneath it. Communities that share only hashes plateau quickly; those that share detection logic and method keep improving.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

MITRE ATT&CK, the common technique taxonomy used to describe adversary behaviour consistently across organisations.
Traffic Light Protocol version 2.0 from FIRST, governing onward disclosure of shared threat information.
STIX and TAXII from OASIS, the structured formats and transport for machine readable threat intelligence.
ISO/IEC 27035 on information security incident management, covering preparation, detection, response and lessons learned.
NIST SP 800-61 Computer Security Incident Handling Guide, the reference incident response lifecycle.
ISO/IEC 27037 on identification, collection, acquisition and preservation of digital evidence.
Budapest Convention on Cybercrime, which frames international cooperation, preservation requests and mutual legal assistance.
The Admiralty grading scale, used to score source reliability and information credibility separately in intelligence reporting.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

MITRE ATT&CK knowledge base — MITRE. Technique taxonomy with documented group and software mappings.
Malpedia malware family library — Fraunhofer FKIE. Curated reference for malware families and actor naming crosswalks.
Cybersecurity advisories — Cybersecurity and Infrastructure Security Agency. Government technical advisories on state linked intrusion activity.
National Vulnerability Database — NIST. Vulnerability records used to date exploitation of edge devices and software.
Traffic Light Protocol standard — FIRST. Definitions governing sharing and onward disclosure of sensitive information.
Computer Security Incident Handling Guide — National Institute of Standards and Technology. Reference lifecycle for incident detection, analysis and recovery.
Targeted surveillance research — Citizen Lab, University of Toronto. Forensic reporting on mercenary spyware and targeting of civil society.
MalwareBazaar sample repository — abuse.ch. Open malware sample corpus supporting retro hunting and family tracking.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: clusters intrusion sets, tracks command infrastructure reuse and reconciles conflicting vendor group naming. Explore the platform, or browse the rest of the library by following any tag above.