Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide

Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what an adversary cannot easily stop doing.

What Threat Actor Intelligence is as a discipline

Threat actor intelligence is the sustained tracking of adversary groups as entities over time: their tooling, infrastructure habits, targeting, operational tempo, personnel and business model. It aggregates evidence from intrusions, malware analysis, infrastructure mapping, criminal-venue observation, indictments, sanctions designations and vendor reporting into a maintained knowledge base. The unit of work is not an indicator but a cluster: a defensible grouping of activity with explicit inclusion criteria, an assessed confidence level, and a documented history of how and why the cluster has changed.

Practice distinguishes activity clusters, meaning observed and unnamed groupings, from named intrusion sets, and both from real-world organisations. Sub-methods include cluster management with disciplined merge and split rules, toolmark and tradecraft analysis, victimology assessment, and persona tracking across criminal venues. It occupies the operational and strategic tiers of the intelligence cycle, converting tactical observation into predictions about targeting, capability and likely next moves.

Why it matters

Actor intelligence answers who is likely to come at you, how they operate and what they will do next. It is what makes intelligence predictive rather than archival. Knowing that a group habitually pivots using a specific remote-access tool within two days of initial access tells you precisely where to hunt before it happens. It also informs strategic decisions on sanctions exposure, ransom payment legality, insurance and geopolitical risk that no indicator feed can support.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Tooling repertoire and version history: custom implants, commodity loaders, legitimate remote-access software and the order they appear
• Infrastructure habits including preferred registrars, hosting providers, certificate authorities, naming conventions and rotation intervals
• Operational tempo and working hours inferred from build timestamps, posting times and activity logs, indicating time zone and staffing
• Victimology: sector, geography, revenue band and technology stack of targets, revealing selection criteria and underlying mission
• Initial access preferences such as lure themes, exploited edge devices, purchased broker access or abuse of valid credentials
• Persona and alias linkage across venues through handle reuse, PGP fingerprints, cryptocurrency addresses and writing style
• Affiliate structure and negotiation behaviour for extortion groups, including leak-site conventions and payment handling practice
• Divergence from established pattern, often the strongest signal that a cluster should be split or that someone is imitating the group

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• MITRE ATT&CK Groups — Curated intrusion-set profiles with technique mappings, aliases and citations back to source reporting
• Malpedia — Family-to-actor associations and reconciliation of the conflicting naming used across vendors
• ETDA threat actor encyclopaedia — Free aggregated actor cards consolidating public reporting, aliases and campaign history
• DOJ indictments and OFAC designations — Evidenced real-world identities, infrastructure and financial nodes disclosed through legal process
• CISA and national CERT advisories — Technique and infrastructure detail validated against real incident response engagements
• VirusTotal and MalwareBazaar — Sample-level toolmark evidence that supports or refutes proposed cluster membership
• Ransomware leak-site aggregators — Victimology and operational tempo data for extortion groups, with dated listings
• Vendor research publications — Mandiant, Talos, Kaspersky and ESET campaign narratives that show their attribution reasoning

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Write the cluster criteria — State precisely which observables place activity in this cluster and which would exclude it. An undocumented cluster cannot be reviewed or challenged.
2. Aggregate with provenance — Record every observation with source, date and reliability grade. Vendor reporting is not primary evidence unless it shows its working.
3. Model the tradecraft — Build technique, infrastructure and targeting profiles, distinguishing habitual behaviour from something observed only once.
4. Reconcile naming — Map your cluster explicitly to vendor names, noting where overlap is partial. Never assume two vendor names describe identical activity sets.
5. Assess and hypothesise — Produce judgements with confidence language, stated assumptions, and an explicit note of what future observation would falsify them.
6. Operationalise — Convert habits into hunting hypotheses, detections and prioritised control changes for the assets that actor victimology implicates.
7. Review, merge and split — Re-examine clusters on a schedule. Merge on strong new evidence, split when behaviour diverges, and record the reasoning either way.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Nation State
• APT / Espionage
• Cyber Crime
• Ransomware
• Dark Web Intel
• Malware
• Threat Analysis
• Organized Crime
• Gangs & Street Crime
• Economic Espionage

Operates on these data points

• Domain Name — Human-readable address that maps to IP infrastructure via DNS.
• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• IP Address — Internet Protocol address identifying a device or server on a network.
• Malware Family — A named class of related malicious software.
• Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
• File Hash — Cryptographic fingerprint of a file, used for malware identification.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• Person / Name — A named individual — the subject of identity resolution and profiling.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• CVE / Vulnerability — Common Vulnerabilities and Exposures identifier for a known flaw.

Related disciplines

• Attack Surface Intelligence — Your Own Exposed Attack Surface
• Breach Intelligence — Exposed Credentials and Compromised Data
• Certificate Intelligence — TLS Certificates and Certificate Transparency
• Cyber Intelligence — Adversary Activity in Networks and Systems
• Dark Web Intelligence — Hidden Services and Closed Criminal Venues
• Domain Intelligence — Domains, DNS, and Registration Intelligence

Inside the platform: where Threat Actor Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=ACTORINT — Discipline hub
• source-catalog.php?disc=ACTORINT — Source catalogue filtered to this discipline
• url-profile.php — Domain Name profile
• ip-profile.php — IP Address profile
• hash-profile.php — Malware Family profile
• blockchain.php — Cryptocurrency Address profile
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Correlate Infrastructure
• DNS Audit
• Threat Hunt
• Detection Rules
• Enrichment Runner
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Write the cluster criteria is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Model the tradecraft turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Review, merge and split feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Threat Actor Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence analysts practise actor intelligence as adversary characterisation feeding intelligence preparation of the operating environment and cyber force protection. The authority is a standing collection requirement against named state and state-aligned groups, worked from mission telemetry, partner reporting and open research. The output is an adversary template: what the group targets, how it gains access, what tempo it sustains, and what it does when contested. That template drives sensor placement, hunt tasking, deception planning and commander decision points, and supports targeting boards only through the correct legal and policy chain. Constraint: attribution to a named unit or individual carries policy consequences and must go through the formal attribution process, not be asserted in a routine J2 product.

🕵 National intelligence

National services treat actor tracking as a persistent requirement rather than an incident response task. Collection is directed against the group as an entity: infrastructure procurement habits, tooling development, personnel, tasking patterns and the relationship to a state sponsor. Fusion is the point, since the discriminating evidence usually sits across compartments, with open technical research supplying the shape and sensitive collection supplying identity. Products carry explicit source grading and clearly separate observed activity from assessed sponsorship. Handling is the hard part: the technical indicators are usually releasable, the identity judgement rarely is, so writing tearlines that let partners and industry act without exposing collection is a core skill of the discipline.

👮 Law enforcement

Investigators practise actor intelligence to convert a diffuse pattern of intrusions into a chargeable case against identified persons. The analytic work builds the linkage: shared infrastructure, reused code, persona continuity, cryptocurrency flows and operational timing that tie separate incidents to one group. Every link that will be relied on must be independently reproducible from preserved evidence, with continuity records for each artefact and hash values recorded at seizure. Identity attribution runs through production orders, warrants and mutual legal assistance requests to registrars, hosting providers, exchanges and platforms, never through informal enquiry. The output supports charging by establishing that a named individual controlled a specific account or asset at a specific time.

🔍 Private investigation and corporate security

Corporate practitioners use actor intelligence to prioritise defence and to inform executive and legal decisions: which groups plausibly target this sector, what they do on entry, and whether an observed intrusion matches a known extortion operation with a known negotiation pattern. Work is confined to your own telemetry, licensed intelligence, and open research. A private actor may not access adversary systems, may not purchase stolen data to study it, may not run undercover personas that involve committing offences, and may not conduct covert surveillance on suspected individuals. Naming a group publicly is a legal and safety decision for counsel and leadership, not an analyst decision, and internal reporting should use behaviour-based language until then.

📰 Journalism and OSINT media

Journalists practise actor intelligence to report responsibly on who is behind an intrusion campaign. The verification standard is that any attribution claim rests on evidence the newsroom can inspect, not on a vendor assertion, and that at least one independent technical expert has reviewed the underlying material. Distinguish carefully between a vendor cluster name, a group of activity, and a named government or person, because conflating them is the commonest error in the field. Protect sources inside victim organisations and inside the research community, who face retaliation. Give the named state or entity a real right of reply, publish denials, and correct promptly when a cluster is later split or merged.

🌍 NGO, humanitarian and human rights

Human rights and civil society practitioners track actors that target activists, journalists and diaspora communities, usually mercenary spyware operators and state-aligned intrusion groups. Practice is victim-centred: consent before device examination, clear explanation of what analysis can and cannot show, and support arrangements in place before findings are delivered, because a confirmed compromise is frightening and can be dangerous. Documentation is built to accountability standards so it can support litigation, export-control action or United Nations mechanisms later. Do-no-harm governs publication timing and detail, since exposing a technique can trigger retaliation against identified targets. Duty of care extends to staff, who become targets of the same actors once the work is known.

🎓 University and research

Researchers study actors as a measurement and classification problem: how clusters are formed, how naming conventions diverge across vendors, how reliably technique profiles discriminate between groups, and how attribution claims are evidenced. Reproducibility requires publishing the sample set or at least the hashes, the clustering features and the decision rules, since most disagreement in the field is definitional rather than factual. Ethics review is required where research touches victim data, human subjects or infiltration of criminal venues, and observation-only designs are strongly preferred. Cite the primary technical reporting rather than secondary summaries, record the date of each claim because clusters are routinely revised, and avoid asserting state sponsorship from technical features alone.

Playbook: working Threat Actor Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the cluster boundary

Establish what the tracked entity actually is before naming it. Decide whether you are tracking a set of activity, a tooling family, an operating crew or a sponsoring organisation, because these are different objects and conflating them is the root cause of most attribution disputes. Write the inclusion criteria explicitly: which technical, behavioural and infrastructural features must be present for an intrusion to join this cluster. A good output is a written cluster definition with the discriminating features and a list of what is deliberately excluded. Stop when a second analyst can apply the criteria to a new incident and reach the same answer.

Phase 2 — Build the evidence baseline

Assemble every incident, sample, indicator and report currently assigned to the cluster and record the provenance of each. Separate first-party evidence you can inspect from second-party partner reporting and third-party vendor claims, because they carry different weight. Rehash samples, re-resolve infrastructure and re-read the original reporting rather than relying on aggregated summaries that have quietly drifted. A good output is a source-graded evidence register where every assertion has a traceable origin and a date. Stop when the register accounts for every claim currently made about the group in your own knowledge base.

Phase 3 — Extract the behavioural profile

Map the group observed behaviour to a technique framework, recording not just which techniques appear but how they are implemented, in what order, and with what tooling. The discriminating value sits in the implementation detail: the specific loader chain, the naming convention for scheduled tasks, the choice of archive utility, the precise sequence of discovery commands. Capture tempo, working hours and holiday patterns. A good output is a technique profile with implementation notes and a confidence rating per technique. Stop when the profile contains enough implementation detail to distinguish this group from the nearest neighbouring cluster.

Phase 4 — Map infrastructure habits

Analyse how the group acquires and configures infrastructure rather than cataloguing individual servers. Look at registrar and hosting preferences, certificate issuance patterns, port and service configuration, the interval between registration and use, reuse of names or templates, and the way infrastructure is retired. Habits persist far longer than individual assets, so a habit-based pivot survives an infrastructure rotation that kills every indicator. A good output is a documented set of pivot rules with expected precision. Stop when you can generate candidate new infrastructure from the habit profile and validate a reasonable proportion of the candidates.

Phase 5 — Establish victimology and intent

Characterise who the group actually hits, by sector, geography, size and function, and distinguish deliberate targeting from opportunistic exploitation of an exposed product. Test the victim set against the plausible tasking: espionage victimology looks different from extortion victimology, and a mismatch is informative. Record what the group did after access, because intent is revealed by post-exploitation behaviour rather than by initial access. A good output is a victimology statement with confidence, plus an explicit assessment of what the group appears to be collecting or monetising. Stop when the victim set has a coherent explanation or the incoherence is itself documented.

Phase 6 — Track personas and identity threads

Where the group operates in criminal venues or uses public personas, track handles, contact details, payment addresses, writing style and venue reputation over time, recording only what is observed and lawfully accessible. Do not engage, purchase or transact. Identity attribution beyond persona level requires legal process against platforms, registrars and exchanges and is a law enforcement function. A good output is a persona register with observed linkages, each graded, and a clear line marking where lawful open collection ends. Stop at persona continuity unless you hold the authority and the legal route to go further.

Phase 7 — Test the cluster against alternatives

Deliberately attempt to break your own cluster. Ask whether the linking evidence could be explained by a shared tool available to many groups, a shared bulletproof hosting provider, a shared access broker, or a false flag. Identify which single piece of evidence, if removed, would collapse the cluster, and assess how robust that piece is. This is the discipline that prevents the slow accretion of unrelated activity under one name. A good output is a written challenge review naming the weakest link and the competing hypotheses considered. Stop when the cluster survives challenge or is formally split.

Phase 8 — Produce detection and hunt content

Convert the profile into content that changes defensive posture: behavioural detection rules keyed to implementation detail rather than to indicators, hunt hypotheses for the techniques the group uses that you cannot currently see, and gap statements where no telemetry exists. Test each rule against historical data for false positive rate before release. A good output is a set of validated rules mapped to the technique profile, plus a prioritised telemetry gap list. Stop when every high-confidence technique in the profile has either a detection, a hunt hypothesis or a documented visibility gap.

Phase 9 — Write the actor assessment

Produce the standing product: what the group is, what it targets, how it operates, what is assessed about sponsorship and motivation, with confidence stated separately for activity, capability and attribution. Keep the naming discipline explicit, listing which vendor names you consider overlapping and which you do not. Include an explicit statement of what is not known. A good output is a maintained profile that a responder can read in ten minutes and act on, with an appendix carrying the evidence. Stop when the assessment answers the standing requirements without requiring the reader to consult the analyst.

Phase 10 — Maintain, revise and record calibration

Set a review cadence and revision triggers: new incident assigned, new public reporting, indictment or designation, tooling change, or a partner disputing the cluster. Version the profile so consumers can see what changed and why, and keep a decision log for merges and splits. Record where previous assessments proved right or wrong, because calibration is the only real measure of the capability. A good output is a versioned profile with a visible change history and a calibration record. Stop tracking only when the group is assessed defunct, and document the basis for that judgement rather than letting the file lapse.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
MITRE ATT&CK	Open	Curated knowledge base of adversary techniques, sub-techniques, software and named groups with references to primary reporting.	Provides the common technique vocabulary for building and comparing behavioural profiles across groups and vendors.
Malpedia	Registration	Curated malware family reference with naming synonyms, sample references and links to authoritative technical analysis.	Resolves tooling family names and synonyms so cluster linkage is not built on inconsistent vendor labels.
MalwareBazaar	Open	Community malware sample repository with family tagging, hashes and submission metadata maintained by abuse.ch.	Supplies samples for verifying that a tooling family attribution actually holds against the binaries in circulation.
ThreatFox	Open	Open indicator of compromise database with malware family association and confidence scoring from community submissions.	Pivots from a known family to current infrastructure and back, supporting infrastructure habit analysis.
VirusTotal	Registration	Multi-engine file and URL analysis platform with submission metadata, relationships and behavioural reports.	Establishes sample lineage, first-seen timelines and file-to-infrastructure relationships during cluster construction.
MISP	Open	Open source threat intelligence platform for structured storage and sharing of events, indicators and attribution objects.	Holds the evidence register with provenance and source grading, and supports controlled sharing with partners.
Sigma	Open	Generic detection rule format and community rule set covering log-based adversary behaviour across many platforms.	Encodes behavioural detections derived from the technique profile in a form portable across defensive stacks.
YARA	Open	Pattern matching engine and rule language for classifying files by structural and content features.	Encodes tooling family and code-reuse linkages so cluster membership can be tested against new samples automatically.
Certificate Transparency via crt.sh	Open	Searchable index of publicly logged TLS certificates including subject alternative names and issuance timestamps.	Detects infrastructure naming and issuance habits, and surfaces new servers before they are used operationally.
Censys	Registration	Internet-wide scan dataset of hosts, services, certificates and software banners with historical views.	Fingerprints command and control server configurations so a habit-based pivot survives indicator rotation.
Shodan	Registration	Internet-wide service scan platform indexing banners, protocols and device metadata with historical records.	Locates additional hosts matching a distinctive service configuration associated with the tracked group.
GreyNoise	Registration	Classification of internet background scanning and exploitation traffic, separating mass activity from targeted behaviour.	Filters opportunistic internet noise out of candidate targeted activity before it is assigned to a cluster.
OpenSanctions	Open	Consolidated sanctions and enforcement datasets with entity resolution across designating authorities.	Checks whether tracked personas, entities or wallet-linked names are subject to designation, which changes handling obligations.
US Department of Justice	Open	Published indictments, complaints and enforcement announcements including detailed technical narratives in cyber cases.	Provides evidenced identity attribution and operational detail that open technical research alone cannot establish.
CISA advisories	Open	Government advisories on named threat activity including technique detail, indicators and mitigation guidance.	Supplies authoritative corroboration of group behaviour and targeting that can be cited in releasable products.
Europol	Open	European law enforcement agency publishing operational results, disruption announcements and organised crime threat assessments.	Confirms disruption events, arrests and infrastructure takedowns that change the assessed state of a tracked group.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Threat Actor Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• MISP — Stores events, indicators, galaxies and relationships with provenance and sharing controls. Limitation: data quality degrades quickly without curation discipline and taxonomy governance.
• OpenCTI — Knowledge graph for actors, campaigns, techniques and infrastructure with relationship modelling. Limitation: ingesting many feeds unfiltered creates a graph that asserts links nobody verified.
• YARA — Classifies samples by structural and code features for tooling family linkage. Limitation: rules keyed to packed or generated content break on the next build.
• Sigma — Portable behavioural detection rules mapped to technique profiles. Limitation: translation to a specific backend loses fidelity, so rules must be tested where they will run.
• Maltego and graph link analysis platforms — Pivot across infrastructure, persona and sample relationships visually. Limitation: visual proximity is persuasive regardless of evidential strength, which encourages weak linkage.
• Diaphora and BinDiff style binary diffing — Compare binaries to establish code reuse between samples and families. Limitation: shared libraries and commodity builders produce convincing false lineage.
• Passive DNS platforms — Historical resolution data for pivoting between domains and hosting used over time. Limitation: coverage varies by sensor network, so absence of a record proves nothing.
• ATT&CK Navigator — Visualises technique coverage for a group and compares it against defensive detection coverage. Limitation: encourages treating technique counts as capability measurement.
• Sandbox platforms such as Triage and ANY.RUN — Produce behavioural traces and configuration extraction from samples at scale. Limitation: sandbox-aware samples withhold behaviour, so absence of activity is not evidence.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• DNS Audit — Bulk-resolves A/AAAA/MX/NS/TXT/CNAME/SOA records and stores them as observations, building passive DNS from your own collection.
• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Detection Rules — Generates YARA, Sigma and Snort/Suricata logic from the selected indicators, ready to deploy.
• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Track habits, not indicators. Infrastructure rotates weekly and hashes change per build, but procurement preferences, naming conventions, command sequencing and working hours persist for years and survive the rotation that kills your indicator list.
• Keep a written cluster definition and enforce it. Clusters decay by accretion, where each individually plausible addition slowly turns a precise group into an unusable label that means nothing to a responder.
• Vendor group names are not interchangeable and mapping tables are approximations. Record which overlaps you accept and on what evidence, because inheriting someone else merge decision imports their errors invisibly.
• Identify the single weakest link holding the cluster together and state it. Every mature actor profile has one piece of evidence that, if wrong, collapses the structure, and knowing which one it is changes how you write confidence.
• Post-exploitation behaviour reveals intent far more reliably than initial access. Access vectors are shared, sold and commoditised; what a group does in the first hour after landing is much harder to borrow.
• Treat shared access brokers and shared bulletproof hosting as the default alternative explanation for infrastructure overlap. Two groups buying from the same supplier look identical at the network layer and are not the same group.
• Separate confidence in activity, confidence in capability and confidence in sponsorship. Collapsing them into one number is how technical certainty gets misread as political attribution by readers who will act on it.
• Record merges and splits with the reasoning and the date. A profile without a decision history cannot be audited, and consumers who built detections on the old boundary need to know it moved.
• Test infrastructure pivot rules by measuring their precision on known cases before trusting them. A rule that generates fifty candidates with three true positives is a research lead, not an indicator source.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Threat Actor Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of new intrusions correctly assigned to an existing cluster on first analysis, measured against the assignment after full investigation.
• Number of cluster splits or merges required per year, which should decline as definitions mature, with each one carrying a documented reason.
• Share of detections derived from the actor profile that fire on genuine activity rather than on benign administrative behaviour, reviewed quarterly.
• Mean time from public reporting or an indictment naming the tracked group to a revised and published internal profile.
• Percentage of assessed techniques in each profile that have either an active detection or a documented telemetry gap, rather than being unaddressed.
• Calibration of stated attribution confidence against later authoritative confirmation such as indictment, designation or government attribution.
• Reduction in incidents where responders had to reconstruct group behaviour from scratch because the maintained profile was out of date.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Conflating an activity cluster with a real-world organisation, then making legal, policy or disclosure decisions on that assumption
• Vendor name equivalence tables that quietly merge partially overlapping sets, producing a chimera actor that never existed
• Anchoring on the first attribution hypothesis and then interpreting all later evidence so that it fits
• Ignoring shared tooling and shared access brokers, which create genuine overlaps between entirely distinct groups
• Treating false-flag and imitation tradecraft as improbable when it is documented, cheap and periodically observed
• Letting clusters ossify, so profiles that are never reviewed describe an adversary that stopped operating years ago

Legal and ethical considerations

Actor tracking touches identifiable individuals, so profiling requires a lawful basis, must be proportionate, and must avoid unfounded accusations that expose the organisation to defamation claims. Attribution statements should be graded and evidenced rather than asserted. Sanctions and export-control regimes make correct identification legally consequential, since paying an extortion demand connected to a designated entity can itself be an offence. Do not pursue identification of individuals through intrusive means; leave de-anonymisation to law enforcement and hand over evidence with intact provenance and hashes.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Threat Actor Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 10 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

When is a cluster mature enough to give it a name?

When the inclusion criteria are written down, a second analyst applies them to fresh incidents and reaches the same answer, and the linkage survives a deliberate attempt to break it. Naming too early is the commonest failure, because a name creates an object that consumers treat as real and that subsequent evidence gets fitted into. Until then, refer to the activity descriptively and by incident reference. Internally, a named cluster should carry its definition and its weakest link in the header, so anyone using it knows what they are relying on and how fragile it is.

How do I handle conflicting vendor names for the same group?

Maintain your own cluster and record mappings as assertions with evidence and dates, not as equivalences. State which overlaps you accept, which you consider partial, and which you reject. Never inherit a mapping table wholesale, because you then import every merge decision the originating vendor made without seeing their evidence. In external products, lead with your own name and list the vendor names you assess as overlapping, with a caution that overlap is not identity. Expect mappings to change and version them, because the field revises group boundaries regularly and consumers build content on those boundaries.

Can technical evidence establish state sponsorship?

Rarely on its own. Technical evidence establishes what was done, with what tooling, from what infrastructure, on what schedule. Sponsorship is an inference from targeting coherence, tasking patterns, tempo aligned to a working calendar, victim sets that only serve a state requirement, and, decisively, from collection or legal process that identifies the operators. Report the technical picture and the assessed sponsorship separately, with separate confidence. In organisations where public attribution has policy consequences, the analyst produces the evidence and the decision to attribute publicly is taken elsewhere, through a defined process.

Is it lawful to interact with an actor persona in a criminal forum?

For a private organisation, generally no. Passive observation of content lawfully accessible without deception is one thing; creating a false persona to build a relationship, purchasing stolen data, or making any transaction is another and can constitute offences including handling stolen property, unauthorised access facilitation, sanctions breach and money laundering. Undercover engagement is a law enforcement function requiring specific authorisation. If your requirement genuinely needs engagement, the correct response is to refer the requirement to law enforcement, not to build a private capability. Document your rules of engagement and have counsel approve them before any collection begins.

What do I do when the group stops appearing?

Do not assume it is defunct. Groups go quiet during retooling, after a takedown, when they rebrand, or when your visibility changes rather than their activity. Distinguish those explicitly: check whether your telemetry or feed coverage changed at the same time, look for successor tooling and personnel overlap with newly emerging clusters, and monitor known infrastructure suppliers. Record the assessment as dormant with a stated basis and a review date rather than closing the file. Where a group has been disrupted by law enforcement, expect partial reconstitution and track the personnel, since crews reform faster than infrastructure does.

How much of an actor profile should be shareable?

Write it so the technical layer can be released without the sensitive layer. Behavioural detail, techniques, tooling and defensive content are usually releasable and are what recipients can act on; identity, sponsorship and collection detail usually are not. Build the product with that separation from the start rather than redacting later, and apply a handling marking such as the Traffic Light Protocol consistently. The test is whether a partner can improve their defences from the releasable version alone. If they cannot, the split is in the wrong place and the product is protecting information at the cost of its own purpose.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• MITRE ATT&CK, which governs the shared vocabulary for describing adversary techniques and provides the reference structure for behavioural profiles.
• Traffic Light Protocol version 2.0 as published by FIRST, which governs handling and onward sharing restrictions on actor reporting.
• STIX 2.1 and TAXII 2.1 from OASIS, which govern structured representation and machine exchange of actor, campaign and indicator objects.
• ICD 203 analytic standards, which govern expression of confidence, consideration of alternatives and separation of judgement from evidence.
• Admiralty source and information reliability grading, which governs how evidence of differing provenance is weighted in a fused assessment.
• ISO/IEC 27037 on digital evidence handling, which governs preservation and continuity where actor analysis may support a prosecution.
• The Budapest Convention on Cybercrime, which governs international cooperation and preservation requests underpinning cross-border identity attribution.
• ISO/IEC 27035 on information security incident management, which governs the incident process that feeds first-party evidence into actor tracking.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. ATT&CK Groups knowledge base — MITRE. Curated adversary technique and group reference with links to primary reporting
2. Malpedia malware family reference — Fraunhofer FKIE. Curated malware family library resolving naming synonyms across vendors
3. Traffic Light Protocol 2.0 standard — FIRST. Handling and redistribution markings for shared threat intelligence
4. MISP threat intelligence platform — MISP Project. Open platform and data model for storing and sharing structured actor and indicator data
5. Cybersecurity advisories — Cybersecurity and Infrastructure Security Agency. Government advisories describing named threat activity and mitigations
6. Cybercrime indictments and enforcement actions — US Department of Justice. Evidenced identity attribution and operational detail from prosecutions
7. Internet Organised Crime Threat Assessment — Europol. Recurring European assessment of organised cybercrime actors and business models
8. Convention on Cybercrime — Council of Europe. Treaty framework for cross-border evidence preservation and cooperation
9. ThreatFox indicator database — abuse.ch. Open indicator database with malware family association used for infrastructure pivoting

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: maintains activity clusters with provenance, naming reconciliation and habit-driven hunting hypotheses. Explore the platform, or browse the rest of the library by following any tag above.