analyzing-campaign-attribution-evidence

What problem does it solve?

Campaign attribution analysis helps investigators determine which threat actor or group is responsible for a cyber operation by systematically evaluating evidence across multiple dimensions and using established analytical models.

Core Features & Use Cases

• Diamond Model & ACH: structured evaluation of competing hypotheses to quantify confidence.
• Infrastructure & TTP Analysis: assess infrastructure overlaps, malware similarities, timing, and language artifacts to support attribution decisions.
• Deliverables: generate structured reports with evidence summaries and actionable insights for threat intel and defense teams.

Quick Start

Identify a campaign, collect relevant evidence, and run through the Diamond Model and ACH steps to produce a weighted attribution assessment.