An Objective Framework for Subjective Data: Inside Unit 42’s Attribution Methodology

Threat actor attribution has traditionally been considered more art than science. This subjective approach often contributes to naming confusion (is it APTx or GroupY?) and makes it difficult for security teams to prioritize real risks.

To address this, Unit 42 has formalized an Attribution Framework that moves away from ad hoc assessments toward a data-driven progression. By leveraging the Diamond Model of Intrusion Analysis and an intelligence-community standard scoring system, they ensure every claim is backed by high-confidence evidence.

The Three Levels of Attribution

The framework tracks threats through a lifecycle that rewards observation over time:

• Activity Clusters (CL): Groups of related events (e.g., shared IP addresses or phishing tactics) where the full objective or actor identity is still unknown.
• Temporary Threat Groups (TGR): Clusters elevated once analysts are confident a single actor is involved. Unit 42 typically observes these for at least six months to confirm persistent behavior.
• Named Threat Actors: The final stage, reached only with high-visibility across all vertices of the Diamond Model: Adversary, Infrastructure, Capability, and Victim.

Standardizing Trust with the Admiralty System

To keep findings objective, Unit 42 uses the NATO-standard Admiralty System to grade every piece of evidence. This removes analyst bias by scoring data on two distinct axes:

1. Source Reliability (A–F): How trustworthy is the source? (e.g., internal telemetry vs. unverified OSINT).
2. Information Credibility (1–6): Is the data logical and corroborated by others?

Case Study: Connecting Bookworm to Stately Taurus

A prime example of this framework in action is the September 2025 link between the Bookworm Trojan and Stately Taurus (a China-nexus espionage group).

By applying the framework's rigorous standards, researchers were able to link modular malware artifacts from 2015 to modern infrastructure. Through shared PDB paths and custom tools like ToneShell, they proved that years of "subjective" data could be resolved into an "objective" named actor.

Stay tuned for my next article about Global Incident response and hopefully Fuel User Group SoCal event around this topic with Kyle Wilhoit .