What is threat intelligence? How cyber attribution works

What is threat intelligence? The question sits behind every headline blaming a cyberattack on Russia, China, North Korea or Iran. Cyber threat intelligence (CTI) is the work of collecting, analysing and contextualising information about who is attacking, how and why, so that governments and companies can get ahead of the threat. Attribution — saying who did it — is its hardest and most political part.

This piece explains the concept, the models the industry relies on and a timeline of public attributions, in descriptive terms and without operational detail.

Threat intelligence at a glance

• Definition: evidence-based knowledge — context, mechanisms, indicators and implications — about an existing or emerging threat, useful for making decisions. This is essentially the formulation popularised by Gartner in 2013.
• Who produces it: intelligence and cybersecurity agencies, in-house teams at large companies, and private vendors such as Mandiant, CrowdStrike, Microsoft and Kaspersky.
• Who uses it: everyone from board members deciding on investment to analysts watching a specific network.
• Method: the classic intelligence cycle — direction, collection, analysis, dissemination — applied to cyberspace.
• Typical output: reports on threat groups (so-called APTs), campaigns, tools and trends.

The three levels of threat intelligence

• Strategic: for leadership. Which actors threaten a sector or country, with what motives, and what trends to expect.
• Operational: for security managers. Which campaigns are under way and how the relevant groups tend to operate.
• Tactical or technical: for defenders. Concrete indicators, such as domains or malware signatures, that help detect activity.

The models the industry uses

CTI draws on several public conceptual frameworks that help organise what is known about an attack and compare cases. They are not recipes, but ways of thinking.

The Pyramid of Pain captures the logic of the field neatly: changing an internet address costs an attacker very little, but changing how they work costs a great deal. That is why the most valuable intelligence is not a list of indicators but an understanding of behaviour.

How cyber attribution works

Attribution answers the question 'who did it?' at different levels of precision: which machines were used, which group is behind them and, at the top level, which state directs or tolerates it. In an influential 2015 paper, Thomas Rid and Ben Buchanan described attribution as a process with technical, operational and strategic layers, and stressed that the final decision to name a state is above all political.

Attribution is what states make of it.

Thomas Rid and Ben Buchanan, 'Attributing Cyber Attacks', Journal of Strategic Studies, 2015

Reaching an attribution means combining technical clues — reused tools, infrastructure, working hours, mistakes — with an analysis of motive and, for governments, classified intelligence that is not always made public. No single clue is conclusive.

A timeline of major public attributions

1. February 2013 — APT1: Mandiant publishes a report linking a cyber-espionage group to Unit 61398 of China's People's Liberation Army. In May 2014 the US Justice Department indicts five officers from the unit.
2. December 2014 — Sony Pictures: the FBI attributes the attack on the studio to North Korea. Some private experts were initially sceptical, sparking a debate about how much evidence should be made public.
3. December 2017 — WannaCry: the US and UK attribute to North Korea the ransomware that in May had crippled computers in around 150 countries, including NHS hospitals.
4. February 2018 — NotPetya: the UK, US and other allies attribute to the Russian military the June 2017 attack that hit Ukraine first and then companies worldwide. In October 2020 US prosecutors charge six GRU officers.
5. 2018 — Olympic Destroyer: the attack on the opening ceremony of the Pyeongchang Winter Olympics contained false clues pointing to North Korea. Kaspersky analysts spotted the manipulation; the 2020 US indictment also blamed the GRU.
6. April 2021 — SolarWinds: the US government formally attributes to Russia's foreign intelligence service (SVR) the espionage campaign that compromised IT management software used by thousands of organisations.
7. 2023–2024 — Volt Typhoon: Five Eyes agencies warn that a Chinese state-linked group has burrowed into US critical infrastructure, with stated concern about its possible use in a crisis.

The limits of attribution

False flags

Olympic Destroyer showed that attackers can plant evidence to frame someone else. Serious attribution therefore never rests on a single indicator but on many converging ones.

Confidence levels

Rigorous reports state their conclusions with confidence levels — low, moderate, high — a practice inherited from traditional intelligence analysis. As early as 1964, the CIA analyst Sherman Kent proposed mapping such phrases to rough probabilities to avoid misunderstandings. Techniques such as the analysis of competing hypotheses, popularised by Richards Heuer, aim to reduce analysts' biases.

Every vendor has its own name

The same group may go by several names depending on who is tracking it: the actor many know as APT28 is Fancy Bear to CrowdStrike and Forest Blizzard under the naming scheme Microsoft adopted in 2023. The overlaps are not always exact, which makes reports hard to compare.

Evidence that stays secret

Governments often rely on intelligence they cannot disclose without exposing sources. That leaves the public having to trust official statements, and fuels scepticism — especially when attribution leads to diplomatic fallout or sanctions.