17/07/2024
CTI
The subtle art of attribution
Cybersecurity Insights
Attribution is a dicey game but one deeply rooted in the way international relationship works.
On the physical space, each sovereign state has the right to recognise any aggression on their territory and citizens. If we accept this principle as equally applicable in cyberspace, the question that every nation is asking is how we can accurately identify and prove aggression in a domain governed by anonymity. Looking for responsibility is crucial in foreign policy as it determines your ability to defend yourself from other countries and enhance the validity of your strategies and politics.
Let’s define attribution
Numerous papers have been published on this subject, mainly from the point of view of the United States. Europe isn’t unanimous on this subject approach.
In 2019, the French Army Ministry published a report on its application of international law. The report states that attribution aims to assess if a cybernetic operation can be attributed to a State meaning whether the behaviour of an individual or a group can be blamed on a State.
Identifying the instigator is not automatically followed by a public attribution which has a different purpose altogether.
Three forms of attribution according to the Tallin Papers:
- Technical by “identifying the machine from which an attack was launched”.
- Political when a state “publicly admit it has been victimised.”
- Legal if the threat actor (individual or group) is either “executing the cyber operation empowered by the law of that state or acting under the instructions/direction/control of that state or acknowledge by that state who adopts the cyber operation as its own”.
Technical attribution: essential to the incident response
The work of Cyber Threat Intelligence analysts, whether they work for government agencies or cybersecurity vendors, revolves around a central mission: technical attribution. How a specific attack has occurred, what the intruders have used, if it is possible to link an event to another, etc., are the questions that analysts are trying to answer. Their primary goal is to understand intrusion sets to find patterns and similarities, categorise traces from the attackers called IOCs, map malicious infrastructure. This knowledge will then assist incident response teams in their efforts to mitigate and prevent cyber threats. Those analysis takes time and are more and more complex in the current threat landscape.
Depending on the resources allocated, technical attribution can have a high degree of certainty. Obviously, certain countries (and government defence entities) have been increasing their attribution capabilities and are able to identify not only the hosts, but also the people behind the keyboard and the hidden links.
Not all attribution relies on a technical analysis and can be either replaced or completed by classic spying operation, diplomatic partnerships, etc.
Naming a group: a key part of attribution
Attributing those incidents involves identifying a distinct group of individuals who consistently perpetrate these actions in a specific manner, and then naming them so they can be recognised and monitored by the community.
Security vendors assign unique names to each threat actor group they identify, utilising their own specific naming conventions. This approach enables them to distinguish the groups they have discovered from those identified by other vendors. Moreover, it allows them to update or modify indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) without affecting the work of other vendors. Sadly, that complicates the way analysts, and the CTI community is referencing one entity and can cause a mistake. It is especially true in the Advanced Persistent Threat ecosystem as the landscape is changing fast and under thick fog. As we have already stated, threat actors are getting smarter and rely on various methods to evade and mislead defence teams.
Additionally, naming is intrinsically related to attribution as this name is often associated with a specific country or government entity by government or certain vendors depending on their policies.
Attribution goals differ depending on the type of entity who’s making it. Usually, vendors and specialised CTI companies are attributing an intrusion set to a certain group which may or may not be supported by a Nation. On the other hand, countries tend to attribute an attack to a country, tend to attribute an attack to another country, using the group as a means to an end rather than identifying them as the true sponsor of the attack.
Sophisticated infrastructures
As APT are now using sophisticated obfuscation and evasion techniques, identifying with absolute certainty who is behind the action is now nearly impossible. Furthermore, the current geopolitical climate has given rise to false flag operations, where an APT group employs the TTPs and IOCs of another group to conceal their identity or manipulate the political relations of other countries.
Historically, groups were working with a set of tools, not exclusive to them but used in a certain way, with customisation that would indicate like a footprint who was behind. Nowadays, the increase of professionalisation makes it more complicated. As we stated in our latest threat landscape, APT groups are increasingly adopting organisational structures like those of legitimate enterprises, with specialised departments dedicated to specific activities (development, deployment, exploitation, corrections, etc.). And the tools developed can be sold or shared to other groups which make attribution a lot trickier.
Ultimately, the objective of attribution is to identify the responsible entity, which could be a machine, an immediate human perpetrator or the “ultimate responsible party” meaning a country.
Political attribution: a state matter
Governments are looking for the ultimate culprit and attribution (if rare) are almost always a denunciation of another State actions via an identified group or cyber-operation.
Shake the tree and you will have a basket of fruits, but are they all coming from the same branches? If the highest goal would be to legally charge the individuals responsible, political attribution is looking to highlight the model of organisation behind an attack and how it can be connected to a foreign state. Is the attacker a loner making money on the side or is he commissioned? Is the group receiving some type of financial or political resources or is he directly under the government’s umbrella? What are the motivations, are they aligned to an ideology or under orders?
Hacktivist, cybercriminals, state-sponsored APT… being able to differentiate each threat actors is an even greater deal as the borders are getting blurrier.
A state attribution can only be made following a political decision and largely depends on the current foreign policy.
A weapon for Foreign Policy
Over the past decade, France could appear to have shifted its approach, especially regarding Russia. Since the invasion of Ukraine in 2022, all eyes are on the Kremlin as cyber-activities targeting Ukrainian supporters are increasing. With the European elections and the following French legislatives, the largely expected Olympic Games, French authorities have been warning of Russian actions through threat actors/hacktivists groups against its citizens and critical infrastructures. However, we must acknowledge that in France digital foreign interference is dealt with by a completely different entity called VIGINUM, a department of the SGDSN (Secrétariat général de la défense et de la sécurité nationale). Investigation of cyberattacks is the ANSSI prerogative. If some information operations have been recently more frequent, attribution of cyberattacks are far less common. In its closing statement at the 2023 SSTIC conference, Mathieu Feuillet said that usually ANSSI disclose modus operandi to force a change in the attackers’ tools and allow time to help the victims. If ANSSI has linked modus operandi to perpetrators, there is almost no example of a cyberattack attributed to a country, one of them being the attack against the German Social Democratic Party in May 2024.
State attribution is majorly influenced by timing: timing in a presidency, timing in geopolitical landscape, timing in diplomacy, timing in internal policies. It is because state attribution is serving a greater purpose than just designating a responsible for one attack. An examination of national security white papers reveals that states frequently position themselves in opposition to one or more nations, establishing a posture of confrontation. This dynamic is often reflected in their cybersecurity strategies and policies, which may prioritise defence against perceived adversaries. National cybersecurity exercises often simulate attacks from one of the nations identified as a potential adversary, or from a fictional group that closely resembles a real nation-backed APT group. To justify that position, three major reasons are often put forward: economic rivalry, territorial dispute, cyber threats.
Holding an entity accountable increase the legitimacy of the foreign policies submitted by decision makers. In other words, attribution puts a target on the “bad guy”. Once a country has been deemed responsible for using a governmental entity or a state-sponsored group against another nation, decision makers are able to take a range of actions in response, either by cyber offensive and/or defensive responses, legal options, strict economic and foreign policies, etc.
No consensus
Yet, only a few countries have adopted the growing trend of publicly attributing cyberattack.
The United States have democratised the concept, both because they have the sophisticated tools to technically identify the source of an attack and that attribution serves their “name and shame” approach in diplomacy. The United Kingdom has adopted the same pattern and often imputed foreign cyber-activities.
France, as explained previously, is notoriously known to reserve attribution to the last resort. The authorities are looking for an almost absolute certainty before accusing another country. They chose to advocate on the dangers of a group but do not link the threat actor to a State.
Still, the current lack of a common understanding and consensus on legal rules for cyber attribution creates a legal vacuum.
For threat actors that are covered by a State (partially or completely funded, taking orders, etc.), attribution may not significantly alter the modus operandi. Saying that they are on the wanted list, or that China for example has been conducted cyber-espionage campaigns doesn’t stop them for conducting ongoing and future operations. However, Mathieu Feuillet demonstrated that after the United States change their policy and increase their attribution towards China, ANSSI observed a period of silence followed by a change in the choice of targets. Originally targeting critical infrastructures, the threat actors were now focusing on the supply chain and IT providers. The objective remains the same, get to the critical infrastructures but they change their modus operandi to be less detected.
Furthermore, as the accused will usually either the allegations or remain silent, a misattribution will have the same impact as a legitimate factual attribution.
So, what’s the point?
Impact of attribution at a government level is purely political. Relayed by medias, it sends a signal that an “enemy” has been targeting your country without justification and that to protect its citizens, your country has the right to invest in time, money and capabilities and is legitimate in its foreign policy regarding that “attacker”.
Attribution serves as a demonstration of power in the geopolitical arena. It’s an equivalent of saying, « I know what you did and there will be retribution in whatever shape or form I deem appropriate ». This also serves as proof that the attacked nation is able to defend itself and is on the same level as the attacker.
Chloé GREDOIRE
CTI Analyst
Jean-Léon CUSINATO
Vulnerability and Threat Analyst
