CyberKit

Threat Actor / APT

Resolve aliases and tooling to the group behind them, and tell similar actors apart.

Resolve aliases to a group, then apply real vendor naming rules to new cases. Advanced, about 20 minutes.

What you will be able to do

  • Resolve a vendor alias or a malware family back to the group it belongs to (Threat Actor / APT Reference)
  • Explain how each major vendor's naming scheme is constructed, and what part of the name carries the attribution
  • Apply a naming scheme to a fact pattern you have not seen before, rather than recalling a specific name
  • Deconflict two reports that describe the same activity under different names

Read first: Threat Actor / APT Reference.

Notes for teaching it
  • The hardest drill on the site, and it assumes some threat-intel exposure. It is a poor first drill and a good capstone.
  • The naming-scheme questions reward understanding over recall by design: they present rules and then ask you to apply them to a case that is not in the reference.
  • Attribution is genuinely contested. The drill grades vendor-published naming facts, never who "really" did something, and that distinction is worth making explicitly with a class.

All questions

  1. The alias "Cozy Bear" refers to which MITRE-tracked threat actor group?

  2. Name the threat actor group attributed to Russia's FSB "Center 16" and known for targeting critical infrastructure and industrial control systems since 2010.

  3. Name the threat actor group attributed to Russia's FSB and known for its Uroburos malware and long-running espionage campaigns.

  4. Name the threat actor group that ran point-of-sale malware campaigns through a front company called Combi Security.

  5. Name the threat actor group that MITRE notes may be linked to Cobalt Group and FIN7, who have also used its namesake malware.

  6. Name the threat actor group that is native English-speaking, active since 2022, and initially targeted CRM/BPO/telecom providers before expanding into gaming and hospitality.

  7. Name the threat actor group whose Military Unit Cover Designator (MUCD) is Unit 61398.

  8. Which threat actor group is documented using the malware/tool "BLINDINGCAN"?

  9. Which threat actor group is documented using the malware/tool "BOOSTWRITE"?

  10. Which vendor's naming scheme uses a two-word cryptonym where the second word is an animal indicating nation-state nexus or motivation (e.g. Bear, Panda, Spider)?

  11. In CrowdStrike's naming scheme, what does the qualifier "Panda" indicate?

  12. Mandiant designates a group it assesses to be financially motivated (not nation-state espionage) with what letter-prefixed code?

  13. Mandiant opens a new, not-yet-attributed cluster of intrusion activity under what prefix, before it has enough evidence to classify it as APT or FIN?

  14. Since April 2023, Microsoft names every threat actor after a shared theme. What is that theme?

  15. In Microsoft's current weather-themed taxonomy, what does the family name "Blizzard" indicate?

  16. A Microsoft-tracked cluster that's newly discovered or not yet fully attributed gets what temporary designation, before it converts to a permanent weather-themed name?

  17. Secureworks Counter Threat Unit (CTU) names every threat group after a metal or chemical element plus a nickname. What does the element "IRON" denote?

  18. MITRE ATT&CK renamed the field listing every other publicly reported name for a tracked group. It used to be "Aliases". What is it called now?

  19. CrowdStrike is naming a newly discovered nation-state adversary it attributes to Russia. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  20. CrowdStrike is naming a newly discovered nation-state adversary it attributes to North Korea. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  21. CrowdStrike is naming a newly discovered adversary it assesses as financially motivated (eCrime), not nation-state. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  22. Microsoft is naming a newly attributed nation-state actor tied to China. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  23. Microsoft is naming a newly attributed nation-state actor tied to North Korea. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  24. Microsoft is naming a newly discovered actor it assesses as financially motivated, not nation-state. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  25. Secureworks CTU is naming a newly tracked threat group it attributes to China. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  26. Secureworks CTU is naming a newly tracked threat group it attributes to North Korea. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  27. Secureworks CTU is naming a newly tracked threat group it assesses as cybercrime/financially motivated. Applying that vendor's own real naming convention, what code/qualifier would it assign?

  28. Axiom and Winnti Group are frequently confused/linked in reporting. Sort each item below into the group it actually, verifiably belongs to.

  29. APT19 and Deep Panda are frequently confused/linked in reporting. Sort each item below into the group it actually, verifiably belongs to.

  30. Scarlet Mimic and Putter Panda are frequently confused/linked in reporting. Sort each item below into the group it actually, verifiably belongs to.

Answer key

Next: Timestamps. All drills