# Threat Actor Profiling and Attribution Limitations

> Build sourced actor profiles, read vendor naming overlaps correctly, and make attribution judgements at the right level with honest confidence.

Canonical: https://codelivly.com/rooms/cti-actor-profiling-and-attribution
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

Purpose: teach junior analysts to describe a threat actor as a tracked, evidence-based cluster and to make or test attribution claims without overstating them. You will build actor profiles from incidents, compare clusters across vendors, rate attribution evidence by strength, recognise false flags, and assign confidence with a stated basis.

Prerequisites: Learning Path 1 (CTI Foundations), especially analytical reasoning and confidence language; Learning Path 2 (OSINT and Indicator Analysis); and modules 1 and 2 of this path (ATT&CK behaviour analysis and the Diamond Model).

Measurable outcomes. After this module you can:
- Produce an actor profile covering TTPs, tooling, infrastructure habits, targeting, timing and assessed motivation, with every statement sourced and dated.
- Explain at least three reasons vendor cluster names do not map one to one, and write a dated overlap record with basis and confidence.
- Place an attribution claim on the correct level (event, cluster, named group, sponsor, individual) and identify the evidence each level requires.
- Rate attribution evidence by exclusivity and cost to fake, and explain why shared tooling, open-source malware, hosting and commercial kits are not attribution.
- Use a small Analysis of Competing Hypotheses matrix to find discriminating evidence and identify possible false flags.

Practical completion objective: in the lab, test a vendor's high-confidence attribution of a synthetic intrusion against an evidence set, apply a confidence rubric, and write a corrected cluster-level assessment that meets the stated rubric.

## Lessons

1. Building and Maintaining a Threat Actor Profile (18 min)
2. Naming Conventions and Why Vendor Clusters Do Not Map One to One (16 min)
3. Levels of Attribution, Evidence Strength and Confidence (20 min)
4. False Flags, Deception and Competing Hypotheses (18 min)
5. Lab: Assess an Attribution Claim and Assign Confidence (45 min)

## Related

- [Learning path: Threat Actor and Campaign Investigation](https://codelivly.com/learning-paths/cti-threat-actor-investigation)
- [All rooms](https://codelivly.com/rooms)