Skip to content

Topic

Cyber Attribution

The practice of identifying who is behind a cyberattack using technical, linguistic, and geopolitical evidence, often contested or politicized.

Current stories

securityConfirmed8 publishers

Washington puts offensive cyber on contract, and the liability questions start now

An August 13 memorandum lets vetted US firms run surveillance and disruption operations against criminal networks. The controls are written around US persons, not bystanders.

Perspective Coverage

8 publishers
Builder
Builder 29%
Operator
Operator 52%
Investor
Investor 19%

Reality

Evidence72
Adoption
Not scored
Hype gap+25
Incentives55
Confidence64
securityConfirmed4 publishers

Norway's shared login layer failed for the third time since June, and nobody broke in

Three attacks on one shared dependency since June, none attributed. Digdir keeps restoring service, and the attackers keep returning to the single queue everything else waits in.

Perspective Coverage

4 publishers
Builder
Builder 28%
Operator
Operator 62%
Investor
Investor 10%

Reality

Evidence72
Adoption80
Hype gap+15
Incentives35
Confidence70
productOne report1 publisher

DOJ downgraded its hacking victims to targets two days after the headlines ran

The 26 August announcement listed the Senate, the Federal Reserve and NASA among a Chinese group's victims. By 28 August they were targets, and any team that opened an incident on day one was hunting a claim the affidavit did not contain.

Publishers:thenextweb.com

Reality

Evidence58
Adoption62
Hype gap+25
Incentives58
Confidence60
securityOne report1 publisher

Server Killers hit Norway's public login the day after an 85 billion crown Kyiv pledge

Digdir calls three days of DDoS the biggest it has seen, and says services stayed up nearly throughout. The timing tracks a prime ministerial visit, not the grievance the group published.

Publishers:securityweek.com

Reality

Evidence52
Adoption38
Hype gap+27
Incentives63
Confidence45