Who Did It? Getting Started with Threat Actor Profiling

Who Did It? Getting Started with Threat Actor Profiling

Speakers: Marthe Råheim Rogndokken, Cyber Threat Intelligence Specialist, Sopra Steria

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=Bdo4MMfUBRM

Overview

In her FIRSTCON talk, "Who Did It? Getting Started with Threat Actor Profiling," Marthe Råheim Rogndokken, a Cyber Threat Intelligence Specialist at Sopra Steria, introduced the PACK model, a novel, step-by-step framework designed to demystify and standardize threat actor profiling in the cyber domain. Drawing from her unique background as a former police officer and investigator, Rogndokken identified a critical gap: while physical investigations prioritize identifying perpetrators, the cyber security realm often over-emphasizes defense without a structured approach to understanding the adversary. This talk addresses that "itch," providing a practical methodology for organizations to move beyond generic defenses to highly targeted, intelligence-driven strategies.

The presentation highlights the inherent difficulties in cyber attribution—the "attribution problem"—while asserting the undeniable value of profiling how an attacker operates, rather than solely focusing on who they are. Rogndokken argues that understanding an adversary's tactics, techniques, and procedures (TTPs), motivations, and resources enables more effective and resilient defensive postures. The PACK model integrates established security frameworks like MITRE ATT&CK, the Admiralty Code, and the RASCALS model, synthesizing them into a coherent process that guides analysts through data collection, meticulous analysis, and comparative assessment, ultimately yielding actionable threat intelligence.

Background

▶ Watch: Speaker introduction and talk overview (0:08)

The concept of identifying an attacker in the physical world is intuitive, but in the cyber domain, it presents significant challenges, often referred to as the attribution problem. Rogndokken explains that linking technical evidence to a specific person, group, or country is inherently difficult due to the nature of technology itself, including the ease of using false flag tactics, spoofing, and the decentralized, collaborative structure of many cybercrime groups. Furthermore, legal gaps and difficulties in cross-border collaboration complicate the process. While some argue that focusing on attribution is a waste of resources that should instead be channeled into defense, Rogndokken contends that a specific aspect of attribution—threat actor profiling—offers substantial benefits.

Rather than fixating on the "who" for purposes of deterrence or international conventions, profiling shifts the focus to the "how," "what," and "why" of an attack. This deeper understanding enables targeted defense, moving beyond generic security measures to strategies specifically tailored to likely adversaries. Rogndokken's journey to develop the PACK model began by seeking existing standardized, step-by-step models for threat actor profiling. She reviewed several prominent models, including the Diamond Model (mapping victimology, adversary, capability, infrastructure), the CAM Model (a copycat of the Diamond Model incorporating motivation), and the BEA Model (focusing on victimology, crime scene, and offender characteristics with an emphasis on equivocal analysis). While these models offered valuable concepts and questions, none provided a clear, end-to-end process that a novice could follow.

Recognizing this gap, Rogndokken set out to create her own model, integrating elements from established frameworks relevant to cyber security and intelligence. Key components woven into the PACK model include:

• CTI Life Cycle, Incident Response (IR) Process, and Digital Forensic Process: These provide the overarching operational context for threat intelligence.
• RASCALS Model: A framework for mapping and understanding an attacker's motivation.
• MITRE ATT&CK Framework: Crucial for structuring technical evidence, specifically focusing on Tactics, Techniques, and Procedures (TTPs). Rogndokken emphasizes the Pyramid of Pain, which illustrates that TTPs are significantly harder for adversaries to change than Indicators of Compromise (IOCs), making them more valuable for long-term defense.
• Admiralty Code Framework: A system for weighing the reliability and credibility of information, essential for dealing with disparate and often unreliable intelligence sources.

The PACK model, therefore, is not revolutionary in its individual components but in its structured integration of these diverse, proven methodologies into a single, comprehensive, and accessible framework for threat actor profiling.

Key Findings

▶ Watch: Introducing the PACK cyber threat profiling model (2:30)

The central finding and contribution of Marthe Råheim Rogndokken's talk is the introduction of the PACK model itself. This model serves as a standardized, step-by-step guide for conducting threat actor profiling, specifically designed to address the lack of such a comprehensive framework in the publicly available cyber security domain. Its core value lies in providing a structured methodology that enables organizations to gain a deeper understanding of their adversaries' operational methods, motivations, and capabilities.

Key findings and contributions of the PACK model include:

• A Standardized Step-by-Step Process: The model offers a clear, sequential approach, guiding analysts from incident detection through data collection, multi-faceted analysis, and optional comparative profiling. This addresses the common challenge of knowing where to start and how to proceed in complex profiling efforts.
• Integration of Established Frameworks: Rather than reinventing the wheel, the PACK model intelligently synthesizes and leverages existing, well-regarded security and intelligence frameworks. This includes the CTI life cycle, IR process, digital forensic process, RASCALS model for motivation, MITRE ATT&CK for technical TTPs, and the Admiralty Code for information reliability. This integration ensures that the model is grounded in proven methodologies.
• Shift from "Who" to "How, What, and Why": The model fundamentally reorients the focus of attribution. While full attribution (identifying the specific group or nation-state) remains challenging, the PACK model prioritizes understanding the adversary's modus operandi, motivations, and resource levels. This shift empowers organizations to develop more targeted defenses that are resilient to changes in specific IOCs.
• Emphasis on Equivocal Analysis: A critical aspect of the PACK model's analysis phase is the mandate for equivocal analysis. This means analysts are encouraged to consider all possible hypotheses and actively attempt to rule them out, rather than falling into the trap of tunnel vision or confirming initial biases. This rigorous approach helps ensure more accurate and robust profiles.
• Value of Comparative Profiling: The model highlights the significant benefit of maintaining a database of previous threat actor profiles. By comparing newly developed profiles against this historical data, organizations can identify similar attack patterns, understand potential adversary evolution, and derive predictive insights, even if a full match isn't found.

While acknowledging that the model is "far from perfect" and faces challenges like data scarcity and collaboration hurdles, Rogndokken's work represents a significant step towards formalizing and democratizing threat actor profiling, making it more accessible and actionable for a broader range of security practitioners.

Technical Deep Dive

▶ Watch: Step-by-step methodology of the PACK model (11:00)

The PACK model is structured around a sequential process designed to systematically build a comprehensive threat actor profile. It begins with the detection of an incident and culminates in a detailed report and lessons learned, with an optional but highly recommended comparison phase.

The process unfolds in the following stages:

1. Incident Detected: The starting point for any profiling effort is the recognition that a security incident has occurred.
2. Collect and Process Data: This involves gathering all available information related to the incident. Crucially, during this phase, the Admiralty Code Framework is applied to each piece of data. The Admiralty Code assigns a two-character rating: the first character (A-F) indicates the source's reliability, and the second (1-6) indicates the information's credibility. For example, A1 denotes "completely reliable source, confirmed by other sources," while F6 would mean "cannot be judged, improbable." This rigorous assessment helps analysts weigh the trustworthiness of their intelligence, especially when dealing with information from disparate or unverified sources.
3. Analysis Phase: This is the core of the PACK model, broken down into three interconnected stages that can partially overlap:

• Victimology: This stage focuses on understanding the "who" and "why" from the victim's perspective. Questions explored include:
• Who is the victim (organization, country, sector)?
• Are there any specific political, economic, or strategic indicators associated with the victim?
• What was the primary damage inflicted by the attack?

This helps establish context and potential motivations from the target's viewpoint.

• Crime Scene Assessment: This stage delves into the "how" of the attack, concentrating on the technical evidence. This is where the MITRE ATT&CK Framework becomes instrumental. Analysts map the observed technical actions to specific TTPs within the ATT&CK matrix. This includes identifying the initial access vector (e.g., phishing), execution methods, persistence mechanisms, privilege escalation techniques, lateral movement, command and control (C2) infrastructure, and exfiltration methods. By focusing on TTPs, the analysis aligns with the Pyramid of Pain, recognizing that altering TTPs is far more costly and difficult for adversaries than changing simple IOCs like IP addresses or hash values.
• Offender Characteristics: This synthesizes the information from victimology and crime scene assessment to build a profile of the attacker. Here, the focus is on the "who," "why," "what," and "how" of the adversary. Key attributes considered include:
• Country of origin/affiliation: (e.g., nation-state, cybercrime group, hacktivist).
• Motivation: (e.g., financial gain, espionage, sabotage, political disruption, leveraging the RASCALS model for deeper insight).
• Type of group: (e.g., Advanced Persistent Threat (APT), ransomware gang, lone wolf).
• Sophistication and resources: How advanced are their tools and techniques? Do they have significant funding, skilled personnel, or access to zero-days?

Throughout this stage, the principle of equivocal analysis is paramount. Analysts must actively consider all plausible hypotheses for the attacker's identity and characteristics, attempting to disprove them rather than prematurely narrowing down possibilities. This prevents confirmation bias and tunnel vision.

1. Comparison (Optional but Recommended): Once a comprehensive threat actor profile is generated, the model suggests comparing it against a database of previously documented profiles. This comparison aims to identify similarities, even if not a complete match, by assigning a likelihood value (e.g., highly unlikely to highly likely) to various attributes. This step can reveal patterns, link incidents to known groups, or provide context from similar past attacks, enriching the current analysis. If new data emerges from this comparison, the process cycles back to the analysis phase.
2. Report and Lessons Learned: The final stage involves documenting the findings in a report or presentation. This output serves to inform stakeholders, guide defensive strategies, and contribute to the organization's collective intelligence. Crucially, any new profiles or refined information should be integrated into the threat actor database, continuously improving the system's effectiveness.

The power of the PACK model lies in its structured approach, which ensures that all critical aspects of an attack are considered, from geopolitical context to granular technical details, and that the reliability of information is continuously assessed.

Demo / Proof of Concept

▶ Watch: Crash Override: PACK model in action (14:00)

Marthe Rogndokken demonstrated the practical application of the PACK model using a real-world scenario: the CrashOverride (also known as Industroyer) attack on the Ukrainian power grid in December 2016. She emphasized that this example was highly simplified for presentation purposes but effectively showcased the model's stages.

1. Incident Detected & Data Collection: The scenario begins with the detection of the attack on the Ukrainian power grid, followed by the collection and processing of all available incident data, applying the Admiralty Code to gauge reliability.

1. Analysis Phase:

• Victimology:
• Country: Ukraine.
• Sector: Critical infrastructure, specifically the energy sector (power grid).
• Political Indicators: Ukraine's ongoing conflict with Russia was a significant contextual factor.
• Damage: A destructive attack aimed at causing widespread power outages.
• Crime Scene Assessment: The technical details of the attack were mapped, focusing on TTPs:
• Initial Access: Achieved via a phishing attack.
• Lateral Movement: After infecting the business network, attackers used credential capture tools like Mimikatz and built-in Windows utilities to move throughout the system.
• Target: The ultimate goal was to reach the Industrial Control Systems (ICS) or Operational Technology (OT) part of the network.
• Malware Deployment: A tailored malware, specifically named CrashOverride, was deployed. It was installed as a Windows system service to ensure persistence even after reboots.
• Malware Functionality: CrashOverride had two primary components:
• A wiper module designed to erase evidence and hinder recovery efforts.
• A module specifically engineered to cause power outages.
• Impact: The attack resulted in power outages, though they lasted less than an hour, indicating a potentially less successful execution than intended. All these technical details would be mapped against the MITRE ATT&CK Framework.
• Offender Characteristics: Combining the above, an initial profile of the attacker emerged:
• Likely Affiliation: While initial thoughts might point to Russia due to the geopolitical context, Rogndokken stressed the importance of equivocal analysis—considering other actors who might benefit from the conflict. However, for this simplified example, Russia was considered the most likely candidate.
• Capabilities: The tailoring of sophisticated malware for a specialized system like an ICS network, requiring deep knowledge of industrial protocols, suggested advanced capabilities and significant resources. This indicated a likely Advanced Persistent Threat (APT) group.
• Motivation: The presence of a wiper and the explicit goal of causing destructive power outages clearly pointed to a destructive motivation.

1. Comparison (Simplified): To illustrate the comparison stage, Rogndokken presented a hypothetical, simplified database of three threat actors:

• Sandworm: Described as a Russian APT group known for targeting NATO countries and those opposed to Russia. They are highly sophisticated, well-resourced, and known for destructive attacks.
• Lapsus$: Characterized as a financially driven, opportunistic group with random victimology, skilled but less sophisticated and resourced than Sandworm.
• NoName: A Russian hacktivist group with victimology similar to Sandworm but significantly less sophisticated, primarily conducting DDoS attacks with minimal damage.

By comparing the CrashOverride profile against these three, Sandworm emerged as the most likely match, given its Russian origin, destructive motivation, high sophistication, and targeting of critical infrastructure in Ukraine. This simplified comparison highlighted how a robust database could help identify potential adversaries.

The demonstration, despite its simplifications, effectively illustrated how the PACK model guides an analyst through a structured process to build a comprehensive threat actor profile, moving from raw incident data to an informed assessment of the adversary's characteristics.

Defensive Implications

▶ Watch: Q&A: Model availability and collaboration (23:30)

The PACK model, by providing a structured approach to threat actor profiling, offers significant defensive implications for organizations. Its primary benefit is enabling a shift from reactive, generic security measures to proactive, targeted defense.

1. Targeted Defense Strategies: By understanding the "how, what, and why" of an attacker, organizations can tailor their defenses to counter specific TTPs, motivations, and capabilities. Instead of broadly defending against all possible threats, resources can be focused on strengthening defenses against the most likely and impactful attack vectors identified through profiling. This includes prioritizing mitigations for TTPs favored by relevant threat groups, as highlighted by the Pyramid of Pain.
2. Enhanced Threat Hunting: A detailed threat actor profile provides specific indicators of behavior (TTPs) and potential motivations that can be used to conduct more effective threat hunting. Security teams can actively search for evidence of these specific TTPs within their networks, even before an incident fully escalates, rather than simply reacting to alerts.
3. Improved Incident Response: Knowing the typical characteristics and methods of an adversary can significantly streamline incident response. If an incident matches a known profile, responders can anticipate the attacker's next moves, understand their likely objectives, and deploy countermeasures more rapidly and effectively. This reduces dwell time and minimizes damage.
4. Strategic Resource Allocation: Understanding the sophistication and resources of potential adversaries helps organizations allocate their security budget and personnel more strategically. For instance, if profiling suggests an organization is a target for highly resourced APTs, investments in advanced detection technologies and skilled analysts become paramount.
5. Proactive Vulnerability Management: Profiling can inform vulnerability management programs. If certain threat actors exploit specific vulnerabilities or misconfigurations, organizations can prioritize patching or hardening against those particular weaknesses.
6. Data Collection and Standardization: The model implicitly encourages a more rigorous and standardized approach to collecting and processing incident data. The use of frameworks like the Admiralty Code for information reliability ensures that defensive decisions are based on the most trustworthy intelligence available. Similarly, mapping TTPs to MITRE ATT&CK creates a common language for discussing and defending against adversary behaviors.
7. Challenges and Future Considerations: Rogndokken candidly addressed several challenges that impact the defensive utility of the PACK model:

• Data Scarcity and Quality: The model's effectiveness heavily relies on sufficient, high-quality data. Organizations with limited incident data may struggle to build robust profiles. Inconsistent data across different profiles can also complicate the comparison stage.
• Collaboration: Populating and enriching threat actor databases requires extensive collaboration, both internally and externally (e.g., with other security vendors, ISACs). Legal, logistical, and political hurdles often impede the seamless sharing of sensitive threat intelligence, especially across borders. Rogndokken highlighted that different jurisdictions might even classify the same group differently (e.g., freedom fighter vs. terrorist), complicating data sharing.
• Database Creation and Maintenance: A standardized, publicly accessible database of threat actor profiles, crucial for the comparison phase, does not yet exist. Creating and continually updating such a database, ensuring its accuracy and relevance, is a massive undertaking.
• Integration of AI: Rogndokken suggested that Artificial Intelligence (AI) could play a significant role in automating data analysis, comparison, and profile updates, especially given the rapid pace of cyber threats. However, integrating AI introduces its own set of challenges, including bias, data privacy, and the need for explainability.

Despite these challenges, the PACK model provides a robust conceptual framework for organizations to elevate their defensive posture by systematically understanding their adversaries, thereby fostering a more intelligence-driven security strategy.

Key Takeaways

• Shift from "Who" to "How, What, Why": While full cyber attribution remains challenging, focusing on threat actor profiling (understanding an adversary's TTPs, motivations, and capabilities) is crucial for building targeted and effective defenses.
• The PACK Model is a Structured Guide: The model provides a clear, step-by-step process for conducting threat actor profiling, addressing the lack of a standardized, end-to-end methodology in publicly available resources.
• Integration of Proven Frameworks: The PACK model intelligently synthesizes established security and intelligence frameworks, including MITRE ATT&CK for TTPs, the Admiralty Code for information reliability, and the RASCALS model for motivation, into a cohesive process.
• Embrace Equivocal Analysis: To avoid biases and tunnel vision, analysts must consider multiple hypotheses during the analysis phase and actively work to rule them out, ensuring a more accurate and robust profile.
• Collaboration and Data are Paramount: The effectiveness of the PACK model, especially its comparison phase, relies heavily on access to rich, reliable data and the ability to collaborate on sharing threat intelligence, though significant challenges exist in these areas.
• The Model is a Framework, Not a Tool: The PACK model itself is a theoretical framework designed to guide analysis, rather than a specific software tool or database, though it lays the groundwork for such developments.

About the Speaker(s)

Marthe Råheim Rogndokken is a Cyber Threat Intelligence Specialist at Sopra Steria in Norway. Her professional journey is marked by a unique transition from traditional law enforcement to the cutting edge of cybersecurity. She began her career as a police officer, serving both as a first responder and an investigator in the physical domain. Driven by a desire for new challenges, she specialized in cybersecurity, bringing her investigative mindset to the digital realm. Rogndokken's motivation for developing the PACK model stems directly from this background; she sought to apply the principles of perpetrator identification from police work to the cyber domain, where she observed a significant gap in structured threat actor profiling. She collaborated with two professors to develop and publish the PACK model, which she presented at FIRSTCON.