Cyber Attribution Lab: Claimed vs Confirmed Evidence
This lab trains you to handle cyber attribution without over-claiming. You are the threat-intelligence lead at a fictional company. An intrusion is contained and everyone wants a name. You weigh message language, tooling, infrastructure, timing, victims, code similarity, self-claims and a vendor report, then choose confidence wording and the line for the board.
The lessons: a language is not attribution, and an exposed workspace shows what a campaign did, not who is behind it. It pairs with the APT Rosetta, the APT Intel Feed and the AI Pentesting Detector Lab. Everything is invented and no real group is named.
You are Priya Raman, threat-intelligence lead at Northgate Telecom. An intrusion was contained last week. Your tracking name for the activity is HOLLOWREED (invented). The board, the press office and a partner company all want to know "who did it". Over 11 scored decisions you weigh message language, tooling, infrastructure, timing, victims, code similarity, self-claims and a vendor report, separate claimed from confirmed, choose confidence wording, write the line for the board, and decide what to share. Everything here is invented: no real group is named and no real indicators appear.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
Loading…
Sample report · illustrative data
Sample result: cyber attribution debrief
Example debrief for a threat-intelligence lead who weighed the evidence on a fictional intrusion cluster (HOLLOWREED, invented) and chose confidence wording and a board line. Scores are illustrative.
Result
- Score
- 88 / 110 (80%, example)
- Band
- Careful analyst
- Decisions
- 11 scored 0 to 10; best answer is 10
Evidence weighed (fictional case)
| Evidence | Weight given | Why |
|---|---|---|
| Operator message language | Low | A language is not attribution; anyone can type in any language |
| Open-source tools shared with a vendor report | Low | Commodity tools are used by many clusters |
| Rare custom routine shared with a public sample | Medium | Links software; operators still unproven |
| Leak-site self-claim | Claim only | Named on the site; not confirmed |
Line for the board
High confidence that five intrusions are one activity cluster; actor not identified (low confidence in any name); will update if that changes. Confidence and likelihood words are not mixed in one sentence.
Where points were lost (example)
- Counted a language as proof of the operator's country.
- Repeated a single vendor post as if confirmed.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
TL;DRWhat this is
5 points
- A scenario lab on cyber attribution and threat actor attribution: you are the threat-intelligence lead for a fictional company and decide how strongly the evidence supports saying who was behind an intrusion.
- You make 11 scored decisions on cluster versus actor, the language of operator messages, what an exposed workspace does and does not show, tooling overlap, infrastructure reuse and false flags, working hours, victimology, code similarity, self-claims and single-source reports, confidence wording, the board and press line, and what to share with whom.
- Key lesson: a language, including "Chinese-speaking", is not attribution, and an exposed workspace shows what a campaign did, not who is behind it. Malbear Labs reports its operator's messages were in Chinese; as we read the report, it treats origin as inference from artifacts and not a confirmed identity.
- It draws on the MITRE ATT&CK Groups page (groups are activity clusters tracked under a common name), ODNI ICD 203 (confidence and likelihood are kept apart), the CISA, FBI and DC3 advisory AA24-241A (how an agency words an attribution) and Malbear Labs' Operation Snowball write-up.
- The case, cluster name (HOLLOWREED) and addresses are invented. No real group is named. Defensive and educational only.
Frequently asked questions
What is cyber attribution?
Cyber attribution is the process of judging who is behind an intrusion, from a technical cluster of activity up to a person, group or sponsor. It is a judgment built from several kinds of evidence, not a lookup. The lab keeps two questions apart: which activity belongs together, and who is behind it.
What is threat actor attribution, and how is it different from a threat group?
MITRE ATT&CK describes groups as "activity clusters that are tracked by a common name in the security community", and says different organisations' definitions may partially overlap or disagree. So a group name is a grouping of activity, and linking it to a real organisation or government is a further step needing more evidence.
Is the language of the attacker's messages proof of attribution?
No. A language says what someone typed, not who they work for. Malbear Labs reports that its operator's messages and the agents' reports were in Chinese, and as we read it the report presents the origin as an inference from artifacts, not a confirmed identity. Treat language as a weak clue, at most.
How do you express confidence in attribution in cyber security?
State a confidence level for each finding with its basis and gaps. ODNI's ICD 203 says confidence may rest on the logic and evidence behind a judgment, including the quantity and quality of sources, and that a confidence level and a degree of likelihood should not be combined in the same sentence. The ICD does not define low, moderate or high, so define your own scale. Our rule of thumb in the lab is PlayCISO practice.
How do agencies word an APT attribution?
Carefully. The CISA, FBI and DC3 advisory AA24-241A uses terms such as "assesses", "judges", "consistent with" and "likely", and separates different activities of one group. It gives no formal confidence level. Reading advisories this way helps you write your own board and press lines without over-claiming.
How do I treat a ransomware leak-site claim or a one-source vendor report?
As a claim to test. Write "named on the leak site; not confirmed" or "a vendor says", attribute every statement to its source and weigh it against your own evidence. That is PlayCISO practice and matches the claimed-versus-confirmed habit the lab scores.
Sources
Read on 2026-11-08. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional and use made-up data.
- MITRE ATT&CK: Groups (groups as activity clusters; names may partially overlap)
- ODNI Intelligence Community Directive 203: Analytic Standards (confidence and likelihood; information versus assumptions and judgments)
- CISA, FBI and DC3 advisory AA24-241A (example of how an attribution is worded)
- Malbear Labs: Operation Snowball, inside an autonomous AI intrusion campaign (8 Nov 2026) (the author's reported findings, not independently verified)
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.