The Art of Threat Attribution

Cybercriminals work hard to cover their tracks, but attribution is possible. In this session, we’ll explore the tools, techniques, and intelligence sources used to link cyberattacks to specific threat actors. From malware signatures and TTP patterns to infrastructure overlap and linguistic analysis, attribution is both a science and an art. We’ll also examine high-profile attribution mistakes that spread rapidly through media and shaped public perception. Using real-world examples, we’ll highlight what successful attribution looks like, why it matters, and where the line is between strong indicators and weak assumptions.