Threat Actor Cluster
Definition
A named collection of observed activity linked by shared infrastructure, malware, and TTPs, without necessarily having confirmed the real-world identity of the operators. Cluster names (such as APT28 or Lazarus Group) are analytical constructs used by threat intelligence firms; different firms may use different names for what may be the same underlying group.
- Definition
- Activity grouped by shared infrastructure, malware, TTPs
- Identity status
- Real-world operators not necessarily confirmed
- Naming
- Analytical construct, e.g. APT28, Lazarus Group
- Caveat
- Different vendors may name the same group differently
Common questions
Why do different security vendors use different names for what seems like the same group?+
Each vendor builds clusters from its own visibility and evidence, so naming reflects that vendor's dataset, and clusters that later prove to overlap are not always merged or cross-referenced publicly across vendors.
Does a threat actor cluster name imply attribution to a nation state?+
Not necessarily, a cluster name only asserts that observed activity shares consistent characteristics; attributing it to a specific sponsor or individual requires additional evidence beyond the cluster definition itself.
Related terms
- Attribution
- The process of identifying the threat actor responsible for a cyberattack. Attribution is a confidence-weighted analytical conclusion, not a binary fact. It...
- Confidence Level
- An explicit label attached to an attribution assessment indicating how strongly the available evidence supports the conclusion. Standard tiers are low, medium,...
- False Flag
- A deliberate deception in which an attacker plants indicators designed to make the intrusion appear to originate from a different actor. Common...
- Technical vs Legal Attribution
- Technical attribution identifies the infrastructure and tooling used in an attack and may link it to a known cluster or actor profile....
- TTPs (Tactics, Techniques, and Procedures)
- The behavioural fingerprint of a threat actor: the broad goals and approaches they pursue (tactics), the specific methods they use to achieve...