## Analysis & Attribution: The "Who"

Attribution (Naming the actor) is hard and often political.

### Levels of Attribution
1.  **Infrastructure**: "This attack came from IP 1.2.3.4 (DigitalOcean VPN)." (Low value).
2.  **Tooling**: "They used 'PoisonIvy', which is often used by Chinese groups." (Medium).
3.  **TTPs**: "They used the exact same 5-step process as APT10." (High).
4.  **Strategic**: "The attack targeted a dissident journalist critical of Country X." (Motivation).

### The Diamond Model of Intrusion Analysis
A simple shape to map attacks.
1.  **Adversary**: Who? (Russia).
2.  **Infrastructure**: What? (IPs/Domains).
3.  **Capability**: How? (Malware/Exploits).
4.  **Victim**: Whom? (You).
*   *Pivot*: If you find a Malware sample (Capability) used by an Adversary, you can pivot to find their Infrastructure.

### Cognitive Biases
Analysts must avoid traps.
*   **Confirmation Bias**: Looking for evidence that supports your theory ("It's Russia") and ignoring evidence that contradicts it.
*   **Mirror Imaging**: Assuming the attacker thinks like you. ("They wouldn't attack on Christmas." Yes, they would).
*   **False Flag**: Attackers verify sophisticated. The "Olympic Destroyer" malware (Russia) contained code snippets from North Korea to confuse analysts.