A Sophisticated Attacker Is Not an Explanation

“It was a sophisticated nation-state attacker; there was no realistic way to stop them.”

Stop there.

That sentence closes an incident review before it has started.

A sophisticated attacker is not an explanation.

It is an adjective.

It sounds like a finding, and it carries the authority of a finding, but it answers none of the questions a victim actually has to answer next.

How long were they inside?

What did they want?

Did they choose you, or did you happen to be exposed?

How sure is anyone about who they were?

Each of those is a separate claim, with separate evidence and a separate consequence for what you do on Monday.

“Sophisticated” folds all of them into one word, then quietly drops the confidence behind the attribution.

What comes out the other end is not an explanation.

It is an absolution.

1. “But the Vendor’s Report Calls the Actor Highly Sophisticated.”

Then ask which axis the vendor meant.

Analysts who compare actors seriously use at least three, and they are independent.

Operational-security discipline. How hard the actor works to avoid detection, relative to how hard it works to get in.

Volt Typhoon sits at one end. It relies on living-off-the-land techniques, abusing PowerShell, built-in administrative tools and valid accounts already on the target, to blend into normal traffic instead of deploying detectable malware.

A big-game-hunting ransomware affiliate sits at the other.

Noise is not a mistake there.

The payout depends on reaching encryption and extortion before the victim understands what happened.

Dwell time. How long the actor stays before detection or action.

Targeting specificity. Whether the actor picked the victim, or the victim was simply reachable.

APT29’s recorded targeting concentrates on European governments, NATO member states and research institutions, a pattern consistent with intelligence requirements rather than opportunism.

Opportunistic actors invert that: they scan for exposed systems and decide afterwards what to do with whatever they found.

Their victims’ sectors describe what was reachable, not what was sought.

Scattered Spider sits between the poles. Its recorded activity in 2022 concentrated on CRM providers, business-process outsourcers, and telecom and technology firms, then expanded through 2023 into gaming, hospitality, retail, managed service providers, manufacturing and financial services.

Chosen enough to be a sector strategy.

Broad enough that an individual victim inside each sector looks close to opportunistic.

Every one of those axes can be checked against a group’s documented history.

“Sophisticated” cannot be checked against anything.

2. “But It Was a Nation-State, and They Have Unlimited Resources.”

Resources buy something specific.

Mostly, they buy patience.

Living-off-the-land tradecraft needs the discipline to move slowly and the organizational tolerance for a longer path to the objective.

Both are cheaper to sustain with state backing than with a criminal group’s pressure to monetize quickly.

That is a resourcing signal, not proof of magic.

The useful consequence is about dwell time, and dwell tracks motive more directly than skill.

An espionage foothold gains value the longer it persists undetected; APT29’s SolarWinds operation shipped its compromised update around March 2020 and was not publicly disclosed until December 2020.

A ransomware affiliate’s dwell, from initial access to payload deployment, is typically measured in days.

Persistence has no value once the account is spent.

So “nation-state” is not a reason the intrusion could not be stopped.

It is a reason to assume the intruder was inside longer, and was looking for something other than a quick payment.

Now look at the capability comparison itself.

APT29’s recorded toolset mixes custom malware, GoldMax, GoldFinder, SUNBURST, TEARDROP and FoggyWeb, with widely available tools: Cobalt Strike, Mimikatz, BloodHound, AdFind.

The mix is a recorded signal in its own right, because reliance on bespoke versus off-the-shelf tooling tracks resourcing.

FIN7 moved from point-of-sale malware to a proprietary ransomware-as-a-service platform after 2020.

That was not a capability upgrade in the nation-state sense.

It was a business-model change towards larger, less frequent payouts, made with broadly the same tooling and social-engineering tradecraft the group had used for years.

Put FIN7 and APT29 on one sophistication scale and you lose the comparison that matters.

Both are well-resourced and persistent within their own objective.

One objective rewards stealth over years.

The other rewards throughput over a fiscal quarter.

Name the objective, and the capability claim starts meaning something.

3. “But the Attribution Is in a Government Indictment.”

Sometimes it is.

Often it is not, and the sentence does not tell you which.

Attribution runs from a formal charging document to inferred consensus without charges.

In the United States, the Department of Justice indicted four PLA members over the Equifax breach in February 2020.

A March 2017 indictment tied at least part of the 2013–2014 Yahoo intrusions to Russian FSB officers and a criminal conspirator.

Marriott and OPM sit at the other end: attributed to Chinese state-linked actors by inferred consensus, with no charges.

Those are different attribution states, and a report that writes “nation-state” over all four has erased the difference.

Yahoo also shows that a state label does not settle the motive.

The same charged conspiracy paired state intelligence officers with a criminal, and the stolen account data was used for financial fraud.

State involvement and monetization, in one incident.

An attribution that stops at “Russia” or “China” has not told you which of the two you are dealing with, or whether it is both.

The indictment is the strongest attribution state available.

It still answers a different question from the one the victim is asking.

The discipline for stating it already exists.

FIRST.org’s Cyber Threat Intelligence community recommends two independent scales.

Words of Estimative Probability state how likely a judgment is, on a five-point scale that runs from “highly unlikely” (under 10%) through “even chance” (40–60%) to “highly likely” (over 90%).

A separate Level of Confidence in Assessment, high, moderate or low, describes the quality of the evidence underneath.

The two are deliberately independent.

An analyst can judge an outcome likely and still hold that judgment with low confidence, because the evidence is thin even where it all points one way.

Mandiant’s attribution framework separates a related pair: confidence, meaning how certain, and specificity, meaning how precisely identified.

Its example: a report can hold high confidence that a Russian state actor was involved and lower confidence about exactly which named Russian group it was.

Drop “moderate confidence” or “assessed” when you repeat a claim, and the sentence now claims something the source did not.

There is also the question of where the evidence came from.

Vendor telemetry supplies volume, but only from organizations running that vendor’s sensors.

Incident-response engagements supply ground truth from inside a victim environment.

Open-source intelligence fills gaps on identity and sponsorship: leaked chats, wallet tracing, government advisories, and for hacktivists, Telegram channels such as NoName057(16)’s, which peaked at over 13,000 members in June 2023.

A profile that blends all three without saying which claim rests on which channel is the commonest quality problem in secondary reporting on threat actors.

4. “But the Data Was Stolen, So Fraud Is the Risk We Notify About.”

That assumption is where “sophisticated” does its most expensive damage.

Famous breaches get sorted three ways, and the three do not agree.

By vector: how the attacker first got in.

By sector: who the victim was.

By motive: financial gain or state espionage.

Motive cuts across the other two.

Target’s card data was sold on carding forums attributed to “Rescator.”

Yahoo’s stolen account data was used for financial fraud and traded among the co-conspirators named in the indictment.

Equifax, Anthem, OPM and Marriott are all attributed to Chinese state-linked actors.

In none of the four has the stolen data surfaced for sale on criminal markets.

The Equifax indictment frames that breach as intelligence collection, not financial crime.

Four of the six best-documented “famous breaches” were not committed for money at all.

That inverts the assumption, dominant in consumer-facing breach-notification language, that a breach means fraud risk.

The vectors do not line up with the motive either.

Target’s entry was a vendor credential; Anthem’s was a spear-phishing typosquat; Equifax’s was an unpatched web application; OPM’s was a stolen contractor credential.

Target and Anthem share almost nothing: different vector, different sector, different motive.

Equifax and OPM share a motive and a data type, identity and eligibility records, despite a different sector and a different vector.

Anthem and OPM both held highly sensitive personal data used for eligibility and clearance decisions.

Here is the inference both halves support.

If the assessed motive is espionage, fraud monitoring watches a market the data may never enter.

The victim has to set its monitoring and notification assumptions for intelligence use as well.

What a person’s eligibility and clearance record reveals, and to whom, is a different harm from a card being cloned.

“Sophisticated” does not tell you which harm you are notifying about. The motive finding does.

5. “But We Can Block Their Infrastructure From the Vendor’s Indicator List.”

You can block what they used.

A threat-actor profile is not a biography.

It is a structured record, and most vendor profiles follow the four features of the Diamond Model, published by Sergio Caltagirone, Andrew Pendergast and Christopher Betz in a 2013 US Department of Defense technical report.

Adversary.

Capability.

Infrastructure.

Victim.

Those four features do not age at the same rate.

Capability, recorded as ATT&CK technique IDs and named tooling, describes how the actor behaves.

Victimology comes directly from confirmed incidents, which makes it one of the more reliable parts.

Infrastructure decays fastest.

Domains are taken down. Hosting providers get burned.

A published indicator list is a historical record of what an actor used, not a live blocklist.

And some of it was never blockable as “theirs” in the first place: Scattered Spider’s recorded exfiltration used legitimate cloud storage, MEGA and AWS S3, rather than actor-controlled servers.

Campaigns carry their own dates, separate from the actor’s activity window.

APT29’s MITRE record carries an activity window of “at least 2008” to present, and within it Operation Ghost, dated September 2013 to October 2019.

Lazarus Group’s record includes Operation Dream Job, September 2019 to August 2020.

An indicator list from one campaign tells you about that campaign.

It does not describe the actor’s next one.

Date the list. Treat it as history. Defend against the behaviour.

6. “But the Board Only Needs to Know Who Did It.”

“Who” is the least certain field in the whole record.

The adversary feature, sponsor, motive and activity window, carries the least certainty and the most revision over time.

APT29’s own MITRE entry says “attributed to” Russia’s Foreign Intelligence Service (SVR).

That phrasing is doing work.

An assessed sponsor is a standing judgment, not a fixed fact.

The board’s decisions do not hang on the name.

They hang on how long the attacker was inside, what it was after, and how sure anyone is.

How long is the field breach reports most often leave out.

The date of first access is a forensic reconstruction, and companies frequently report only the detection or disclosure date.

Where a dwell figure exists, it usually comes from a congressional or regulatory investigation.

The Senate Permanent Subcommittee on Investigations’ 2024 Equifax report put Equifax’s dwell at 78 days.

The gap between detection and disclosure measures a different interval, and should never be passed off as dwell.

Give the board a short record instead of a name.

The dwell figure and who established it.

The assessed motive, with its probability and confidence words intact.

The attribution state: indictment, vendor assessment or inferred consensus.

The collection channel behind it.

The harm model that follows: fraud, intelligence use, or both.

That is a board paper somebody can act on.

7. No, This Does Not Mean State-Backed Actors Are No More Capable.

They can be.

The patience and tooling state backing buys is real, and it shows up as dwell, discipline and chosen targets.

Attribution is not guesswork either.

Indictments, incident-response findings and years of campaign records are evidence.

The claim here is narrower.

A capability or attribution claim has to name its axis and carry its confidence.

The adjective alone licenses neither a defence nor an excuse.

8. What You Should Actually Do

Replace “sophisticated” in incident reports with the axis actually claimed: operational-security discipline, dwell time or targeting specificity.

Carry the source’s probability and confidence language forward unchanged. “Likely, low confidence” is not “likely.”

Record the evidence channel for each attribution claim: vendor telemetry, an incident-response engagement or open-source intelligence.

Record the attribution state, from indictment to inferred consensus, and date it.

Classify the incident separately by vector, sector and motive before comparing it with anything else. Name which axis licenses the comparison.

Attach a publication date to any vendor indicator list, and treat it as history, not a blocklist.

Where the assessed motive is espionage, set monitoring and notification assumptions for intelligence use as well as fraud.

9. The Adjective Is the Gap.

A sophisticated attacker is a description of your review, not of the attacker.

It marks the place where the specific findings should have gone.

How long they stayed.

What they wanted.

Whether they chose you.

How sure anyone is.

Write those down, with their confidence and their dates.

Then decide what to assume about the data, the dwell and the next intrusion.

That is the explanation.