Revisiting Known Perps: Behavioral Profiling for Continuous Monitoring of Threat Actors
summary
Argues for profiling based on observable tooling and operations rather than institutional labels, showing how to infer resource model (internal dev vs outsourced tools), burn rate of zero‑days, and automation level from telemetry. Gives a concrete case: a group that runs multiple modular frameworks in parallel, prefers manual hands-on operations over mass infection, and practices strict operational segmentation, making it stealthy and durable. Useful if interested in practical signals to prioritize and track ongoing adversary activity.
AI-written summary · about
chapters (15)
- 0:00Introduction and context
- 0:58The problem with sophistication
- 2:25Limitations of current models
- 3:55Behavioral profiling approach
- 5:17Profiling and attribution
- 7:18Operational configuration
- 8:46Internal vs external resources
- 12:43Visible behavioral traits
- 13:54Dynamic nature of actors
- 16:44Designing for defenders
- 18:56Case study: The Lamberts
- 20:26Insights from Lamberts
- 23:19Operational segmentation
- 24:44Conclusion
- 25:10Q&A and framework critique
related talks
28mWho Did It? Getting Started with Threat Actor Profiling
35mEnhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns
51mTrack the Attacker’s Actions — Understanding and Investigating Cross‑Cutting Intrusions Based on Behavior Patterns
47mRough and Ready: Frameworks to Measure Persistent Engagement and Deterrence
44m📗 Threat Chords: Tuning into Persistent Patterns in Adversary Behavior 🔥
37mExposure Management: The Rise of Proactive Cybersecurity Platforms
41mCriminal Minds: World’s Most Wanted Cybercriminals Interview Insights
50mAdversary Emulation: How I Stopped Being Polite and Got Real Results