Facilitating Informed Cyberattack Attributions: The PACT Model

Accurate cyberattack attribution is crucial in cybersecurity to prevent severe repercussions and improve mitigation strategies. Misattribution can lead to serious consequences, potentially escalating to kinetic warfare. However, attribution remains a significant challenge due to the lack of standardized procedures, limited use of criminal profiling, and the absence of a unified public database for threat actor data. This study developed two artefacts to address these issues: the PACT (Profiling Attributing Cyber Threats) model and a profiling database. PACT integrates principles from existing attribution models, criminal profiling techniques, and the ATT&CK framework. The profiling database features profiles of three known threat actors: Sandworm, Lapsus$, and NoN-ame057(16). These artefacts were created through an extensive investigation into attribution, the ATT&CK framework, criminal profiling, and threat actor literature. The effectiveness of PACT was assessed using a case study on the CrashOverride attack to verify its ability to identify perpetrators by matching findings against profiles in the database. Although the profiling database was not independently tested, it was evaluated through reflective discussion. Results showed that PACT correctly attributed the attack to Sandworm, however further refinement is needed for broader application. Despite its current limitations, PACT represents a significant contribution to cybersecurity. The literature review highlights PACT as the first practical attribution model of its kind, addressing key gaps in existing research. While not yet fully implementable, PACT lays the groundwork for a standardized attribution model, providing valuable insights into the attribution problem in cybersecurity.