DRAGNET attribution assessment: multi_signal_boost¶

Assessment: SANDWORM_SIM with HIGH confidence

Hypotheses¶

Hypothesis	Support	TTP sim	Score	P (normalised)
SANDWORM_SIM	0.92	0.88	0.92	0.92
UNKNOWN	0.08	0.00	0.08	0.08
FALSE_FLAG	0.00	0.00	0.00	0.00

ACH matrix (C=consistent, I=inconsistent, N=neutral)¶

Signal	SANDWORM_SIM	FALSE_FLAG	UNKNOWN
`ip:198.51.100.23`	C	N	N
`ttp:T1485`	C	N	N
`ttp:T1570`	C	N	N
`file_hash:0000000000000000000000000000000000000000000000000000000000000003`	N	N	C
`imphash:bb22bb22bb22bb22bb22bb22bb22bb22`	C	N	N

Weights¶

Effective weight of a signal = kind weight x specificity (1 / number of actors it links to); ttp_profile scales the IDF-cosine tradecraft term. Override with --weight kind=value.

kind	weight	default
code_reuse	0.75	0.75
domain	0.60	0.60
family	0.50	0.50
file_hash	0.90	0.90
imphash	0.60	0.60
ip	0.55	0.55
language	0.15	0.15
mutex	0.40	0.40
rich_header	0.35	0.35
tlsh	0.55	0.55
tool	0.30	0.30
ttp	0.15	0.15
ttp_profile	0.60	0.60
victimology	0.10	0.10

Evidence-to-campaign links¶

EV-F-003 -> ip:198.51.100.23 -> C-SW-2017-WIPER
EV-M-003 -> imphash:bb22bb22bb22bb22bb22bb22bb22bb22 -> C-SW-2017-WIPER

False-flag indicators¶

none detected

What would raise confidence¶

Independent infrastructure overlap (C2 IP/domain) with a known campaign
Code-reuse match in non-trivial, non-public functions
Corroboration from an independent reporting source

What would lower confidence¶

Shared infrastructure turns out to be public/shared hosting (CDN, VPS pool)
Shared code is shown to be publicly leaked or open-source
Hard evidence linking to a different actor

Chain of custody¶

seq	action	item	sha256	entry_hash
0	ingest	EV-F-003	9894c58ca3392972...	5e90ee18b1460595...
1	ingest	EV-M-003	612f3acf5240e8c7...	d9edfa57a835adbb...
2	assess	multi_signal_boost	3dfb9018656aa29a...	76fde0bb20e498e1...

Attribution is an analytic judgment, not proof. This assessment was generated by a transparent rule-based engine and must be reviewed by a qualified analyst before any action is taken.