Skip to content

DRAGNET attribution assessment: olympic_destroyer_like

Assessment: Insufficient for attribution (INSUFFICIENT)

Hypotheses

Hypothesis Support TTP sim Contradiction Score P (normalised)
FALSE_FLAG 0.70 0.00 0.00 0.70 0.35
SANDWORM_SIM 0.76 0.78 0.35 0.60 0.30
UNKNOWN 0.40 0.00 0.00 0.40 0.20
LAZARUS_SIM 0.43 0.22 0.55 0.29 0.15

ACH matrix (C=consistent, I=inconsistent, N=neutral)

Signal SANDWORM_SIM LAZARUS_SIM FALSE_FLAG UNKNOWN
ip:198.51.100.23 C I N N
ttp:T1485 C N N N
ttp:T1003 C C N N
file_hash:0000000000000000000000000000000000000000000000000000000000000002 N N N C
family:UnknownWiper N N N C
rich_header:rh:9f8e7d6c I C C N

Weights

Effective weight of a signal = kind weight x specificity (1 / number of actors it links to); ttp_profile scales the IDF-cosine tradecraft term. Override with --weight kind=value.

kind weight default
code_reuse 0.75 0.75
domain 0.60 0.60
family 0.50 0.50
file_hash 0.90 0.90
imphash 0.60 0.60
ip 0.55 0.55
language 0.15 0.15
mutex 0.40 0.40
rich_header 0.35 0.35
tlsh 0.55 0.55
tool 0.30 0.30
ttp 0.15 0.15
ttp_profile 0.60 0.60
victimology 0.10 0.10
  • EV-F-002 -> ip:198.51.100.23 -> C-SW-2017-WIPER
  • EV-M-002 -> rich_header:rh:9f8e7d6c -> C-LZ-2017-RANSOM

False-flag indicators

  • LAZARUS_SIM: supported only by forgeable/soft signals (rich_header) with no hard infra/code overlap
  • forgeable artifacts point to LAZARUS_SIM while hard evidence points to SANDWORM_SIM

What would raise confidence

  • Independent infrastructure overlap (C2 IP/domain) with a known campaign
  • Code-reuse match in non-trivial, non-public functions
  • Corroboration from an independent reporting source

What would lower confidence

  • Confirmation that forgeable artifacts (Rich header, strings) were planted
  • Shared infrastructure turns out to be public/shared hosting (CDN, VPS pool)
  • Shared code is shown to be publicly leaked or open-source
  • Hard evidence linking to a different actor

Chain of custody

seq action item sha256 entry_hash
0 ingest EV-F-002 e247f2d6e8fe258d... d7a2e8f8c40559b8...
1 ingest EV-M-002 d3176a6c93e1b13e... 0515dfa9c75326c5...
2 assess olympic_destroyer_like 17d34bed5759e9b7... 9aaa81f7222fe49c...

Attribution is an analytic judgment, not proof. This assessment was generated by a transparent rule-based engine and must be reviewed by a qualified analyst before any action is taken.