Skip to content

DRAGNET attribution assessment: thin_evidence

Assessment: Insufficient for attribution (INSUFFICIENT)

Hypotheses

Hypothesis Support TTP sim Contradiction Score P (normalised)
UNKNOWN 0.72 0.00 0.00 0.72 0.59
SANDWORM_SIM 0.28 0.47 0.00 0.28 0.23
LAZARUS_SIM 0.21 0.36 0.00 0.21 0.18
FALSE_FLAG 0.00 0.00 0.00 0.00 0.00

ACH matrix (C=consistent, I=inconsistent, N=neutral)

Signal SANDWORM_SIM LAZARUS_SIM FALSE_FLAG UNKNOWN
ip:192.0.2.200 N N N C
ttp:T1003 C C N N

Weights

Effective weight of a signal = kind weight x specificity (1 / number of actors it links to); ttp_profile scales the IDF-cosine tradecraft term. Override with --weight kind=value.

kind weight default
code_reuse 0.75 0.75
domain 0.60 0.60
family 0.50 0.50
file_hash 0.90 0.90
imphash 0.60 0.60
ip 0.55 0.55
language 0.15 0.15
mutex 0.40 0.40
rich_header 0.35 0.35
tlsh 0.55 0.55
tool 0.30 0.30
ttp 0.15 0.15
ttp_profile 0.60 0.60
victimology 0.10 0.10
  • none

False-flag indicators

  • none detected

What would raise confidence

  • Any hard (infra/code/exclusive-family) signal corroborating SANDWORM_SIM
  • Independent infrastructure overlap (C2 IP/domain) with a known campaign
  • Code-reuse match in non-trivial, non-public functions
  • Corroboration from an independent reporting source

What would lower confidence

  • Shared infrastructure turns out to be public/shared hosting (CDN, VPS pool)
  • Shared code is shown to be publicly leaked or open-source
  • Hard evidence linking to a different actor

Chain of custody

seq action item sha256 entry_hash
0 ingest EV-F-004 04424c3adf14ddc4... 8cfc6ad753deaad8...
1 assess thin_evidence b4042374143fa9ce... 6e7eb30d69917919...

Attribution is an analytic judgment, not proof. This assessment was generated by a transparent rule-based engine and must be reviewed by a qualified analyst before any action is taken.