Threat Actor Profiling

Most cyberattacks go unattributed-not because the evidence is missing, but because analysts lack a structured methodology for turning raw OSINT into a defensible conclusion. This book changes that.

Threat Actor Profiling delivers the PAP Framework-Pivot, Attribute, Profile-a repeatable three-stage investigation methodology used by senior CTI analysts to build confirmed threat actor attributions from a single starting indicator.

Every chapter builds one component of the complete investigation stack: adversary infrastructure mapping through passive DNS, WHOIS pivoting, and TLS certificate fingerprinting; behavioral fingerprinting with MITRE ATT&CK at the sub-technique level; multi-tool investigation chains connecting Maltego, Shodan, SpiderFoot, and VirusTotal; structured pivot methodology that distinguishes meaningful linkages from coincidental associations; attribution confidence scoring using the Diamond Model and an adapted Admiralty Grading System; and automated Python pipelines for continuous actor monitoring at scale.

Real case studies appear throughout as worked examples of the methodology:

• SolarWinds and APT29, where behavioral TTP correlation confirmed attribution that infrastructure mapping alone could not;
• Lazarus Group's LinkedIn social engineering campaign, showing the complete pivot chain from a suspicious profile to confirmed C2 infrastructure;
• Sandworm's KMS activator malware, illustrating ATT&CK fingerprint comparison across two campaigns separated by three years;
• and the TV5Monde CyberCaliphate false flag, demonstrating how structured confidence scoring catches what intuitive attribution misses.