Repercussions from the Absence of Threat Actor Taxonomy by Jeffrey Bell
Repercussions from the Absence of Threat Actor Taxonomy by Jeffrey Bell.
Summary
The Naming Problem
Jeffrey Bell argues inconsistent threat-actor naming undermines IOC accumulation and ATT&CK mapping. Without uniform taxonomy, the same actor appears under many aliases—he cites Kim Suuki referenced sixteen different ways across industry reports—fragmenting intelligence sharing.
Threat Actor Categories
Bell groups actors into criminal (financial motives, e.g., Scattered Spider casino breaches), state-sponsored (geopolitical targets including elections, ICS, and research), and hacktivist (ideological, e.g., SiegedSec actions against Heritage Foundation). Overlaps exist, but buckets clarify motive and targeting context.
MITRE ATT&CK as a Shared Language
Using a fictional SOC scenario, he shows vendors like CrowdStrike and Unit 42 independently observing overlapping infrastructure yet struggling to merge attribution. Bell proposes MITRE ATT&CK’s open knowledge base as a neutral framework to align TTPs across naming schemes, improving collective defense without marketing-driven alias proliferation.
Related talks
AUSCERT·38 min
Jack Reis · Cody Meakin · Jon Robertson
Coverage of 20223 - Threat actors are diversifying from the conference program.
37th Annual FIRST Conference·35 min
Industry experts analyze emerging threats surrounding Navigating the Threat Actor Maze: A Tool for Mapping Names, Families and Insights.
Videos·30 min
Honeyyy Trap
Security researchers examine technical aspects of Honeyyy Trap - A Bad Day For A Threat Actor by Dónnan Mallon.