How Can Companies Attribute Shared Financial Malware to the Same Actor?

CA1-005 By islever Editorial Last updated

Given a scenario, apply threat-hunting and threat intelligence concepts.

Short answer

AB Apply code stylometry and compare common TTPs to determine whether the same threat actor is behind the shared malware and attacks.

Question

After several companies in the financial industry were affected by a similar incident, they shared information about threat intelligence and the malware used for exploitation. Which of the following should the companies do to best identify whether the attacks are being conducted by the same actor? (Choose two.)
  1. Apply code stylometry. Correct Answer
  2. Look for common TTPs. Correct Answer
  3. Use IoC extractions.
  4. Leverage malware detonation.
  5. Perform malware decompilation.
  6. Verify malware hashes.

Key Takeaways

The exam tests threat-actor attribution versus sample-level identification, and the trap is treating reusable IoCs or hashes as proof of the same actor.

Code stylometry and common TTP comparison are the strongest methods for attributing shared financial-sector malware to the same actor. This page explains why IoCs and hashes are weaker attribution signals and confirms the correct pair (A, B).

Common mistake: A common wrong choice is C, Use IoC extractions, because shared IPs, domains, or hashes feel like attribution evidence; however, IoCs are volatile and can be reused or copied by unrelated actors.

Expert Analysis

Why the Answer Is Correct

Code stylometry examines the author's coding fingerprint—naming conventions, formatting, control-flow choices, and compiler artifacts—so it can link separately compiled malware samples to the same developer or group. Common TTPs, mapped through MITRE ATT&CK, compare the actor's operational behavior: initial access, persistence, privilege escalation, command-and-control, and exfiltration patterns. The question asks whether the attacks come from the same actor, not whether the samples are byte-identical, so these actor-level indicators are the strongest pair. Because the companies shared both threat intelligence and the malware, they have the inputs needed for TTP comparison and code-style analysis.

Why the Other Options Are Wrong

Use IoC extractions (C) is a sample- or campaign-level tactic: IP addresses, domains, and other IoCs are volatile and can be shared, reused, or sold, so they do not prove one actor. Verifying malware hashes (F) only confirms an identical file; a rebuilt, packed, or slightly modified variant changes the hash while the actor stays the same. Malware detonation (D) reveals runtime behavior but needs TTP analysis to become attribution evidence and can be defeated by sandbox evasion. Malware decompilation (E) is a reverse-engineering step that supports code stylometry, but decompiled code alone does not establish actor identity.

Community Comment Notes

The visible community answer from BWH9492 selects A and B and frames the goal as "Attributing attacks/malware to the same human threat actor". That comment pairs TTPs with MITRE ATT&CK and code stylometry with author fingerprinting, which is exactly the actor-level reasoning the question requires. No substantive comment argues for IoCs or hashes as attribution proof, so the community note reinforces the A/B verdict.

Official Reference

https://attack.mitre.org/

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a multi-select asks about the same actor, separate actor-level evidence such as code style and TTPs from sample-level evidence such as hashes and IoCs. Select the two that survive malware recompilation and infrastructure changes.

Frequently Asked Questions

Why are malware hashes not enough to attribute attacks to the same actor?

Hashes change whenever malware is rebuilt, packed, or modified, so a match proves only a sample match. Code style and TTPs persist across variants and support actor attribution.

Does decompilation replace code stylometry for actor attribution?

No. Decompilation exposes code for review, but stylometry compares author fingerprints and TTP analysis compares behavior; neither is replaced by decompilation alone.

More CA1-005 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. BWH9492 👍 1
    Attributing attacks/malware to the same human threat actor TTPs (MITRE ATT&CK) & Code Stylometry (Author Fingerprinting).

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Are the Key Design Considerations When Merging OT and Unmanaged IoT?

S-grade

Which two controls best reduce unauthorized BYOD access risk?

S-grade

How to Reduce IaC Deployment Failures in a CI/CD Pipeline?

S-grade

Which Sources Best Support SIEM False Positive and Negative Analysis?

A-grade

← Back to CA1-005 Study Guide