How Can Companies Attribute Shared Financial Malware to the Same Actor?
After several companies in the financial industry were affected by a similar incident, they shared information about threat intelligence and the malware used for exploitation. Which of the following should the companies do to best identify whether the attacks are being conducted by the same actor? (Choose two.)
Community Insight
The exam tests threat-actor attribution versus sample-level identification, and the trap is treating reusable IoCs or hashes as proof of the same actor.
Code stylometry and common TTP comparison are the strongest methods for attributing shared financial-sector malware to the same actor. This page explains why IoCs and hashes are weaker attribution signals and confirms the correct pair (A, B).
A common wrong choice is C, Use IoC extractions, because shared IPs, domains, or hashes feel like attribution evidence; however, IoCs are volatile and can be reused or copied by unrelated actors.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Code stylometry examines the author's coding fingerprint—naming conventions, formatting, control-flow choices, and compiler artifacts—so it can link separately compiled malware samples to the same developer or group. Common TTPs, mapped through MITRE ATT&CK, compare the actor's operational behavior: initial access, persistence, privilege escalation, command-and-control, and exfiltration patterns. The question asks whether the attacks come from the same actor, not whether the samples are byte-identical, so these actor-level indicators are the strongest pair. Because the companies shared both threat intelligence and the malware, they have the inputs needed for TTP comparison and code-style analysis.Why the Other Options Are Wrong
Use IoC extractions (C) is a sample- or campaign-level tactic: IP addresses, domains, and other IoCs are volatile and can be shared, reused, or sold, so they do not prove one actor. Verifying malware hashes (F) only confirms an identical file; a rebuilt, packed, or slightly modified variant changes the hash while the actor stays the same. Malware detonation (D) reveals runtime behavior but needs TTP analysis to become attribution evidence and can be defeated by sandbox evasion. Malware decompilation (E) is a reverse-engineering step that supports code stylometry, but decompiled code alone does not establish actor identity.Community Comment Notes
The visible community answer from BWH9492 selects A and B and frames the goal as "Attributing attacks/malware to the same human threat actor". That comment pairs TTPs with MITRE ATT&CK and code stylometry with author fingerprinting, which is exactly the actor-level reasoning the question requires. No substantive comment argues for IoCs or hashes as attribution proof, so the community note reinforces the A/B verdict.Official Reference
Exam Strategy
When a multi-select asks about the same actor, separate actor-level evidence such as code style and TTPs from sample-level evidence such as hashes and IoCs. Select the two that survive malware recompilation and infrastructure changes.
Frequently Asked Questions
Why are malware hashes not enough to attribute attacks to the same actor?
Hashes change whenever malware is rebuilt, packed, or modified, so a match proves only a sample match. Code style and TTPs persist across variants and support actor attribution.
Does decompilation replace code stylometry for actor attribution?
No. Decompilation exposes code for review, but stylometry compares author fingerprints and TTP analysis compares behavior; neither is replaced by decompilation alone.