The document discusses adversary tactics and techniques observed in real-world incidents, emphasizing the evolution of threat groups over time. It highlights the importance of organizing intrusion activities into campaigns for better understanding and context. The takeaways suggest that while adversaries change behavior slowly, introducing structure can improve intelligence analysis.

1. The Adversaries We’ve Met Along the Way
Adam Pennington (@_whatshisface)
MITRE ATT&CK Lead
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.

2. A knowledge base of
adversary tactics and
techniques based on
real-world observations.
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.

3. ©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1. https://attack.mitre.org/groups/

4. The World We’re Used To
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.
Incident
Incident
Incident
Incident
Incident
Incident Incident
Threat Group
APT1337
Angry
Gecko
G0256
Incident
Incident
Incident

5. What We’re Actually Doing
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.
Incident
Incident
Incident
Incident Incident
Threat Group
2008 – Training Wheels
2016 – Competent
Incident
Incident
Incident
Incident
Incident
2023 – 🔥

6. Ransomware is Another Mess
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.
Threat Group
Ransomware-as-a-
Service (RaaS) Operator
RaaS Affiliate
RaaS Affiliate

7. ©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.
Campaign
A grouping of intrusion activity
conducted over a specific
period of time with common
targets and objectives.
https://medium.com/mitre-attack/attack-2022-roadmap-cd5a1a3387c7

8. A Threat Group Into Campaigns
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.
Incident
Incident
Incident
Incident
Incident
Incident Incident
C0154/Solorigate
C0199/GRIZZLY STEPPE
C0155/PowerDuke
G0016
APT29
Incident
Incident
Incident

9. Takeaways
Adversaries change behavior slowly, but even
with slow change can completely transform
Building long term threat groups can be useful,
but can make a mess of our intel
Introducing a bit of structure can get us back
some of the context we’ve lost along the way
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.

10. https://attack.mitre.org
attack@mitre.org
Adam Pennington
@_whatshisface
©2023 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 23-00696-1.