THREAT ACTOR PATTERNS · PATTERN EXTRACTION

Patterns, not attribution.

Paste an incident description, threat report, or after-action writeup. Card 10 extracts six categories of tradecraft pattern: TTPs observed, tooling fingerprints, targeting profile, operational tempo, attribution considerations (what aids or complicates), and gaps. The output does not name an APT group or nation-state. It structures what the writeup contains so you can investigate.

PASTE

One incident or report per run. After-action, news writeup, vendor blog, IR notes.

FRAME

Add a one-line context note if the source needs framing.

REVIEW

Six categories of patterns with quoted evidence, diagnosticity, and the analyst action for each.

REDLINE

Investigate the patterns. Send the structured redline to the Intel Publisher.

CARD 10 · THREAT ACTOR PATTERN EXTRACTION

Tradecraft pattern, not the actor.

The model extracts the diagnostic pattern an incident exhibits: TTPs, tooling, targeting, tempo, and what would help (or complicate) attribution. It does not assign the activity to a named APT group, financial-crime crew, or nation-state. Naming is for the analyst, with sourcing this dashboard cannot provide.

REMINDER: Output is a structured pattern extract, not an attribution. Do not paste classified material, ongoing-investigation IOCs, or victim PII you cannot lawfully share. Do not treat any pattern flagged here as proof of a specific actor.

I confirm this report is publicly available or lawfully in my possession, and I will treat the output as a structured redline.