Threat Group ClassificationHacktivismCybercrimeCyber EspionageUnknownAttributionAttribution ConfidenceThe Attribution ProcessIdentifying Tactics, Techniques, and ProceduresConducting Time-Zone AnalysisAttribution MistakesDon’t Identify Attacker Infrastructure Based on DDNSDon’t Assume Domains Hosted on the Same IP Address Belong to the Same AttackerDon’t Use Domains Registered by Brokers in AttributionDon’t Attribute Based on Publicly Available HacktoolsAttribution TipsBuilding Threat ProfilesConclusion