SPYOPS.PL

Search /

SpyOps.pl › Maps › Attributing a cyber attack: from incident to naming the culprit

Concept map

Attributing a cyber attack: from incident to naming the culprit

Eight steps from detecting an incident to publicly naming the culprit and the response of states. This is a summary of the article on attribution in the Cyber section, which has the full discussion, examples and differing views.1,2,3,4,5,6,7,8,9

  1. Incident

    It all starts with an event that has or may have an adverse effect on the security of systems – that is how the Polish Act on the National Cybersecurity System defines an incident.

  2. Reporting and handling

    Reports go to CSIRT teams; in Poland, CSIRT GOV, CSIRT MON and CSIRT NASK work at national level. Incident handling means detecting, recording, analysing, classifying and removing the incident and limiting its effects.

  3. Technical analysis

    Analysts examine the tools and traces of the attack. On 13 April 2023 the SKW and CERT Polska published analyses of three tools used in an espionage campaign and a list of indicators of compromise. They also compared parts of it with activity that companies describe as NOBELIUM and APT29.

  4. Masking the culprit

    Attackers cover their tracks. According to the UK government, NotPetya masqueraded as a criminal enterprise, and during the attack on the Pyeongchang Games a GRU cyber unit tried to pass itself off as North Korean and Chinese hackers – a false flag.

  5. Intelligence assessment

    Technical work is not everything. The Council of the EU stresses that attribution rests on all-source intelligence (all-source intelligence). Certainty is expressed on a scale: in the US directive ICD 203, ‘almost certain’ means 95–99%.

  6. Political decision

    According to the Council of the EU, attribution remains a sovereign political decision. On 15 February 2018 the UK government announced that the Russian Government, specifically the Russian military, was responsible for NotPetya; the UK’s NCSC assessed this as ‘almost certain’. Polish institutions were more cautious about the 2023 campaign, describing it as ‘linked to’ Russian special services.

  7. Sanctions

    One response is EU cyber sanctions, part of the EU’s cyber diplomacy toolbox. In 2020 they covered, among others, the GRU unit GTsST in connection with NotPetya. According to the Council decision, however, imposing sanctions does not amount to attributing responsibility to a third state.

  8. Indictment

    Another route is criminal proceedings. In October 2020 the US Department of Justice announced the indictment of six officers of GRU Unit 74455, among other things over NotPetya. A charge is not a verdict: the defendants are presumed innocent. The full discussion is in the article ‘Attribution: how states name the perpetrators of cyber attacks’.

Sources

  1. Sejm of the Republic of Poland, Act on the national cybersecurity system, consolidated text, Journal of Laws 2026, item 20, as amended (consolidated text prepared by the Chancellery of the Sejm) (in Polish)
  2. Military Counterintelligence Service and CERT Polska (Gov.pl portal, Knowledge base), Espionage campaign linked to Russian intelligence services, 13 April 2023
  3. UK Government (Foreign Office), Foreign Office Minister condemns Russia for NotPetya attacks, 15.02.2018
  4. UK Government (FCDO), UK exposes series of Russian cyber attacks against Olympic and Paralympic Games (press release), 19.10.2020
  5. Council of the European Union, Draft Council Conclusions on a Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities (‘Cyber Diplomacy Toolbox’), doc. 10474/17, adopted 19 June 2017
  6. Office of the Director of National Intelligence (USA), Intelligence Community Directive 203: Analytic Standards, 2 January 2015 (Federation of American Scientists copy)
  7. Sara Poli, Emanuele Sommario, The Rationale and the Perils of Failing to Invoke State Responsibility for Cyber-Attacks: The Case of the EU Cyber Sanctions, German Law Journal, 2023 (quotes recital 9 of Decision 2019/797)
  8. Council of the European Union, Council Decision (CFSP) 2020/1127 of 30 July 2020 – recitals and annex (legislation.gov.uk copy)
  9. US Department of Justice, Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace, 19 October 2020

Checked: 6 November 2026