Attribution: how states name the perpetrators of cyber attacks

What attribution is

Attribution means identifying who is responsible for a cyber attack. In its conclusions of 19 June 2017 the Council of the EU put it plainly: attributing an attack to a state or a non-state actor remains a sovereign political decision based on all-source intelligence (see all-source intelligence).¹

There is therefore no single international arbiter that decides who attacked. The EU's 2019 decision on sanctions against cyber attacks recalls, in recital 9, that each member state makes its own determination as to whether to attribute an attack to a third state, case by case.⁴

Assessment is made harder by perpetrators covering their tracks. According to the UK government, the NotPetya attack of June 2017 masqueraded as a criminal enterprise, although its main aim was disruption. And during the attack on the 2018 Winter Olympics in Pyeongchang, Russian military intelligence's cyber unit tried to pass itself off as North Korean and Chinese hackers – a textbook false flag.^2,5

From incident analysis to a government statement

Before any state is named, a technical team examines the incident. In Poland, reports are received and handled by CSIRT teams. A good example is the statement of 13 April 2023: the Military Counterintelligence Service and CERT Polska (CSIRT NASK) described an espionage campaign aimed mainly at foreign ministries and diplomatic missions in NATO and EU countries, published analyses of the tools and a list of indicators, and described the perpetrator cautiously – as an “espionage campaign linked to Russian intelligence services”.⁶

The same statement shows how technical analysis is combined with earlier knowledge in practice: according to the SKW and CERT Polska, elements of the campaign overlapped in part or in full with activity that Microsoft called NOBELIUM and Mandiant called APT29. Group names are given by companies and researchers; they are not the official names of units.⁶

The last step is political. On 15 February 2018 the UK Minister for Cyber Security, Lord Ahmad of Wimbledon, announced that the government judged the Russian government, specifically the Russian military, to have been responsible for NotPetya. The statement also promised stronger coordinated international efforts.²

How certainty is worded: the language of intelligence assessments

Attribution statements rarely say “certainly”. In the United States the rules for writing assessments are set by ODNI Intelligence Community Directive 203 (ICD 203) on analytic standards, signed by James R. Clapper on 2 January 2015. It requires analysis to indicate and explain the basis for the uncertainties of major judgments, to describe the quality and credibility of sources, and to distinguish clearly between information, assumptions and judgments.³

ICD 203 includes a likelihood scale with percentage ranges: from “almost no chance” (1–5%) through “roughly even chance” (45–55%) to “almost certain(ly)” (95–99%). Analytic confidence is something else: it concerns the logic and evidence on which an assessment rests. The directive stipulates that the two measures are not combined in the same sentence.³

In the UK a similar role is played by the probability yardstick described by the Intelligence Analysis profession (publication of 24 March 2025): “almost certain” means roughly 95% to under 100%, and “realistic possibility” roughly 40% to under 50%. According to that document, analytical confidence reflects how sound and stable the foundations of the likelihood assessment are.⁷

Both UK statements on Russian military intelligence use this language: the NCSC assessed that the Russian military was “almost certainly” responsible for NotPetya, and in 2020 – with high confidence – that the attacks on the Olympic Games were “almost certainly (95%+)” the work of the GTsST unit.^2,5

Attribution and sanctions: the EU toolbox

In 2017 the Council of the EU adopted a framework for a joint diplomatic response to malicious cyber activities, known as the cyber diplomacy toolbox. It includes Common Foreign and Security Policy measures, restrictive measures if necessary, which must be proportionate to the scale and impact of the attack. The conclusions point out that not every step requires attribution.¹

The legal basis for EU sanctions against cyber attacks is Council Decision (CFSP) 2019/797 of 17 May 2019. It covers attacks with a significant effect, including attempted ones, consisting of unauthorised access to information systems, interference with a system or data, or data interception. Whether the effect is significant depends on factors such as the scope of disruption, the number of people and member states affected, economic loss and the nature of the data stolen.⁸

Recital 9 of the decision separates sanctions from attribution: imposing restrictive measures on persons and entities does not amount to attributing responsibility to a third state.⁴

The Council imposed its first sanctions on 30 July 2020 (Decision 2020/1127): on six individuals and three entities, with a travel ban and an asset freeze, in connection with the attempted attack on the OPCW and the attacks known as WannaCry, NotPetya and Operation Cloud Hopper.⁹

The annex to the decision lists, among others, the Main Centre for Special Technologies (GTsST) of the GRU, also known by its field post number 74455, in connection with NotPetya and the attacks on a Ukrainian power grid in the winter of 2015 and 2016; it states that NotPetya was carried out by the actor publicly known as Sandworm. For the North Korean entity Chosun Expo, the attacks listed include those against the Polish Financial Supervision Authority.¹⁰

Indictment: attribution in court

The third route is criminal proceedings. On 19 October 2020 the US Department of Justice announced that a federal grand jury in Pittsburgh (Western District of Pennsylvania) had indicted six officers of GRU Unit 74455. The charges concern, among other things, attacks on Ukraine's power grid, the 2017 French elections, NotPetya, the Olympic Destroyer attack on the Pyeongchang Games, and activity against the OPCW and the UK's DSTL laboratory.¹¹

An indictment is not a verdict. The Department of Justice itself notes that the charges are merely accusations and that the defendants are presumed innocent. The announcement thanked, among others, the authorities of Ukraine, South Korea, New Zealand and Georgia, the UK's intelligence services, and technology companies.¹¹

On the same day the UK government published its own assessment of the attacks on the Games and noted the charges brought by the Department of Justice. Two states thus announced their findings in parallel, each in a different form.⁵

Poland: statements, sanctions, solidarity

Poland uses the same tools. On 31 July 2020 the Ministry of Foreign Affairs published a notice on the first EU sanctions against cyber attacks.⁹

On 3 May 2024 the Ministry issued a statement on Russia's malicious behaviour in cyberspace. It expressed solidarity with Germany and Czechia, which had publicly attributed to the APT28 group a campaign targeting their political parties and democratic institutions, described APT28 as controlled by the Russian Federation, and stated that Poland had also been among its targets.¹²

In this statement Poland did not present its own analysis of the attacks on Germany and Czechia; it expressed solidarity with the states that had announced the attribution. In the 2023 campaign, by contrast, Polish institutions described the incident themselves and pointed to the link with Russian intelligence services.^6,12

How to read an attribution statement

A few questions help. Who is speaking – a government, an intelligence service, a CSIRT, the Council of the EU or prosecutors? What scale of certainty is used – “almost certainly” or “linked to”? Is it attribution to a state, sanctions on persons and entities, which under EU law are not attribution, or an indictment, which is only a charge?^3,4,11

It also helps to distinguish the name of a unit from the name of a group. The GTsST is a GRU unit named in the Council decision; “Sandworm” or “APT28” are names in public use that government documents take over from researchers' descriptions. SpyOps.pl names the perpetrators of cyber attacks only on the basis of official attributions by governments and EU bodies, with a date – as in the NotPetya card.^10,12