Tracking, analyzing, interpreting and mitigating constantly evolving IT security threats is a massive undertaking.
Threat intelligence has true value beyond the current hype of an emerging pocket in the information security
industry and threat attribution is probably the most prominent point of interest and contention when it comesto threat intelligence.
Product highlights:• Provides instant access to a repositoryof curated data about hundreds of APT
actors and samples• Allows efficient automated or manual
threat prioritization and alert triage• Functionality to add private actors andsamples, educating the product to detectsamples that are similar to files in yourprivate collection• Manual sample upload and an enhanced
REST API for integration with automatedworkflows• Can be deployed in a secure, air-gappedenvironment to protect your systems anddata as well as meeting any compliancerequirements• Supports deployment on Amazon Web
Services (AWS) enabling quick productsetup and saving costs as you don’t needto invest in hardware upfront• Export to YARA rules fur further
automated search/scanning for similar
files or integration with third-partysolutions• Export to STIX 2.1 format (TXT and JSON
formats are also supported) for further
automated analysis of security logs orintegration with third-party solutions/security controls

And it has a clear reason for that. An average time from detection to response ofhighly sophisticated threats is usually too long due to complex investigation andreverse engineering processes. In many cases it is enough for the attackers to reach
their goals. Correct and timely attribution helps not only to shorten incident response
times from hours to minutes but also reduce the number of false positives.
Identifying a targeted attack, profiling the attackers and creating attribution factors
for the different threat actors is long and thorough job; it can take years. The creating
working attribution also requires the big amount of accumulated data since years aswell as highly-skilled team of researchers with the investigation experience. In common,researchers follow the activity of different groups and populate the database withthe bits of information. And the database become a valuable resource that can beshared as a tool.
Kaspersky Threat Attribution Engine incorporates the database of APT malware
samples and clean files gathered by Kaspersky experts for the last 22 years. We track
600+ threat actors and campaigns with 120+ APT Intelligence reports released everyyear. Our ongoing research supports the actuality of the large APT collection whichcontains 60K+ files. It improves the false flags detection and make the attribution as
much accurate as possible using the automated tools.
The product enables the unique approach for comparing samples for their similarity
while ensuring zero false positive rates. It can quickly link a new attack to known APTmalware, previous targeted attacks and hacker groups, helping to see the high-riskthreat among less serious incidents and take timely protective measures to preventan attacker from gaining a foothold in the system.

How it works
Kaspersky Threat Attribution Engine analyzes the “genetics” of malware looking forcode similarity with previously investigated APT samples and linked actors in anautomated way. It compares the “genotypes”, i.e. small binary pieces of the decomposed
files, with the APT malware samples database and provides a report on malware origin,threat actors and file similarity with known APT samples. Moreover, the product allows
security teams to add private actors and objects to its database and educate theproduct to detect samples that are similar to files in your private collection. With theThreat Attribution Engine the attribution process only takes seconds comparing to theyears it was required in the past.
The product can be deployed in a secure, air-gapped environment restricting any
3rd party from accessing the processed information and submitted objects. There is an
API interface to connect the Engine to other tools and frameworks in order toimplement attribution into existing infrastructure and automated processes.

New APT and clean files genotypes (Updates)

Attribution EngineDNA Extractor

DNA MatcherSAMPLE

Kaspersky Threat Attribution Engine
Detailed information about the related APT actor can be found in Kaspersky APTIntelligence reports1. As a subscriber to Kaspersky APT Intelligence Reporting, we
provide you with unique ongoing access to our investigations and discoveries, including
full technical data, provided in a range of formats, on each APT as it’s revealed,
including all those threats that will never be made public.
1A subscription to Kaspersky APT Intelligence
Reporting needs to be purchased separately

Kaspersky Threat Attribution Engine further extends and strengthens the Kaspersky
portfolio for national cybersecurity agencies and commercial Security Operations Centers(SOCs) by supporting them in establishing an effective incident management process.
Kaspersky Attribution Engine significantly improves security operations helping to:• Rapidly attribute files to known APT actors to reveal motivations, methods and tools
behind cyber incidents;• Quickly evaluate if you are the target of attack or a side victim to setup proper
containment and response procedures;• Ensure effective and timely threat mitigation according to actionable threat
intelligence on the APT family provided in Kaspersky APT Intelligence Reporting.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business
IT Security for Enterprise: kaspersky.com/enterprisewww.kaspersky.com
2021 AO Kaspersky Lab.
Registered trademarks and service marks are the propertyof their respective owners.

We are proven. We are independent. We aretransparent. We are committed to building a safer
world, where technology improves our lives. Whichis why we secure it, so everyone everywhere has theendless opportunities it brings. Bring on cybersecurity
for a safer tomorrow.
Know more at kaspersky.com/transparency