As Christiaan Beek, Rapid7’s Vice President of Cyber Threat Intelligence, noted, an operation that resembles ransomware is likely to be treated as cybercrime before investigators recognize the involvement of a nation-state.
Attribution shapes more than threat intelligence reporting, it influences incident response, legal obligations, government notification requirements, intelligence sharing, and in some cases, diplomatic or military decisions.
Governments are placing greater emphasis on offensive cyber operations, coordinated responses, and public attribution of malicious activity.
If attribution can be manufactured on demand, who’s actually deciding what happens next: the analyst, or the actor who scripted the frame?
He currently works as an Information Security Analyst at EXL, where he focuses on threat intelligence, supporting proactive vulnerability remediation, OSINT, and incident response.