Identification of the malicious group’s digital trace using cryptography tools

Abstract

Every year, information about a new data leak or compromise of a public or private organization becomes more commonplace in everyday life. The most dangerous and effective in this field are special hacker groups whose funding is associated with special government agencies or services. The study of the activities of these groups has led to identification of each unique method (or tactics, techniques and procedures - TTP) and systematization of the findings. The advantage of creating a digital fingerprint of APT groups is to quickly identify similarities in TTPs and compare these intervention attempts with known groups or compare the means of existing groups with new ones for which there is little information.