CTI Portfolio Part 1: The Threat Actor Profile

This is Part 1 of the CTI portfolio series. The group you pick here is the one you'll keep investigating in the rest of the series, so pick one you won't get sick of!

I would say almost every single CTI interviewer will ask you to tell them about an actor you've tracked, how you did it, and the outcome. A threat actor profile shows you can fulfill the intel lifecycle: plan, research/collect, process messy raw intel, use frameworks to analyze the data, and tell someone what it all means for them. The hardest part: Keeping it below 20 pages. 😅

Picking Your Group

For this first write up, you want a group with LOTS of public reporting so you have more to cite and more chances to compare sources. In the future, we can talk about unclassified, bespoke actors but for right now, stick to the biggies. A few things to check before you commit:

Does it have a MITRE ATT&CK group page? That's a good sign there's enough out there.
Is there a government advisory? CISA, the FBI, NCSC, and friends publish joint advisories that are great primary-ish sources.
Is it still active? A group with reporting from this year gives you fresh infrastructure to pivot on in Part 2.
Do vendors agree on who it is? If a boutique shop says one thing, Dragos says another, and Google disagrees with both of them, pick a different one lol

What Goes in the Profile

Curated Intelligence has a free Threat Actor Profile Guide with a full template, and it's the one I'd use. It's also mentioned in another great "How to write an actor profile" article by Feedly! I definitely suggest using their guide as well. Use all the guides! More data is always better than less, a classic CTI analyst mindset!

Recommended structure:

Executive summary SHORT. Answers What? So what? What now?
About the actor, including an alias table (don't get me started, it just has to be lol threat group naming schemes)
Targets: sectors, regions, how recently, how long they hang around ("dwell time" makes you sound super official)
Diamond Model attributes: adversary, target, capabilities, infrastructure
TTPs in a table: ATT&CK ID, description, observable, source
References, in-line citations or at the very end with supertext, up to you

My Scattered Spider Diamond Model post is a piece of a profile like this, if you want to see one in the wild.

Save your infrastructure notes. Any domains, IPs, or certificates your sources mention, drop them in a separate list (defanged!) with where you found each one. That list is your starting point for Part 2.

Lab 04: Write a Profile in an Hour

The most important thing to consider is your audience. It determines the type of intelligence brief you're writing. For right now, assume the audience is a SOC Director. They're well versed in the cyber threat landscape, the org's defense capabilities, and its gaps. This report is a quick brief to them, explaining a "new" actor, and a high level recommendation of "what now?" Later in the series (Part 4), we'll rewrite this for the execs who DON'T speak cyber.

So let's set a timer, pick a group, and go!! The goal isn't perfection, the goal is a finished first draft.

(10 min) Pick and collect. Choose a group with lots of public reporting. Grab 3–5 sources: a government advisory, a couple of vendor reports, and the group's MITRE ATT&CK page.
(10 min) Alias table. List every name the group goes by and who uses each one.
(15 min) Diamond Model. Fill in adversary, victim, capability, infrastructure. Cite each item.
(10 min) TTP table. Pick 5 techniques. ATT&CK ID, what they actually did, what a defender would see, source.
(10 min) Executive summary. It will go first, but it's always written LAST. Because, how do you summarize what you haven't written? lol It should answer What? So what? What now?
(5 min) Confidence check. Go back through and label anything you inferred.

Then grade yourself:

Could the SOC Director stop after the first paragraph and know what to do?
Does every claim have a source?
Did I separate what's observed from what I'm assessing?
Do my ATT&CK mappings match the behavior in my sources?
Did I say who this is written for?
Are all IOCs defanged?
Is there anything in here from my job? (If yes, take it out!)

Be Ready to Talk About It

If you're like me, talking is hard. People WILL ask you about the brief. I know it's your baby and you worked super hard on it, but some will just not read it. They will just ask you directly about the things you painstakingly wrote down. Trust me. lol Practice answering these things out loud:

If I'm a defender at a company they target, what's the first thing I should do?
Why is this group important to us?
How much of a risk is this group to us?

You'll also get questions about security fundamentals, not just the threat actor. If your profile says a group "abuses OAuth tokens to bypass MFA," expect a follow-up like "okay, how does that work?" You don't need to be a sysadmin, but a few things I've found are beneficial to have a handle on:

Identity: how SSO, MFA, and session tokens work, and the usual ways people get around them (phishing, MFA fatigue, token theft, help desk social engineering)
Where defenders see things: what EDR, firewall, proxy, and identity logs each capture, so your "what a defender would see" column is real

Quick self-check: for every recommendation in your portfolio, could you explain how the control works and why it would have stopped (or caught) the behavior you described? If not, no worries! You can always go read more. The internet is endless and time is an illusion. nvm.

Resources

Next up is Part 2, where we take one domain from your infrastructure list and pivot all the way out. Back to the series hub.