Automatically Attributing Mobile Threat Actors by Vectorized ATT&CK Matrix and Paired Indicator

Area of Science:

• Cybersecurity
• Mobile Security
• Threat Intelligence

Background:

• Mobile devices are increasingly targeted by Advanced Persistent Threat (APT) groups.
• Smartphones store sensitive data, making them attractive targets for cyberattacks.
• Existing research lacks focus on automated cyber attribution for mobile threats.

Purpose of the Study:

• To develop an automated system for cyber attribution of mobile threats.
• To leverage MITRE's ATT&CK for mobile framework for analysis.
• To improve the accuracy of identifying threat actors behind mobile attacks.

Main Methods:

• Utilized MITRE's ATT&CK for mobile framework to analyze tactics, techniques, and procedures (TTPs).
• Developed an automated system for cyber attribution.
• Compared indicators of compromise (IoCs) to reduce false flags.
• Analyzed 12 threat actors and 120 malware samples.

Main Results:

• Successfully developed and tested an automated cyber attribution system for mobile threats.
• Demonstrated a reduction in false flags through IoC comparison.
• Provided a method for attributing mobile malware to specific threat actors.

Conclusions:

• The automated system effectively attributes mobile cyber threats.
• The approach enhances the accuracy of threat intelligence.
• This research contributes to understanding and mitigating APT activities on mobile platforms.