Uncovering ICS Threat Groups

This report explains the concept and analytic purpose of activity groups in intrusion analysis, describing how analysts should construct, validate, evolve, and retire groupings to support questions like attribution, malware authorship, trending, and cross-capability correlation; it warns against indiscriminate cross-vendor naming, recommends using groups to drive efficient mitigations, and notes that models like the Diamond Model and MITRE ATT&CK are complementary tools for analysis.