Between Two Nerds: Attribution is dead, long live attribution
Summary
This episode explores how AI-driven attacks complicate cyber attribution by lowering the cost of bespoke malware and generic tooling. The host discusses antiforensics strategies, noting that while LLMs make unique tools cheaper, attribution may shift from technical artifacts to victimology and tradecraft. They argue that top-tier actors will use AI to scale operations rather than hide, while crime groups rely on branding, meaning attribution remains possible through behavioral patterns and target selection.
Topics discussed
Introduction and sponsor Push Security
Antiforensics framework: data prevention and hiding
Critique of data chaffing and attacker mindset
Attribution relies on the cost of bespoke tooling
K-strategy vs r-strategy in malware development
AI lowers maintenance costs for bespoke tools
Living off the land and generic tooling
LLMs homogenize hacking techniques and signatures
Attribution via tradecraft sequences and branding
Victimology and business models as attribution clues
False flags and geopolitical context in attribution
AI as an augmentative tool for human hackers
Listen ad-free on Castria