Lion Cipher Lab
Write a threat-actor profile
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
A defender who only ever sees single alerts is fighting blind. The teams that stay ahead ask a bigger question: WHO keeps doing this to organisations like ours, and how do they operate? A threat-actor profile answers exactly that. It takes a named group of attackers and turns the scattered public reporting about them into one structured document a real security team can use: to recognise the group's fingerprints when they appear, to prioritise the defences that matter most against this specific adversary, and to brief leadership on a threat in language that is honest about how much is…
What you'll learn
- structuring a threat-actor profile: aliases, motivation, targeted sectors, TTPs, campaigns, takeaways
- reading a MITRE ATT&CK Groups page and pulling aliases, techniques, and campaigns from it
- using the Diamond Model (adversary, capability, infrastructure, victim) to organise what you find
- mapping a group's behaviour to ATT&CK tactics and technique IDs (TTP mapping)
- finding and judging reputable OPEN sources: MITRE ATT&CK, government advisories, vendor reports
- writing hedged, probabilistic attribution language instead of stating guilt as fact
- turning a profile into concrete detection and mitigation takeaways a defender can act on
Steps in this lab
- The words first: threat actor, threat group, TTP, campaign, attribution
- Your two scaffolds: the Diamond Model and MITRE ATT&CK
- Open sources only: where reputable public reporting lives
- Pick a well-documented group — and untangle its aliases
- Suspected motivation and targeted sectors (the Victim corner)
- Map the TTPs to ATT&CK (the Capability corner, in shared words)
- Notable campaigns (the group's greatest hits, with dates)
- Detection and mitigation takeaways (make it useful today)
- The copyable profile template — fill it in end to end
- Say it honestly: attribution is probabilistic, so hedge it