Visualising APT threat actor and tool commonalities

Interactive version at the bottom of the blog post

Recently a data matrix of tool use by Russian threat actors by BushidoUK aka Will Thomas caught my eye. When I see data like this, I immediately want to know:

• How many unique threat actors are there?
• How many unique tools are listed?
• How many tools are in each category?
• Which tools are used by many threat actors, and which are only used by one?
• Which threat actors use the same tools?

Below is a vis.js network visualisation of that data. It's interactive, so give it a try with these notes:

• Threat actors are orange dots.
• Tools are boxes, and linked to the threat actors using them.
• Hover to see connections.
• Tool colour represents tool class.
• Tools used by many actors are near the centre of the graph, those used by one one are on the outside.
• Scroll in and out with your mouse.

Many thanks to Will for this great data set!

Interactive APT tool matrix explorer