Technical Summary: Synthetic APTs and the Collapse of TTP-Based Attribution

Problem Statement

Cyber Threat Intelligence (CTI) attribution traditionally relies on identifying the Tactics, Techniques, and Procedures (TTPs) unique to specific Advanced Persistent Threat (APT) groups. This model presupposes that adversaries leave distinct operational fingerprints based on their preferred toolkits and behavioral patterns. However, as AI-driven cyber operations become prevalent, there is a critical question regarding whether AI agents can be configured to emulate any APT group using a shared underlying toolset. If AI agents converge on similar techniques regardless of their assigned persona, the distinctiveness required for TTP-based attribution may collapse, rendering attribution significantly harder or impossible.

Methodology

The authors evaluated this hypothesis using their Cybersecurity SuperIntelligence (CSI) framework, deploying AI-driven agents in a controlled, dynamic cyber range environment.

• Experimental Design: The study consisted of 20 experiments across two distinct scenarios provided by CYBER RANGES:
  • Scenario A (Enterprise): A flat network topology modeling a technology company (~20 hosts).
  • Scenario B (Military): A segmented, dual-organization critical infrastructure topology (~15 hosts) with strict network isolation.
• Agents:
  • Attackers: Five distinct APT profiles (APT28, APT29, APT41, APT44, and Lazarus Group) were configured using system prompts derived from their official MITRE ATT&CK documentation. All attacker agents utilized the Anthropic Claude Opus 4.6 model.
  • Defenders: Two defender models were tested: Opus 4.6 (same-model confrontation) and alias2-mini (a ~30B-parameter on-premise model developed by the authors).
• Procedure:
  • Defenders were deployed 30 minutes prior to attackers to simulate a "grace period" for hardening (credential rotation, firewall rules).
  • Agents operated concurrently for approximately 6 hours.
  • Experiments measured three dimensions: Operational Outcome (hosts compromised), MITRE ATT&CK Adherence (fidelity to assigned profiles), and Stealth (time-to-detection).
• Evaluation Metrics:
  • Fidelity: Precision (observed techniques matching the official profile) and Recall (fraction of the profile exercised).
  • Convergence: Analysis of whether different profiles produced identical initial-phase behaviors.

Key Contributions

1. First Controlled Empirical Data on AI Attribution: This work provides the first experimental evidence quantifying the convergence of attack techniques when distinct APT personas are driven by the same AI model on identical infrastructure.
2. Phase-Dependent Fidelity: The study demonstrates that emulation fidelity is not uniform; it is heavily gated by kill chain progression. High fidelity (55–80% precision) is only observed when attackers successfully penetrate deep into the network (Scenario A), whereas containment at the perimeter (Scenario B) results in low fidelity (4–8%).
3. Emergent Convergent Behaviors: The research identifies specific behaviors that emerge independently across all profiles, most notably the weaponization of the defender's own Velociraptor endpoint management platform as a Command-and-Control (C2) channel. This behavior was not encoded in any threat intelligence profile.
4. Topology as the Dominant Determinant: The study establishes that network topology, rather than attacker profile or defender model scale, is the sole determinant of strategic outcomes in AI-driven emulation.

Results

Operational Outcomes

A binary pattern emerged across all 20 experiments:

• Scenario A (Enterprise): All 10 experiments resulted in compromise, with attackers gaining access to 2–12 hosts. The attacker model (Opus 4.6) consistently succeeded regardless of the APT profile or the defender model used.
• Scenario B (Military): All 10 experiments were successfully defended or resulted in stalemates. Network segmentation (VLANs, gateways) contained attackers at the perimeter, resulting in zero or marginal compromise regardless of the APT profile or defender model.

MITRE ATT&CK Adherence

• Initial Phase Convergence: In all 20 experiments, regardless of the assigned APT profile, agents converged on identical initial-phase techniques: active scanning (T1595), network service discovery (T1046), and credential brute force (T1110).
• Differentiation: Profile-specific behaviors (e.g., Pass-the-Hash for APT28, DCSync for APT29, PAM interception for APT41) only emerged in Scenario A where the kill chain progressed to later stages.
• Precision: In successful Scenario A experiments, observed techniques matched official profiles with 55–80% precision. However, 8 out of 10 Scenario A experiments exhibited a convergent behavior (Velociraptor weaponization) that did not map to any specific group's profile.

Stealth and Detection

• Detection Time: Detection times varied widely (8 minutes to >2 hours), but detection was a poor predictor of outcome. Fast detection did not prevent compromise in Scenario A, while slow or non-existent detection in Scenario B did not lead to compromise due to topology.
• Emergent Stealth: Attackers in Scenario A frequently hijacked the Velociraptor platform using pre-configured credentials. This allowed them to execute commands through a trusted management channel, rendering their activity invisible to network-level detection.
• Defensive Failure: The most critical defensive failure was the failure to rotate pre-configured credentials on security tools. In every instance where these were not rotated, attackers weaponized them.

Significance and Claims

The paper argues that the entry barrier for operating like a nation-state APT has collapsed in the AI era. The key implications are:

1. Undermining TTP-Based Attribution: Because AI agents driven by the same model and toolset converge on identical initial-phase techniques and generate novel, undocumented convergent behaviors (like Velociraptor weaponization), defenders cannot distinguish between different APT groups based on early kill chain indicators.
2. The "Floor" vs. The "Fingerprint": The documented MITRE ATT&CK profile shifts from being a unique fingerprint identifying a specific actor to a "floor" describing what any AI agent can reproduce. An actor from any nation could deploy an AI agent configured with another nation's profile and produce indicators consistent with that group at 55–80% precision without specialized tradecraft.
3. Geopolitical Consequence: This convergence makes false-flag operations trivially accessible to any actor with access to AI models, potentially destabilizing the attribution mechanisms that underpin sanctions and diplomatic responses.
4. Defensive Priorities: The study suggests that network segmentation and moving target defenses (specifically credential rotation) are more effective against AI-driven attacks than real-time AI-driven detection and response. Model scale (e.g., 30B vs. frontier models) had negligible impact on strategic outcomes compared to network architecture.

The authors conclude that while AI-driven emulation can reproduce specific APT tradecraft at later stages, the standardization of initial phases and the emergence of convergent behaviors fundamentally challenge the viability of traditional TTP-based attribution.