Southampton Builds a Malware Tracker That Knows When to Stay Silent

When a cyberattack hits, one of the first questions defenders ask is: who did this? Attributing an intrusion to a specific Advanced Persistent Threat (APT) group , a state-sponsored or highly organized hacking collective , can change everything about how you respond. It shapes which countermeasures you deploy, which threat intelligence you pull, and how urgently you escalate. Malware is one of the richest sources of attribution evidence, since APT groups tend to reuse tooling, code fragments, and operational patterns across campaigns. But automating that attribution reliably has remained a stubborn open problem.

A new paper from researchers at the University of Southampton, "High-Precision APT Malware Attribution with Out-of-Scope Resilience", tackles the core reason existing systems fail in practice: they are trained to always give an answer, even when they shouldn't.

The Closed-Set Trap

Automated attribution is typically treated as a closed-set classification problem, where a classifier is trained on samples previously associated with known adversaries by expert analysts, and is then used to classify unseen samples into one of those known groups. That sounds reasonable , until you consider what happens in the real world.

This approach is problematic in operational environments, where defenders may encounter malware from out-of-scope (OOS) groups , APT groups that were not included in the training data. Existing closed-set approaches are typically not designed or evaluated for this setting, limiting their practical applicability. The result is that a model trained on 12 known APT groups, when it encounters malware from a 13th group it has never seen, will confidently assign it to one of the 12 it does know. That's not just a wrong answer , it can be a dangerous one.

The paper illustrates this vividly: when the Gorgon Group was excluded from training, many of its 193 samples were misclassified as APT28 or APT29. MITRE ATT&CK describes the Gorgon Group as suspected to be Pakistan-based, whereas APT28 and APT29 are suspected to be Russia-based. Misattributing a Pakistani threat actor as Russian isn't a minor error , it points defenders at entirely the wrong geopolitical context, threat playbooks, and response strategies.

The scale of the problem is growing. Kaspersky estimates that the number of APTs increased by 74% between 2023 and 2024 and affected 25% of companies. Additional market data suggests that 80% of attacks remain undetected for at least six months, by which time 48% of affected organisations have already suffered significant damage. Faster, more reliable automated attribution is not a nice-to-have.