{"id":"https://openalex.org/W7163924320","doi":"https://doi.org/10.48550/arxiv.2606.07158","title":"Synthetic APTs: the Collapse of TTP-Based Attribution","display_name":"Synthetic APTs: the Collapse of TTP-Based Attribution","publication_year":2026,"publication_date":"2026-06-05","ids":{"openalex":"https://openalex.org/W7163924320","doi":"https://doi.org/10.48550/arxiv.2606.07158"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.07158","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.07158","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.07158","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138136943","display_name":"Francesco Balassone","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Balassone, Francesco","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004023951","display_name":"V\u00edctor Mayoral-Vilches","orcid":"https://orcid.org/0000-0001-8308-3363"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mayoral-Vilches, V\u00edctor","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138192966","display_name":"Mar\u00eda Sanz-G\u00f3mez","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sanz-G\u00f3mez, Mar\u00eda","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138171310","display_name":"Paul Zabalegui-Landa","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zabalegui-Landa, Paul","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138148272","display_name":"Stefan Rass","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rass, Stefan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138135369","display_name":"Davide Quarta","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Quarta, Davide","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138121791","display_name":"Daniel Sanchez-Prieto","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sanchez-Prieto, Daniel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138161452","display_name":"Marina Oteiza-\u00c1lvarez","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Oteiza-\u00c1lvarez, Marina","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077902181","display_name":"Almerindo Graziano","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Graziano, Almerindo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138191564","display_name":"Lauren Young-Gi Kim","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kim, Lauren Min","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138109660","display_name":"MinSeok Choi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Choi, MinSeok","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12572","display_name":"Intelligence, Security, War Strategy","score":0.22709999978542328,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T12572","display_name":"Intelligence, Security, War Strategy","score":0.22709999978542328,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12888","display_name":"Military Strategy and Technology","score":0.20100000500679016,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.10050000250339508,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.8086000084877014},{"id":"https://openalex.org/keywords/compromise","display_name":"Compromise","score":0.580299973487854},{"id":"https://openalex.org/keywords/emulation","display_name":"Emulation","score":0.5216000080108643},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.4203999936580658},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.420199990272522},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.41659998893737793},{"id":"https://openalex.org/keywords/attribution","display_name":"Attribution","score":0.3718999922275543},{"id":"https://openalex.org/keywords/cyberwarfare","display_name":"Cyberwarfare","score":0.35530000925064087}],"concepts":[{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.8086000084877014},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7588000297546387},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.580299973487854},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.527400016784668},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.5216000080108643},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.4203999936580658},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.420199990272522},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.41659998893737793},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.3718999922275543},{"id":"https://openalex.org/C171769113","wikidata":"https://www.wikidata.org/wiki/Q849340","display_name":"Cyberwarfare","level":2,"score":0.35530000925064087},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.3508000075817108},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.3398999869823456},{"id":"https://openalex.org/C2781241145","wikidata":"https://www.wikidata.org/wiki/Q204606","display_name":"Cyberspace","level":3,"score":0.33739998936653137},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.33649998903274536},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3019999861717224},{"id":"https://openalex.org/C2777855551","wikidata":"https://www.wikidata.org/wiki/Q12310021","display_name":"Subject (documents)","level":2,"score":0.2919999957084656},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.27730000019073486},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.2736000120639801},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.265500009059906},{"id":"https://openalex.org/C149859251","wikidata":"https://www.wikidata.org/wiki/Q483426","display_name":"Enterprise private network","level":2,"score":0.25519999861717224},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.25440001487731934}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.07158","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.07158","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.07158","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.07158","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.4508039057254791,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cyber":[0],"Threat":[1,57],"Intelligence":[2],"CTI":[3],"attribution":[4],"relies":[5],"on":[6],"identifying":[7],"the":[8,153,180,189,197,203],"Tactics,":[9],"Techniques,":[10],"and":[11,64,87,95,163,194,200,226],"Procedures":[12],"TTPs":[13],"that":[14,24,41,178],"distinguish":[15],"one":[16],"threat":[17,173,224],"actor":[18],"from":[19,46],"another.":[20],"This":[21,32],"approach":[22],"presupposes":[23],"each":[25],"adversary":[26,38],"leaves":[27],"a":[28,96,106,161,166,209],"recognizable":[29],"operational":[30],"fingerprint.":[31],"work":[33],"investigates":[34],"whether":[35],"AI":[36,68,89,181],"driven":[37,69,90],"emulation":[39],"challenges":[40],"presupposition.":[42],"We":[43,176],"deploy":[44],"agents":[45,71,184],"our":[47],"Cybersecurity":[48],"SuperIntelligence":[49],"CSI":[50],"framework,":[51],"configured":[52],"as":[53,160],"five":[54],"Advanced":[55],"Persistent":[56],"APT":[58,139,212],"groups,":[59],"APT28,":[60],"APT29,":[61],"APT41,":[62],"APT44,":[63],"Lazarus":[65],"Group,":[66],"against":[67],"Defender":[70],"across":[72],"two":[73,103],"cyber":[74],"ranges":[75],"provided":[76,188],"by":[77],"CYBER":[78],"RANGES,":[79],"equipped":[80],"with":[81,227],"defensive":[82],"software":[83],"Wazuh,":[84],"Velociraptor,":[85],"Elasticsearch":[86],"active":[88],"defenders:":[91],"an":[92],"enterprise":[93],"network":[94],"military":[97],"infrastructure.":[98],"Across":[99],"20":[100],"experiments":[101,114,129],"using":[102],"defender":[104,142],"models,":[105],"binary":[107],"pattern":[108],"emerges:":[109],"all":[110,125],"10":[111,126,147],"Enterprise":[112,148],"range":[113,128],"resulted":[115,134],"in":[116,135,171,179],"compromise":[117],"2":[118],"to":[119,196],"12":[120],"hosts":[121],"per":[122],"experiment,":[123],"while":[124],"Military":[127],"were":[130],"successfully":[131],"defended":[132],"or":[133,141],"stalemates,":[136],"regardless":[137],"of":[138,146],"profile":[140],"model.":[143],"In":[144],"8":[145],"experiments,":[149],"attackers":[150],"independently":[151],"weaponized":[152],"defender's":[154],"own":[155],"Velociraptor":[156],"endpoint":[157],"management":[158],"platform":[159],"command":[162],"control":[164],"channel,":[165],"convergent":[167],"behavior":[168],"not":[169],"encoded":[170],"any":[172],"intelligence":[174],"profile.":[175],"argue":[177],"era,":[182],"wherein":[183],"can":[185,218],"be":[186],"deployed":[187],"right":[190,198],"models":[191],"are":[192],"available":[193],"subject":[195],"scaffolding":[199],"agentic":[201],"configuration,":[202],"entry":[204],"barrier":[205],"for":[206],"operating":[207],"like":[208,221],"nation":[210,215],"state":[211],"collapses:":[213],"beyond":[214],"states,":[216],"individuals":[217],"now":[219],"act":[220],"commonly":[222],"identified":[223],"actors,":[225],"it,":[228],"fundamentally":[229],"undermine":[230],"TTP":[231],"based":[232],"attribution.":[233]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-09T00:00:00"}