Attribution Engine & Artifact Correlation

Side-by-Side Matrix

Side-by-side comparative matrix linking observed target telemetry directly to cataloged threat syndicates.

1. Unknown Observed Target (Incident Telemetry)

2. Known Cataloged Threat Actor

Attribution Resolution: 84% High Confidence Match

Possible linkage based on supporting signals: deterministic PGP public key re-use corroborated by 81% stylometric cosine similarity.

Deterministic PGP Match81% Stylometric

Zero-Hallucination Evidence Protocol: All automated links correspond to verifiable technical artifacts. No generative inferences are asserted as facts. Primary assertion grounded in PGP fingerprint checksum 8A2F 7B19....

Side-by-Side Artifact Correlation Matrix

7 Comparative Vectors

Telemetry Dimension	Unknown Observed Target	Known Cataloged Actor	Attribution Signal
Monikers & Handles	@shadow_ops_26	@shadow_x / sx_broker	Probabilistic (78%)
PGP Fingerprint	8A2F 7B19 4E21 9C08 1102 B491 5C22 90D3	8A2F 7B19 4E21 9C08 1102 B491 5C22 90D3	Exact Match (100%)
Crypto Wallet Cluster	bc1q8w7yv9g2x92kfqz92m0x892a01l	bc1q8w7yv9g2x92kfqz92m0x892a01l	Co-Spend Cluster (92%)
C2 & Egress Relay	onion-node-09.exit	onion-node-09.exit	Shared Relay (94%)
Comms (Jabber/Tox)	tox: 4A10F882C901... / jabber: ops@xss.is	tox: 4A10F882C901... / jabber: sx@exploit.im	Corroborated (88%)
Stylometric & Slang	Russian / English (Slang: sliv, garant, otstoy, crypter)	Russian / English (Slang: sliv, garant, otstoy, locker)	81% High Similarity
Activity Window (UTC)	14:00 - 22:00 UTC	15:00 - 23:00 UTC	89% Time Overlap

NLP Stylometry Analysis Model

Lexical & Stylometric Match:81% High Similarity

Stylometric Cosine Score: 0.81281.2% Correlation

1. TF-IDF Vocabulary Weights

privat_sliv:0.428

baza_dannykh:0.384

decryptor_bin:0.351

garant_escrow:0.312

2. Character & Word N-Grams

Char 3-grams:84.6% Match

Char 4-grams:78.2% Match

Word Bi-grams:82.1% Match

Slang Markers:6/7 Matched

3. Distance Models & Variance

Cosine Distance:0.188

Jaccard Coefficient:0.742

Yule's K Stat:114.2 (Consistent)

TTR Richness:0.68 vs 0.71

Analytical Summary: Target Alpha demonstrates striking stylistic concordance with known threat actor ShadowX. Both corpora exhibit the same bilingual Russian-English forum register, selective capitalization, and idiosyncratic ransomware extortion phrasing.