How to read a government attribution statement as a defender

A government attribution statement names who a state assesses is behind an intrusion, usually well after the technical response began. For a defender it adds context, not instructions. Your containment, eviction and recovery steps depend on observed behaviour, so do not delay them while waiting for a name.

A real timeline from the record

CISA's alert on the compromise of the SolarWinds Orion software lifecycle shows how this plays out. The alert warned that an advanced persistent threat actor had compromised government agencies, critical infrastructure entities and private sector organisations, beginning at least in March 2020. It described the actor as patient, well-resourced and focused.

The alert was later updated, on 15 April 2021, to say the US Government attributes the activity to the Russian Foreign Intelligence Service, referring to a White House statement. The technical guidance in the alert did not change because of that line. The response steps were already there.

What an attribution statement adds

• Context for leadership. It helps executives judge the seriousness and the likely goals.
• A thread to follow. Agencies and researchers can then publish more detail under a shared name, which helps hunting.
• Support for policy or legal decisions that sit above the security team.

What it does not add

• It does not tell you what to rebuild. That comes from your own evidence, such as which systems ran the affected software and which credentials they held.
• It does not prove your intrusion is the same one. Your case may be related, or a copycat, or unrelated activity that overlaps in time.
• It does not change the indicators you need to check. Those come from the technical sections.

A reading routine

When a statement is published, read in this order:

1. The technical details and indicators. Test them against your environment first.
2. The mitigations. Compare them with your controls and note gaps.
3. The scope and date of the activity. Check whether your logs reach back that far.
4. Only then the attribution text, and note who made the claim and on what basis they state it.

Record the publisher and the date. If the claim is later updated, you can see what changed.

Say less than you know

In internal and external messages, write what you observed and what authorities have publicly said. Do not add your own guess about who did it. A guess that turns out wrong can damage trust, and it adds nothing to the fix.

Quick check

Sources

• CISA AA20-352A, advanced persistent threat compromise of government agencies, critical infrastructure and private sector organisations

Last reviewed: 19 October 2026.