In MITRE ATT&CK, a group is an activity cluster tracked by a common name in the security community. It is a convenient label for observed behaviour, not proof of one organisation, one operator or one country. Read group pages as a source of techniques to defend against, not as an identity.
The definition, in MITRE's words
MITRE's groups page says groups are "activity clusters that are tracked by a common name in the security community". It uses "Group" as an umbrella term that covers threat groups, activity groups and threat actors.
That wording is careful on purpose. A cluster is a set of activity that analysts believe belongs together. The belief can change. Clusters can merge, split or be renamed as evidence arrives.
Associated groups are not aliases
Each group page lists associated groups. MITRE used to call these aliases and changed the label. Its note says overlapping names come from public reporting and are not treated as exact matches, and it urges analysts to research further.
So if one page lists three other names, do not assume the three vendors mean exactly the same thing. They may describe overlapping activity with different boundaries.
Definitions differ between organisations
MITRE states that organisations' group definitions may partially overlap with groups designated by others, and may disagree on specific activity. It gives one example: North Korean group definitions are known to have significant overlap, so some researchers report all state-sponsored activity from that country under one name instead of tracking subgroups.
For a defender this means two things. A technique list for a group is a summary of one body of reporting. And two reports using the same name may not be describing the same set of intrusions.
The mapping is a subset
MITRE also notes that technique mappings reflect only a subset of the activity available from open-source reporting, not all possible technique use. A technique missing from a group page does not mean the group never uses it.
How to use group pages well
- Treat the technique list as a starting set for a detection review, not a complete threat model.
- Pick the techniques that apply to your platforms. A page full of Windows domain techniques adds little if you run a cloud-only stack.
- Record the source of each claim in your own notes, with the date you read it.
- Avoid writing "we were attacked by" followed by a group name in tickets or messages. Write the behaviours you saw.
- Revisit pages periodically, since they are updated.
What not to do
Do not use a group page to guess who attacked you. The same behaviour can show up across unrelated actors, and defenders rarely have the visibility to settle it. Attribution is a separate discipline, and how to read a government attribution statement covers statements about it.
Quick check
Are ATT&CK groups the same as nation-state units?
No. They are activity clusters named by the community. Some are linked to states in public reporting, but the group page itself is a label for observed activity.
If a technique is not on a group page, can I ignore it?
No. Mappings reflect only the open-source reporting available, so absence is not evidence.
Sources
Last reviewed: 19 October 2026.
