Campaigns

Security teams may struggle with understanding their threat landscape and determining what activity to focus on, especially when faced with a myriad of emerging threats. To better assist these teams, the Threat Campaign feature in Google Threat Intelligence gives security professionals visibility into active campaigns affecting their industries, regions, and peers.

This feature provides a campaign-centric view and lets you easily pivot across all accompanying intelligence. Campaigns help you better prioritize mitigation and response actions in preparation for the next attack with a high degree of confidence. Data is updated daily as analysts get new campaign details, so you get access to Google Threat Intelligence’s knowledge in near real-time.

Campaign Types

To help analysts quickly understand the scale and scope of a threat, Google Threat Intelligence categorizes activity into three distinct types:

1. Single target Operation: Represents highly targeted activity involving a single threat actor directing their efforts against a single specific victim organization (One actor, one victim).
2. Multitarget Campaign: Characterizes broader operations where a single threat actor coordinates attacks against multiple victims, often within a specific sector or region (One actor, many victims).
3. Global Multiactor Campaign: Defines widespread, systemic threat activity involving multiple threat actors targeting numerous victims globally, indicating a massive scale of operations (Many actors, many victims).

Campaign Creation

Google TI analyzes emerging threat data gathered from a wide variety of diverse intelligence sources. When assessing a campaign's viability for a Threat Campaign profile, our analysts collect and synthesize all available surrounding context—including indicators, actor behaviors, and targeting trends—to construct a comprehensive view of the threat. Considerations for campaign creation include the following:

• Who is the threat actor, what are their motivations, and how impactful are their operations on targeted organizations? For example, an espionage actor targeting Ministries of Foreign Affairs or a fast-paced extortion operator does not equate to automated drive-by adware or infostealer campaigns.

• What level of insight into the campaign do we have? Can we confirm that multiple organizations have been targeted? Do we have a sufficient amount of shareable, actionable data that we can disseminate to our clients?

• Is the targeting broad enough that the targeted organizations could not be discerned based on the data we have available to share?

  We take sensitivities of this data very seriously and make every effort to restrict the unintended release of sensitive, client-attributable data into the Threat Campaign profile.

Campaign List

All active campaigns appear in full in the Campaign List. You can search or filter on the results and open a specific campaign to access its more granular details. Campaigns are automatically updated as analysts tag events.
You can use the left-hand filtering menu to pare down the list across the platform using the following filters:

• Campaign Type
• Creation Date
• Last Modification Date
• Origin
• Source Region
• Targeted Region
• Targeted Industry
• Associated Malware
• Associated Tools

Campaign card

Each campaign is shown as a card in the list with relevant information. Key fields include:

1. Campaign title
2. Update date: Date when the campaign card was last updated with any new associated report, malware family, targeted region, etc.
3. Owner: Creator of the campaign card.
4. Campaign Type: Type and scale of the threat campaign (Single Target Operation, Multitarget Campaign, Global Multiactor Campaign).
5. Campaign ID: Unique identifier for the campaign.
6. Last activity: Date when the last observation about that campaign was made by Google Threat Intelligence analysts.
7. Description: Short summary of the Campaign.
8. Published date: Date and time when the campaign was published.
9. Targeted Industries
10. Targeted Regions
11. Associated Actors
12. IoCs: Number of IoCs related to this Campaign.
13. Telemetry graph on IoC activity.

Each Campaign card has a checkbox to the left to select it, when selected you have two options that are enabled in the top right corner:

Follow Campaigns

In the Campaigns tab, click Follow for any Campaign to monitor changes to the selected Campaigns over time, such as new activity, associations or IoCs.

To add a Campaign to a Threat Profile, open the card details and use the Follow button inside, it will give you the option to choose which profile to add it to.

Run TTP analysis

Redirects you to TTP Analysis tab where a MITRE ATT&CK matrix is filled with the TTPs of the campaign/s selected so you can explore it in detail.

Actions available for TTPs:

• Hovering over the ID of a Technique or Tactic provides a brief description of it and a link to open details in MITRE site.
• Clicking on the name of a Technique or Tactic will redirect you to an Intelligence search filtering for that specific Technique (example: attack_technique:T1129)
• Clicking on the matches tag on the bottom right corner of a Technique will redirect you to the list of the current Campaign's IOCs that match this Technique

Campaign details

Click on the name of any Campaign card for a view of its details, navigate its tabs for specific data:

• Summary: This tab displays the same comprehensive summary of the Campaign as seen in the quick view. It also includes an Overview block with information such as Targeted Regions and Industries and dates of campaign activity. The following blocks have a dashboard with a timeline with Campaign most relevant activity, and summarized information on Associated Actors, Malware, Tools & Vulnerabilities, Associations timeline, Telemetry Graph and Activity board.

• Associations: This tab provides a list of the various associations with this Campaign. It includes associated Malware, Toolkits, Threat Actors and Vulnerabilities. Various filter options let you customize your view.

• IOCs: This tab includes a table with all known Indicators attributed to this Campaign, such as specific IP addresses, urls, domains, and hashes.
  

• Rules: This tab shows detection rules for this Campaigns IoCs, there are Yara, Sigma and IDS rules, and they can be crowdsourced or curated. These rules can be downloaded for use in threat hunt efforts or other workflows involving third-party security tools outside the Google Threat Intelligence platform.

• TTPs: This tab shows the Tactics, Techniques, and Procedures (TTPs) observed to be associated with this Campaign. This tab contains 2 sub tabs:
  1. Threat Actor Actions: shows the events observed by Google Threat Intelligence analysts in a timeline and as a detailed list.
  2. MITRE ATT&CK: shows the MITRE matrix with all TTPs associated, they can be downloaded by clicking Download TTPs from the Actions drop-down.

• Community: This tab features a dedicated space for community discussion, it is a section that contains comments posted by the community making observations on the Campaign.