Threat Actors & TTPs

WhisperGraph carries the MITRE ATT&CK actor layer as part of the graph: over 1,100 named threat actors (ACTOR nodes) connected to more than 700 ATT&CK techniques and tactics (ATTACK_PATTERN nodes) through 7,300+ USES_TECHNIQUE edges. The mapping sits in the same graph as DNS, hosting, BGP, WHOIS, and the threat feeds, so "which techniques does this actor use" runs against the same endpoint as "what infrastructure is this campaign on".

That shapes what attribution work looks like here. Start from a named actor and read its full technique set, rolled up by tactic to see kill-chain coverage. Start from a technique that stood out in an intrusion and widen to every actor known to use it. Or invert the question: hand the graph a set of observed techniques and get back a ranked shortlist of candidate actors, weighted toward the rare techniques that discriminate rather than the commodity tradecraft every actor shares.

Actor names are case-sensitive and follow their canonical spelling (APT28, Sandman APT, Volt Typhoon). The actor layer is shallow by design: one hop from actor to technique, two from actor to actor. Every recipe in this section fits the anonymous 2-hop tier, so you can run it without a key. The cross-layer chains that connect tradecraft to live infrastructure go deeper; a free key raises the cap to 3 hops.

Run it

These guided workflows run in the browser against the live graph, one step at a time, with the Cypher behind every step visible and editable.

Workflow	What it does
Map a named actor to its ATT&CK techniques	Walks an actor's USES_TECHNIQUE edges to its full technique set, then rolls it up by ATT&CK tactic to show kill-chain coverage.
Actor → shared TTPs → other actors	Lists a named actor's techniques, then pivots through them to every other actor sharing the same tradecraft, ranked by overlap.
Chain a phishing domain to actor TTPs	Enumerates lookalikes of a brand domain, clusters the co-hosted phishing infrastructure, and maps a named actor's techniques in one run.
Narrow actor attribution by rare-technique convergence	Turns a set of observed techniques into a ranked actor shortlist, scored by how rare the shared techniques are rather than how many are shared.

Recipes

Actor Attribution & ATT&CK collects the copy-paste queries behind these workflows: actor to techniques, tactic rollups, shared-technique pivots, and rarity weighting, each with the caveats that keep attribution honest.

For the infrastructure half of an attribution case — co-tenancy, shared registrants, nameservers, TLS fingerprints — see Campaign Pivoting under Threat Investigation. Attack Paths & Blast Radius covers what connected infrastructure an intrusion could reach.