US24-Maasakkers-Unraveling-the-Mind-behind-the-APT-Wednesday.pdf

A Black Hat USA 2024 presentation describing a behavioral-analysis approach to attribute and cluster APT spear-phishing emails by analyzing content (stylometry, language models) and context (themes, principles of influence). The speaker outlines a three-model pipeline (textual, contextual, stylometric) combined via a meta-model, reports model accuracies (stylometry ~41%, LM ~60%, contextual ~67%, combined 88–96% after filtering), demonstrates clustering and subclustering insights, and discusses limitations including LLM-generated text and copycats.