Shared object skeletons, repeated ordering of pages and annotations, and recurring structural patterns are strong indicators that multiple PDFs were built from the same process or builder. Those signals are more useful than a single matching hash when visible content has been updated.
What signals that multiple PDFs belong to the same threat cluster?
The most reliable clue is not whether the visible content looks identical, but whether the PDFs share a common construction pattern. Repeated object skeletons, consistent page ordering, matching annotation placement, and recurring structural quirks often point to the same builder or workflow, even when the text has been changed to evade simple hash-based matching.
Why structure matters more than a single hash
A single file hash is useful only when the document is unchanged. Campaigns that reuse the same template, exploit chain, or document generator can alter images, text, or minor metadata and still preserve the underlying PDF anatomy. That is why analysts should compare object layouts, stream ordering, page tree behaviour, annotation usage, and other stable structural markers rather than relying on content similarity alone.
When several samples preserve the same low-level construction choices, that usually indicates a shared production process. If those samples also share delivery timing, lure theme, or downstream behaviour, the clustering signal becomes much stronger. For PDF triage, the question is often less “Do they look the same?” and more “Were they assembled by the same hands or pipeline?”
How to compare samples in practice
Start with a stable feature set that survives light editing: object counts, page order, embedded file handling, annotation structure, script usage, metadata consistency, and any repeated naming patterns in objects or resources. Then compare how those features recur across samples. A campaign cluster often shows the same quirks in more than one place, which makes coincidence less likely.
- Look for repeated object graphs or near-identical document skeletons.
- Compare page sequencing and whether the same pages carry the same kinds of annotations.
- Check for repeated resource naming, template reuse, or the same embedded artefact patterns.
- Use visible-content changes as a secondary signal, not the primary one.
If you are already mapping related deliverables to a broader intrusion set, this kind of structural comparison is most useful when combined with external threat reporting and internal case notes. Public advisories can help confirm whether the observed document pattern matches a known delivery trend, while your own sample history can show whether the same builder is appearing repeatedly.
Risk and Threat Considerations
PDF-based campaigns are often designed to survive superficial cleanup. Attackers can swap text, compress images, or adjust layout while keeping the same underlying construction pattern, which makes one-file analysis misleading. Structural similarity therefore matters because it can reveal reuse across a cluster even when visible content has been refreshed to avoid detection.
Failure mechanism: Defenders over-weight the visible payload or the hash of one file, and miss that the shared PDF structure is the persistent indicator linking separate samples. That lets a campaign appear fragmented when it is actually a repeated delivery pattern.
Impact: Related samples may be triaged as unrelated, which slows detection, weakens campaign attribution, and can delay containment if the same builder or operator is still active.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1027 — Obfuscated Files or Information | PDF campaigns often change visible content while preserving structure. |
| T1036 — Masquerading | Campaign PDFs may be modified to appear distinct while retaining the same delivery pattern. | |
| T1204 — User Execution | PDF lures depend on user interaction, making campaign clustering useful for spotting repeated delivery. | |
| Recommendation — Correlate altered PDFs with other samples when the construction pattern stays stable. Compare structural traits to expose reused lures disguised as new files. Track recurring lure delivery patterns to identify repeated user-execution attempts. | ||
Practitioner Guidance
What to verify: Treat structural consistency as the first clustering test, then confirm it with metadata, lure theme, delivery path, and downstream behaviour. If the same PDF skeleton keeps reappearing, assume campaign reuse until disproven.
Common mistake: Assuming a changed visible payload means a new cluster. In PDF investigations, small editorial changes are cheap; repeated document anatomy is the harder-to-fake signal.
Practitioner takeaway: Cluster PDFs by durable construction features first, because the campaign’s real fingerprint is often in how the file was built, not in what the current text happens to say.
Related resources from NHI Mgmt Group
- What are the signs that a package compromise is part of a broader threat actor campaign?
- What does AI model abuse reveal about the current NHI threat surface?
- What are effective practices for operationalizing NHI threat detection?
- Why does threat hunting need identity data as part of the same workflow?