Join our Newsletter — 33% off our NHI Course

Activity Group

An activity group is a named set of malicious behaviours, infrastructure, and often related indicators that analysts link to the same operator or campaign. It is used when attribution is not strong enough to name a specific threat actor, but the cluster still helps defenders track tactics, tooling, and access patterns across incidents.

How Activity Groups Are Used in Intrusion Analysis

Activity groups are a practical way to name and track clusters of malicious behaviour when attribution is incomplete. They help defenders discuss a coherent set of incidents without overstating who is behind them.

This framing is common in intrusion analysis because the same operator can reuse tooling, infrastructure, access paths, and tradecraft across campaigns. The label keeps analysts focused on observable behaviour rather than forcing a premature actor judgment.

What Belongs in an Activity Group

An activity group usually bundles repeated tactics, infrastructure patterns, malware, operational habits, and associated indicators that appear to belong together. The important test is whether the collection is internally consistent enough to support tracking and response.

It is not the same thing as a fully attributed threat actor. In many cases, an activity group is a working construct that can later be merged into a named cluster, split into multiple clusters, or retired if better evidence emerges.

Because the label is based on evidence density rather than certainty of identity, it is especially useful during early investigation, recurring campaign analysis, and long-running monitoring of an adversary’s operational patterns.

How Activity Groups Support Defender Workflows

Activity groups make it easier to correlate incidents across time, environments, and telemetry sources. They give security teams a stable reference point for hunting, case management, and reporting even when the underlying attribution remains provisional.

They also help standardise language across analysts and tools. The same pattern may be described as an activity group in one dataset, a cluster in another, or a campaign fragment in a third, so clear internal conventions matter.

For teams that map intrusion behaviour to broader analytical models, NHIMG’s Cyber Kill Chain and Diamond Model Guide is a useful companion because it shows how to structure repeated observations into phases, relationships, and courses of action.

Why Activity Groups Matter for Attribution and Response

Activity groups sit between raw telemetry and high-confidence attribution. They preserve analytical discipline by letting defenders act on a repeatable pattern while avoiding claims that the evidence does not yet support.

That matters operationally because campaign-level tracking often informs prioritisation, threat hunting, and communication with stakeholders. A well-maintained activity group can reveal reuse of infrastructure, tooling, and access methods even when the actor’s identity stays uncertain.

When defenders compare activity groups across cases, they can also spot whether a pattern is stabilising, fragmenting, or evolving. That helps separate one-off noise from a persistent operator’s tradecraft.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK provides the primary governance reference for this term.

Framework Control / Reference Relevance
MITRE ATT&CK Tactic-Technique Mapping — Adversary Tactics and Techniques Activity groups cluster repeated adversary behaviours for ATT&CK-style analysis and campaign mapping.
Recommendation — Map the grouped behaviours to ATT&CK techniques to improve hunting and response prioritisation.