Topic starter
11/11/2026 6:04 pm
TL;DR: The Com keeps rebranding and replacing operators fast enough that attribution based on one tactic or name alone becomes unreliable, according to Flare. Security teams have to separate clusters from brands or they will defend the wrong TTPs and lose credibility.
Editorial analysis by NHI Mgmt Group, based on content published by Flare: “Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com”.
Key questions
Q: Why do social engineering crews succeed against identity workflows?
A: They succeed when identity controls rely on human judgement under pressure, such as password resets, MFA fatigue, help desk verification, or urgent approval paths.
Q: How do analysts separate a threat cluster from a public brand?
A: Analysts separate them by looking for converging evidence of behaviour, infrastructure, tooling, targeting, and victim overlap rather than by names used in public reporting.
Q: What are the signs that helpdesk password recovery is being abused?
A: Look for unusual reset volume, repeated assisted resets for the same identities, weak caller verification, and a growing gap between self-service and support-led recovery outcomes.
Practitioner guidance
- Strengthen help-desk verification Require strong identity checks before password resets, MFA resets, device changes, or support-driven account recovery, and make the escalation path auditable.
- Separate clusters from brands Document actor names, aliases, and campaigns separately in threat intelligence notes so a public brand does not overwrite the underlying evidence.
- Set an attribution threshold Name a specific actor only when independent evidence converges, such as behaviour, infrastructure, and first-party reporting, and otherwise use a broader cluster label.
Bottom line: The core risk is not a single threat name but the tendency to turn a shifting ecosystem into a false certainty.
Glossary terms: The Com, Social Engineering, Help Desk Vishing, Cluster Attribution
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Attribution is itself a security control in The Com environment: When teams collapse clusters, brands, and aliases into one label, they lose analytic precision and weaken response decisions. The same access tradecraft can appear under different names, but the governance failure is treating a label as evidence. Practitioners should separate what is proven from what is merely familiar.
A question worth separating out:
Q: What is the difference between an intrusion cluster and a criminal brand?
A: An intrusion cluster is a technically linked set of malicious activity, usually tied together by shared infrastructure, tradecraft, malware, or operational patterns. A criminal brand is the name used in public or underground reporting for a group, which may cover several different clusters or change over time as operators split, merge, or rebrand.
👉 Read our full editorial: The Com blurs cluster attribution and raises governance risk