What are the signs that a PDF campaign is part of the same threat cluster?

What signals that multiple PDFs belong to the same threat cluster?

The most reliable clue is not whether the visible content looks identical, but whether the PDFs share a common construction pattern. Repeated object skeletons, consistent page ordering, matching annotation placement, and recurring structural quirks often point to the same builder or workflow, even when the text has been changed to evade simple hash-based matching.

Why structure matters more than a single hash

A single file hash is useful only when the document is unchanged. Campaigns that reuse the same template, exploit chain, or document generator can alter images, text, or minor metadata and still preserve the underlying PDF anatomy. That is why analysts should compare object layouts, stream ordering, page tree behaviour, annotation usage, and other stable structural markers rather than relying on content similarity alone.

When several samples preserve the same low-level construction choices, that usually indicates a shared production process. If those samples also share delivery timing, lure theme, or downstream behaviour, the clustering signal becomes much stronger. For PDF triage, the question is often less “Do they look the same?” and more “Were they assembled by the same hands or pipeline?”

How to compare samples in practice

Start with a stable feature set that survives light editing: object counts, page order, embedded file handling, annotation structure, script usage, metadata consistency, and any repeated naming patterns in objects or resources. Then compare how those features recur across samples. A campaign cluster often shows the same quirks in more than one place, which makes coincidence less likely.

• Look for repeated object graphs or near-identical document skeletons.
• Compare page sequencing and whether the same pages carry the same kinds of annotations.
• Check for repeated resource naming, template reuse, or the same embedded artefact patterns.
• Use visible-content changes as a secondary signal, not the primary one.

If you are already mapping related deliverables to a broader intrusion set, this kind of structural comparison is most useful when combined with external threat reporting and internal case notes. Public advisories can help confirm whether the observed document pattern matches a known delivery trend, while your own sample history can show whether the same builder is appearing repeatedly.

Risk and Threat Considerations

PDF-based campaigns are often designed to survive superficial cleanup. Attackers can swap text, compress images, or adjust layout while keeping the same underlying construction pattern, which makes one-file analysis misleading. Structural similarity therefore matters because it can reveal reuse across a cluster even when visible content has been refreshed to avoid detection.

Failure mechanism: Defenders over-weight the visible payload or the hash of one file, and miss that the shared PDF structure is the persistent indicator linking separate samples. That lets a campaign appear fragmented when it is actually a repeated delivery pattern.

Impact: Related samples may be triaged as unrelated, which slows detection, weakens campaign attribution, and can delay containment if the same builder or operator is still active.

Practitioner Guidance

What to verify: Treat structural consistency as the first clustering test, then confirm it with metadata, lure theme, delivery path, and downstream behaviour. If the same PDF skeleton keeps reappearing, assume campaign reuse until disproven.

Common mistake: Assuming a changed visible payload means a new cluster. In PDF investigations, small editorial changes are cheap; repeated document anatomy is the harder-to-fake signal.

Practitioner takeaway: Cluster PDFs by durable construction features first, because the campaign’s real fingerprint is often in how the file was built, not in what the current text happens to say.

Related resources from NHI Mgmt Group

• What are the signs that a package compromise is part of a broader threat actor campaign?
• What does AI model abuse reveal about the current NHI threat surface?
• What are effective practices for operationalizing NHI threat detection?
• Why does threat hunting need identity data as part of the same workflow?