Focusing on the Weakest Link: A Similarity Analysis on Phishing Campaigns Based on the ATT&CK Matrix

Table 8

Similarity of phishing campaigns conducted by Lazarus group.

	TA0001	TA0002	TA0003	TA0004	TA0005	TA0006	TA0007	TA0008	TA0009	TA0011	TA0010	TA0040
(L1, L2)	1	0.8536	0.5547	0.5477	0.3351	0	0.1474	0	0	0.6882	1	0
(L1, L3)	1	0.8427	0.5262	0.5774	0.3796	0	0.2649	0	0	0.4924	1	0
(L1, L4)	1	0.6372	0.2631	0	0	0	0.3625	0	0	0	1	0
(L1, L5)	1	0.5238	0	0	0	0	0.5443	0	0	0	1	0
(L1, L6)	1	0.6146	0	0	0.7393	0	0.4523	0	0	0.5669	1	0
(L1, L7)	1	0.6003	0	0	0.6465	0	0.2132	0	0	0.4629	1	0
(L2, L3)	1	0.9918	0.9487	0.9487	0.9713	1	0.8593	0	1	0.9319	1	0
(L2, L4)	1	0.7742	0	0	0.2362	0.2425	0.2316	0	0	0.4199	1	0
(L2, L5)	1	0.6348	0	0	0.3210	0	0.2809	0	0	0.3709	1	0
(L2, L6)	1	0.7385	0	0	0.5637	0	0.4446	0	0	0.6018	1	0
(L2, L7)	1	0.7213	0	0	0.4495	0	0.3772	0	0	0.6018	1	0
(L3, L4)	1	0.7479	0	0	0.1768	0.2425	0.3601	0	0	0.3411	1	0
(L3, L5)	1	0.6105	0.2236	0	0.2404	0	0.4506	0	0	0.3489	1	0
(L3, L6)	1	0.7991	0	0	0.6155	0	0.5791	0	0	0.3489	1	0
(L3, L7)	1	0.7805	0	0	0.4327	0	0.4801	0	0	0.4558	1	0
(L4, L5)	1	0.9224	0.6708	0.9707	0.9767	0.9412	0.9043	1	0	0.9738	1	0
(L4, L6)	1	0.4901	0	0	0	0	0.7104	0	0	0.3336	1	0
(L4, L7)	1	0.4784	0	0	0	0	0.6955	0	0	0.3742	1	0
(L5, L6)	1	0.4428	0	0	0	0	0.8616	0	0	0.4146	1	0
(L5, L7)	1	0.4388	0	0	0	0.2425	0.7543	0	0	0.3742	1	0
(L6, L7)	1	0.9989	0	0	0.8555	0	0.9000	0	0.7071	0.8165	1	0
Avg.	1	0.6972	0.1517	0.1450	0.3781	0.1271	0.5179	0.0476	0.0813	0.4723	1	0