Verification methodology

IOCs, hashes and samples

A hash must match the collected sample and include the algorithm and provenance. Domain, IP and URL indicators need a timestamp, role and context; infrastructure can change ownership, so historical data is not automatically a current blocklist.

Do not run samples on production systems. Sample analysis must take place in an authorized, controlled environment with a procedure for preserving originals.

Ransom notes and extensions

Preserve original data and record names, sizes, locations and observed changes. Do not use a single indicator to identify a family. Check for spoofing, copying or multiple consecutive events.

Timelines, logs and forensic artifacts

Cross-check time sources, time zones and clock drift. Every timestamp must be tied to a log source or evidence. Record data gaps, collection scope and alternative explanations where they remain plausible.

Vendor sources and reliability

Read the source's sample scope, products, versions and research period. Do not turn one vendor's observations into statistics for the whole market or Vietnam. A technical notice can be verified as to its source without having been independently reproduced.

Four attribution levels

Confirmed: sufficient technical evidence supports the conclusion within its stated scope. Probable: several consistent leads exist, but a decisive check is still missing.

Unconfirmed: leads have not been sufficiently validated. Unknown: no sufficiently reliable hypothesis is available. These levels are not percentage probabilities.