MuCamp: Generating Cyber Campaign Variants via TTP Synonym Replacement for Group Attribution

As cyberattack operators have progressed to encompass group and nation-state levels, the nature of attacks has evolved into more sophisticated forms such as cyber campaigns. In response to these large-scale campaigns, tactical cyber threat intelligence (CTI) which focuses on tactics, techniques, and procedures (TTPs) has gained significant attention. However, the data-driven aspects of tactical CTI confront two primary challenges: (i) the extreme scarcity of campaign data and (ii) the difficulty of effectively integrating security domain knowledge. To this end, this paper presents MuCamp, a novel campaign generation method that operates in the context of limited campaign data while also considering the unique characteristics of large-scale attacks. The proposed method assumes that campaigns are TTP sequences, and based on this assumption, it generates valid campaign variants by replacing target TTP words with TTP synonyms, and preserves the strategic goals of the seed campaigns. MuCamp offers a scalable and interpretable augmentation strategy, enhancing CTI effectiveness under data scarcity and facilitating rapid adaptation to evolving threat landscapes. We also prepared a dataset consisting of 858 real-world campaigns labeled by security experts, including 14 tactics and 206 techniques, enabling reliable performance evaluation. Experimental results demonstrate that each component of MuCamp contributes to embedding-based group attribution by improving the separability of the correct group from alternative candidates, while effectively reflecting domain knowledge.