DragonFly like a intrustion set about cti HOT 2 CLOSED

Hey @sebdraven, I just removed those documents since they shouldn't have been hosted there. You can get the latest documents on our new site here: https://oasis-open.github.io/cti-documentation/resources.html

from cti.

Good question, @sebdraven. You can see the definition of groups in ATT&CK here: https://attack.mitre.org/wiki/Groups. Based on the definition "related intrusion activity that are tracked by a common name in the security community" we felt that intrusion set was a better mapping than threat actor. That applies to Dragonfly but also the other groups referenced in ATT&CK.

from cti.