An adversary cluster is a collection of malicious activity that appears to come from the same operator, campaign, or shared infrastructure, even when different vendors label it differently. In threat intelligence, one cluster may have several aliases because teams observe different slices of the same behavior: malware family names, phishing infrastructure, command-and-control hosts, or overlapping tactics, techniques, and procedures.
This concept matters because name collisions can hide connections between incidents. If analysts treat every label as a separate actor, they may miss repeat activity, duplicate work, or underestimate a campaign’s scope. Defenders correlate clusters by comparing infrastructure, code reuse, targeting patterns, and operational timing. The result is better detection, faster triage, and more cautious attribution, since a cluster is often evidence of related behavior rather than a confirmed identity.