I think people, especially on HN, like to think of these groups as far more professional than they are. Just look at all the talk of “tradecraft” and “threat actors”.
Empirically, it appears that hackers are simply people. These groups seem to have maybe just one or a handful of talented individuals at their core, and they all have habits they like to return to.
This is my opinion of the type-a “hacker-types” that palantir hires...
(Had dinner with the head of US cyber-security and his minions and military contractors (This was when I was with Lockheed))
Like Sherlock-style high functioning sociopaths, or Patrick Bateman with top notch computer skills?
Sure,that's why Indicators of compromise exist to begin with. What I don't get is this notion of a "high quality" indicator. You would normally match on all indicators you have.
I mean,why match with a dozen indicators knowing full well the attacker might reuse any one of the hundreds of indicators that exist? All the big name security companies match against all known indicators for a group. What practical benefit is there to limiting yourself to a few indicators,even if they are top notch indicators?