This study empirically analyzed the latent structure of APT tactical capabilities by conducting principal component analysis, hierarchical cluster analysis, and multidimensional scaling (MDS) on 147 APT groups listed in the MITRE ATT&CK framework. The number of attack techniques across 14 tactical phases was used as the input data. The principal component analysis revealed that the first principal component explained 57.75% of the total variance and exhibited positive loadings across nearly all tactical phases. This indicates that differences in capability among APT groups are defined not by emphasis on particular tactics, but by the degree of expansion in their overall tactical capability scale across tactics. Hierarchical cluster analysis extracted four capability types, with the full-spectrum type at the apex. However, as indicated by the Silhouette coefficient and the spatial configuration obtained through MDS, no clear discontinuities exist between these types. Rather, the four types represent stepwise divisions along a continuous capability-scale dimension and inherently imply the possibility of transition between types as capabilities expand. These findings demonstrate that APT tactical capabilities are better understood not as multiple independent qualitative types, but as an “expanding capability accumulation structure” in which capabilities accumulate and expand progressively along a single dominant dimension.
View full abstract