# 10 Things I Hate About Attribution: A Clustering Conundrum

Page: https://stenobird.com/podcast/discarded-tales-from-the-threat-research-trenches-5154469/10-things-i-hate-about-attribution-a-clustering-conundrum
Text version: https://stenobird.com/podcast/discarded-tales-from-the-threat-research-trenches-5154469/10-things-i-hate-about-attribution-a-clustering-conundrum.md
Podcast: [DISCARDED: Tales From the Threat Research Trenches](https://stenobird.com/podcast/discarded-tales-from-the-threat-research-trenches-5154469)
Published: 2025-07-15T08:00:00+00:00
Episode link: https://www.buzzsprout.com/2445401/episodes/17506414-10-things-i-hate-about-attribution-a-clustering-conundrum.mp3
Audio file: https://www.buzzsprout.com/2445401/episodes/17506414-10-things-i-hate-about-attribution-a-clustering-conundrum.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/discarded-tales-from-the-threat-research-trenches-5154469/episodes/10-things-i-hate-about-attribution-a-clustering-conundrum
Duration seconds: 3384

## Resource

Send us fan mail! Hello to all our cyber detectives and pedantic CTI friends! In this episode of Discarded, host Selena Larson is joined by Greg Lesnewich, Staff Threat Researcher at Proofpoint for a behind-the-scenes look at one of the most frustratingly fascinating attribution cases yet. What begins as a lighthearted rant: “10 Things I Hate About Attribution,” quickly turns into a deep dive into the murky overlap between TA829 (aka RomCom), TA289, and the elusive GreenSec cluster. From Tran...

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/discarded-tales-from-the-threat-research-trenches-5154469/episodes/10-things-i-hate-about-attribution-a-clustering-conundrum/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/discarded-tales-from-the-threat-research-trenches-5154469/10-things-i-hate-about-attribution-a-clustering-conundrum.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.