An intrusion cluster is a set of cyberattacks that analysts link because they share observable traits, such as tactics, tools, infrastructure, or patterns of behavior. The term describes a grouping of activity, not necessarily a confirmed organization or a single command structure.
Clusters matter because defenders can use recurring behavior to guide detection and response, even when an attacker’s identity is uncertain. In real investigations, analysts compare evidence such as access methods, identity abuse, infrastructure reuse, and post-compromise actions. A shared name or brand alone does not prove that attacks come from the same people; keeping attribution confidence separate from technical findings helps avoid combining distinct activity or overlooking coordination.