Operational links are clues that two threat identities may be connected through shared infrastructure, personnel, tooling, or working methods. They are used in cyber threat analysis to compare how campaigns behave, not just what names they use.
These links matter because attackers often rebrand, split into subgroups, or reuse resources. A shared Tor portal, similar malware configuration, overlapping server patterns, or repeated command-and-control habits can suggest a common operator or support network. Defenders use operational links to cluster activity, improve attribution, and anticipate follow-on attacks. However, a link is usually a lead, not proof: analysts look for multiple consistent signals before concluding that two groups are related.