Update 2014-01-17 I'm updating this post to include a slightly revised version of the Pyramid. The only real change I made was that I added a new level for hashes. I also updated the text to account for this. On February 18th, Mandiant put a major hole in the APT intelligence dam when they released their APT1 report profiling a group commonly referred to as Comment Crew. There followed a small
![The Pyramid of Pain](https://cdn-ak-scissors.b.st-hatena.com/image/square/927a4f5d18e836930379fbbed24b745e98d6ff02/height=288;version=1;width=512/https%3A%2F%2Fblogger.googleusercontent.com%2Fimg%2Fb%2FR29vZ2xl%2FAVvXsEgx1UShcW3qOx2XR-CHbbtfyG_VWpwCgEcuziAsiiueSMDfKkTMsL_8MOn92vofA1v64Gj3CGSy6FFbRoZYIPAmWNEHKSkBp6DDA-AmFLRuAWPC9b6i1AZjQOujblyTiXyXmdm6r6tk4guX%2Fw1200-h630-p-k-no-nu%2FPyramid%2Bof%2BPain%2Bv2.png)