Same Actor, New Voice: Testing Whether AI Rewriting Actually Breaks Threat Actor Attribution
Stylometric attribution, linking different aliases, personas, or campaign communications back to the same individual or crew by writing style, has been part of threat intelligence and forensic linguistics for over a decade, and it’s quietly load-bearing: it’s how researchers connect a ransomware affiliate’s new alias to an old one, or tie a run of forum posts to a single seller. Generative AI is now positioned as the tool that breaks that link, but the academic evidence on this is currently split. One recent line of research demonstrates an LLM agent that can be guided to rewrite text specifically to reduce authorship identifiability while preserving meaning.
A separate, equally recent study tests the more straightforward version of the same idea and finds that current authorship verification methods are not actually evaded by it. Neither has been tested against the real material threat intelligence works with: jargon-dense, often multilingual, frequently terse underground forum posts and ransom notes. This talk closes that gap, comparing real multi-alias threat actor writing samples from before and after a suspected shift toward AI-assisted drafting, across several distinct crews and crime types, against both classical stylometric and modern embedding-based attribution methods, reporting, case by case, where the link holds and where it doesn’t.
Rishika Desai – BforeAI
Rishika Desai lives at the intersection of threat intelligence, cybercrime research, and content creation. A Threat Intelligence Researcher and Technical Writer at BforeAI’s PreCrime Labs, she specializes in OSINT, DARKINT, phishing, and emerging cyber threats. Alongside the experience of 6 years in cybersecurity, she was recently named Cybersecurity Rising Star of the Year 2025 and amongst Top 100 Cybersecurity Influencers. Beyond research, Rishika is the creator behind Rishsec, where she turns complex cybersecurity concepts, investigations, and industry realities into content for a 40K+ community.