Clustering on intrusions is an effective tool for tracking adversaries and the methods they use. Once a set of intrusions with similar characteristics is identified, victimology and infrastructure patterns can be studied to reach attribution.