<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-geopolitical-threat-analysis
description: >-
  Assess cyber threat implications of geopolitical events, map nation-state actor
  motivations to targeting patterns, and produce strategic intelligence assessments
  linking political developments to cyber operations.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - geopolitical-analysis
  - nation-state
  - strategic-intelligence
  - ach
  - targeting-patterns
  - geopolitical-risk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---
# Performing Geopolitical Threat Analysis

## Overview

Geopolitical threat analysis links political events, interstate tensions, and
strategic objectives to cyber threat actor behavior. This skill covers mapping
nation-state motivations to TTPs, correlating geopolitical events with cyber
campaign timing, applying structured analytic techniques (ACH, Key Assumptions
Check), and producing strategic threat assessments for leadership.

## Prerequisites

- Python 3.10+ with `requests`, `stix2` libraries
- Access to geopolitical news feeds and conflict databases
- Understanding of nation-state cyber programs (Russia, China, Iran, DPRK)
- Familiarity with structured analytic techniques (SATs)
- MITRE ATT&CK for nation-state group TTP profiles

```bash
pip install requests stix2 feedparser
```

## Key Concepts

### Nation-State Cyber Motivation Matrix

| State | Primary Motivation | Secondary | Key Actors |
|-------|-------------------|-----------|------------|
| Russia | Strategic disruption, espionage | Information operations | APT28, APT29, Sandworm |
| China | IP theft, economic espionage | Strategic positioning | APT1, APT10, APT41 |
| Iran | Regional influence, retaliation | Destructive capability | APT33, APT35, MuddyWater |
| DPRK | Revenue generation | Espionage | Lazarus, Kimsuky, Andariel |

### Geopolitical Event → Cyber Impact Model

```
Political Event → Actor Motivation Assessment → Capability Review →
Targeting Prediction → Collection Requirements → Monitoring Plan →
Alert Threshold → Strategic Assessment
```

### Structured Analytic Techniques

- **ACH**: List hypotheses for observed cyber activity → weigh evidence
- **Key Assumptions Check**: Challenge implicit assumptions about actor intent
- **Indicators & Warnings (I&W)**: Define observable precursors to cyber escalation
- **Red Team Analysis**: Think like the adversary — what would you target?

## Workflow

### Step 1: Event Assessment

```python
import feedparser
from datetime import datetime

def collect_geopolitical_events(rss_feeds: list[str]) -> list[dict]:
    """Collect recent geopolitical events from RSS feeds."""
    events = []
    for feed_url in rss_feeds:
        feed = feedparser.parse(feed_url)
        for entry in feed.entries[:10]:
            events.append({
                "title": entry.get("title", ""),
                "summary": entry.get("summary", "")[:500],
                "published": entry.get("published", ""),
                "source": feed.feed.get("title", feed_url),
                "link": entry.get("link", ""),
            })
    return events
```

### Step 2: Actor-Event Correlation

```python
ACTOR_TRIGGERS = {
    "Russia": ["NATO", "Ukraine", "sanctions", "Baltic", "election"],
    "China": ["Taiwan", "South China Sea", "trade war", "Uyghur", "Hong Kong"],
    "Iran": ["Israel", "JCPOA", "Gulf", "sanctions", "proxy"],
    "DPRK": ["sanctions", "military exercise", "cryptocurrency", "South Korea"],
}

def correlate_events_to_actors(events: list[dict]) -> list[dict]:
    """Map geopolitical events to likely responsive threat actors."""
    correlations = []
    for event in events:
        text = f"{event['title']} {event['summary']}".lower()
        for state, triggers in ACTOR_TRIGGERS.items():
            matched = [t for t in triggers if t.lower() in text]
            if matched:
                correlations.append({
                    "event": event["title"],
                    "state_actor": state,
                    "triggers": matched,
                    "risk_level": "high" if len(matched) >= 2 else "medium",
                })
    return correlations
```

### Step 3: Produce Strategic Assessment

```python
def generate_assessment(correlations: list[dict], confidence: str = "MODERATE") -> dict:
    """Generate strategic threat assessment from correlations."""
    by_state: dict[str, list] = {}
    for c in correlations:
        by_state.setdefault(c["state_actor"], []).append(c)

    return {
        "assessment_date": datetime.utcnow().isoformat(),
        "confidence": confidence,
        "summary": f"{len(correlations)} geopolitical events correlated to cyber threat actors",
        "state_assessments": {
            state: {
                "event_count": len(events),
                "risk_level": max(e["risk_level"] for e in events),
                "key_events": [e["event"] for e in events[:3]],
            }
            for state, events in by_state.items()
        },
        "recommendations": [
            "Increase monitoring for nation-state TTPs from correlated actors",
            "Update PIRs to reflect current geopolitical triggers",
            "Brief SOC on elevated threat actors and expected targeting patterns",
        ],
    }
```

## Verification

- [ ] Geopolitical events collected from multiple open-source feeds
- [ ] Events correlated to nation-state actors with trigger keyword matching
- [ ] Structured analytic techniques applied (ACH, Key Assumptions Check)
- [ ] Strategic assessment produced with confidence levels and recommendations
- [ ] Assessment distributed to appropriate audience with correct TLP marking
- [ ] Monitoring plan updated to reflect current geopolitical threat landscape

## References

- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)
- [CISA Nation-State Advisories](https://www.cisa.gov/news-events/cybersecurity-advisories)
- [Council on Foreign Relations Cyber Operations Tracker](https://www.cfr.org/cyber-operations/)
- [Recorded Future Nation-State Research](https://www.recordedfuture.com/research)
- [Mandiant Threat Intelligence](https://www.mandiant.com/advantage/threat-intelligence)
