[rrhyne]

Forensics. Attackers use and sometime re-use domains, ips and code to recon, attack and exfil data. Those items may have been used before. All the attributes related to each of those items are cross referenced. You might find a server in this breach was associated with an email address that was used to register a domain in the current breach. That email now loosely ties the two breaches and actors together.

[sbarre]

I don't know about where you work, but the people who register domains aren't typically the people who use them.

Did the DOJ just indict a bunch of procurement people? ;-)

[rrhyne]

Read this: https://intrusiontruth.wordpress.com/