2.1.1 Threat Actors

A threat actor is any individual, group, or automated entity that possesses the motive and resources to initiate a negative event against an IT infrastructure.

Common Threat Actor Profiles - Nation-state (State Actors): Highly sophisticated, government-sponsored groups focused on long-term espionage, strategic advantage, and Intelligence Gathering. They have the highest resource levels (funding and people) and often utilize OSINT (Open-Source Intelligence) to plan attacks. - Criminal Syndicates: Organized crime groups motivated primarily by financial gain. They are professional, well-funded, and cause significant global damage through extortion and theft. - Hacktivists: Actors driven by political, social, or ideological motives. They use hacking to promote a cause or protest against an organization or government. - Insider Threats: Individuals within an organization who have authorized access but use it maliciously or accidentally. They represent a major risk because they have "the keys to the kingdom," often motivated by greed, revenge, or simple negligence. - Script Kiddies: Technically unsophisticated actors who use pre-made, open-source tools and scripts created by others. They lack deep knowledge and are generally easier to defend against compared to professional actors. - Competitors: Outside organizations in the same industry that seek unauthorized access to trade secrets or customer lists to gain a market advantage via competitive intelligence gathering.

Threat Intelligence and Research - Threat Intelligence: The collection and analysis of information regarding potential attacks to help organizations prepare and prevent incidents. - Vulnerability vs. Threat: A vulnerability is an inherent weakness (e.g., a default password), while a threat is the specific action an actor takes to exploit that weakness. - Dark Web: Unindexed websites often used by criminal syndicates to trade illegal goods or data. Law enforcement uses it for sting operations. - Indicators of Compromise (IoC): Forensic evidence or "artifacts" left behind after an attack, such as unusual outbound traffic, unauthorized file changes, or malware signatures.

Quick recall - Nation-states = Extreme persistence, high funding, and political motives. - Insiders = Use legitimate access; hard to detect; can be malicious or accidental. - Criminal Syndicates = Motivation is almost always money. - Script Kiddies = Low skill; use existing tools; seek notoriety. - IoCs = Evidence of an intrusion (the "smoking gun" in logs or traffic). - OSINT = Publicly available info (news, reports) used for targeting.