Understanding the attackers, their motivations, and their methods
A Threat Actor is an individual or entity responsible for incidents that impact security and data protection. These actors can range from lone hackers to Organized Crime Groups or even Nation-state entities. They initiate attacks to steal, alter, or destroy your data. Understanding Threat Actors and their motivations is a crucial part of developing effective cybersecurity strategies.
A Threat Actor can be anything from the neighborhood kid trying to crack your Wi-Fi password to enjoy some free internet, all the way up to government-funded organizations seeking to cause chaos and disruption among their enemies.
In this section, we focus on Domain-1 and Domain-2, specifically Objectives 1.2, 2.1, and 2.2:
Threat Actor motivations are the reasons why Threat Actors do what they do. Understanding these motivations helps security professionals anticipate and counter potential attacks.
Most common motivation - stealing data or deploying ransomware for monetary profit.
Stealing sensitive information from organizations for various purposes.
Obtaining classified information for political, military, or economic advantage.
Disrupting operations through DDoS attacks or infrastructure sabotage.
Threatening to release sensitive information unless demands are met.
Promoting a cause or ideology through cyber attacks.
Finding and exposing vulnerabilities to improve security.
Retaliating against perceived wrongdoing by an organization.
Creating disorder simply for the challenge or entertainment.
Nation-states engaging in cyber warfare as part of broader conflicts.
Threat Actor Attributes refer to the specific characteristics or properties that define and differentiate various Threat Actors from one another.
Internal Threat Actors: Operate from within the organization with some level of trusted access.
External Threat Actors: Operate from outside the organization without prior access.
The resources available to threat actors significantly impact their capabilities and attack sophistication:
Threat actors vary widely in their technical expertise and operational capabilities:
Understanding the different types of threat actors helps organizations prepare appropriate defenses.
| Threat Actor Type | Motivation | Sophistication | Resources | Common Tactics |
|---|---|---|---|---|
| Unskilled Attackers | Curiosity, Learning, Thrill | Low | Limited | Pre-written scripts, publicly available tools |
| Hacktivists | Political/social causes | Low to Medium | Limited to Moderate | Website defacement, DDoS, doxing |
| Organized Crime | Financial gain | Medium to High | Substantial | Ransomware, phishing, identity theft |
| Nation-state Actors | Espionage, Warfare, Sabotage | Very High | Extensive | APTs, zero-day exploits, supply chain attacks |
| Insider Threats | Revenge, Financial gain, Inadvertent | Varies | Insider access | Data exfiltration, privilege abuse, negligence |
Individuals with limited technical experience who use readily available tools like downloaded scripts or exploits to carry out their attacks. Often called "script kiddies," they typically lack the knowledge to develop their own attack methods.
Example: A teenager using a publicly available DDoS tool to take down a school website during exam period.
Cyber attackers driven by political, social, or environmental ideologies, often aiming to draw attention to a specific cause. They use cyber attacks as a form of protest or to promote their message.
Example: A group defacing a corporation's website to protest environmental policies or leaking sensitive documents to expose perceived wrongdoing.
Well-structured groups executing cyber attacks for financial gain, usually through methods like ransomware, identity theft, or credit card fraud. These groups operate like businesses with specialized roles.
Example: A criminal organization deploying ransomware across multiple healthcare facilities and demanding bitcoin payments for decryption keys.
Highly skilled attackers sponsored by governments who carry out cyber espionage, sabotage, or cyber warfare against other nation-states or specific targets in various industries.
Example: Government-backed hackers infiltrating critical infrastructure systems of another country to gather intelligence or prepare for potential future conflicts.
Security threats originating from within the organization, often due to employees seeking revenge or careless staff misusing their trusted access to systems and data.
Example: A disgruntled employee who has been passed over for promotion exfiltrating proprietary data before leaving the company.
Shadow IT refers to Information Technology systems, devices, software, applications, and services that are managed and utilized without explicit organizational approval. These can pose significant security risks to your organization.
Threat vectors are the pathways or methods that attackers use to gain access to a system for malicious purposes. Attack surfaces represent all the potential points where an unauthorized user can attempt to enter or extract data from an environment.
Email phishing, SMS phishing (smishing), instant messaging, and social media messages.
Malicious code embedded in images, steganography to hide data, malicious QR codes.
Infected documents, malicious macros, trojanized software, malware-laden attachments.
Vishing (voice phishing), social engineering through phone calls, pretexting.
Infected USB drives, external hard drives, malicious firmware on peripherals.
Public Wi-Fi exploitation, rogue access points, man-in-the-middle attacks.
Organizations can employ various deception technologies to detect, delay, and analyze threat actors' activities.
Decoy systems or servers designed to attract and deceive potential attackers, simulating real-world IT assets to study their techniques.
Example: A vulnerable-looking database server that contains no real data but logs all access attempts and techniques.
Networks of decoy systems to observe complex multi-stage attacks and attacker movements between systems.
Example: A simulated corporate network with multiple interconnected honeypots mimicking various organizational systems.
Decoy files placed within systems to detect unauthorized access or data breaches when they are accessed.
Example: Files with names like "employee_salaries.xlsx" or "network_passwords.txt" that trigger alerts when opened.
Fake pieces of data, like fabricated user credentials, inserted into databases or systems to alert administrators whenever they are accessed or used.
Example: Fake login credentials that, when used, indicate a compromised database or access attempt.