Welcome to your sixth lesson. In our last session, we detailed the AAA framework—Authentication, Authorization, and Accounting—which provides the bedrock of access control for securing systems. We focused on the rules and mechanisms the "good guys" use to protect resources. Now, it's time to turn our attention to the other side of the equation.
This lesson explores the world of threat actors: the adversaries who seek to undermine the security controls you will be tasked with operating and defending. Our goal is to explain their role and learn how to categorize them by their motivations (the why behind their actions) and their capabilities (their skills and resources). For you as an aspiring SOC Analyst, understanding the enemy is the first step in mounting an effective defense. Knowing who might be attacking you, and why, helps you anticipate their moves, recognize their tactics, and prioritize your response.
Defining the Adversary
First, let's establish a clear definition. A threat actor is any individual or group that intentionally acts to compromise the security of a computer system or network. Their actions aim to violate the principles of confidentiality, integrity, or availability that we discussed in our first lesson.
The Canadian Centre for Cyber Security provides a solid official definition.
An introduction to the cyber threat environment
This document from a national cybersecurity agency offers formal definitions of key concepts.
Please read the introductory sections titled "Cyber threat" and "Cyber threat actors". This will give you the foundational terminology.
To effectively analyze and defend against these actors, we need a way to classify them. Professor Messer provides a concise overview of the attributes we use for this classification.
Threat Actors - CompTIA Security+ SY0-701 - 2.1
In this video, Professor Messer introduces the key characteristics used to profile threat actors.
Watch the introduction from the beginning up to the end of the motivation discussion. Pay close attention to the attributes he lists: location (internal/external), resources, sophistication, and motivation.
As you saw, motivation and capability (a combination of sophistication and resources) are the primary lenses through which we categorize threat actors. Let's explore the most common types, starting from the least sophisticated and moving to the most advanced.
A Spectrum of Adversaries
Threat actors exist on a spectrum of skill, funding, and intent. The following image provides a great visual overview of this progression.
Let's break down each of these archetypes.
1. Recreational Attackers ("Script Kiddies" / Thrill-Seekers)
At the lowest end of the spectrum are individuals who are often new to hacking. They are not typically creating their own attack tools but are instead using pre-written scripts and programs developed by others—hence the name "script kiddies."
- Motivation: Often driven by curiosity, a desire for notoriety, or simple vandalism. Their goal might be to see if they can do something, or to brag to their peers.
- Capability & Resources: Low. They rely on known, often automated, exploits and have limited technical skills and funding. While their individual actions might seem minor, they can still cause significant disruption, especially against poorly secured targets.
Professor Messer describes this group as "unskilled attackers."
Threat Actors - CompTIA Security+ SY0-701 - 2.1
Let's go back to Professor Messer's video for his take on this category.
Watch his description of unskilled attackers. Notice his point that if a script fails, these actors often lack the skills to troubleshoot or modify the attack.
2. Hacktivists
Moving up in motivation, we find hacktivists. These are individuals or groups who use hacking to promote a political, ideological, or social agenda.
- Motivation: Ideological. Their goal is to make a statement, embarrass a target, expose perceived wrongdoing, or disrupt the operations of an organization they oppose. Financial gain is not their primary objective.
- Capability & Resources: Varies from low to medium. They often use relatively simple techniques like Distributed Denial-of-Service (DDoS) attacks to take a website offline or website defacement to replace a site's content with their own message. However, some hacktivist groups are highly skilled.
7 Types of Cyber Threat Actors: Motivations, Methods, and ...
This article from the security firm RedLegg provides practical descriptions of different actor types.
Read the section titled "Hacktivists". Note the focus on their non-financial motives and public-facing attacks.
3. Cybercriminals
This is a broad and highly active category of threat actor, defined by one primary driving force: money.
- Motivation: Financial gain. Everything they do is aimed at making a profit. This can involve stealing financial data, credit card numbers, intellectual property, or deploying ransomware.
- Capability & Resources: Medium to high. Cybercrime ranges from individual actors to sophisticated, international organized crime syndicates that operate like corporations, with developers, support staff, and a management structure. They often have significant resources, reinvesting their profits into developing new attack methods. Ransomware-as-a-Service (RaaS) is a prime example of their business-like operations.
Professor Messer provides an excellent summary of how these criminal enterprises are structured.
Threat Actors - CompTIA Security+ SY0-701 - 2.1
Let's return to the Professor Messer video.
Watch the segment on organized crime. He highlights the corporate structure these groups can adopt, with specialized roles for hacking, development, and even "customer support" for ransomware victims.
4. State-Sponsored Actors (Nation-States)
At the apex of the pyramid are state-sponsored actors. These groups operate on behalf of a government to advance that nation's strategic and geopolitical objectives.
- Motivation: National interest. This includes espionage to steal state secrets or intellectual property, sabotage to disrupt critical infrastructure, and information warfare to influence public opinion.
- Capability & Resources: Extremely high. Backed by the full resources of a nation-state, they have nearly unlimited funding, extensive personnel, and the ability to develop custom, highly sophisticated attack tools (including zero-day exploits).
These groups are often referred to as Advanced Persistent Threats (APTs) because of their skill and their ability to maintain long-term, undetected access to a target network.
Threat Actors - CompTIA Security+ SY0-701 - 2.1
Professor Messer explains this top-tier threat actor and provides a classic example.
Watch his explanation of nation-state actors. The Stuxnet worm he describes is a landmark case of a state-sponsored cyber-physical attack.
5. Insider Threats
The final category is unique because the threat originates from within the organization. An insider is an employee, contractor, or partner with authorized access to systems and data.
- Motivation: Varies widely. It can be malicious (revenge, financial gain) or unintentional (accidents, negligence).
- Capability & Resources: Also varies. The key factor is their legitimate access, which allows them to bypass external defenses. A disgruntled system administrator with high privileges poses a much greater risk than an entry-level employee.
We can split this category further:
- Malicious Insider: Intentionally abuses their access for personal gain or to harm the company.
- Unintentional Insider: Causes a security breach through error, negligence, or being tricked (e.g., falling for a phishing email). This also includes Shadow IT, where departments set up their own technology solutions without official approval, often bypassing security controls.
Connecting Actors, Motivation, and Impact
We can synthesize this information by connecting an actor's motivation to the security goals they impact—the CIA triad.
- A Nation-State actor conducting espionage to steal secrets directly affects Confidentiality.
- A Cybercriminal using ransomware to encrypt files and demand payment affects Availability (and often Integrity). A criminal manipulating bank records affects Integrity.
- A Hacktivist launching a DDoS attack to take a website offline directly affects Availability.
As a SOC Analyst, making these connections helps you understand the implications of an attack. Seeing evidence of a DDoS attack points toward a certain type of actor (hacktivist) and a specific goal (disruption), which is different from seeing evidence of subtle data exfiltration, which might point toward a more sophisticated actor (nation-state or organized crime) with a different goal (espionage or theft).
To review and consolidate all these categories, watch the final summary segment from Professor Messer's video.
Threat Actors - CompTIA Security+ SY0-701 - 2.1
This final table provides a concise summary of the different threat actor attributes.
Watch the segment from the start of the table to the end of the video. This is a great way to review the key characteristics of each actor type we've discussed.
From Categories to Real-World Intelligence
The categories we've discussed are foundational archetypes. In the real world of threat intelligence, security companies and researchers track specific, named groups. You may have heard names like "Fancy Bear," "Lazarus Group," or "APT29." These are labels created by security vendors to track clusters of activity they believe belong to a single, persistent threat actor.
A fascinating complexity is that different vendors have different visibility into attacks. CrowdStrike might see one set of intrusions, while FireEye sees another. As a result, they may give different names to what is essentially the same adversary. For example, "APT29" (FireEye's name) and "Cozy Bear" (CrowdStrike's name) are both widely believed to be the same Russian intelligence service.
You don't need to memorize these names now, but it's important to understand the concept as you advance in your career. To get a feel for this professional-level nuance, let's watch a brief clip from a SANS Institute talk.
Threat Intelligence Naming Conventions: Threat Actors, & Other Ways of Tracking Threats
In this video, a leading expert from the SANS Institute discusses the complexities of naming threat groups.
Watch just the introduction, from "I wanted to do this webcast". Rob Lee introduces the core problem: are APT29 and Cozy Bear the same, and does it matter? This sets the stage for understanding how threat intelligence works in practice.
The key takeaway is that our categories provide the "what," while real-world threat intelligence tries to identify the "who" behind an attack.
Conclusion
In this lesson, we have moved from understanding defensive controls to profiling the adversaries who challenge them. You have learned to categorize threat actors and analyze them based on their defining characteristics.
Here are the key takeaways:
- Threat actors are the individuals and groups who carry out cyberattacks.
- We primarily classify them by motivation (why they attack) and capability (their skills and resources).
- The main categories include Script Kiddies (fame/curiosity), Hacktivists (ideology), Cybercriminals (money), Nation-States (geopolitics), and Insider Threats (varied).
- An actor's motivation often correlates with a direct impact on Confidentiality, Integrity, or Availability.
- In professional threat intelligence, these archetypes are refined into specific, named Advanced Persistent Threats (APTs) and other groups tracked by security vendors.
What's Next?
Now that we know who the attackers are and why they attack, our next lesson will focus on how they attack. We will introduce the Cyber Kill Chain, a framework that breaks down a cyberattack into a sequence of phases. Understanding this sequence is critical for a SOC Analyst, as it allows you to detect, understand, and disrupt an attack at various stages.