Threat actors

Understanding and analyzing the different actor types and their distinct characteristics and motivations play a key role in synthesizing and enriching threat intelligence data. Connecting the dots of who performed an attack, along with the TTPs they leveraged, creates an accurate intelligence profile. Cyber threat actors are the individuals, states, or groups behind an attack. Threat actors act with malicious intent to take advantage of technical vulnerabilities and lack of security awareness to gain unauthorized access to enterprise devices, data systems, or networks.

There are six basic classifications of threat actors that are commonly used in CTI, and while these broad classifications help illustrate the who behind an attack, these threat actor classifications are often mixed. This is because an actor group may comprise mixed motivations and classifications. To fully understand the nature of cyber threat actors, it's important to understand the history of...