Threat Actors Guide

Threat Actors Objectives: ● 1.2 - Summarize fundamental security concepts ● 2.1 - Compare and contrast common threat actors and motivations ● 2.2 - Explain common threat vectors and attack surfaces ● Threat Actors ○ Threat Actor Motivations ■ Data Exfiltration ■ Blackmail ■ Espionage ■ Service Disruption ■ Financial Gain, ■ Philosophical/Political Beliefs ■ Ethical Reasons ■ Revenge ■ Disruption/Chaos ■ War ○ Threat Actor Attributes ■ Internal vs. External Threat Actors ■ Differences in resources and funding ■ Level of sophistication ○ Types of Threat Actors ■ Unskilled Attackers ● Limited technical expertise, use readily available tools ■ Hacktivists ● Driven by political, social, or environmental ideologies ■ Organized Crime ● Execute cyberattacks for financial gain (e.g., ransomware, identity theft) ■ Nation-state Actor ● Highly skilled attackers sponsored by governments for cyber espionage or warfare ■ Insider Threats ● Security threats originating from within the organization ○ Shadow IT ■ IT systems, devices, software, or services managed without explicit organizational approval ○ Threat Vectors and Attack Surfaces ■ Message-based ■ Image-based ■ File-based ■ Voice Calls ■ Removable Devices ■ Unsecured Networks ○ Deception and Disruption Technologies ■ Honeypots ● Decoy systems to attract and deceive attackers ■ Honeynets ● Network of decoy systems for observing complex attacks ■ Honeyfiles ● Decoy files to detect unauthorized access or data breaches ■ Honeytokens ● Fake data to alert administrators when accessed or used ● Threat Actor Motivations ○ There is a difference between the intent of the attack and the motivation that fuels that attack ■ Threat Actors Intent ● Specific objective or goal that a threat actor is aiming to achieve through their attack ■ Threat Actors Motivation ● Underlying reasons or driving forces that pushes a threat actor to carry out their attack ○ Different motivations behind threat actors ■ Data Exfiltration ● Unauthorized transfer of data from a computer ■ Financial Gain ● Achieved through various means, such as ransomware attacks, or through banking trojans that allow them to steal financial information in order to gain unauthorized access into the victims' bank accounts ■ Blackmail ● Attacker obtains sensitive or compromising information about an individual or an organization and threatens to release this information to the public unless certain demands are met ■ Service Disruption ● Some threat actors aim to disrupt the services of various organizations, either to cause chaos, make a political statement, or to demand a ransom ■ Philosophical or Political Beliefs ● Attacks that are conducted due to the philosophical or political beliefs of the attackers is known as hacktivism ● Common motivation for a specific type of threat actor known as a hacktivist ■ Ethical Reasons ● Contrary to malicious threat actors, ethical hackers, also known as Authorized hackers, are motivated by a desire to improve security ■ Revenge ● It can also be a motivation for a threat actor that wants to target an entity that they believe has wronged them in some way ■ Disruption or Chaos ● Creating and spreading malware to launching sophisticated cyberattacks against the critical infrastructure in a populated city ■ Espionage ● Spying on individuals, organizations, or nations to gather sensitive or classified information ■ War ● Cyber warfare can be used to disrupt a country's infrastructure, compromise its national security, and to cause economic damage ● Threat Actor Attributes ○ 2 Most Basic Attributes of a Threat Actor ■ Internal Threat Actors ● Individuals or entities within an organization who pose a threat to its security