Introduction to Security · 1.3

🕵️ Cyber Threat Actors

Know your enemy — who attacks, why, and how⏱ ~3 min

🔍Threat actors are like criminals with different motives

A pickpocket, a bank robber, a political activist who vandalizes billboards, and a spy all break the law — but they have completely different targets, methods, skills, and resources. The same is true in cybersecurity. Knowing who is attacking you changes everything: what they're after, how sophisticated the attack is, what defenses matter most, and who to call for help. A school getting hit by a script kiddie needs a different response than a hospital being targeted by a nation-state.

The Six Threat Actor Categories

Threat ActorMotivationResources & SkillTypical Targets & Methods
Nation-StateEspionage, political sabotage, military advantageVirtually unlimited budget, elite teams, zero-day exploitsGovernments, critical infrastructure, defense contractors; Advanced Persistent Threats (APT) — stay hidden for months/years
CybercriminalFinancial gainWell-funded criminal organizations; highly skilledBanks, hospitals, businesses; ransomware, fraud, data theft, selling stolen data on dark web
HacktivistPolitical or ideological messageModerate skill; loosely organized collectivesCompanies/governments they oppose; website defacement, DDoS attacks, leaking embarrassing data
Insider ThreatGrievance, financial gain, espionage, negligenceAlready has legitimate access — biggest advantageAny organization; data exfiltration, sabotage, accidental exposure; hardest to detect
Script KiddieNotoriety, curiosity, proving themselvesLow skill — uses pre-built tools written by othersAnyone vulnerable; random victims; automated scans and script-based attacks. Still dangerous!
Terrorist / ExtremistDisruption, fear, political coercionVariable; may be backed by state sponsorsCritical infrastructure (power grids, water systems); goal is disruption and psychological impact

TTPs — Tactics, Techniques, and Procedures

Cybersecurity analysts identify threat actors by their TTPs — the specific methods they consistently use. Like a criminal's signature, TTPs are hard to change completely. A nation-state APT uses patient, stealthy, long-term access. A hacktivist group uses loud, public, attention-grabbing attacks. A ransomware criminal monetizes quickly and moves on.

Wireless Attacks (Public Network Risks)

  • Evil Twin Attack — attacker creates a fake WiFi hotspot named 'Airport_Free_WiFi'; your device connects automatically; attacker sees all your traffic
  • Packet Sniffing — on open (unencrypted) WiFi, attackers capture data packets flowing through the air with free tools like Wireshark
  • Man-in-the-Middle (MitM) — attacker secretly sits between you and the real network, reading and potentially modifying everything you send
  • Deauthentication Attack — attacker sends forged WiFi disconnect signals, forcing your device off the real network and onto their evil twin

Protecting Yourself on Public Networks

  • Use a VPN — encrypts all traffic between your device and the VPN server; useless to an eavesdropper on the local network
  • Verify HTTPS — the padlock means your browser-to-server connection is encrypted (not the whole network path)
  • Avoid sensitive transactions — don't log into banking or email on unknown public WiFi
  • Turn off auto-connect — prevents your phone from silently joining a familiar-named evil twin network
  • Use cellular data instead — for sensitive tasks, use your phone's mobile data rather than public WiFi
  • Forget public networks after use — removes saved networks your device might auto-join later
★ FactThe 2021 Colonial Pipeline attack (ransomware that shut down fuel distribution across the southeastern US for 5 days) was executed by DarkSide — a ransomware-as-a-service criminal group. They rented their attack tools to other criminals for a percentage of the ransom. The initial access: one compromised VPN password, no MFA. The criminal group's business model was more sophisticated than most legitimate tech startups.
🔒 SecurityInsider threats are statistically the hardest to detect and among the most damaging. Edward Snowden (NSA contractor), Reality Winner (NSA contractor), and the 2020 Twitter hack (insider bribed by outsiders) all demonstrate that the greatest risk often comes from people who already have legitimate access. Organizations counter this with least-privilege access, separation of duties, activity monitoring, and behavioral analytics.
🧠Quick Checkfirst try = +5 XP

A major social media platform is hacked. The attackers don't steal money or data — they post inflammatory political messages, deface the company's website with slogans, and publicly release internal emails showing the company's executives' private discussions. What type of threat actor is most likely responsible?

0 XP🔥 0 days