🕵️ Cyber Threat Actors
Know your enemy — who attacks, why, and how⏱ ~3 min
A pickpocket, a bank robber, a political activist who vandalizes billboards, and a spy all break the law — but they have completely different targets, methods, skills, and resources. The same is true in cybersecurity. Knowing who is attacking you changes everything: what they're after, how sophisticated the attack is, what defenses matter most, and who to call for help. A school getting hit by a script kiddie needs a different response than a hospital being targeted by a nation-state.
The Six Threat Actor Categories
| Threat Actor | Motivation | Resources & Skill | Typical Targets & Methods |
|---|---|---|---|
| Nation-State | Espionage, political sabotage, military advantage | Virtually unlimited budget, elite teams, zero-day exploits | Governments, critical infrastructure, defense contractors; Advanced Persistent Threats (APT) — stay hidden for months/years |
| Cybercriminal | Financial gain | Well-funded criminal organizations; highly skilled | Banks, hospitals, businesses; ransomware, fraud, data theft, selling stolen data on dark web |
| Hacktivist | Political or ideological message | Moderate skill; loosely organized collectives | Companies/governments they oppose; website defacement, DDoS attacks, leaking embarrassing data |
| Insider Threat | Grievance, financial gain, espionage, negligence | Already has legitimate access — biggest advantage | Any organization; data exfiltration, sabotage, accidental exposure; hardest to detect |
| Script Kiddie | Notoriety, curiosity, proving themselves | Low skill — uses pre-built tools written by others | Anyone vulnerable; random victims; automated scans and script-based attacks. Still dangerous! |
| Terrorist / Extremist | Disruption, fear, political coercion | Variable; may be backed by state sponsors | Critical infrastructure (power grids, water systems); goal is disruption and psychological impact |
TTPs — Tactics, Techniques, and Procedures
Cybersecurity analysts identify threat actors by their TTPs — the specific methods they consistently use. Like a criminal's signature, TTPs are hard to change completely. A nation-state APT uses patient, stealthy, long-term access. A hacktivist group uses loud, public, attention-grabbing attacks. A ransomware criminal monetizes quickly and moves on.
Wireless Attacks (Public Network Risks)
- •Evil Twin Attack — attacker creates a fake WiFi hotspot named 'Airport_Free_WiFi'; your device connects automatically; attacker sees all your traffic
- •Packet Sniffing — on open (unencrypted) WiFi, attackers capture data packets flowing through the air with free tools like Wireshark
- •Man-in-the-Middle (MitM) — attacker secretly sits between you and the real network, reading and potentially modifying everything you send
- •Deauthentication Attack — attacker sends forged WiFi disconnect signals, forcing your device off the real network and onto their evil twin
Protecting Yourself on Public Networks
- •✅ Use a VPN — encrypts all traffic between your device and the VPN server; useless to an eavesdropper on the local network
- •✅ Verify HTTPS — the padlock means your browser-to-server connection is encrypted (not the whole network path)
- •✅ Avoid sensitive transactions — don't log into banking or email on unknown public WiFi
- •✅ Turn off auto-connect — prevents your phone from silently joining a familiar-named evil twin network
- •✅ Use cellular data instead — for sensitive tasks, use your phone's mobile data rather than public WiFi
- •✅ Forget public networks after use — removes saved networks your device might auto-join later
A major social media platform is hacked. The attackers don't steal money or data — they post inflammatory political messages, deface the company's website with slogans, and publicly release internal emails showing the company's executives' private discussions. What type of threat actor is most likely responsible?