What Is a Threat Actor?
A threat actor is an individual, or group of individuals, who conduct malicious activities on the internet such as cyber attacks, data theft, or the spread of malware. They operate under various motivations, such as financial gain, political or ideological beliefs, or for other criminal motivations.
There are many terms, including threat actor, bad actor, and malicious actor, that are mostly interchangeable. There are also many terms that refer to threat actors but give a little more context around what their methods or motivations may be.
What Are the Different Terms for Threat Actor?
Scammer
This is a term often used for threat actors that rely on social engineering, often a combination of phishing and scam phone calls. This term often refers to threat actors who prey on individuals to gain access to their personal accounts and or their finances. Not frequently used when discussing threat actors who focus on attacking organizations, but more for those who target individuals.
Insider threat
This term is used when a threat actor comes from inside a company. Sometimes the threat actor hides their intentions and makes their way into an organization by getting hired as an employee. But it could also refer to a current or former employee that becomes tempted by outside threat actors to divulge sensitive information for financial gain or malicious purposes, such as revenge against an organization who slighted them.
Insider threat can also refer to employees who are insufficiently trained, which results in them being ill-equipped to identify or defend against threats and as a result, they become an inside threat.
Social Engineer
A social engineer uses believable lies or offers to convince people into taking a specific action or divulging information that helps to exploit themselves or their organization. Tactics include phishing emails, smishing (text scams) and vishing (phone calls built on lies), or even trying to enter a physical location
Cybercriminal/Cyber thief/Black Hat Hacker/Hacker
These act as individuals or as part of an organized group to target individuals and organizations for financial information such as credit card numbers, social security numbers, wire fraud, and other sensitive data. Sometimes, they are motivated by notoriety rather than financial gain.
In addition, these are the kinds of threat actors behind ransomware attacks, business email compromise (BEC) attacks, and various malware-initiated breaches.
State-Sponsored Threat Actor or Cyber Terrorist
Typically backed by a government or nation-state, these threat actors engage in cyber attacks for political or military objectives. They often have a high level of resources and technical expertise, making them a significant threat to organizations and governments. This category includes individuals or groups who engage in cyber attacks with the intention of causing widespread fear and panic.
Unlike other categories of threat actors, cyber terrorists are not necessarily motivated by financial gain.
Since in the invasion of Ukraine by Russia in 2022, both sides have utilized state-sponsored threat actors to carry out cyber attacks against each other and allies. According to Politico, more than 2,000 cyber attacks were aimed at Ukraine in 2022.
Hacktivists
These are individuals or groups who engage in hacking or other cyber attacks for political or ideological reasons. They often target organizations that they believe to be engaging in activities that are contrary to their beliefs.
All of these terms essentially speak about the same activity. A bad actor exposing a vulnerability to gain information, access, or performs a damaging action they are not supposed to.
While some cybercriminals are technical wizards, often the bad actors don’t have to be technical to expose a vulnerability in an organization or system or conduct a social engineering attack. The rise of ransomware-as-a-service has allowed more amateur cyber criminals to launch ransomware attacks, and the expansion of the dark web has also increased the ecosystem in which new threat actors can operate and conduct cybercrime.
What Do Threat Actors Look For? Tricks, Slips, Risks.
1. Tricks
Often threat actors will rely on simply tricking people to give them the information or access they are looking for. Many times, the way a threat actor gets into an organization is by simply tricking employees to thinking they can be trusted and then ask for access.
They resort to tricking employees through:
Phishing, SMishing, or Vishing: This involves tricking individuals into providing sensitive information through emails, text messages, or phone calls. Phishing attacks can be targeted or mass distributed and often use social engineering tactics to trick individuals into revealing their personal information.
2. Slips
Much like walking through a shopping mall parking lot jiggling door handles on vehicles to see which ones are unlocked, threat actors will also navigate their way through organizations; technology, website, pay portals, and any other technology they’re utilizing, to find something that someone who left a digital door open.
3. Risks
Threat actors can’t always get everything they want without introducing risks into your environment. Getting their malware or, ransomware, into the environment is often what it takes.
There are many ways they get this done with either attachments in emails, thumb drives left in an office parking lot, dropping malware or ransomware on machines through malicious apps, fraudulent or risky websites, or many other delivery mechanisms.
What Are Common Risks Threat Actors Work to Introduce to an Environment
Malware
This includes viruses, Trojans, and other forms of malicious software that are designed to cause harm to computer systems. Malware can be spread through email attachments, downloads from the internet, or even via infected USB devices.
Distributed Denial of Service (DDoS) Attacks
This involves overwhelming a website or network with traffic, causing it to become unavailable. DDoS attacks can be used to take down websites for political or ideological reasons or simply to extort money from the targeted organization.
Ransomware
This type of malware involves encrypting an individual or organization’s data and demanding a ransom payment in exchange for the decryption key. Ransomware attacks can cause significant financial harm and can disrupt business operations.
Advanced Persistent Threats (APTs)
This is a type of targeted cyber attack that involves gaining unauthorized access to an organization’s network and remaining undetected for an extended period of time. The threat actor often remains just a ‘fly on the wall’ as they observe the actions and information used to execute important tasks such as wire transfers, then uses that ‘inside info’ to easily fool an organization to follow their instructions for wiring money.
Also, in many instances of this type of attack, the threat actor waits until a holiday, or a weekend when they know fewer people will be monitoring activity to launch their attack so they can get further into the damaging attack before being caught or stopped. APTs can steal sensitive data, intellectual property, other valuable information, or launch a second phase of an attack deeper and further into organizations, like during a ransomware attack.
Threat actors are focused on how they can exploit their tricks, slips, and risks in each area of an organization’s threat landscape to then launch an attack. They will attempt to access organization devices, network, cloud, and even people.
How Arctic Wolf Can Help
Arctic Wolf’s solutions are designed to help organizations proactively protect and reactively respond to threat actors and their tactics.
Arctic Wolf® Managed Detection and Response (MDR) utilizes 24×7 monitoring to help detect immediate threats. If a threat actor is trying to breach a network, working to access credentials, or introduce a risk to the environment, MDR can help detect these behaviors and guide organizations through a response and possible remediation.
Arctic Wolf® Managed Risk helps organizations identify and mitigate vulnerabilities. External exposure, or the exploitation of vulnerabilities by threat actors, is a common root point of compromise. By mitigating threats like vulnerabilities, organizations are preventing threat actors from even initiating an attack.
Arctic Wolf Managed Security Awareness® combines micro-learning sessions with relevant content to help employees not only understand how threat actors operate and dive into tactics like credential theft and BEC, while ensuring that they can spot and report suspicious activity before it becomes a full-blown attack.
Arctic Wolf Incident Response can help organizations respond, restore, and remediate fast after a breach or attack by a threat actor. Valued for breadth of IR capabilities, technical depth of incident investigators, and exceptional service provided throughout IR engagements, Arctic Wolf Incident Response is a preferred partner of cyber insurance carriers.
