In cybersecurity, a threat actor, bad actor or malicious actor is either a person or a group of people that take part in malicious acts in the cyber realm including: , devices, , or Computer network. Threat actors engage in cyber related offenses to exploit open Vulnerability and disrupt operations. Threat actors have different educational backgrounds, skills, and resources. The frequency and classification of cyber attacks changes rapidly. The background of threat actors helps dictate who they target, how they attack, and what information they seek. There are a number of threat actors including: Cybercrime, Nation state actors, Ideology, thrill seekers/trolls, insiders, and competitors. These threat actors all have distinct motivations, techniques, targets, and uses of stolen data.
Mass scammers and automated hackers include cyber criminals who attacks a system to gain Money. These threat actors use tools to infect organization computer systems. They then seek to gain financial compensation for victims to retrieve their data. Criminal infrastructure providers are a group of threat actors that aim to use tools to infect a computer system of an organization. Criminal infrastructure providers then sell the organization's infrastructure to an outside organization so they can exploit the system. Typically, victims of criminal infrastructure providers are unaware that their system has been infected. Big game hunters are another sub-group of cyber criminals that aim to attack one single, but high-value target. Big game hunters spend extra time learning about their target, including system architecture and other technologies used by their target. Victims can be targeted by email, phone attacks or by social engineering skills.
Hacktivism is a term that was coined in the early days of the World Wide Web. It is derived from a combination of two words: hacking and activism. Hacktivists typically are individuals or entities that are ready to commit cyber crimes to further their own beliefs and ideologues. Many hactivists include Anti-capitalism or anti-corporate idealists and their attacks are inspired by similar Politics and . Terrorism includes individuals or groups of people that aim to cause terror to achieve their goals. The main difference between hacktivists and terrorists is their end goal. Hacktivists are willing to break security laws to spread their message while terrorists aim to cause terror to achieve their goals. Ideologues, unlike other types of threat actors, are typically not motivated by financial incentives.
The National Institute for Standards and Technology (NIST) is a government agency that works on issues dealing with cyber security on the national level. NIST has written reports on cyber security guidelines, including guidelines on conducting risk assessments. NIST typically classifies cyber threat actors as national governments, terrorists, organized crime groups, hactivists, and hackers.
European Union (EU) - The European Union Agency for Cybersecurity (ENISA)
The European Union Agency for Cybersecurity is a European Union-based agency tasked in working on cyber security capabilities. The ENISA provides both research and assistance to information security experts within the EU. This organization published a cyber threat report up until 2019. The goal of this report is to identify incidents that have been published and attribute those attacks to the most likely threat actor. The latest report identifies nation-states, cyber criminals, hactivists, cyber terrorists, and thrill seekers.
United Nations (UN)
The United Nations General Assembly (UNGA) has also been working to bring awareness to issues in cyber security. The UNGA came out with a report in 2019 regarding the developments in the field of information and telecommunications in the context of international security. This report has identified the following threat actors: nation-states, cyber criminals, hactivists, terrorist groups, thrill seekers, and insiders.
Canada - Canadian Centre for Cyber Security (CCCS)
Canada defines threat actors as states, groups, or individuals who aim to cause harm by exploiting a vulnerability with malicious intent. A threat actor must be trying to gain access to information systems to access or alter data, devices, systems, or networks.
Japan - National Center of Incident Readiness and Strategy (NISC)
The government's National Center of Incident Readiness and Strategy (NISC) was established in 2015 to create a "free, fair and secure cyberspace" in Japan. The NICS created a cybersecurity strategy in 2018 that outlines nation-states and cybercrime to be some of the most key threats. It also indicates that terrorist usage of the cyberspace needs to be monitored and understood.
Russia - Security Council of the Russian Federation
The Security Council of the Russia published the cyber security strategy doctrine in 2016. This strategy highlights the following threat actors as a risk to cyber security measures: nation-state actors, cyber criminals, and terrorists.
CrowdStrike is a cybersecurity technology company and antivirus company that publishes an annual threat report. The 2021 Global Threat Report reports nation-states and cybercriminals as two major threats to cyber security.
FireEye
FireEye is a cybersecurity firm that is involved with detecting and preventing cyber attacks. It publishes a report on detected threat trends annually, containing results from their customers sensor systems. Their threat report lists state sponsored actors, cyber criminals and insiders as current threats.
McAfee
McAfee is an American global computer security software company. The company publishes a quarterly threat report that identifies key issues in cybersecurity. The October 2021 threat report outlines cybercriminals as one of the biggest threats in the field.
Verizon
Verizon is an American multinational telecommunications company that has provided a threat report based on past customer incidents. They ask the following questions when defining threat actors: "Who is behind the event? This could be the external “bad guy” who launches a phishing campaign or an employee who leaves sensitive documents in their seat back pocket". They outline nation state actors and cybercriminals as two types of threat actors in their report.
Phishing is one method that threat actors use to obtain sensitive data, including usernames, passwords, credit card information, and social security numbers. Phishing attacks typically occur when a threat actor sends a message designed to trick a victim into either revealing sensitive information to the threat actor or to deploy malicious software on the victim's system.
Cross-Site Scripting
Cross-site scripting is a type of security vulnerability that can be found when a threat actor injects a client-side script into an otherwise safe and trusted . The code then launches an infectious script onto a victim's system. This allows a threat actor to access sensitive data.
SQL Injections
SQL injection is a code injection technique used by threat actors to attack any data-driven applications. Threat actors can inject malicious SQL statements. This allows threat actors to extract, alter, or delete victim's information.
Denial of Service Attacks
A denial-of-service attack (DoS attack) is a cyber-attack in which a threat actor seeks to make an automated resource unavailable to its victims by temporarily or indefinitely disrupting Network service of a network host. Threat actors conduct a DoS attack by overwhelming a network with false requests to disrupt operations.
|
|