What is Threat Actor?

Nation-state actors, tracked in the industry as APT (Advanced Persistent Threat) groups, are the most resourced and patient category, often operating with government backing, months-long dwell times, and objectives tied to espionage, strategic disruption, or economic advantage rather than quick payout. APT28/Fancy Bear (linked to Russia's GRU) and APT41 (China, notable for running both state espionage and financially motivated operations out of the same infrastructure) and Lazarus Group (North Korea, blending financial theft with espionage to fund state programs) are commonly referenced examples, each with a documented TTP profile that intelligence teams track over years. Cybercriminal organizations are purely financially motivated: ransomware operators, business email compromise crews, and financial fraud rings. Ransomware-as-a-Service groups like LockBit, BlackCat/ALPHV, and Cl0p run affiliate models where the core group develops the malware and negotiates payment infrastructure while independent affiliates handle initial access and deployment for a cut, which is why the same ransomware strain can show wildly different initial-access techniques across victims. Hacktivists pursue political or ideological goals through DDoS, website defacement, or leaking stolen data publicly rather than for profit, and their operations are often loud and timed to a news event rather than stealthy. Insider threats and low-skill opportunists ('script kiddies') round out the taxonomy at the lower-sophistication end, though an insider with legitimate credentials can be just as damaging as an APT despite needing none of the technical capability. Commercial threat intelligence platforms (Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence) maintain living actor profiles that track observed infrastructure, malware families, and targeted sectors, which analysts use to build actor-specific detection rules and hunting hypotheses rather than generic ones. Frameworks like the Diamond Model formalize this by mapping every intrusion event across four connected vertices, adversary, capability, infrastructure, and victim, so that overlapping infrastructure or malware reuse observed across separate incidents can reveal they're actually the same threat actor operating against multiple targets, not unrelated events.