Threat Landscape and Actor Analysis
What this domain tests
Threat landscape and actor analysis tests your ability to classify adversaries, compare their intent, capability, opportunity, and constraints, and reason about attribution without overstating certainty. Questions often present intrusion evidence and ask what can and cannot be concluded.
Actor categories and attributes
- Nation-state and state-aligned groups pursue espionage, strategic advantage, disruption, and intellectual property. They often have long dwell times, custom tooling, strong operational security, and patience.
- eCrime groups pursue revenue through ransomware, business email compromise, payment fraud, and data extortion. The ecosystem includes ransomware-as-a-service (RaaS) operators and affiliates, initial access brokers (IABs), loaders, infostealers, and money-laundering services.
- Hacktivists pursue ideological influence through defacement, DDoS, leaks, and doxxing; capability varies widely.
- Insiders abuse authorized access for grievance, coercion, ideology, or money.
- Cyberterrorists seek psychological and political impact; true cases are rare, and the label is often misapplied.
Compare actors on intent, capability, targeting, TTPs, infrastructure, funding, risk tolerance, and operational tempo. Capability is not the same as intent, and high capability does not prove state sponsorship.
Attribution and naming
Vendors use different naming schemes (animal names, weather names, numbered APTs), so alias tracking is essential. Attribution is layered: malware family, campaign or intrusion set, threat actor cluster, and sponsor. Each layer carries different confidence. Evidence can include targeting, tooling reuse, infrastructure overlaps, language artifacts, time-zone patterns, code similarities, and tasking that aligns with state interests. All can be false-flagged or shared through criminal markets.
Worked example
Two intrusions use the same loader and the same phishing kit but diverge afterward: one deploys a commodity ransomware affiliate, the other steals email and persists quietly. The shared loader suggests a common supplier or affiliate, not a single actor. The divergent post-exploitation and victimology weaken the "same actor" hypothesis. A defensible judgment names the shared tooling, attributes the activity to a criminal ecosystem with moderate confidence, and recommends monitoring both post-exploitation patterns.
Traps that cost marks
- Equating a malware family with an actor.
- Attributing by IP geolocation or language alone.
- Assuming sophistication equals state sponsorship.
- Treating vendor cluster names as stable ground truth.
- Ignoring false flags and shared criminal infrastructure.
- Writing static actor profiles that never get updated.