Threat Actor Landscape: Ransomware, APTs and Motivation
The threat actor landscape domain tests whether you can place an intrusion in the right actor category and predict the next move from motive, funding and tooling rather than from a single malware hash.
Categories and what they imply
- Nation-state APTs - APT28 (GRU), APT29 (SVR, also tracked as Cozy Bear and Midnight Blizzard), Lazarus (DPRK) and APT41 (China, espionage plus financially motivated work). Expect long dwell time, bespoke implants, and interest in email, government, defence and research.
- eCrime and RaaS - profit-driven affiliates who often buy access from initial access brokers, then use commodity C2 (Cobalt Strike, Sliver), exfiltration tooling (rclone, ExMatter) and an encryptor.
- Hacktivists - DDoS, defacement and doxxing; low tradecraft, high noise.
The ransomware supply chain
Ransomware-as-a-service separates development from intrusion. Core operators maintain the encryptor, leak site and negotiation portal; affiliates obtain access, move laterally, steal data and execute the payload, and splits usually favour the affiliate. Double extortion means theft is planned before encryption, so exfiltration logs often precede the ransom note by days.
Worked example
Telemetry shows a phishing attachment, a Cobalt Strike beacon from a user workstation, nine quiet days, rclone uploads to cloud storage, then LockBit execution. Reasoning: dwell time alone does not make this an APT. The discriminating facts are commodity tooling, cloud exfiltration and clear monetisation, so the profile is a RaaS affiliate. The hunt should pivot backwards to the access broker entry point - an exposed VPN or purchased RDP credential - not to a bespoke implant.
Traps
- Treating aliases as separate actors (APT29, Cozy Bear and Midnight Blizzard are one cluster).
- Assuming APT means advanced at every step; many rely on phishing and valid accounts.
- Attributing every LockBit intrusion to one person; affiliates differ enormously.