2.4.1. Threat Actors and TTPs
💡 First Principle: Different threat actors have different motivations, capabilities, and target profiles — knowing who is likely to target your organization shapes which threats to prioritize and which defensive investments matter most.
Understanding threat actors isn't abstract profiling. It drives concrete decisions: a financial institution faces different adversaries with different TTPs than a defense contractor or a hospital. Mitigating controls for nation-state APTs differ from those for opportunistic ransomware groups.
Threat Actor Categories:
| Actor Type | Motivation | Capability | Typical Targets |
|---|---|---|---|
| Nation-state / APT | Espionage, sabotage, geopolitical advantage | Very high — zero-days, custom malware, long-term persistence | Government, defense, critical infrastructure, research |
| Organized crime | Financial gain | High — ransomware-as-a-service, credential theft, BEC | Any organization with money or data to monetize |
| Hacktivists | Political/ideological message | Moderate — DDoS, defacement, data leaks | Organizations with controversial public positions |
| Script kiddies | Recognition, curiosity, disruption | Low — repurposed tools, public exploits | Unpatched, internet-facing systems (opportunistic) |
| Insider threat (intentional) | Revenge, financial gain, coercion | Variable — legitimate access, knows the environment | Employer's sensitive data, systems |
| Insider threat (unintentional) | None — human error | N/A | Any system the user can access |
| Supply chain | Target downstream customers via trusted vendor | Variable | Organizations reliant on specific software/hardware vendors |
TTPs (Tactics, Techniques, and Procedures) describe how threat actors operate:
- Tactics — The high-level goal at each stage (initial access, persistence, lateral movement, exfiltration)
- Techniques — The specific method used to achieve a tactic (spear-phishing attachment, scheduled task creation, SMB lateral movement)
- Procedures — The specific implementation details (exact PowerShell syntax, specific malware variant, specific C2 infrastructure)
MITRE ATT&CK organizes TTPs into a comprehensive matrix — covered in Phase 4. For the exam, the key insight is that TTPs are harder to change than indicators like IP addresses or file hashes. An attacker can rotate C2 infrastructure overnight; changing their core TTP requires retraining and rebuilding tooling. Defensive controls that detect TTPs (behavioral detection) are more durable than controls that block specific indicators (signature detection).
⚠️ Exam Trap: "Advanced Persistent Threat" (APT) refers specifically to nation-state or state-sponsored threat actors characterized by advanced capabilities AND persistence (long-term, stealthy campaigns). Not every sophisticated attack is an APT — the "persistent" element (months or years of quiet presence) is key.
Reflection Question: A threat intelligence report indicates an APT group is actively targeting organizations in your industry using spear-phishing emails with malicious macro-enabled Excel attachments, followed by PowerShell-based lateral movement. Your organization already blocks macro execution in Excel via Group Policy. What does this tell you about the relative value of indicator-based vs. TTP-based defenses for this specific threat?
