3.1.1. Types of Threat Actors

💡 First Principle: Threat actors are categorized by their organizational backing, resources, and capabilities. The category tells you what level of sophistication to expect and what defenses are proportionate.

Nation-state actors are government-sponsored or government-affiliated groups conducting cyber espionage, sabotage, or warfare. They have effectively unlimited resources, zero-day exploits, and long time horizons. Examples include APT groups targeting critical infrastructure, defense contractors, and political targets. Their attacks are persistent, stealthy, and strategically motivated.

Unskilled attackers (sometimes called script kiddies) use pre-built tools and scripts without deep understanding of underlying techniques. Despite limited skill, they cause real damage through automated scanning, exploit kits, and widely available malware. They represent the highest volume of attacks but the lowest sophistication.

Hacktivists are motivated by political, social, or ideological causes. They use defacement, DDoS attacks, and data leaks to embarrass targets or promote their message. Anonymous was the most prominent hacktivist collective. Their attacks are typically less sophisticated but very public.

Insider threats come from people with legitimate access: employees, contractors, or business partners. They're particularly dangerous because they bypass perimeter defenses entirely. Insider threats can be malicious (disgruntled employee stealing data) or unintentional (careless employee clicking phishing link).

Organized crime treats cybercrime as a business. These groups run ransomware-as-a-service operations, credit card theft rings, and business email compromise schemes. They're motivated purely by financial gain, highly organized, and increasingly sophisticated.

Shadow IT — technology deployed by employees or departments without IT approval. While not a traditional threat actor, shadow IT creates unmanaged attack surfaces: unapproved cloud storage, personal devices on the network, and unsanctioned SaaS applications that may not meet security standards.

⚠️ Exam Trap: Insider threats include both malicious (intentional harm) and unintentional (careless mistakes). The exam may describe a scenario where an employee accidentally exposes data — that's still an insider threat. Also distinguish shadow IT from insider threat: shadow IT is about unapproved technology, not malicious intent.