Threat Actors & Attack Vectors
Mission Brief
Glasshouse Bank's risk register lists 'cyber attack' as a single line item. The CISO wants you to decompose it into named adversaries with realistic playbooks so the defence budget can be aimed, not sprayed.
Story · Three breaches, three very different attackers
In one month Glasshouse's industry peers suffered three incidents. A small credit union was crippled by LockBit ransomware demanding $2.1M. A government-owned bank in a neighbouring country had wire-transfer instructions silently altered for 11 days — fingerprints pointed to a state-sponsored APT. A fintech lost a confidential merger memo: posted to a leak forum by a contractor who'd been let go the prior Friday.
Same word — 'breach'. Three completely different attackers, with different goals, tools, patience, and tells. A defence built only for ransomware would have missed the APT and the insider entirely.
Threat-actor literacy is what turns generic security spending into targeted spending. By the end of this hour you'll read an incident summary and name the likely actor class within thirty seconds.
Trainer · Core Concepts
Low skill, runs off-the-shelf tooling (Metasploit modules, leaked exploit kits). Motivation: bragging rights, curiosity. Targets are opportunistic — whoever is exposed. Defends easily with patching, MFA, basic hygiene. They are noisy and unsubtle, which makes them the most common reason for a SOC alert.
Skill ranges low to medium. Motivation is ideological (political, environmental, religious). Common vectors: web defacement, DDoS, doxxing, hack-and-leak. Anonymous, LulzSec, and modern groups like KillNet are archetypes. They want visibility, so attacks are public-facing and timed to events (elections, conflicts, protests).
Skilled, well-resourced, financially motivated. Ransomware-as-a-Service crews (LockBit, BlackCat, Cl0p), business-email-compromise rings, banking trojan operators, initial-access brokers. They run businesses — affiliates, ransom negotiators, leak sites. Their preferred vectors: phishing, exposed RDP/VPN, exploited public CVEs, MSP supply chain.
Has legitimate access already. Sub-types: MALICIOUS (disgruntled, espionage-for-hire, ideological), NEGLIGENT (clicks the phishing link, misconfigures the S3 bucket), COMPROMISED (account taken over without their knowledge). Hardest class to detect because their behaviour starts inside the trust boundary. UEBA, DLP, least-privilege, and offboarding rigor are the main controls.
Nation-state or state-sponsored. Highest skill, long-term resources, willing to spend months staging an operation. Goals: espionage, IP theft, sabotage, financial gain for the state (e.g. DPRK's Lazarus stealing crypto). Operate slowly, blend with legitimate admin activity, use zero-days when needed. Detection requires threat-intel-driven hunting and high-fidelity telemetry.
Aim to cause physical or societal disruption (power grids, transport, hospitals). Often state-tolerated or state-aligned. Vectors blur with APTs: spear-phish into OT environments, then destructive payloads. CEH groups them under 'cyber terrorism' but their tradecraft overlaps with both hacktivists and APTs.
Knowledge Map · drag to explore
Micro Labs
Lab 7 · Profile the Actor
Read each incident summary. Tag with the most likely threat-actor class.
Lab 8 · Map Actor → Preferred Vector
Match each actor class to the attack vector that statistically appears most in their playbooks.
Lab 9 · Pick the High-Leverage Control
For each threat-actor profile, which single control gives the most defensive leverage per dollar?
Regional bank's biggest risk is ransomware (organised cybercrime). Limited budget for one initiative this quarter.
Threat model now adds APT (state-sponsored economic espionage). Top single investment?
Insider risk is rising — three contractor terminations next month. Single biggest control?
Knowledge Check
Challenge · The 30-Second Triage
Pick any one of Lab 7's scenarios. In ≤30 seconds, state: (1) actor class, (2) probable next move, (3) the ONE control that would have stopped them earliest in the kill chain.
CEH v13 Exam Focus
- ·Threat-actor classes and distinguishing motivations
- ·Mapping actor → typical TTPs / vectors
- ·Insider sub-types: malicious vs. negligent vs. compromised
- ·Why zero-days correlate with APTs
- ·SHCIA — Script-kiddie, Hacktivist, Cybercrime, Insider, APT (low → high capability).
- ·MNC insiders — Malicious, Negligent, Compromised: three flavours, one access path.
- ⚠Equating 'sophisticated attack' with 'APT' — ransomware crews are sophisticated too.
- ⚠Forgetting that negligent insiders count even without intent.
- ⚠Calling state-aligned hacktivists 'just hacktivists' — tradecraft may overlap APT.
- ▸Lone wolf / vandal = script kiddie
- ▸Ideology + public = hacktivist
- ▸Money + business model = cybercrime
- ▸Already inside = insider
- ▸Stealth + state = APT