CompTIA Security+ Preparation · lesson 11 of 45 · 25 min
Understanding Threat Actors
A threat actor (also called a threat agent) is any individual, group, or entity that has the potential to cause harm to an information system. Understanding who your adversaries are — their capabilities, resources, and motivations — is the foundation of threat intelligence and risk assessment.
The Security+ exam expects you to identify threat actor types, their attributes (sophistication, resources, intent), and their typical motivations. This knowledge directly informs which controls you prioritize.
Threat Actor Types
Threat Actor Attributes
When analyzing a threat actor, security professionals assess four key attributes:
APT — Advanced Persistent Threat
An APT is a prolonged, targeted attack campaign — typically nation-state sponsored — that gains and maintains unauthorized access over months or years. APTs use sophisticated, custom malware and live-off-the-land techniques to avoid detection. Examples: APT28 (Fancy Bear / Russia), APT41 (China), Lazarus Group (North Korea).
Motivations Deep Dive
Flashcard Drill
Nation-state / APT Government-sponsored, highly sophisticated, long-term targeted attacks for espionage or sabotage. Organized crime Criminal groups motivated by financial gain — ransomware, fraud, data theft. Hacktivist Ideologically motivated attacker — political/social agenda; defacement, DDoS, leaks. Insider threat Current or former employee/contractor with privileged access; motivated by gain, revenge, or negligence. Script kiddie Low-skill attacker using pre-built tools; motivated by notoriety or curiosity. APT Advanced Persistent Threat — prolonged, targeted, nation-state-level campaign maintaining long-term access. Shadow IT Unauthorized technology used by employees — creates unmanaged risk even without malicious intent. Threat intelligence Evidence-based knowledge about threat actors, their capabilities, and their tactics used to inform defenses. TTPs Tactics, Techniques, and Procedures — the behavior patterns of a threat actor. MITRE ATT&CK Knowledge base of adversary TTPs organized by attack phase — used for threat modeling and detection.
Scenario Practice
The Ransomware Attack
This is most likely a nation-state APT attack motivated by espionage. This is most likely organized crime motivated by financial gain using ransomware-as-a-service. This is most likely a hacktivist attack motivated by ideology. This is most likely a script kiddie using a pre-built tool. 1 Double-extortion ransomware with cryptocurrency demands is the signature of organized crime groups. Nation-states prefer stealth over ransom. Hacktivists typically use DDoS or defacement. Script kiddies lack the sophistication for double-extortion campaigns.
The Disgruntled Employee
External threat actor — organized crime recruited him. Insider threat — disgruntled employee motivated by revenge/grievance with privileged access. Nation-state threat — he is selling data to a foreign government. Script kiddie — he is using pre-built tools. 1 This is a classic insider threat scenario. The actor is internal, has privileged access, and is motivated by grievance. The key indicators are: recent negative event, privileged role, and data exfiltration to personal storage.
Knowledge Check
Threat Actors — 10 Questions
Which threat actor type is characterized by government sponsorship, high sophistication, and long-term persistent access?
- Script kiddie
- Hacktivist
- Nation-state / APT
- Organized crime
Answer: Nation-state / APT
Nation-state APTs are government-sponsored, highly sophisticated, and maintain persistent access over months or years.
A group defaces a corporation’s website to protest its environmental practices. This is best described as:
- Organized crime
- Hacktivism
- Corporate espionage
- Insider threat
- Answer: Hacktivism
Hacktivists are ideologically motivated — they attack to make a political or social statement.
An insider threat must be a malicious employee — negligent employees do not qualify.
- True
- False
Answer: False
Insider threats include negligent employees who accidentally expose data, not just malicious actors.
Which attribute of a threat actor describes their technical skill and capability?
- Resources
- Intent
- Level of sophistication
- Internal vs external
Answer: Level of sophistication
Sophistication describes the actor’s technical skill — from script kiddies (low) to nation-states (very high).
The knowledge base of adversary tactics, techniques, and procedures organized by attack phase is called MITRE _____.
Answer: ATT&CK
MITRE ATT&CK is the industry-standard framework for cataloging adversary TTPs.
Which threat actors are primarily motivated by financial gain? (Select all that apply)
- Nation-state
- Organized crime
- Hacktivist
- Insider (financial)
- Script kiddie
Answer: Organized crime
Insider (financial)
Organized crime and financially motivated insiders are primarily driven by money. Nation-states seek espionage/disruption. Hacktivists seek ideological goals. Script kiddies seek notoriety. An employee uses an unauthorized cloud storage service to share work files because the approved tool is too slow. This is best described as:
- Insider threat — malicious
- Shadow IT — unintentional risk
- Hacktivist activity
- Organized crime
- Answer: Shadow IT — unintentional risk
Shadow IT is the use of unauthorized technology for convenience — it creates risk without malicious intent.
Which term describes the behavior patterns of a threat actor — their methods and procedures?
- IOC
- CVE
- TTPs
- CVSS
Answer: TTPs
TTPs (Tactics, Techniques, and Procedures) describe how a threat actor operates.
Script kiddies are considered low-sophistication threat actors because they rely on pre-built tools rather than developing their own exploits.
- True
- False
Answer: True
Script kiddies lack the skill to develop original exploits — they use tools and scripts created by others.
Double-extortion ransomware (encrypt + threaten to leak data) is most associated with which threat actor type?
- Nation-state APT
- Organized crime
- Hacktivist
- Script kiddie
Answer: Organized crime
Double-extortion ransomware is a financially motivated organized crime tactic — encrypt for ransom, threaten to publish stolen data for additional leverage.
Try it: Threat actors
Previous lesson: Authorization models: DAC, MAC, RBAC, ABAC, rule-based access control
Back to CompTIA Security+ Preparation
Next lesson: Vulnerability scanning and assessment concepts