Threat Actors, Attacks and the Cyber Threat Landscape

Introduction

Cybersecurity is concerned not only with protecting computers and networks, but also with understanding who conducts attacks, why attacks occur, how they are organised, and how defenders can interrupt them. A security control is most effective when it is selected in response to a credible threat. For example, multifactor authentication directly reduces the value of stolen passwords, while offline backups reduce the impact of ransomware. Neither control is sufficient for every threat.

The cyber threat landscape is the changing environment of adversaries, vulnerabilities, technologies, criminal markets, geopolitical interests and defensive capabilities. It is shaped by cloud computing, mobile devices, remote work, artificial intelligence, software dependencies and the increasing connectivity of operational technology. Threat analysis therefore requires both technical knowledge and an understanding of human, organisational and economic factors.

This chapter introduces major threat actors and attack types, then uses the Cyber Kill Chain and MITRE ATT&CK to interpret attacks as sequences of observable behaviour. The objective is not to teach offensive exploitation, but to develop the analytical foundation needed for prevention, detection, response and risk-informed decision-making.

Learning Objectives

By the end of this chapter, you should be able to:

• classify threat actors according to motivation, resources, capability and access;
• distinguish vulnerabilities, threats, attacks, exploits, events and incidents;
• explain malware, ransomware, phishing, social engineering, credential attacks, denial-of-service and supply-chain compromise;
• interpret an attack using the Cyber Kill Chain and MITRE ATT&CK;
• identify defensive controls at different stages of an intrusion;
• evaluate limitations, ethical issues and governance responsibilities in threat analysis.

1. Foundations of the Threat Landscape

A threat is a circumstance or actor with the potential to cause harm. A vulnerability is a weakness that may be exploited. An exploit is a method, code sequence or procedure that takes advantage of a vulnerability. An attack is an intentional attempt to compromise confidentiality, integrity or availability. A security event is an observable occurrence in a system; an incident is an event, or group of events, that actually or potentially compromises security and requires investigation or response.

These concepts should not be treated as synonyms. A vulnerable server is a condition; an exploit is a means; an attack is an attempt; and an incident is a security consequence requiring organisational action. Risk is commonly described conceptually as the relationship between likelihood and impact. This is not a universal numerical law, because organisations use different scales and assumptions, but a useful qualitative expression is:

Likelihood describes how probable a harmful event is within a defined period and context. Impact describes the severity of resulting harm, such as financial loss, service interruption, legal exposure, safety consequences or reputational damage. The expression is useful for prioritisation, but it should not be interpreted as a precise probability unless the variables have been formally defined and measured.

The CIA triad provides a basic classification of security objectives:

• Confidentiality: information is accessible only to authorised parties.
• Integrity: information and systems remain accurate, complete and trustworthy.
• Availability: authorised users can access systems and information when required.

Modern security programmes also consider authenticity, accountability, resilience, privacy and safety. A ransomware attack may primarily threaten availability, but it can also threaten confidentiality when attackers steal data before encrypting it.

2. Threat Actors and Their Motives

A threat actor is an individual, group or organisation that conducts, enables or sponsors malicious activity. Classification helps defenders estimate likely resources, persistence, targets and methods. Categories overlap: a criminal group may use an insider, purchase access from an initial-access broker and deploy tools developed by another group.

2.1 Cybercriminals

Cybercriminals seek financial gain. They may steal payment data, commit business email compromise, operate ransomware, sell access or monetise personal information. Cybercrime is increasingly organised through specialised services. One group may obtain credentials, another may provide malware infrastructure, and a third may negotiate payment. This division of labour lowers the technical barrier to entry.

2.2 Nation-state and state-sponsored actors

Government-directed or government-aligned groups may pursue espionage, strategic intelligence, political influence or military objectives. They often possess substantial funding, specialist personnel and patience. Their operations may remain hidden for months or years and may target government, defence, telecommunications, energy, research or diplomatic organisations. Attribution is difficult: technical evidence can be falsified, infrastructure can be shared, and actors may deliberately imitate others.

2.3 Hacktivists

Hacktivists use cyber activity to promote political, ideological or social causes. Common actions include website defacement, data publication and denial-of-service attacks. Their capability varies widely, from individuals using public tools to coordinated groups with considerable media reach. Their motivation may be symbolic rather than financial, but the operational consequences can still be serious.

2.4 Insiders

An insider is a person with legitimate organisational access who causes harm intentionally or accidentally. A malicious insider may steal data, sabotage systems or assist an external group. A negligent insider may disclose information through a misdirected email, unsafe configuration or response to a fraudulent message. Insider risk is difficult because legitimate access can resemble normal work activity.

2.5 Script users, researchers and competitors

Some actors have limited technical ability and rely on publicly available tools or instructions. Their actions can nevertheless cause damage through poor understanding or indiscriminate scanning. Security researchers may interact with systems to identify weaknesses, usually with authorisation and responsible disclosure. Competitors may seek confidential information or disrupt operations, although such conduct may violate law, contracts and professional ethics.

2.6 Comparing actors

The following dimensions are more useful than labels alone:

Threat intelligence should express confidence and evidence rather than presenting attribution as certainty. Analysts should distinguish observed facts, reasonable inferences and hypotheses.

3. Common Attack Classes

3.1 Malware

Malware is software designed to perform unauthorised or harmful actions. Important categories include:

• Virus: malicious code that attaches to a host file and typically requires execution of that host.
• Worm: malware capable of self-propagation across systems or networks.
• Trojan: software that appears legitimate but performs hidden malicious actions.
• Remote access trojan: malware that provides covert control or monitoring capabilities.
• Spyware: software that collects information without appropriate authorisation.
• Keylogger: a tool that records keystrokes, often to capture credentials.
• Rootkit: tools designed to conceal malicious components or maintain privileged access.
• Bot: an infected device controlled as part of a larger collection, or botnet.
• Wiper: malware intended to destroy or render data and systems unusable.

Modern malware often uses legitimate administrative tools, stolen credentials and cloud services. Consequently, malicious activity cannot always be identified by a distinctive executable file. Behavioural analysis, logging, application control and endpoint detection are increasingly important.

3.2 Ransomware

Ransomware restricts access to systems or data and demands payment. Earlier forms commonly encrypted files on a victim device. Contemporary operations frequently use double extortion: attackers first steal sensitive data and then encrypt systems or threaten publication. Some groups add pressure through harassment, denial-of-service or attacks on business partners.

A ransomware sequence may include phishing or exploitation for initial access, privilege escalation, credential theft, lateral movement, data discovery, exfiltration, backup disruption and encryption. A ransom payment does not guarantee restoration, deletion of stolen data or future safety. Effective resilience includes tested backups, network segmentation, privileged-access controls, endpoint monitoring, vulnerability management and an incident-response plan.

3.3 Phishing and social engineering

Phishing uses deceptive messages or websites to induce a victim to reveal information, open a file, transfer money or approve access. Variants include:

• Spear phishing: targeted deception directed at a particular person or organisation.
• Whaling: targeting senior executives or high-value personnel.
• Smishing: phishing through SMS or messaging applications.
• Vishing: phishing through voice communication.
• Business email compromise: impersonation or compromise used to manipulate payments, disclosures or business processes.

Social engineering is broader than phishing. It exploits trust, authority, urgency, fear, curiosity or helpfulness. An attacker may telephone a help desk, impersonate a supplier or use information from social media to make a message credible. Awareness training is valuable but cannot be the only defence. Strong authentication, transaction verification, email authentication, least privilege and approval workflows reduce the consequences of human error.

3.4 Credential attacks

Credential attacks seek passwords, tokens, keys or session material. Common forms include:

• Brute force: trying many possible passwords.
• Password spraying: trying a small number of common passwords against many accounts.
• Credential stuffing: testing credentials obtained from another breach.
• Phishing: persuading a user to disclose credentials or approve authentication.
• Pass-the-hash or token theft: abusing reusable authentication material without necessarily knowing the original password.
• MFA fatigue: repeatedly generating authentication prompts until a user approves one.

Defences include phishing-resistant multifactor authentication, password managers, breached-password screening, rate limiting, account lockout designed to avoid denial-of-service, risk-based authentication, secure recovery procedures and monitoring for impossible travel or abnormal device use. Password policies should prioritise length, uniqueness and resistance to known compromise rather than relying only on frequent arbitrary changes.

3.5 Denial of service

A denial-of-service attack attempts to make a service unavailable. A distributed denial-of-service attack uses many systems, often a botnet, to generate traffic or requests. Attacks may consume bandwidth, exhaust connection tables, overload applications or target expensive database operations.

Defensive planning should combine capacity, traffic filtering, rate controls, content-delivery services, upstream provider coordination, resilient architecture and tested communication procedures. Availability protection must account for legitimate traffic surges, since an overly aggressive defence can block customers. Service-level objectives and recovery priorities should be agreed before an incident.

3.6 Supply-chain compromise

A supply-chain compromise attacks or abuses a trusted relationship rather than directly attacking the final victim. Targets may include software vendors, managed service providers, open-source packages, build systems, update mechanisms, hardware suppliers and logistics providers. A compromised dependency can distribute malicious code to many downstream organisations.

Controls include supplier due diligence, contractual security requirements, software bills of materials, signed and verified builds, dependency pinning and review, protected build pipelines, separation of development and release privileges, monitoring of vendor access and an ability to revoke or isolate trust. No single control eliminates supply-chain risk because trust is distributed across people, processes and technologies.

4. Understanding Attack Lifecycles

Attacks are often described as lifecycles because an intrusion usually involves a sequence of decisions rather than one action. Lifecycle models support detection and disruption, but real attacks do not always follow a neat linear order. Attackers may repeat stages, skip stages, operate in parallel or exploit an existing foothold.

4.1 The Cyber Kill Chain

Lockheed Martin’s Cyber Kill Chain describes seven broad stages:

1. Reconnaissance: collecting information about targets, people, technologies and exposed services.
2. Weaponisation: combining an exploit or malicious capability with a delivery mechanism.
3. Delivery: transmitting the payload through email, a website, removable media, a service or another route.
4. Exploitation: triggering a vulnerability or persuading a user to execute or authorise an action.
5. Installation: establishing malware or another persistent capability.
6. Command and control: communicating with an operator or receiving instructions.
7. Actions on objectives: stealing data, disrupting operations, conducting fraud or achieving another goal.

The model encourages defenders to ask where an attack can be interrupted. For example, secure email gateways may reduce delivery, patching may reduce exploitation, endpoint controls may prevent installation, and egress monitoring may identify command and control. The model is easy to communicate, but it was designed around intrusion campaigns and may represent modern identity attacks, cloud abuse and insider activity imperfectly.

4.2 MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary tactics, techniques and procedures. A tactic describes the adversary’s objective, such as Credential Access or Discovery. A technique describes how that objective may be achieved, while a sub-technique provides greater detail. A procedure is an observed implementation by a particular actor or campaign.

ATT&CK is not a linear attack checklist. It is a structured language for mapping observed behaviour, developing detections, assessing defensive coverage and communicating threat intelligence. Organisations can map logs and controls to techniques, then identify important gaps. ATT&CK also includes perspectives for enterprise, mobile and operational technology environments.

The two models serve different purposes. The Cyber Kill Chain gives a high-level campaign sequence; ATT&CK provides a more detailed behavioural vocabulary. They can be used together: a phishing email may represent delivery in the Kill Chain and a technique associated with Initial Access in ATT&CK; credential dumping may occur during Credential Access and support later Lateral Movement.

5. Applied Analysis: A Ransomware Scenario

The following is an illustrative case, not a report of a particular real organisation.

Background

A medium-sized manufacturer operates an internet-facing remote-access portal, central identity services, production systems and cloud email. Employees work across several sites, and a managed service provider supports some infrastructure. Backups exist, but restoration has not been tested recently.

Problem

A finance employee receives a convincing supplier-themed message and enters credentials into a counterfeit sign-in page. Two days later, monitoring identifies unusual authentication from a foreign address. The attacker accesses a file server, obtains additional credentials, disables selected security tools and copies production and personnel documents. On a weekend, systems are encrypted and a ransom demand appears.

Analysis

Using the Cyber Kill Chain, the campaign can be interpreted as reconnaissance, delivery through targeted phishing, exploitation through credential disclosure and authentication approval, installation or persistence through account and remote-access abuse, command and control through external infrastructure, and actions on objectives through theft and encryption.

Using ATT&CK terminology, the defenders would investigate Initial Access, Valid Accounts, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Inhibit System Recovery and Impact. The exact mapping must be based on evidence; analysts should not claim a technique merely because it is common in ransomware incidents.

Response and improvement

The organisation should first activate incident response, isolate affected systems, preserve evidence, protect safety-critical production processes and notify appropriate stakeholders. It should not destroy logs or immediately rebuild every system before evidence is collected. Credentials and tokens should be reset in a controlled manner, with priority given to privileged and service accounts. External responders, legal advisers, insurers and regulators may need to be involved.

After containment, the organisation should validate clean backups, restore in a prioritised sequence and monitor for persistence. Longer-term measures include phishing-resistant MFA, conditional access, segmentation between office and production networks, least privilege, privileged-access management, centralised logging, tested recovery exercises, supplier-access review and improved detection of unusual data transfers.

Outcome and learning points

The most important lesson is that ransomware resilience is not a single product. The incident crossed identity, email, endpoint, network, backup, supplier and governance boundaries. A control that would have interrupted the campaign early—such as phishing-resistant authentication—may be more valuable than a control that only detects encryption after substantial damage. Post-incident review should examine technical causes, decision-making, communication, training, business continuity and accountability.

6. Defensive and Professional Implications

Effective defence is layered. Preventive controls reduce the chance of compromise; detective controls identify suspicious activity; responsive controls contain and investigate it; recovery controls restore reliable services. Examples include secure configuration, vulnerability remediation, multifactor authentication, segmentation, endpoint detection, central logging, backup protection, incident exercises and tested continuity plans.

Security teams should prioritise assets and identities rather than treating all alerts equally. A suspicious login to a privileged administrator account deserves different attention from an isolated failed login to a low-risk account. Detection engineering should begin with realistic threats and important business processes, then identify the telemetry needed to recognise relevant behaviours.

Threat intelligence has limitations. Indicators such as IP addresses, domains and file hashes can become obsolete quickly. Behavioural intelligence is often more durable, but it may produce false positives. Attribution can be uncertain, and intelligence collected without legal authority may create privacy or admissibility problems. Analysts should document sources, confidence, assumptions and time sensitivity.

Ethics, law and governance

Defenders must obtain authorisation before scanning, testing or monitoring systems. Unauthorised access, interception, data alteration and distribution of malware may be criminal offences. Privacy principles require that monitoring be proportionate, transparent where appropriate, securely managed and limited to legitimate purposes. Organisations should define roles, escalation paths, retention periods and breach-reporting obligations before an incident occurs.

Responsible vulnerability disclosure balances timely remediation with the risk of enabling exploitation. Security professionals should avoid publishing sensitive details before affected parties can respond, should respect scope in testing agreements and should protect evidence and personal information. Artificial intelligence can assist with phishing analysis, anomaly detection, malware triage and analyst productivity, but generated conclusions require verification. AI systems can produce false positives, expose sensitive data or be manipulated by adversarial inputs; they do not remove the need for human judgement and governance.

7. Contemporary Developments and Best Practice

Several developments are reshaping the threat landscape:

• cloud identity has become a primary attack surface;
• criminals increasingly purchase access and specialised services;
• software and data supply chains create concentrated systemic risk;
• extortion may involve data theft even when encryption is not used;
• deepfakes and generative AI can improve impersonation and fraud;
• defenders increasingly adopt zero-trust principles, continuous verification and identity-aware segmentation;
• operational technology and connected devices expand the consequences of compromise.

A practical baseline for diploma-level professionals is to:

1. maintain an inventory of assets, identities, suppliers and dependencies;
2. apply risk-based patching and secure configuration;
3. require strong, preferably phishing-resistant authentication for sensitive access;
4. use least privilege and separate administrative accounts;
5. centralise and protect logs, with time synchronisation;
6. segment critical services and restrict unnecessary egress;
7. protect backups from ordinary administrative credentials and test restoration;
8. train users using realistic, non-punitive exercises;
9. rehearse incident response, communications and continuity procedures;
10. map important threats and detections to ATT&CK or another documented framework.

These practices should be measured through meaningful outcomes: reduced time to detect and contain, successful restoration tests, coverage of critical assets, remediation of high-risk weaknesses and the proportion of privileged access protected by strong authentication. Metrics must be interpreted carefully; a high number of detected incidents may indicate better visibility rather than worse security.

Chapter Summary

Threat actors differ in motivation, capability, resources, access and persistence. Cybercriminals commonly pursue financial gain, nation-state actors may conduct espionage or strategic operations, hacktivists seek ideological impact, and insiders may act maliciously or negligently. Malware, ransomware, phishing, social engineering, credential attacks, denial of service and supply-chain compromise exploit different weaknesses and require layered controls.

The Cyber Kill Chain provides a high-level sequence from reconnaissance to actions on objectives. MITRE ATT&CK provides a detailed behavioural vocabulary of tactics, techniques, sub-techniques and procedures. Used together, these models help defenders identify prevention and detection opportunities without assuming that every attack follows a fixed linear path. Effective cybersecurity combines technology, governance, human judgement, legal authority, resilience and continuous improvement.

Key Terms

Threat actor: An individual, group or organisation that conducts or enables harmful cyber activity.

Threat: A circumstance or actor with the potential to cause harm.

Vulnerability: A weakness that may be exploited.

Exploit: A method or code sequence that takes advantage of a vulnerability.

Malware: Software designed to perform unauthorised or harmful actions.

Ransomware: Malware or an operation that restricts access to systems or data to demand payment.

Phishing: Deceptive communication intended to manipulate a recipient into an unsafe action.

Social engineering: Manipulation of human behaviour to obtain access, information or action.

Credential stuffing: Testing credentials obtained from one source against other services.

Password spraying: Trying a small number of common passwords against many accounts.

Denial of service: An attempt to make a service unavailable to legitimate users.

Supply-chain compromise: Abuse or compromise of a trusted supplier, dependency or delivery process.

Insider: A person with legitimate access who causes intentional or accidental harm.

Cyber Kill Chain: A seven-stage model of intrusion activity from reconnaissance to objectives.

MITRE ATT&CK: A knowledge base of adversary tactics, techniques and procedures.

Tactic: An adversary’s broader operational objective in ATT&CK.

Technique: A method used to achieve an adversary objective.

Command and control: Communication through which an attacker manages compromised systems.

Double extortion: Theft of data combined with encryption or another form of extortion.

Least privilege: Giving users and processes only the access necessary for authorised tasks.

Review Questions

Short Answer Questions

1. Distinguish a threat, vulnerability, exploit and incident.
2. Identify three dimensions useful for classifying threat actors.
3. What is the difference between phishing and social engineering?
4. Explain why ransomware can threaten both availability and confidentiality.
5. State the main purpose of MITRE ATT&CK.

Long Answer Questions

1. Compare cybercriminals, nation-state actors, hacktivists and insiders in terms of motivation, resources and persistence.
2. Explain the major stages of the Cyber Kill Chain and identify one defensive opportunity at each stage.
3. Discuss how an organisation can reduce credential-attack risk without relying solely on user training.
4. Explain the causes and consequences of supply-chain compromise and evaluate suitable controls.
5. Compare the Cyber Kill Chain and MITRE ATT&CK, including their strengths and limitations.

Analytical / Application Questions

1. A company observes repeated MFA prompts followed by a successful login from an unfamiliar device. Analyse the likely attack, evidence to collect and immediate controls to apply.
2. A supplier’s software update is suspected of introducing malicious code. Develop an incident-analysis plan covering containment, evidence, communication and recovery.
3. Map the illustrative ransomware case to both the Cyber Kill Chain and relevant MITRE ATT&CK tactics. Identify the earliest realistic interruption point and justify your choice.

Multiple Choice Questions with Answers

Question 1

Which threat actor is primarily motivated by financial gain?

A. Cybercriminal group

B. Hacktivist group

C. Security researcher

D. Accidental insider

Correct Answer: A. Cybercriminal group

Question 2

Which statement best describes credential stuffing?

A. Trying every possible password against one account

B. Testing breached credentials against other services

C. Sending repeated authentication prompts to a user

D. Encrypting credentials in a password manager

Correct Answer: B. Testing breached credentials against other services

Question 3

In the Cyber Kill Chain, sending a malicious email is primarily an example of which stage?

A. Reconnaissance

B. Delivery

C. Installation

D. Actions on objectives

Correct Answer: B. Delivery

Question 4

What is the principal purpose of MITRE ATT&CK?

A. To provide a structured knowledge base of adversary behaviours

B. To replace the need for incident response plans

C. To guarantee that an attacker can be attributed

D. To provide a universal risk equation

Correct Answer: A. To provide a structured knowledge base of adversary behaviours

Question 5

Which attack attempts to make a service unavailable to legitimate users?

A. Data classification

B. Denial of service

C. Credential stuffing

D. Software signing

Correct Answer: B. Denial of service

Question 6

Which control most directly reduces the risk that a stolen password alone can be used to access an account?

A. Multifactor authentication

B. Website defacement monitoring

C. Data compression

D. Network documentation

Correct Answer: A. Multifactor authentication

Question 7

What distinguishes double extortion ransomware from encryption-only ransomware?

A. It uses two separate operating systems

B. It steals data and threatens disclosure as well as restricting access

C. It affects exactly two files

D. It requires two passwords to decrypt files

Correct Answer: B. It steals data and threatens disclosure as well as restricting access

Question 8

Which situation is the clearest example of supply-chain compromise?

A. An employee forgets a password

B. A trusted software update distributes malicious code

C. A server is slowed by legitimate demand

D. A user enables automatic screen locking

Correct Answer: B. A trusted software update distributes malicious code

Question 9

Which statement about attribution is most accurate?

A. A single IP address always proves the attacker’s identity

B. Attribution should distinguish evidence, inference and confidence

C. Attribution is unnecessary in every investigation

D. Technical indicators cannot be falsified

Correct Answer: B. Attribution should distinguish evidence, inference and confidence

Question 10

Which measure best supports ransomware recovery?

A. Untested backups connected with ordinary administrator credentials

B. Protected backups with regularly tested restoration procedures

C. Removing all system logs after encryption

D. Allowing unrestricted lateral movement

Correct Answer: B. Protected backups with regularly tested restoration procedures