What threat actors are generally believed to be the most dangerous threat actors explain your answer

The threat landscape is growing every day. It’s not just organizations like businesses that need to be concerned about the increasing sophistication of attacks aimed at their network; everyday home users should be worried about these as well, because the threat landscape isn’t going to leave your home computer alone.

Índice Show

Types of threat actors
Why should you care?
Protection against threat actors
What are the different types of threat actors?
State-Sponsored Actor
Organized Cybercriminals
Hacktivists
The Lone Wolf

A component of the landscape you’ll hear often is the “threat actor.” This is anyone who has the potential to impact your security. The phrase ‘threat actor’ is commonly used in cybersecurity. To be more specific in the cybersecurity sphere, a threat actor is anyone who is either is a key driver of, or participates in, a malicious action that targets an organization’s IT security. But personal PCs and Macs are as susceptible to cyberthreats as an organization’s IT infrastructure.

A threat actor can be a single person carrying out a security incident, as well as a group, an organization, or even a country involved in carrying out a cyberattack.

Types of threat actors

Cybercriminal: This is the most common type of threat actor. Their attacks are intended to steal data and make that data inaccessible to them until they pay a hefty ransom, or just disrupt an organization’s key processes. Working alone or in a group, money is their primary motivation. Their attack arsenal is made up of phishing attacks, ransomware, malware and other tactics and techniques.

Insider threats: This usually in reference to a business situation , when an employee, third-party contractor, or partner wants to get at organizational data and/or compromise key processes. They sometimes maliciously and intentionally damage an organization’s cybersecurity infrastructure, sometimes this is unintentional. For example, a staff member might fall prey to a phishing attack and share sensitive company credentials that they shouldn’t be sharing.

Can you have an “insider threat” at home? Sure. Your kids might unintentionally visit a website they shouldn’t and download some malware. Not every insider threat is motivated by greed or revenge.

Nation states: There are countries out there who target institutions in other countries to steal data, either to disrupt their security, impede some governmental function, or damage the economy, for example. They might seek access to military secrets, try to commit acts of espionage, or more.

There are also “hacktivists” who are not primarily motivated by money but rather by a need to publicize an organization’s misdeeds, or to be a part of a political or social movement. Terrorist organizations are also a type of threat actor when they indulge in cyber terrorism for propaganda and for political, ideological, and financial purposes.

Why should you care?

When we talk about threat actors, it’s often focused on businesses, but the fact remains home users like yourself are the target. Malicious actors are continuously looking for ways and means to infiltrate an organization’s network. You and your computer can be the conduit they can use. A threat actor might look at various ways to target the organization you are working for. They send a phishing message your way and trick you into sharing sensitive credentials through a cleverly worded message.

Suddenly you’ve become a threat actor, though unintentionally. Awareness about the various types of threat actors and how they go about their dirty business enables you to take proactive steps to not fall into their traps.

Protection against threat actors

Maintaining strict cyber hygiene is the low hanging protection fruit. Still, alone it’s not enough. Use an advanced antivirus solution to protect your home computer to safeguard all data on this computer and protect your computer from attacks launched by threat actors. Sophos Home aligns cutting-edge artificial intelligence malware detection, unbeatable exploit prevention, and advanced ransomware protection to keep known and unknown threats at bay.

We’ve all heard stories of espionage, mafia crime, and lone wolf attackers throughout history. These real-life stories have inspired some of the most iconic characters ever known—Mata Hari, the Godfather, The Jackal, Unabomber – to name a few. As threats move from the physical world into cyberspace, enterprises are beginning to see these same types of threat actors targeting their organizations online. Though they use different means to their desired end, the threat actors behave similarly to their traditional counterparts. As your organizations analyze cyber threat groups, it’s important to understand the actors’ target, motivation, and your best defense against them.

What are the different types of threat actors?

State-Sponsored Actor

Target: Any and every computer Example Tactics & Motivation: Cyberwarfare/espionage for political, economic, and/or military agendas

Best Defense: Patch/Vulnerability management

A true force to be reckoned with the infrastructure, power; and substantial technical, financial, and material resources behind nation state-sponsored cyber attacks is unparalleled. State-sponsored threat actors are typically well-funded and sophisticated, and – as the name suggests – sponsored or supported by a government entity. This support doesn’t always come in the form of money, but sometimes direction. These attackers are more calculated and measured and are known to play the “long-game,” meaning they deploy tactics and attacks that grant them access to your systems and networks quietly, possibly hanging around for months or years. Nation-state activity has included distributed denial of service (DDoS) attacks, destructive wiper malware, disinformation, influence operations, and cyber reconnaissance of critical infrastructure. Though nation-states targeted other government entities in the past, they are aiming for new targets—like your organization to gain access to your sensitive company data.

One of the better-known nation-state attacks is the massive NotPetya ransomware outbreak that according to some researchers is still considered the single most expensive computer security incident in history. A little background: conflict between Ukraine and Russia has resulted in the cyber arm of the Kremlin reaching across the Russian border into Ukraine many times. This caused power outages and destroyed terabytes of Ukraine’s data. The political tension and undeclared war had been going on for four years. By using Ukraine as a testing ground for its cyberwar tactics, Russia left doors open in the form of software vulnerabilities that they could re-enter whenever they wanted. One of these open doors provided the perfect passageway for NotPetya—the fastest-propagating malware ever— to enter. Russian military hacking groups deployed the malware to target Ukraine, but the effect was global almost instantaneously.

Damage from NotPetya affected global shipping magnates, multi-national pharmaceutical companies, financial services organizations, and food manufacturers. It caused $10 billion in damage worldwide. Modern state-sponsored cyber attacks reach farther than traditional warfare ever could, and the results can be catastrophic in all industry verticals. NotPetya exploited a software vulnerability that had a known fix—many of the organizations impacted by NotPetya could have avoided this fate if they had patched this vulnerability. While there is no single answer to defending against nation-states, one of the easiest defenses is patching and updating your systems as soon as a fix is available.

Organized Cybercriminals

Target: Enterprises Example Tactics & Motivation: Financial gain/profits

Best Defense: Good cyber hygiene

Cybercrime is a gold mine for successful criminals. Not only because there’s a lot of money in the game – some say global damage related to cybercrime is expected to reach $6 trillion by 2021 – but also because actors don’t need to be sophisticated to carry out these crimes. Organized cybercriminals are motivated by profits, so it only makes sense that they would exploit the financial opportunities that hacking presents. Cybercriminal actors are most interested in stealing personally identifiable information (PII) like credit card numbers, account credentials, and Social Security Numbers. They will either steal directly from their victims or steal information and/or accesses that can be monetized in cybercrime forums, and will use any means to carry out this goal – phishing, ransomware, cryptominers, remote access Trojans, exploit kits, social media, data/financial theft, extortion, and blackmail. Unlike original mafia groups, the barrier to entry on the cybercrime market is low. There is no need for bribing law enforcement or killing people off when the Dark Web can provide ample anonymity to these threat actors.

Hacking group Fin7 is notorious for being well-organized and disciplined in their craft. If you have had your credit card number stolen at a restaurant, you have most likely come into contact with Fin7 yourself. They developed their own malware and attack styles, proving very effective for the group. Chipotle, Trump Hotels, and Whole Foods have been victims of Fin7’s point-of-sale malware, breaching more than five million credit and debit card numbers. Because of their highly organized nature, Fin7 can operate efficiently—to the tune of $50 million in profit per month. Fin7 uses phishing tactics to deliver malware that are developed and tested by its many departments. After discovering a weak spot in Microsoft applications, Fin7 needed only a day to create a file-less malware attack designed to steal as many credit card numbers as possible.

Your best defense against this type of organized cybercrime network? Good cyber hygiene! If we have said it once, we have said it 1,000 times. Change your passwords often, be highly skeptical when it comes to unexpected emails or calls, and patch and update regularly.

Hacktivists

Target: Government entities, corporations, or individuals Example Tactics & Motivation: Political, social, religious, economic, and environmental causes

Best Defense: Understanding TTPs

Hacktivism describes individuals or groups that use hacking to affect political or social change. These actors meld traditional political activism with the Internet, allowing them to express social and political discontent via cyberspace. The hacktivist landscape is diverse, encompassing individuals and groups of various levels of skillsets and capabilities. Hacktivists are known to use malware, DDoS attacks, “doxing,” web page defacement, and social media to expose damning information about their target, from unjust business practices to government secret-keeping. Hacktivists have been active since the mid-90’s. Modern hacktivism was shaped heavily by group Anonymous throughout the past decade. Unlike organized cybercriminals Fin7, Anonymous is amorphous, made up of many different proxy organizations and affiliated hackers.

In recent years, the group targeted the 2016 presidential campaign of U.S. President Donald Trump, as well as the Islamic State (IS) and the Ku Klux Klan (KKK). After the Islamic State attacks on Paris in 2015, Anonymous set out to dismantle the large network of Islamic State social media accounts to stifle the dissemination of propaganda. Though their motive was for social justice, their methods were brought into question and could have caused more damage than good. It is highly unlikely that Anonymous has the counterterrorism skillset to properly vet these accounts, and the takedown of alleged IS accounts and forums hampers intelligence operations of actual counterterrorism experts and the intelligence community working to dismantle these terrorist groups.

Hacktivists like Anonymous face high-risk of infiltration due to the disorganization of its members and associates—possibly allowing nation-states or other dangerous actors to leverage them for the proliferation of government propaganda. It is a dangerous game to play when state secrets and intelligence operations are put in harms way. Your best defense against organizations like these are to understand their TTP’s—hacktivists are known to target unjust business practices at the corporate level.

The Lone Wolf

Target: Financial institutions and their networks Example Tactics & Motivation: Financial gain, Network access

Best Defense: Understanding tactics, techniques, and procedures (TTPs)

Lone wolf threat actors are a powerful force in the cybercrime underground. As we have written before, the popularization of the cybercrime-as-a-service model is furthering the reach of these lone-wolf actors. Traditional lone wolf attackers were difficult to track, and cyber lone wolf actors are equally difficult to find. The reason? They operate individually (in rare cases work with other accomplices) and they operate on the Dark Web, known for the anonymity it provides. Threat actors like “gookee”–a lone wolf malware developer hawking his wares on cybercrime forums—are prime examples of what today’s lone wolf threat actor looks like.

Gookee, thought to be Russian, has been operating on one cybercrime forum since January 2018 selling his malware to other less skilled cybercriminals. Like many other threat actors, gookee provides cybercrime-as-a-service, and similar to threat actor Glad0ff, gookee has proved his bona fides on his forum of choice through customer reviews of his service and products. His malware du jour is an ATM exploit that allows his customers to manually extract cash from ATMs. ATM exploits provide an immediate source of cash to criminals, but even more dangerous is the access that they provide into bank networks—potentially putting millions of dollars at risk. These types of actors prove difficult for law enforcement to catch due to their business model, which allows them to distance themselves from the crimes their customers commit. These threat actors are just the accomplice to their bank robberies and other criminal pursuits.

The best defense enterprises have against lone wolf actors is collecting intelligence on their TTPs to better understand how and where these actors continue to operate. This intelligence will also alert you to new threat actors selling cybercrime-as-a-service, providing the situational awareness needed to protect your organization’s most sensitive information.

Traditional crime groups and tactics will never go away—but they will evolve and move to new landscapes. Keeping your organization abreast of emerging threat actors is the best way to defend against them. Knowing your adversary is the only way to anticipate their next move. LookingGlass’ intelligence team provides finished intelligence, including Threat Actor Profiles. If you are looking for information similar to what’s in this blog, or would like a more in-depth look at one of these threat actors contact us.

Related Content