Lesson 2.5: Threat actors and their motives
Who is behind attacks and what they want: cybercriminals (money), hacktivists (a cause), state-sponsored groups (espionage and sabotage), insiders (revenge, money or simple mistakes) and unskilled opportunists. What threat intelligence is and how indicators of compromise (IP addresses, domains, file hashes) are shared. In the lab you pull the indicators out of an advisory with regular expressions and search your own web log for them.
17 min
You will learn to
- Name the main threat actor types and their motives
- Explain threat intelligence and indicators of compromise
- Extract IP addresses and domains from a report
- Search logs for known indicators
Key terms
- Threat actor
- A person or group that carries out or could carry out attacks.
- Cybercriminal
- Attacks for money: ransomware, stolen cards, fraud, selling data.
- Hacktivist
- Attacks to promote a political or social cause, often by defacing sites or leaking data.
- State-sponsored actor (APT)
- A well-funded group working for a government: spying, stealing secrets, preparing sabotage. Patient and hard to detect.
- Insider threat
- Someone inside the organisation (an employee, contractor, partner) who causes harm on purpose or by mistake.
- Threat intelligence
- Information about threat actors, their methods and their traces, collected and shared so defenders can prepare.
- Indicator of compromise (IOC)
- A trace that suggests an attack: a known-bad IP address or domain, a file hash, an unusual process.
← Command line arguments and options · All lessons · Getting help on the command line →