A threat actor is the person, group or organization that carries out or attempts an attack against systems or data. Threat actors are classified by motivation and capability: financially motivated cybercriminals, state-sponsored groups, hacktivists or insiders. Identifying the actor behind an incident helps anticipate its TTPs (tactics, techniques and procedures) and prioritize defenses.
How TecnetOne handles it: TecnetSOC
malicious actor, threat actors, adversary, threat group, cybercriminal group, nation-state actor
Related terms
Phishing as a Service (PhaaS)
Phishing as a service (PhaaS) is a criminal business model in which a group sells subscription-based kits for launching phishing campaigns: fake sign-in pages, email templates, hosting and dashboards for collecting credentials. Unlike ransomware as a service (RaaS), its product is stolen access, and some kits capture the session even when the account has multi-factor authentication.
Initial access broker (IAB)
An initial access broker (IAB) is a cybercriminal who obtains a foothold in a company's network, such as VPN (virtual private network) credentials, an exposed remote desktop or a compromised server, and sells it on dark web forums to other groups. The buyers are often ransomware affiliates, who use that access to launch the attack.
SEO poisoning
SEO (search engine optimization) poisoning is a technique in which attackers push malicious sites to the top of search results so that someone looking for software, a template or a manual downloads malware. For example, an employee searches for a PDF reader and installs a fake setup file. Unlike malvertising, which relies on paid ads, it exploits organic search results.
Vishing
Vishing is a variant of phishing carried out by phone call or voicemail: the attacker poses as a bank, the IT help desk or an executive to obtain passwords, verification codes or a wire transfer. The name combines voice and phishing. Some attackers now use voices cloned with artificial intelligence (AI) to sound like someone the victim knows.
Smishing
Smishing is a variant of phishing that uses text messages (SMS) or messaging apps to trick victims into opening a fake link, handing over data or installing malware. The name combines SMS and phishing. A common example is a message that impersonates a bank or a delivery company and asks the recipient to confirm a purchase or pay a fee for a held package.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.