What are the 5 Types of Threat Actors?<\/h2>\n\n\n\n<\/div>\n\n\n\nWithin the latest Microsoft’s Digital Defence Report<\/a>, five categories of threat actors are defined: <\/strong><\/p>\n\n\n\n\n- Nation-state actors.<\/strong><\/li>\n\n\n\n
- Financially motivated actors.<\/strong><\/li>\n\n\n\n
- Cyber mercenaries or private sector offensive actors.<\/strong><\/li>\n\n\n\n
- Influence operations.<\/strong><\/li>\n\n\n\n
- Groups in development.<\/strong><\/li>\n<\/ol>\n<\/div>\n<\/div>\n\n\n\n<\/div>\n\n\n\n
Nation-state actors<\/h3>\n\n\n\n<\/div>\n\n\n\nThis group of actors operate on behalf of or is directed by a nation\/state-aligned program, irrespective of whether the goal is espionage, financial gain, or retribution. Microsoft observed that the majority of nation-state actors will focus their operations and attacks on government agencies, intergovernmental organisations, nongovernmental organisations, and think tanks for traditional espionage or surveillance objectives.<\/p>\n\n\n\n
<\/div>\n\n\n\nFinancially motivated actors<\/h3>\n\n\n\n<\/div>\n\n\n\nActors who are driven by financial motives account for cyber campaigns or groups who are guided by criminal organisations for monetary gain. These groups do not associate with high confidence, to a non-nation state or commercial entities. This group of actors encompasses ransomware<\/a> operators, business email compromise, phishing<\/a>, as well as other groups who only have financial or extortion motivations.<\/p>\n\n\n\n<\/div>\n\n\n\nPrivate sector offensive actors (PSOAs)<\/h3>\n\n\n\n<\/div>\n\n\n\nPrivate sector offensive actors (PSOAs) are commonly known as cyber mercenaries, this refers to commercial actors who are legitimate legal entities that create and sell cyberweapons to customers and in turn select specific targets and operate the cyberweapons for attack.<\/p>\n\n\n\n
It has been observed that these tools target and surveil dissidents, human rights defenders, journalists, civil society advocates, and other private citizens, posing a threat to many global human rights efforts.<\/p>\n\n\n\n
<\/div>\n\n\n\nInfluence operations<\/h3>\n\n\n\n<\/div>\n\n\n\nInfluence operations encompass information campaigns that communicate through various channels on and offline in a manipulative approach. Their primary aim is to shift perception, behaviours, or decisions by target audiences to further a group or a nation\u2019s interests and objectives.<\/p>\n\n\n\n
<\/div>\n\n\n\nGroups in development<\/h3>\n\n\n\n<\/div>\n\n\n\nActivities posing threats that are unidentified, emerging, or in the developing stages fall under the temporary designation \u2018groups in development.\u2019 This allows Microsoft to monitor a group as a discrete set of information until higher confidence is reached about the origin or identity of the actor behind the operation. Once the specific criteria are met, a group in development is transferred to a named actor or merged into existing names.<\/p>\n\n\n\n
<\/div>\n\n\n\nName taxonomy of threat actors<\/h2>\n\n\n\n<\/div>\n\n\n\nIn April 2023, Microsoft has decided to transform their naming categorisation aligning it with the theme of weather in response to the increasing complexity, scale, and volume of threats. This allows customers to understand threats quicker and clearer. <\/p>\n\n\n\n
The updated categorisation brings better context to security researchers that are already confronted with a consuming amount of threat intelligence data. Using weather terms offers a more organised, memorable, and easy way to reference adversary groups, allowing organisations to prioritise threats and protect themselves more efficiently. The adoption of these weather-centric terms ensures that security professionals can understand the nature of the threat actor simply by reading their name. If you’d like more information about the naming of threat actors, we recommend reading Microsoft’s threat actors guidance<\/a>.<\/p>\n\n\n\nThe table below shows an overview of the actor categories, their type and the weather term that is assigned to them. Nation-state actors are assigned to a family name according to a country\/region of origin, Typhoon for example indicates the origin or attribution to China. The family name of other actors represents a motivation, like Tempest, which indicates financially motivated actors. <\/p>\n\n\n\n
Threat actors that belong to the same weather family have received an adjective to distinguish the actor groups within distinct tactics, techniques, and procedures (TTPs), infrastructure, objectives, or other identified patterns. Groups in development have received a temporary designation of Storm with a four-digit number where there is a newly discovered, unknown, emerging, or developing cluster of threat activity. <\/p>\n\n\n\n![\"Threat](\"https:\/\/cwsisecurity.com\/wp-content\/uploads\/2024\/05\/threat-actor-table-1024x636.png\")
<\/figure>\n\n\n\nContact Us to Discuss Threat Actor Groups<\/h2>\n\n\n\n
If you require more information on how to keep your organisation secure, or you have more questions around the different types of threat actors, we recommend contacting us via the form below.<\/p>\n\n\n\n
Within the latest Microsoft’s Digital Defence Report<\/a>, five categories of threat actors are defined: <\/strong><\/p>\n\n\n\n This group of actors operate on behalf of or is directed by a nation\/state-aligned program, irrespective of whether the goal is espionage, financial gain, or retribution. Microsoft observed that the majority of nation-state actors will focus their operations and attacks on government agencies, intergovernmental organisations, nongovernmental organisations, and think tanks for traditional espionage or surveillance objectives.<\/p>\n\n\n\n Actors who are driven by financial motives account for cyber campaigns or groups who are guided by criminal organisations for monetary gain. These groups do not associate with high confidence, to a non-nation state or commercial entities. This group of actors encompasses ransomware<\/a> operators, business email compromise, phishing<\/a>, as well as other groups who only have financial or extortion motivations.<\/p>\n\n\n\n Private sector offensive actors (PSOAs) are commonly known as cyber mercenaries, this refers to commercial actors who are legitimate legal entities that create and sell cyberweapons to customers and in turn select specific targets and operate the cyberweapons for attack.<\/p>\n\n\n\n It has been observed that these tools target and surveil dissidents, human rights defenders, journalists, civil society advocates, and other private citizens, posing a threat to many global human rights efforts.<\/p>\n\n\n\n Influence operations encompass information campaigns that communicate through various channels on and offline in a manipulative approach. Their primary aim is to shift perception, behaviours, or decisions by target audiences to further a group or a nation\u2019s interests and objectives.<\/p>\n\n\n\n Activities posing threats that are unidentified, emerging, or in the developing stages fall under the temporary designation \u2018groups in development.\u2019 This allows Microsoft to monitor a group as a discrete set of information until higher confidence is reached about the origin or identity of the actor behind the operation. Once the specific criteria are met, a group in development is transferred to a named actor or merged into existing names.<\/p>\n\n\n\n In April 2023, Microsoft has decided to transform their naming categorisation aligning it with the theme of weather in response to the increasing complexity, scale, and volume of threats. This allows customers to understand threats quicker and clearer. <\/p>\n\n\n\n The updated categorisation brings better context to security researchers that are already confronted with a consuming amount of threat intelligence data. Using weather terms offers a more organised, memorable, and easy way to reference adversary groups, allowing organisations to prioritise threats and protect themselves more efficiently. The adoption of these weather-centric terms ensures that security professionals can understand the nature of the threat actor simply by reading their name. If you’d like more information about the naming of threat actors, we recommend reading Microsoft’s threat actors guidance<\/a>.<\/p>\n\n\n\n The table below shows an overview of the actor categories, their type and the weather term that is assigned to them. Nation-state actors are assigned to a family name according to a country\/region of origin, Typhoon for example indicates the origin or attribution to China. The family name of other actors represents a motivation, like Tempest, which indicates financially motivated actors. <\/p>\n\n\n\n Threat actors that belong to the same weather family have received an adjective to distinguish the actor groups within distinct tactics, techniques, and procedures (TTPs), infrastructure, objectives, or other identified patterns. Groups in development have received a temporary designation of Storm with a four-digit number where there is a newly discovered, unknown, emerging, or developing cluster of threat activity. <\/p>\n\n\n\n If you require more information on how to keep your organisation secure, or you have more questions around the different types of threat actors, we recommend contacting us via the form below.<\/p>\n\n\n\n\n
Nation-state actors<\/h3>\n\n\n\n
Financially motivated actors<\/h3>\n\n\n\n
Private sector offensive actors (PSOAs)<\/h3>\n\n\n\n
Influence operations<\/h3>\n\n\n\n
Groups in development<\/h3>\n\n\n\n
Name taxonomy of threat actors<\/h2>\n\n\n\n
<\/figure>\n\n\n\nContact Us to Discuss Threat Actor Groups<\/h2>\n\n\n\n