On Monday a manufacturer's file server greets staff with a ransom note. On Wednesday its public website shows a protest slogan instead of the product catalog. On Friday someone notices that an engineer who resigned last month signed in the previous Sunday night and downloaded the full product roadmap. Three incidents, three very different people behind them, and three different responses.
Security teams sort attackers into types because the type predicts what happens next. On the CompTIA Security+ SY0-801 exam this sits under objective 2.2, which expects you to describe the common threat actors and the reasons they attack. This lesson covers the eight actor types on that list and the scenario clues that identify each one. Motivations and actor attributes get their own lessons next in this section.
A threat actor is whoever is behind the harm, intentional or not
A threat actor is the person or group responsible for an event that damages an organization's security. Keep it separate from three neighboring terms. A threat is the potential for harm, a vulnerability is the weakness that makes harm possible, and a threat vector is the path the actor uses to reach the target, such as email or an exposed remote access service. The actor is the "who".
Most actors are malicious, which is why you'll also see the phrase "malicious actor". The SY0-801 list adds one that isn't: the accidental or unintentional actor, an ordinary employee whose mistake exposes data or takes a system down. Its place on the list is a reminder that plenty of real incidents involve no attacker at all.
Classifying the actor matters because the same technical event means different things depending on who caused it. Suppose 40 GB of engineering files left a file server. If a ransomware group took them, expect a payment demand and a leak-site deadline. If a foreign intelligence service took them, expect silence and an intruder working to keep access. If a departing employee took them, expect the files to turn up at a rival, and expect HR and legal to lead the response. The actor type shapes threat modeling, which defenses get funded first, and whom you call during an incident.
On the job, you rarely know the actor for certain. Attribution relies on evidence: the tools and infrastructure used, the demands made, the data targeted, and threat intelligence that links those details to known groups. Exam scenarios work the same way, except the clues are planted for you to find.
Organized crime runs attacks as a business
Crime syndicates, also called organized crime, are groups organized around profit. Their main products today are ransomware, business email compromise, payment card theft, banking fraud, and the sale of stolen data and network access.
The larger groups look like companies. In the ransomware-as-a-service model, a core team writes the malware, runs the payment and leak sites, and leases the operation to affiliates who break into victims and deploy it. The affiliate usually keeps the larger share of each ransom, commonly 70 to 80 percent. Around them sits a supply chain of initial access brokers who sell footholds in corporate networks, money launderers who move cryptocurrency, and negotiators who deal with victims through chat portals.
That structure gives syndicates substantial resources and medium to high sophistication, and it lets less-skilled affiliates use polished tools that someone else built. Crime groups are mostly opportunistic: they hit whoever has weak defenses and can pay. Some deliberately pursue large, high-revenue targets, an approach called big game hunting.
A ransom note is the classic sign:
YOUR FILES ARE ENCRYPTED
We also copied 412 GB from your file servers, including HR and Finance.
To receive the decryptor and keep this data off our blog, contact us
through the portal with your ID 7F3A-91C2. The price doubles after 72 hours.
On the exam, a demand for cryptocurrency, a negotiation portal, a deadline, a leak site, stolen card numbers offered for sale, or fraudulent changes to the bank details on invoices all point to organized crime.