What is a threat actor?
A threat actor is whoever is responsible for an event that harms an organization's security. It is the who of an attack, and it sits next to three terms that are easy to mix up: a threat is the potential for harm, a vulnerability is the weakness that makes harm possible, and a threat vector is the route the actor uses, such as email or an exposed remote desktop service. Most actors are malicious, which is why the phrase malicious actor is common, but an employee who misconfigures a storage bucket and exposes customer data is an actor too, an accidental or unintentional one.
Classifying the actor matters because it predicts what happens next. If 40 GB of engineering files left a file server, a ransomware crew will soon send a demand, a foreign intelligence service will stay quiet and try to keep its access, and a departing employee will take the files to a rival.
Types of threat actors
| Actor | Typical goal | Scenario clue |
|---|---|---|
| Nation-state | Espionage, disruption, influence | Zero-day, months undetected, government or infrastructure target, no demand |
| Organized crime | Money | Ransom note, cryptocurrency, leak-site deadline, stolen cards for sale |
| Hacktivist | A political or social cause | Defacement, DDoS or leak tied to a slogan |
| Terrorist | Fear, pressure on a government | Attack meant to endanger the public or cause panic |
| Unskilled attacker | Notoriety, curiosity, a grudge | Downloaded tool, public exploit, noisy scanning, bragging online |
| Malicious insider | Revenge, money | Disgruntled or departing employee misusing granted access |
| Accidental actor | None intended | Misconfiguration, misdirected email, leaked API key |
| Competitor | Trade secrets, market advantage | Designs or bid data turning up at a rival |
Attributes: access, resources and sophistication
Three attributes describe what an actor can do. Internal or external asks whether the organization granted the actor access; an outsider who phished a password and logs in through the VPN is still external, even with an internal IP address. Resources and funding decide how long an actor can keep trying: a state can buy zero-day exploits and spend a year on one target, while an unskilled attacker moves on when blocked. Sophistication, or capability, is how advanced the methods are, from scanners run on default settings up to custom malware and compromised software updates. Capability can also be rented, as in ransomware-as-a-service, where affiliates use polished tools someone else built.
Motivations
Motivation is the intent behind an attack. Common motives include financial gain, extortion (a threat backed by a demand), espionage, theft of intellectual property, political or ideological goals, influence over public opinion, revenge, fear and chaos, notoriety, curiosity and, for authorized testers and researchers, the ethical goal of improving security. Motives combine, and they don't map one to one onto actor types: money drives crime groups, but also some insiders and even a few states.
Attribution comes from evidence, not size
Analysts identify actors from the tools, infrastructure, demands and targets they leave behind, matched against threat intelligence. Damage alone proves little. NotPetya in 2017 displayed a ransom demand but had no working way to restore files, and the U.S. and U.K. governments later attributed it to the Russian military; it looked like crime and was sabotage. A defacement done with a downloaded tool could come from a hacktivist or an unskilled attacker, and the best answer is whichever explains the most details.
Threat actor on the CompTIA Security+ exam
Threat actors, their attributes and their motivations are SY0-801 objective 2.2. Scenarios plant clues for you: a ransom portal points to organized crime, a slogan to a hacktivist, "well-funded" and "undetected for months" to a nation-state, "publicly available exploit" to an unskilled attacker, and a recently terminated employee to an insider. Read for evidence of skill and intent rather than the scale of the damage, and remember that network location doesn't make someone an insider. A frequent distractor is the threat vector: the actor is who attacked, and the vector is how the attack arrived. Some questions ask for the actor and the motive separately from the same scenario, so answer each from its own clue.