Instructor: In the world of cybersecurity, 2 2
we refer to the attacker as a threat actor. 3 3
Now, a threat actor is the term we use 4 4
to describe these bad folks, 5 5
those who want to do harm to your networks 6 6
or steal your secure data. 7 7
However, not all threat actors are created equal 8 8
so there are different categories 9 9
or tiers of adversaries 10 10
that you're going to encounter. 11 11
Some of these are considered structured, 12 12
some are considered unstructured, 13 13
some are more skilled than others 14 14
and there are many different things 15 15
that actually motivates each type of threat actor. 16 16
Now in the media, 17 17
you usually hear the terms hacker 18 18
and cracker being used interchangeably 19 19
but hacker has actually been the term most used 20 20
in recent years 21 21
and usually conjures up visions 22 22
of somebody behind a laptop 23 23
in a black hooded sweatshirt, 24 24
sitting in a dark basement. 25 25
Originally though, 26 26
a hacker was simply a computer enthusiast 27 27
and not considered a criminal. 28 28
Crackers were hackers with malicious intent 29 29
and those were the people who were criminals. 30 30
The reason we got cracker is because it's a criminal hacker 31 31
but due to the media coverage 32 32
in the 1990s and early 2000s, 33 33
the terms got blended together 34 34
where hackers became known 35 35
as these evil threat actors among us. 36 36
But in the information security world, 37 37
people try to retain the term hacker 38 38
for computer enthusiasts 39 39
and even for security professionals 40 40
like cybersecurity analysts. 41 41
And this led to the categorization of hackers 42 42
by the different hats they wear. 43 43
The term black hat hacker, 44 44
also an unauthorized hacker, was developed 45 45
to describe these criminal hackers or crackers. 46 46
The good folks were then dubbed white hat hackers 47 47
or ethical hackers or authorized hackers. 48 48
But there's some hackers 49 49
who sometimes operate as good folks 50 50
and sometimes as bad folks 51 51
and these are actually called gray hat hackers 52 52
or semi authorized hackers. 53 53
Now, regardless of the hat a particular hacker is wearing, 54 54
they're still going to perform the same basic activities 55 55
as part of their attacks 56 56
if they're a black hat or a gray hat 57 57
or a penetration test 58 58
if they're doing it as a white hat. 59 59
Generally, the hacker is first going to start out 60 60
by utilizing social media 61 61
to profile a vulnerable employee 62 62
within an organization. 63 63
Then they'll conduct 64 64
some kind of social engineering campaign against them 65 65
using phishing or other mechanisms, 66 66
and then the threat actors can also scan 67 67
and enumerate the networks to find targets 68 68
and use fingerprinting and service discovery 69 69
to identify vulnerable services 70 70
that they can exploit and attack. 71 71
If they find one, 72 72
they'll then be able to exploit it 73 73
to gain access to the network 74 74
and even set up things like packet captures 75 75
from the victim machines, 76 76
key loggers or other things 77 77
to learn more about the network 78 78
and the computer, 79 79
and then conduct lateral movement throughout the domain. 80 80
Now, there are eight main types of threat actors 81 81
that we're going to cover 82 82
as we go through this lesson, 83 83
including script kiddies, insider threats, 84 84
competitors, organized crime, hacktivists, 85 85
nation-state, APT, and supply chain threats. 86 86
The first type of threat actor we have 87 87
is known as a script kiddie. 88 88
This is somebody who has the least amount of skill 89 89
when it comes to being an attacker. 90 90
Script kiddies tend to use other people's tools 91 91
to conduct their attacks 92 92
and they don't have the skills necessary 93 93
to develop their own tools 94 94
like more advanced attackers might. 95 95
Instead, a script kiddie is going to use freely available tools 96 96
found on the internet 97 97
or an openly available security tool sets 98 98
that pen testers might also use. 99 99
This includes things like Metasploit, 100 100
Aircrack-ng, John the Ripper, 101 101
and many others to conduct their attacks. 102 102
Using these freely available vulnerability assessment 103 103
and hacking tools, 104 104
these script kiddies can conduct their attacks for profit 105 105
to gain credibility or just for fun. 106 106
For example, 107 107
there's a tool out there called Low Orbit Ion Cannon. 108 108
This is a really simple program 109 109
that's used by a lot of script kiddies 110 110
to conduct denial of service attacks. 111 111
Essentially, the script kiddie 112 112
simply needs to enter a URL 113 113
or IP address in the input box 114 114
and then click on a button labeled go. 115 115
Immediately, a barrage of traffic is going to begin 116 116
to flood the victim's system 117 117
to attempt a denial of service attack. 118 118
It's really just that simple. 119 119
There's no skill 120 120
or underlying knowledge required. 121 121
Instead, simply plug in a website address and hit go 122 122
and now you're doing an attack. 123 123
Script kiddies often also don't understand 124 124
what tools they're actually using 125 125
or the damage they can cause 126 126
or even what actions they're really performing 127 127
under the hood. 128 128
That said, even these simple tools 129 129
can create some really undesirable effects 130 130
to your organization's network. 131 131
So script kiddies are still a threat 132 132
you need to think about. 133 133
The second type of threat actor we have 134 134
is what's known as an insider threat. 135 135
Now, an insider threat is an employee 136 136
or former employee 137 137
who has knowledge of the organization's network, 138 138
policies, procedures, and business practices. 139 139
The insider threat is one of the most dangerous categories 140 140
for an organization 141 141
because these people actually have authorized access 142 142
to the network if they're a current employee, 143 143
and this makes them very dangerous 144 144
and very difficult to find inside of your network. 145 145
An insider threat could either be skilled or unskilled, 146 146
depending on who they are. 147 147
For example, an unskilled insider 148 148
might try to copy the organization's files 149 149
onto a thumb drive 150 150
and walk out the front door with them. 151 151
Even though they were authorized 152 152
to access those files, 153 153
they were not authorized 154 154
to remove them from the network 155 155
or post them online 156 156
and this results in some kind of a data breach. 157 157
Or you may have a very skilled insider threat 158 158
who's able to elevate their own user account permissions 159 159
so they can now access data 160 160
from across the entire network 161 161
as a system administrator 162 162
and then try to grab all of that 163 163
and sell it to a willing buyer. 164 164
To prevent an insider threat, 165 165
organizations really need to have policies 166 166
and enforcement technologies in place, 167 167
including things like data loss prevention systems 168 168
to detect these insiders 169 169
who attempt to remove data from the network. 170 170
Also, all the organization's standard internal defenses 171 171
need to be properly configured 172 172
and cybersecurity analysts need 173 173
to search through the security information 174 174
and event management systems 175 175
to identify any patterns of abuse 176 176
in order to catch these malicious insiders. 177 177
Now, when we talk about insider threats, 178 178
there's also two different types of insider threats. 179 179
These are known as intentional 180 180
and unintentional insider threats. 181 181
Now, an intentional insider threat 182 182
is when an individual within an organization 183 183
is deliberately seeking to cause harm, 184 184
and this includes things 185 185
like stealing sensitive information, 186 186
disrupting operations, 187 187
or even launching a cyber attack 188 188
against the organization. 189 189
This can include malicious insiders 190 190
who've been recruited 191 191
or coerced by an outside party, 192 192
or those who have personal or financial motives 193 193
to cause harm to the organization. 194 194
On the other hand, 195 195
an unintentional insider threat 196 196
is going to refer to an individual 197 197
within the organization 198 198
who causes harm unintentionally 199 199
because they're careless, 200 200
they have a lack of knowledge, 201 201
or it's just a simple human error. 202 202
This can include actions 203 203
such as falling for a phishing email, 204 204
using weak passwords, 205 205
or accidentally sharing sensitive information 206 206
with somebody outside of the organization. 207 207
Now, both intentional 208 208
and unintentional insider threats 209 209
can have serious consequences 210 210
for an organization's security, 211 211
and therefore, 212 212
it's important to have measures in place 213 213
to mitigate both of these types of insider threats. 214 214
A solid cybersecurity strategy should include things 215 215
like employee education and training, 216 216
access controls, incident response planes, 217 217
and regular monitoring of user activity 218 218
to detect any unusual behavior. 219 219
Additionally, having an incident response team 220 220
and adequate incident response processes in place 221 221
can help to quickly detect, contain and deal 222 222
with any kind of insider threat you may encounter. 223 223
The third type of threat actor is known as a competitor. 224 224
Now, a competitor is a rogue business 225 225
that attempts to conduct cyber espionage 226 226
against your organization. 227 227
Competitors are focused on stealing your proprietary data, 228 228
disrupting your business, 229 229
or damaging your reputation. 230 230
Often, competitors will seek to use an employee 231 231
as an insider threat in your organization 232 232
to steal the data from you 233 233
or they may attempt to break into your network 234 234
over the internet. 235 235
The fourth type of threat actor we have 236 236
is known as organized crime. 237 237
Now, organized crime is a category of threat actor 238 238
that's focused on hacking and computer fraud 239 239
in order to receive financial gains. 240 240
Now, due to the Internet's wide reach, 241 241
a criminal in one part of the world can hack the computer 242 242
of somebody on the other side of the globe 243 243
with relative ease 244 244
and organized crime gangs often run different schemes 245 245
or scams using social engineering 246 246
or conducting more technical attacks 247 247
using ransomware 248 248
in order to steal money from their victims. 249 249
Organized crime hackers tend to be well-funded 250 250
and they use sophisticated attacks and tools as well. 251 251
The fifth type of threat actor we have 252 252
is known as a hacktivist. 253 253
Now, a hacktivist tends to be comprised 254 254
of politically motivated hackers 255 255
who target governments, 256 256
corporations and individuals 257 257
to advance their own political ideologies 258 258
or agendas. 259 259
For instance, 260 260
an environmentalist might be considered a hacktivist 261 261
if they hack into a logging company 262 262
because they want to see 263 263
that company's stock prices fall 264 264
in effort to drive them out of business 265 265
and thereby, save the forest. 266 266
Here, it is an environmental hacktivist 267 267
who is really focused 268 268
on taking this company out 269 269
so the environment can have a better chance of surviving. 270 270
Hacktivists can be individuals 271 271
or they can be part of larger groups as well. 272 272
For example, Anonymous is a really large 273 273
and well-known hacktivist group. 274 274
Hacktivists tend to vary in levels of organization 275 275
from loosely organized to highly structured 276 276
and they can have a high level of sophistication 277 277
in their attacks 278 278
but they tend not to be well funded 279 279
because most of these folks are doing it 280 280
based on their ideology 281 281
and not because they're trying 282 282
to seek out financial gain. 283 283
Now, the next type of threat actor we have 284 284
is known as a nation-state. 285 285
Now, a nation-state is one of the most skilled types 286 286
of threat actors you're going to encounter 287 287
and this group usually has people 288 288
with exceptional capability, 289 289
funding and organization 290 290
and they have the intent 291 291
to hack a particular network or system. 292 292
Nation-states don't simply pick a network 293 293
at random to attack 294 294
but instead, they determine specific targets 295 295
to achieve their political motives. 296 296
These incredibly organized teams of hackers 297 297
conduct highly covert attacks 298 298
over long periods in time, 299 299
and so we often will refer to them as an APT 300 300
or an advanced persistent threat. 301 301
Now, not all APTs are nation-states 302 302
but almost all nation-states are going to be considered APTs 303 303
and we'll talk a little bit more about the differences 304 304
between an APT and a nation-state 305 305
in just a minute. 306 306
Now, when we're talking about a nation-state or an APT, 307 307
in general, they're going to be inside of a victimized network 308 308
for six to nine months 309 309
before the network defenders 310 310
even discover there's an intrusion 311 311
and some have actually gone several years 312 312
between their breach 313 313
and the eventual discovery 314 314
by a networks defenders. 315 315
Nation-state actors are really, really good at what they do 316 316
and they're very difficult to find 317 317
once they're in your network. 318 318
Over the years, many nation-states 319 319
have also tried to present themselves 320 320
as a threat actor inside of one of the other groups 321 321
like hacktivists or organized crime. 322 322
This way, they can maintain a plausible deniability 323 323
for the hacks they're conducting. 324 324
Oftentimes, a nation-state might use the TTPs 325 325
of a different nation-state as well 326 326
in order to implicate them inside of an attack. 327 327
And when this is done, 328 328
it's known as a false flag attack. 329 329
For example, back in 2015, 330 330
there was a French TV network 331 331
known as TV5 Monde 332 332
that was taken off the air 333 333
by a sophisticated cyber attack. 334 334
The network's website was also defaced 335 335
by a group calling itself the Cyber Caliphate 336 336
and they made the attack look 337 337
like it was launched by the Islamic State 338 338
which is a politically motivated hacktivist group. 339 339
Now, when security investigators 340 340
looked into the attack though, 341 341
they actually found the attack was conducted in Russian 342 342
because the code used in the attack was typed 343 343
with a Cyrillic keyboard 344 344
during normal working hours 345 345
in Moscow and St. Petersburg. 346 346
If this was accurate, then it means 347 347
that a Russian nation-state actor 348 348
was actually trying to appear 349 349
as an Islamic State hacktivist 350 350
and that way, they would get the blame 351 351
for the attack instead of Russia getting the blame 352 352
and this makes this a false flag attack. 353 353
Another issue that has been seen in recent years 354 354
is supply chain attacks 355 355
and these are normally conducted 356 356
by nation-state actors as well. 357 357
For example, in 2020, 358 358
there was an attack 359 359
on the company SolarWinds 360 360
that was allegedly tied back 361 361
to Russian nation-state actors. 362 362
The threat actors hacked 363 363
into the SolarWinds corporate network 364 364
in order to add a backdoor 365 365
into the code for SolarWinds. 366 366
SolarWinds has numerous corporations 367 367
and governments as their clients and users. 368 368
So this backdoor 369 369
that was embedded into their next update 370 370
went out to all of these companies 371 371
and government networks 372 372
and effectively compromised all of them. 373 373
Now, this meant that the nation-state actors 374 374
now had control over all of those networks 375 375
and be able to access them. 376 376
This attack was not really directed at SolarWinds 377 377
but instead, it was directed at SolarWind's customers. 378 378
But to get to those customers, 379 379
they had to get themselves 380 380
into SolarWinds network 381 381
and then put code 382 382
into their distribution channels. 383 383
A similar supply chain access attack was also conducted 384 384
against the retailer Target in 2015 385 385
by criminal attackers. 386 386
Now in this case, an HVAC company 387 387
that services the store's equipment was hacked, 388 388
and that connection between the HVAC company system 389 389
and the Target systems 390 390
allowed the attacker to steal data 391 391
from the retailer's point of sale systems 392 392
and credit card terminals. 393 393
Another attack credited to nation-states over the years 394 394
that involves a supply chain 395 395
was the embedding of root kits 396 396
into Cisco routers and switches 397 397
that were purchased from third party suppliers. 398 398
And this again, 399 399
is another reason why supply chain management 400 400
and using trusted suppliers is so important 401 401
to the security of your organization 402 402
and its networks. 403 403
Now in general, as I said, 404 404
most nation-state actors are going to be classified as an APT 405 405
but not all APTs or advanced persistent threats 406 406
are going to be nation-state actors. 407 407
Remember, a nation-state actor refers to a government 408 408
or government affiliated group 409 409
that conducts cyber attacks. 410 410
These attacks can be used for a variety of reasons 411 411
such as espionage, sabotage, 412 412
or intelligence gathering. 413 413
Nation-state actors are always going to be well-funded 414 414
and well-equipped, 415 415
and they have access 416 416
to really sophisticated tools and techniques 417 417
including zero day vulnerabilities. 418 418
They're also highly motivated 419 419
by political and strategic objectives 420 420
and they operate on a really large scale. 421 421
Now, an APT 422 422
or advanced persistent threat on the other hand, 423 423
is a more generic type of cyber attack 424 424
where an attacker establishes a long-term presence 425 425
on a network 426 426
in order to gather sensitive information. 427 427
These types of attacks can be carried out 428 428
by a variety of different actors, 429 429
including nation-states, 430 430
criminal organizations, 431 431
and even individual hackers. 432 432
APTs are known to be well-funded, well organized 433 433
and have a high level of persistence 434 434
and determination in achieving their goals. 435 435
APTs usually will infiltrate a network 436 436
over a prolonged period 437 437
from weeks to months or even years 438 438
and they'll carefully hide their activity 439 439
and blend in with normal network traffic 440 440
and use a lot of tools 441 441
that exist on the computer already 442 442
which we refer to as living off the land. 443 443
The main goal of an advanced persistent threat 444 444
is really to harvest sensitive data, 445 445
intellectual property 446 446
and other sensitive information 447 447
from the compromised network. 448 448
So remember, the big difference here 449 449
between a nation-state actor and an APT 450 450
is that a nation-state actor is a group or organization 451 451
that's affiliated with a government, 452 452
while an APT is a type of cyber attack 453 453
that's characterized by its long-term presence 454 454
on a given network. 455 455
So always remember 456 456
that nation-state actors are almost always APTs 457 457
but not all APTs are nation-state actors.