What Is a Threat Actor?

Types of Threat Actors

Threat actors come in many forms, each with their own motivations, tactics, and objectives. Understanding these distinctions is critical for effectively defending against them.

Nation-state actors

Nation-state actors are typically government-sponsored groups or individuals who engage in malicious cyber operations—such as cyber espionage, data theft, advanced persistent threats (APTs)—to achieve political, military, or economic objectives. These actors are usually highly sophisticated and well-resourced, often targeting critical infrastructure, government agencies, and key industries. 

Example: In 2021, the Russia-linked hacker group NOBELIUM (aka Midnight Blizzard) breached Microsoft, targeting customer data through a compromised reseller’s account as a part of a broader cyber-espionage campaign. 

Cybercriminals

Cybercriminals are individuals or groups who use cyberattacks primarily for financial gain. They often employ tactics such as ransomware, phishing, and identity theft to extort money from -victims or steal valuable data. 

Example: The Dark Angels ransomware group encrypts victims’ data, demanding ransom for decryption. They target corporate networks, threatening to leak stolen data if demands aren’t met, often via double extortion tactics.

Insiders

Insider threats originate from within an organization and can be malicious or unintentional. These threats often involve employees or contractors who have access to sensitive information and misuse it for personal gain, revenge, or due to negligence, such as falling victim to phishing attacks. 

Example: In 2023, Microsoft AI researchers accidentally exposed 38TB of sensitive data, including private keys and passwords, by misconfiguring a shared Azure storage URL used for open source AI development.

Hacktivists

Hacktivists are those who use hacking techniques to promote or push their agendas, whether they be social or political. Their attacks are often aimed at disrupting services, defacing websites, or leaking information to bring attention to their causes. 

Example: Anonymous, a decentralized hacktivist group, launched attacks against Russian government websites in 2022 in response to the invasion of Ukraine. Another example is the group LulzSec, which targeted corporations and government agencies in 2011.

Script kiddies

Script kiddies are inexperienced hackers who use pre-written scripts or tools developed by others to launch attacks. While they generally lack advanced skills, they can still cause significant damage, particularly by exploiting known vulnerabilities and poorly secured systems. These less-experienced threat actors have found greater success through cybercrime services like ransomware-as-a-Service (RaaS) and advancements in generative AI. 

Example: In 2016, a group of script kiddies used the Mirai botnet to launch a massive distributed denial of service (DDoS) attack that brought down large portions of the internet. Another example is the 2019 Twitter hack, where teenagers gained access to high-profile accounts by exploiting social engineering techniques.
 

Motivations for Threat Actors 

Threat actors have a variety of drivers, each one influencing the nature and severity of their actions on different scales. Cybercriminals motivated by financial gain, for example, often seek to steal sensitive information, such as credit card numbers or intellectual property, which they can sell on the black market or use for extortion through ransomware attacks. 

Others are motivated by political ideology. In these cases, actors may target organizations or governments to promote their beliefs, disrupt operations, or expose what they perceive as injustices. These actors see their cyberattacks as a form of protest, aiming to sway public opinion or pressure those in power to change policies. 

Then there are those driven by revenge or simply the thrill of the challenge. Disgruntled employees or former partners might launch attacks against an organization out of spite, looking to settle personal scores. Others, particularly younger or less experienced hackers, may be motivated by the adrenaline rush of breaking into a secure system, seeking the recognition that comes with pulling off a daring cyber-heist. For these individuals, the act itself is often more important than the outcome.

Techniques and Tactics Used by Threat Actors

Below are some of the most common methods threat actors employ to take advantage of an individual or organization:

• Phishing: Phishing attacks deceptive “social engineering” techniques to trick users into divulging sensitive information, transferring sums of money, and more. Types include emails or text messages, fake websites used to steal credentials, vishing attacks, and others that lure victims into trusting the attacker. It remains a dominant cyberattack method, with attempts increasing by 58.2% in 2023
• Malware: Malware is malicious software designed to invade a computer system and take hostile action—such as stealing or encrypting sensitive information, taking over system functions or spreading to other devices—most often for profit. There are many types of malware, including ransomware, spyware, adware, and trojan horses. Learn more about the most recent malware developments here.
• Advanced persistent threats (APTs): APTs are a hallmark of nation-state  threat actors and sophisticated cybercriminals, wherein an attacker stealthily gains access to an organization’s network and establishes a foothold, allowing them to remain there undetected for an extended period. APTs often target a specific company and tend to use advanced malware that can bypass or dodge common security measures.
• Insider threat techniques: Someone with authorized access to an organization's systems and data misuses their privileges to negatively impact the organization. Insider threats can be intentional or unintentional, and they can come from employees, contractors, third-party vendors, or partners.

Real-World Cyberattacks

Cyberattack methods are many, and we’ve seen plenty of noteworthy examples recently. Below are some notable real-world attacks that highlight their potential impact:

SolarWinds Attack 

In December 2020, the SolarWinds attack targeted the Orion software platform used by thousands of organizations worldwide. Threat actors inserted malicious code into software updates, which were then distributed to over 18,000 customers, including government agencies and major corporations. This breach led to unauthorized access to sensitive data and networks, with the attackers remaining undetected for several months. It is considered one of the most significant cyber espionage campaigns in history.

WannaCry Ransomware

In May 2017, the WannaCry ransomware attack spread rapidly across the globe, affecting hundreds of thousands of computers in over 150 countries. This strain exploited a vulnerability in Windows operating systems, encrypting files and demanding ransom payments in bitcoin. Critical services, including healthcare systems like the UK's National Health Service (NHS), were severely disrupted as a result. Despite its widespread impact, the attack was largely mitigated within days due to a discovered kill switch.

Scattered Spider

Scattered Spider is a financially motivated threat group that emerged around 2022, known for targeting telecommunications and technology companies. The group uses social engineering tactics, such as phishing and SIM-swapping, to gain access to corporate networks and perpetrate fraud or deploy ransomware. Companies targeted by Scattered Spider have faced significant operational disruptions and financial losses, with the group’s sophisticated tactics making it a formidable threat.

Colonial Pipeline

The Colonial Pipeline attack in May 2021 was a ransomware attack carried out by the DarkSide group, targeting the largest fuel pipeline in the U.S. It exploited outdated cybersecurity measures, leading to a shutdown that disrupted fuel supplies across the East Coast. The attack highlighted vulnerabilities in critical infrastructure, exposing the need for stronger cybersecurity in essential services. 

Dark Angels

Dark Angels is a ransomware group that emerged in 2022, known for its sophisticated tactics, targeted one high-value company at a time, and high ransom demands. The group typically uses double extortion methods, where they not only encrypt the victim's data, but also threaten to leak sensitive information if the ransom is not paid. However, this tactic was not employed to orchestrate a record-breaking $75 million ransom payout uncovered by ThreatLabz in 2024.

How to Protect Against Threat Actors

Threat actors will find any and all means of infiltrating your systems. Use these techniques to ensure your organization’s vulnerabilities are closed off.

• Keep operating systems and browsers up to date: Software providers regularly address newfound vulnerabilities in their products and release updates to keep your systems protected.
• Protect data with automatic backups: Implement a regular system data backup process so you can recover if you suffer a ransomware attack or data loss event.
• Use advanced multifactor authentication (MFA): Access control strategies such as MFA create additional layers of defense between attackers and your internal systems.
• Educate your users: Cybercriminals constantly invent new strategies for carrying out their attacks, and the human element remains any organization’s biggest vulnerability. Your organization will be safer if all users understand how to identify and report phishing, avoid malicious domains, and so on.
• Invest in comprehensive, integrated zero trust security: Cyberthreats have come a long way—to best protect your workforce and reduce organizational risk, look for a proactive, intelligent, and holistic defense platform.

Future Trends In Threat Actor Activities

Here are some of the ways threat actors and the groups they participate in will continue to be thorns in the sides of security teams.

Dark chatbots and AI-driven attacks

The scourge of “AI for bad” will grow. AI-driven attacks are likely to surge as the dark web serves as a breeding ground for malicious chatbots like WormGPT and FraudGPT to amplify cybercriminal activities. These insidious tools will become instrumental in executing enhanced social engineering, phishing scams, and various other threats.

IoT attacks

Vulnerable IoT devices will increase as a primary threat vector, exposing enterprises to breaches and new security risks. The lack of standardized security measures by device IoT developers and manufacturers leads to vulnerabilities that attackers can easily exploit.

Coupled with the widespread adoption and use of these devices, IoT is low-hanging fruit for easy yet significant financial gain for attackers.

VPN exploitation

Given the frequency, severity, and scale of VPN vulnerabilities, enterprises should expect this trend to continue. Threat actors and security researchers are aware of the heightened risk of high-severity vulnerabilities in VPN products. In turn, they are actively hunting for more, making it likely that additional CVEs will be found in the coming months and years.

Protect Yourself from Threat Actors with Zscaler

To ward off threat actors from all angles, invest in Zscaler Cyberthreat Protection, part of our Zero Trust Exchange™ platform. Zscaler is the world’s largest and most deployed inline security cloud, purpose-built to address the evolving cyber needs of today’s enterprises. 

Built on the principle of least privilege, Zscaler’s proxy architecture enables full TLS/SSL inspection at scale, with connections brokered between users and applications based on identity, context, and business policies, so you can:

• Minimize the attack surface: Hide your apps, locations, and devices from the internet, preventing threat actors from reaching and breaching these assets.
• Prevent compromise: Snuff out phishing attacks and malware downloads with full inline TLS/SSL inspection at scale and AI-powered threat prevention.
• Eliminate lateral movement: Minimize the blast radius, defend against insider threats, and reduce operational overhead with zero trust segmentation.
• Stop data loss: Discover shadow IT and risky apps with automatic classification of sensitive data. Secure user, workload, and IoT/OT traffic for data at rest and in motion.

Want to learn more about Zscaler Cyberthreat Protection? Schedule a custom demo with one of our experts to learn how Zscaler helps you keep threat actors at bay, no matter how advanced their techniques.