Chapter 22: Threat Actor Encyclopedia¶

Overview¶

Understanding adversaries — their motivations, capabilities, infrastructure, and behavioral patterns — transforms security from reactive to proactive. This chapter is a comprehensive encyclopedia of major threat actors organized by geopolitical origin, motivation, and sector targeting. Each profile covers the actor's TTPs mapped to MITRE ATT&CK, known tooling, infrastructure signatures, historical operations, and detection opportunities. Whether defending critical infrastructure, financial services, healthcare, or government networks, understanding your adversary is the first step toward defeating them.

Learning Objectives¶

By the end of this chapter, students SHALL be able to:

1. Distinguish nation-state actors, cybercriminal groups, hacktivists, and insider threats
2. Profile the top 20 advanced persistent threat (APT) groups with their TTPs and targeting
3. Map threat actor tooling to MITRE ATT&CK techniques for detection engineering
4. Use threat intelligence to prioritize defensive controls based on likely adversaries
5. Recognize infrastructure signatures (C2 patterns, malware families) of specific actors

Prerequisites¶

• Completion of Chapter 7 (Threat Intelligence & Context)
• Familiarity with MITRE ATT&CK framework
• Basic understanding of nation-state geopolitical dynamics

22.1 Threat Actor Classification¶

graph TD
    A[Threat Actors] --> B[Nation-State / APT]
    A --> C[Cybercriminal\nGroups]
    A --> D[Hacktivists]
    A --> E[Insider Threats]
    A --> F[Script Kiddies /\nOpportunistic]

    B --> B1[Intelligence Collection\nSpy / Steal IP]
    B --> B2[Destructive /\nSabotage]
    B --> B3[Financial Crime\nSanction Evasion]

    C --> C1[Ransomware\nAs a Service]
    C --> C2[Banking Trojans /\nFraud]
    C --> C3[BEC / Wire Fraud]

    D --> D1[Defacement /\nDDoS]
    D --> D2[Data Leak /\nEmbarrassment]

    style B fill:#e63946,color:#fff
    style C fill:#f4a261,color:#000
    style D fill:#1d3557,color:#fff

22.2 Russian Threat Actors¶

22.2.1 APT28 / Fancy Bear (GRU Unit 26165)¶

Sponsor: Russian Military Intelligence (GRU) Active Since: 2004 Primary Targets: Government, defense, political organizations, NATO/EU member states Motivation: Intelligence collection, influence operations, election interference

ATT&CK Mapping: - T1566.002: Spearphishing Link (primary initial access) - T1078: Valid Accounts (credential reuse) - T1036.005: Match Legitimate Name or Location - T1071.001: Web Protocols (HTTPS C2) - T1003.001: LSASS Memory

22.2.2 APT29 / Cozy Bear (SVR / FSB)¶

Sponsor: Russian Foreign Intelligence Service (SVR), possibly FSB Active Since: 2008 Primary Targets: Government, think tanks, healthcare, SolarWinds supply chain Motivation: Long-term intelligence collection; highly patient and stealthy

Detection Opportunities:

- Unusual outbound connections to OneDrive/Dropbox from non-user processes
- SolarWinds Orion processes making DNS queries to avsvmcloud.com subdomains
- OAuth token requests from anomalous applications
- SUNBURST DGA pattern: base32-encoded victim organization name in subdomain

22.2.3 Sandworm (GRU Unit 74455)¶

Sponsor: Russian GRU Active Since: 2009 Primary Targets: Ukraine, critical infrastructure, media, Olympic Games Motivation: Destructive attacks aligned with geopolitical objectives

22.3 Chinese Threat Actors¶

22.3.1 APT41 / Double Dragon (MSS / PLA overlap)¶

Sponsor: Chinese Ministry of State Security (MSS) Active Since: 2012 Primary Targets: Healthcare, biotech, telecom, video game industry, government Motivation: Dual: state espionage + financial crime (unique dual-mission actor)

22.3.2 Volt Typhoon (BRONZE SILHOUETTE)¶

Sponsor: Chinese People's Liberation Army Active Since: 2021 (identified) Primary Targets: US critical infrastructure (power, water, telecom, transportation) — pre-positioning Motivation: Pre-position for destructive attacks in case of Taiwan conflict

22.3.3 APT10 / Stone Panda¶

Sponsor: MSS (Tianjin State Security Bureau) Active Since: 2009 Primary Targets: Managed Service Providers (MSPs), cloud, aerospace, healthcare, defense Motivation: Technology theft, IP espionage, targeting via MSP supply chain

Cloud Hopper Operation: Compromised 45+ MSPs to gain access to 45+ countries simultaneously — among the most impactful supply chain attacks in history.

22.4 North Korean Threat Actors¶

22.4.1 Lazarus Group (RGB Unit 180)¶

Sponsor: Reconnaissance General Bureau (RGB) Active Since: 2009 Primary Targets: Financial sector, cryptocurrency exchanges, defense, media Motivation: Financial theft to fund WMD programs; revenge/espionage

22.4.2 APT38 (Bluenoroff)¶

Sponsor: RGB (financial operations branch) Active Since: 2014 Primary Targets: Banks, SWIFT network, cryptocurrency Motivation: Generate revenue for North Korean state

SWIFT Network Attacks: APT38 has compromised 16+ banks across 11+ countries using the SWIFT interbank messaging system to initiate fraudulent wire transfers.

22.5 Iranian Threat Actors¶

22.5.1 APT33 / Elfin¶

Sponsor: IRGC (Iranian Revolutionary Guard Corps) Active Since: 2013 Primary Targets: Aerospace, petrochemical, energy, government Motivation: Espionage, destructive attacks against adversaries

22.5.2 APT34 / OilRig¶

Sponsor: Iranian Ministry of Intelligence (MOIS) Active Since: 2014 Primary Targets: Middle East governments, energy, financial, telecom Motivation: Regional intelligence collection; persistence in strategic organizations

22.6 Major Ransomware Groups¶

22.6.1 LockBit¶

Active: 2019–present (LockBit 3.0 / LockBit Black) Model: Ransomware-as-a-Service (RaaS) — most prolific ransomware 2022–2024 Notable Victims: Royal Mail UK, Boeing, ICBC Bank, Fulton County Georgia, City of Oakland

22.6.2 ALPHV / BlackCat¶

Active: 2021–2024 (FBI seized in Dec 2023; group disbanded Mar 2024) Language: Rust (cross-platform Win/Linux/VMware ESXi) Notable Victims: MGM Resorts ($100M impact), Caesar's Entertainment, Change Healthcare ($22M ransom)

Change Healthcare Attack: Most impactful healthcare ransomware attack in US history — disrupted prescription processing for 6,000+ pharmacies for weeks.

22.6.3 Cl0p¶

Active: 2019–present Unique Model: Mass exploitation of zero-days for bulk victim acquisition Notable Campaigns: Accellion FTA (2021), GoAnywhere MFT (2023), MOVEit Transfer (2023)

MOVEit Campaign: Exploited CVE-2023-34362 in MOVEit Transfer software — compromised 1,000+ organizations including Shell, US government agencies, airlines, universities in weeks without deploying ransomware (data theft extortion only).

22.7 Hacktivists and Ideologically Motivated Actors¶

22.8 Threat Actor Detection Matrix¶

22.9 Intelligence Platforms for Threat Actor Tracking¶

22.10 Benchmark Controls¶

Exam Prep & Certifications¶

Key Terms¶

APT (Advanced Persistent Threat) — A prolonged and targeted cyber attack, typically nation-state sponsored, that aims to steal data or surveil a target over months or years while remaining undetected.

Double Extortion — Ransomware tactic of exfiltrating data before encrypting, then threatening to publish it if the ransom isn't paid — first used by Maze ransomware (2019).

Living-off-the-Land (LotL) — Using legitimate system tools (PowerShell, WMI, certutil) for malicious purposes, making detection harder as these are not classified as malware.

RaaS (Ransomware-as-a-Service) — Criminal business model where ransomware developers lease their malware and infrastructure to affiliates who conduct attacks and share revenue (typically 70-80% to affiliate, 20-30% to developer).

TTPs (Tactics, Techniques, Procedures) — The behavior patterns of a threat actor — how they operate. TTPs are more durable indicators than IOCs because actors can change IPs and domains but habits persist.