Module - 3Threat Actors and the Attack Lifecycle
2026-08-18 20:09
Tags: #IAS
Author: Duke Hsu
Topic
- Threat Actor
- Attack Lifecycle
- Threat Actors
1. The Actor
1.1 Cybercrime vs Cyberterrorism
| Cybercrime | Cyberterrorism |
|---|---|
| Usually motivated by financial gain | Motivated by ideological or terrorist objectives |
| Focuses on profit, theft , or fraud | Focuses on fear, disruption, or intimidation |
| Targets individuals and organizations | May target critical infrastructure or public systems |
- Cybercriminals
- Insider
- Hacktivists
- Nation-State Actors
- Script Kiddies
- Cyberterrorism
An Advanced Persistent Threat (APT) is a prolonged and targeted cyber
campaign in which an attacker maintains access to a specific network or
organization for an extended period.
1.2 The three important words are:
Advanced: The attacker may have sophisticated skills, tools, and
resources.
Persistent: The attacker attempts to maintain access over a long period.
Threat: The attacker intentionally targets a system or organization
Threat: The attacker intentionally targets a system or organization
1.3 Typical APT characteristics
- Carefully selected targets
- Long-term operations
- Stealthy behavior
- Intelligence gathering
- Multiple stages
- Persistent access
- Often associated with well-funded groups
Key idea: An APT is not simply a single attack. It is usually a long-term, targeted campaign.
2. Attack Lifecycle
The attack lifecycle describes the different stages an attacker may go through when attempting to compromise a target.
2.1 Cyber Kill Chain is the commonly used model.
| Stage | Main Activity | Example |
|---|---|---|
| 1. Reconnaissance | Gather information | Research employees |
| 2. Weaponization | Prepare attack | Prepare malicious payload |
| 3. Delivery | Send attack | Phishing email |
| 4. Exploitation | Abuse weakness | Exploit vulnerable software |
| 5. Installation | Establish access | Install malware |
| 6. Command and Control | Maintain communication | Compromised system communicates with attacker |
| 7. Actions on Objective | Achieve goal | Steal or disrupt information |
3. Comparing the Threat Actors
| Threat Actor | Main Motivation | Typical Skill /Resources |
|---|---|---|
| Cybercriminals | Financial gain | Low to highly organized |
| Insiders | Revenge, profit, mistake, or compromised account | Depends on access |
| Hacktivists | Political / social cause | Low to high |
| Nation-State Actors | National / geopolitical interests | Very high |
| Script Kiddies | Curiosity, entertainment, attention | Usually low |
| Cyberterrorists | Fear, disruption, ideological objectives | Varies |
| APT Groups | Long-term intelligence or strategic objectives | Usually highly capable |
Class note
Practice Software
- Nmap
- Wireshark
References
WEEK3-PPT