Modern cybersecurity is not just about building higher digital walls. You also need to prevent those walls from being torn down by threat actors. To that end, you need to know who is trying to tear them down. The truth is that cyber adversaries do not all operate with the same motivations. They do not all have the same technical capabilities and budgets.
Effectively defending an organization requires security teams to categorize threat actors based on their operational profiles. They can leverage open-source intelligence (OSINT) investigations to better understand their adversaries and convert raw data into effective defense strategies.
A Full Spectrum of Cyber Threat Actors
It helps tremendously to look at cybercrime and state-sponsored threats as a spectrum. Not all cyber threats are the same. They don’t all originate from the same threat actors motivated by the same things. Security professionals know this, which is why DarkOwl recommends categorizing threat actors based on resource capabilities, technical sophistication, and primary objectives:
- Script Kiddies – The least threatening group are script kiddies. These are individuals with rudimentary skills who tend to rely on publicly available, prepackaged exploit kits and automated scanners. They choose their targets randomly. They are essentially newbies trying to learn on-the-fly while establishing some street cred.
- Initial Access Brokers – Known as IABs, these are specialized threat actors DarkOwl says gain access to a network through compromised credentials or an unpatched VPN. Once access is established, they sell it to the highest bidder on a dark web marketplace.
- Malware Developers – These highly sophisticated software experts use the latest code and specialized tools to create all sorts of malicious software. They sell the software outright or offer it through a subscription model.
- Ransomware Affiliates – Similar to malware developers, ransomware affiliates develop and lease their tools to lower-level hackers. The model has proved so successful that security analysts now need to account for Ransomware-as-a-Service (RaaS), a model through which affiliates pay for ransomware while sharing profits with developers.
- Data Brokers – Data brokers are individuals or groups whose business model relies on acquiring, stealing, and monetizing corporate data. They go after intellectual property, network credentials, personally identifiable information (PII), and more.
- Advanced Persistent Threats (APTs) – Security analysts treat state-sponsored and heavily funded nation-state groups as APTs. Such groups tend to conduct long-term cyber espionage and destruction campaigns that target critical government assets. They go after both military and law enforcement.
This list of categories should make clear why security teams need to understand the types of threat actors they are dealing with. When solid OSINT investigations reveal the category that an adversary belongs to, security teams can do a better job neutralizing the threat.
OSINT Investigations Connect the Dots
Structured OSINT investigations are leveraged to gather publicly available data points across a broad surface of both the standard and dark web. Investigators map the data points to build profiles on individuals and groups. The three most commonly utilized techniques are:
- Digital foot-printing and alias tracking.
- Infrastructure correlation.
- Pattern and TTP analysis.
By directly correlating intelligence data with internal defense systems, security teams can move beyond reactive patching in favor of data-driven threat mitigation. Threat actor categorization and OSINT investigations facilitate a tailored defensive posture capable of addressing nearly any type of threat. In addition, OSINT investigations help security teams develop preemptive countermeasures.
When all is said and done, categorizing threat actors is more effective than depending on vague security assumptions. Deploying OSINT investigations to better understand threat actors and what they are working on gives security teams a strategic advantage. Failing to deploy either practice makes little sense given the modern cybersecurity landscape.
