Threat Actors and Attack Vectors
Who attacks and why, the routes they use to get in, and the models defenders use to describe an attack from start to finish.
Threat actors
A threat actor is a person or group that carries out, or intends to carry out, actions that harm an organization's security. Knowing who is likely to target you helps decide what to defend first: a local bakery and a defense contractor face very different opponents.
Threat actors are usually compared on a few attributes:
- Internal or external: inside the organization (employees, contractors) or outside it.
- Resources and funding: a lone teenager versus a group with a budget, staff and time.
- Sophistication: using ready-made tools versus developing their own methods and finding new vulnerabilities.
- Motivation: financial gain, espionage, disruption, ideology, revenge, or simply curiosity and bragging rights.
| Actor | Typical motivation | Capability | Typical activity |
|---|---|---|---|
| Nation-state | Espionage, sabotage, political or military advantage | Very high: large budgets, patience, own tools | Long, stealthy intrusions into government, defense, research and critical infrastructure |
| Organized cybercriminals | Money | High, and businesslike: specialists, help desks, affiliate schemes | Ransomware and data extortion, business email compromise, selling stolen data and access |
| Hacktivists | Ideology, protest, publicity | Low to medium | Defacing websites, denial-of-service attacks, leaking documents |
| Insiders | Revenge, money, ideology — or no motive at all (mistakes) | Varies, but with legitimate access | Taking data when leaving, sabotage, misdirected emails, misconfigurations |
| Unskilled attackers (script kiddies) | Curiosity, thrill, bragging rights | Low: use tools written by others | Running public scanning and attack tools against anything reachable |
| Competitors | Commercial advantage | Varies; may hire others | Stealing designs, price lists or customer lists (industrial espionage) |
| Shadow IT | Getting work done faster | Not malicious, but unmanaged | Departments using unapproved cloud services or devices that nobody patches or monitors |
Organized cybercrime deserves a special mention because it is the threat most organizations actually meet. Ransomware-as-a-service (RaaS) works like a franchise: one group develops the ransomware and runs the payment and "negotiation" infrastructure, while affiliates break into victims and share the ransom with the developers. Many groups also steal data before encrypting it and threaten to publish it (double extortion), so good backups alone no longer remove the pressure. Other criminals specialize in selling initial access — stolen passwords or a foothold in a network — to whoever pays.
Insider threats
An insider threat comes from someone with authorized access — an employee, contractor or partner — who misuses it, deliberately or by accident. The malicious insider steals customer lists before joining a competitor or sabotages systems after a conflict. The negligent insider is far more common: sending a file to the wrong address, reusing a password, falling for a phishing email, leaving a storage bucket public.
Insiders are hard to stop with perimeter defenses, because they are already inside. The controls are least privilege, separation of duties (see Access Control), prompt removal of access when people leave or change roles, logging of sensitive actions, and a culture in which mistakes are reported rather than hidden.
Advanced persistent threats
An advanced persistent threat (APT) is a well-resourced attacker, usually state-sponsored or state-aligned, that targets specific organizations and stays hidden in their networks for a long time to reach its goals. Advanced: skilled and well equipped. Persistent: patient, returning when thrown out. Threat: a specific, organized adversary rather than random malware. The term is also used for the groups themselves, which security companies track under names such as "APT29".
Because APTs aim to stay unnoticed, defending against them leans heavily on detection: centralized logging, monitoring for unusual behavior and threat hunting, often by a security operations center (SOC) (see Security Monitoring and the SOC).
Attack vectors
An attack vector (also called threat vector) is the path or means by which an attacker reaches a target to deliver an attack. Most incidents start through a small number of well-known vectors, each with known defenses:
| Vector | Examples | Main defenses |
|---|---|---|
| Email and messages | Phishing links, malicious attachments, fake invoices; also text messages, chat and voice calls | Email filtering, awareness, reporting button, multi-factor authentication (MFA) (see Social Engineering and Phishing) |
| Web | Compromised or fake websites, malicious ads, vulnerable public web applications | Web filtering, patched browsers, secure development (see Web Application Security) |
| Removable media | Infected USB sticks, a "found" drive in the parking lot | Block or control USB storage, disable autorun, awareness |
| Remote services | Remote Desktop Protocol (RDP) exposed to the internet, virtual private network (VPN) appliances without patches or MFA | Never expose RDP directly, patch VPN gateways quickly, require MFA (see Remote Access) |
| Supply chain | Tampered software updates, compromised service providers, malicious open-source packages | Vendor assessment, least privilege for suppliers, monitoring |
| Cloud misconfiguration | Public storage buckets, leaked access keys, over-permissive roles | Guardrails and posture scanning (see Cloud Security and Compliance) |
| Physical | Following staff through a door, plugging a device into an office network port, stealing a laptop | Badges, visitor procedures, 802.1X, disk encryption (see Physical Security) |
| Wireless | Weakly protected Wi-Fi, fake access points with a familiar name, Bluetooth weaknesses | Wi-Fi Protected Access 3 (WPA3) or enterprise Wi-Fi authentication, separate guest network, VPN on public Wi-Fi |
| Weak or default credentials | Factory passwords on cameras and routers, reused or leaked passwords | Change defaults at installation, password manager, MFA (see Passwords and Authentication) |
Supply chain attacks
A supply chain attack compromises a trusted supplier — a software vendor, an IT service provider, a hardware manufacturer — to reach that supplier's customers. It is attractive to attackers because one break-in gives access to many victims, and because the malicious code or connection arrives through a channel the victims trust.
Two widely reported examples:
- In 2020, a tampered update of the SolarWinds Orion network monitoring software was installed by thousands of organizations, giving a state-linked group a way into a selected number of them.
- In 2021, criminals abused Kaseya VSA, a remote-management tool used by managed service providers, to push ransomware to the providers' customers in one go.
Defenses: know which suppliers have access to what, give them the least privilege they need, require security commitments in contracts, monitor what supplier accounts and tools do, and verify software (signatures, trusted repositories, a software bill of materials or SBOM listing the components). For a managed service provider with administrator access to your network, its security is effectively your security. A recent example from the build pipeline, and what it changed: the supply chain lesson.
Attack surface
The attack surface is the total of all points where an attacker could try to enter or extract data: every internet-facing service, open port, user account, device, application, supplier connection and every person who can be tricked. The bigger it is, the more there is to defend and the more likely one point is weak.
Reducing the attack surface is one of the cheapest defenses:
- Remove what is not needed: unused services, software, ports, accounts and old test servers. A service that does not run cannot be attacked.
- Know what you have: an up-to-date inventory of devices, software and internet-facing systems. You cannot protect what you do not know about — shadow IT and forgotten servers are classic entry points.
- Hide management interfaces: administration only from a management network or through a VPN or jump server, never open to the internet.
- Limit access: least privilege for users, services and suppliers, and segmentation so that one compromised device does not reach everything.
- Harden what remains: secure configuration and timely patching (see Linux Security and Endpoint Security).
The cyber kill chain
The cyber kill chain is a model, published by Lockheed Martin in 2011, that describes a targeted attack as seven consecutive stages. Its value for defenders is the insight that the attacker must complete every stage, while the defender only has to break one of them — preferably as early as possible.
| Stage | What happens | What defenders can see or do |
|---|---|---|
| 1. Reconnaissance | The attacker gathers information: staff names and roles, email formats, exposed services, software versions | Limit what is public, know your internet-facing systems, notice scanning in firewall logs |
| 2. Weaponization | The attacker prepares the means of attack, such as a malicious document matched to a known flaw | Invisible to the victim; threat intelligence about attacker tools and malware artifacts helps defenders prepare detections |
| 3. Delivery | The attack reaches the target: email, website, USB | Email and web filtering, blocked macros, user reports |
| 4. Exploitation | A vulnerability or a person's action lets the attack run | Patching, MFA, least privilege, awareness |
| 5. Installation | The attacker establishes a lasting foothold | Application allowlisting, EDR alerts on new persistence |
| 6. Command and control | The compromised machine contacts the attacker for instructions | Restrict outbound traffic, DNS filtering, look for unusual connections |
| 7. Actions on objectives | The attacker does what they came for: steal data, encrypt systems, sabotage | Segmentation, data loss prevention, offline backups, incident response |
The model has known limits: it was designed around malware delivered from outside, and fits insider threats, cloud account takeovers or attacks that use only stolen passwords less well. Real attacks also loop back — after the first machine, the attacker does reconnaissance again inside the network. That is one reason many teams now prefer MITRE ATT&CK.
MITRE ATT&CK
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a free, publicly available knowledge base of how real attackers operate, maintained by the non-profit MITRE Corporation and based on observed incidents. It gives defenders a common language: instead of "they got in somehow and then moved around", a report says which techniques were used, each with an identifier.
- Tactics are the attacker's goals at a stage — the why. Examples: Initial Access, Persistence, Privilege Escalation, Credential Access, Lateral Movement, Exfiltration, Impact. The Enterprise matrix has 15 tactics (since version 19 in 2026, when Defense Evasion was split into Stealth and Defense Impairment).
- Techniques are how a goal is achieved — the how. For example, the tactic Initial Access includes the technique Phishing (T1566), with sub-techniques such as Spearphishing Attachment (T1566.001), and Valid Accounts (T1078) — logging in with stolen credentials.
- Procedures are the specific way a particular group carries out a technique, as seen in real incidents.
Besides the Enterprise matrix for office IT and cloud, there are matrices for mobile devices and for industrial control systems (ICS). Each technique page also lists ways to detect and mitigate it, which is where defenders spend most of their time.
How security teams use ATT&CK
- Detection coverage: a SOC maps its detection rules to techniques and sees at a glance which common techniques it would not notice.
- Threat intelligence: reports about a group list its techniques, so a team can check "would we see this?" for the groups that target its sector.
- Incident reports: describing what happened in ATT&CK terms makes incidents comparable and lessons reusable.
- Testing: authorized red-team and purple-team exercises use techniques from the matrix to check whether defenses work as intended.
For a starter, ATT&CK is mostly a vocabulary. When an alert says "T1078 Valid Accounts", look up the technique page: it explains what the attacker is doing and what to check next. More on this in Security Monitoring and the SOC.
Critical infrastructure
Energy, water, transport, healthcare and telecommunications are attractive targets for several kinds of actors: criminals because downtime is so costly that victims may pay quickly, and nation-states because disruption can serve political or military goals. These organizations run operational technology (OT) — industrial control systems that open valves, run pumps and switch power — alongside normal office IT.
Some publicly documented events illustrate the risk:
- In December 2015, attackers caused power outages for hundreds of thousands of customers in Ukraine by taking over control systems of regional distribution companies.
- In 2021, ransomware hit the office IT of Colonial Pipeline, a large fuel pipeline operator in the United States; the company stopped the pipeline as a precaution, causing fuel shortages. The control systems themselves were not reported to be encrypted.
The second example shows something important: an attack on office IT can stop physical operations when the business cannot bill, schedule or verify its processes. Government advisories in recent years have also warned about state actors quietly gaining access to critical infrastructure networks without causing damage — possibly to be in position for later.
Defenses follow the same principles as elsewhere, with a stronger emphasis on separating OT from IT networks, strictly controlling remote access for vendors, keeping manual fallback procedures, and on availability and safety over confidentiality. In Europe the NIS2 directive (the European Union's second Network and Information Security directive) sets security and incident-reporting duties for many of these sectors; in the Netherlands the National Cyber Security Centre (NCSC-NL) supports and warns organizations in vital sectors. See Governance, Frameworks and Compliance.