Threat Actor Landscape Guide: Actor Types, Motives and Using Profiles for Defence

Security teams read about dozens of named threat groups every month, yet few can say which kinds of actor actually matter to their organisation or what to change because of them. This guide maps the threat actor landscape by type: state-sponsored groups, financially motivated crime, the access and service economy behind it, hacktivists, commercial offensive vendors and insiders. For each it sets out motive, typical access route, impact and the defensive priority it implies, then shows how to choose the actors relevant to you and turn their profiles into detections, controls and tests. It is written for threat intelligence analysts, detection engineers and security leads, and it acts as the entry point to NHI Mgmt Group's individual actor profiles.

Key takeaways

• Classify by motive first, name second. Whether an actor wants money, intelligence, disruption or attention predicts its behaviour better than its brand, which changes with every vendor and rebrand.
• Identity is the common entry point. State groups, extortion crews and insiders all lean on valid accounts, help desk resets, MFA abuse and stolen tokens far more than on novel malware.
• Relevance beats notoriety. Build a short list of five to ten actors that target your sector, region and technology, and ignore headline groups with no path to you.
• Profiles are only useful when they change something. Translate each priority actor into ATT&CK techniques, check detection and control coverage, and test it.
• Expect overlap and convergence. State groups use criminal tooling, crime groups buy access from brokers, and some states raise revenue through cybercrime, so lines between types blur.

The actor types at a glance

Microsoft's public taxonomy is a useful baseline because it separates actors by category before origin: nation-state actors, financially motivated actors, private sector offensive actors (PSOAs), influence operations, and groups in development (temporary designations for emerging activity). The table below extends that into a defensive view, adding hacktivists and insiders.

State-sponsored actors

CISA's nation-state threat pages focus on four states. In CISA's descriptions, China conducts activity to advance national interests including infiltrating critical infrastructure networks; Russia pursues broad espionage, suppression of social and political activity, intellectual property theft and harm to adversaries; North Korea gathers intelligence, conducts attacks and generates revenue; and Iran suppresses social and political activity and harms regional and international adversaries. Microsoft's family names map the same split: Typhoon (China), Blizzard (Russia), Sandstorm (Iran) and Sleet (North Korea).

• Espionage at scale: groups such as APT29 (Midnight Blizzard) and Salt Typhoon pursue long-term access. The Microsoft Midnight Blizzard breach shows the pattern: a forgotten test tenant and an OAuth application rather than an exotic exploit.
• Pre-positioning: CISA, NSA and FBI assessed with high confidence in advisory AA24-038A (February 2024) that Volt Typhoon was pre-positioning on IT networks to move into OT and disrupt communications, energy, transport and water infrastructure in a crisis. The group relied on native tools such as PowerShell, wmic, ntdsutil and vssadmin, entered through internet-facing devices, and kept persistence with valid credentials taken from NTDS.dit, with some intrusions lasting at least five years.
• Destructive operations: Sandworm is the reference case for state disruption against energy and industrial targets.
• Revenue generation: North Korean groups such as the Lazarus Group combine espionage with cryptocurrency theft, and fake IT worker schemes put state operators on payrolls. See the Insider Threat from Fake IT Workers Guide.

Go deeper by country with the China State Cyber Operations Guide, Russia State Cyber Operations Guide, Iran State Cyber Operations Guide and North Korea Cyber Operations Guide.

Financially motivated actors and the crime economy

Most organisations are far more likely to meet a criminal group than a state one. Modern cybercrime is a supply chain of specialists: infostealer operators and initial access brokers sell credentials and footholds, ransomware-as-a-service operators rent their platforms to affiliates, and data leak sites apply pressure. The Cybercrime Ecosystem Guide, Ransomware-as-a-Service Business Model Guide and Initial Access Brokers Guide cover each layer.

• Ransomware brands: LockBit, Akira and Black Basta illustrate how brands rise, fragment and rebrand. Track the affiliates' behaviour, not just the brand. See the Ransomware Groups Guide.
• Extortion without encryption: Cl0p mass-exploits file transfer products, and UNC5537 used infostealer credentials against cloud data warehouses in the Snowflake breach. See the Data Extortion Without Encryption Guide.
• Social engineering crews: the FBI and CISA advisory on Scattered Spider (AA23-320A) describes help desk impersonation to reset passwords and MFA, SIM swapping, MFA fatigue, registering attacker MFA devices, adding a federated identity provider to the SSO tenant, and later ALPHV BlackCat deployment against VMware ESXi. The MGM Resorts breach began with a help desk call. Lapsus$ showed the same identity-first approach earlier.
• Long-running financial groups: FIN7 moved from payment card theft into ransomware affiliation, a reminder that groups change business models.

Hacktivists, commercial offensive vendors and insiders

• Hacktivists: mostly DDoS, defacement and leak claims timed to political events, with exaggerated claims common. Some state-aligned personas, such as CyberAv3ngers, have reached internet-exposed OT controllers. See the Hacktivism Guide and Pro-Russia Hacktivists Targeting OT Guide.
• Private sector offensive actors: Microsoft defines PSOAs as legitimate commercial entities that create and sell cyberweapons to customers who choose the targets. Exposure concentrates on journalists, officials, executives and activists. See the Commercial Spyware Guide.
• Insiders: CISA defines an insider as anyone who has or had legitimate access to, or knowledge of, the organisation, and splits insider threats into unintentional (negligent or accidental), intentional, collusive (working with an outside actor) and third-party. Collusive insiders are increasingly recruited by extortion groups. See the Insider Threat Programme Guide.

Convergence: why the categories blur

ENISA's Threat Landscape 2025, covering July 2024 to June 2025, describes EU targets being hit by diverse yet convergent threat groups that reuse tools and techniques, exploit vulnerabilities and collaborate. In practice this shows up in three ways. State operators buy or borrow criminal tooling and infrastructure, which makes tooling a weak attribution signal. Criminal affiliates move between ransomware brands, so a takedown of one brand rarely removes the people. And some states, North Korea most visibly, run revenue operations that look like ordinary crime. For defenders the lesson is to plan controls around behaviours and entry points that many actor types share, and to treat the category label as a hint about likely objectives and persistence rather than a promise about technique.

Reading a threat actor profile

Every group is known by several names. MITRE ATT&CK assigns neutral group IDs (for example G0016 APT29, G0007 APT28, G0034 Sandworm Team, G0032 Lazarus Group, G1015 Scattered Spider, G1004 LAPSUS$, G0046 FIN7) that make a good join key across vendor reports. Microsoft also uses Storm-#### for groups in development and Tempest for financially motivated actors. See the Threat Actor Naming Conventions Guide and, for how much weight a name deserves, the Cyber Threat Attribution Guide.

Choosing the actors that matter to you

A relevant actor list is the bridge from landscape to action. A practical method:

1. Define your profile. Sector, countries of operation, high-value data, OT presence, exposed technologies (VPN, file transfer, identity provider, cloud data platforms) and high-risk people.
2. Collect candidates. Pull actors named in government advisories and sector ISAC reporting for your sector over the last 24 months; sector views such as the Threat Actors Targeting Financial Services Guide, Threat Actors Targeting Healthcare Guide and Energy Sector Threat Actors Guide help.
3. Score relevance. For each actor, score intent (targets your sector or region), capability, observed activity recency and opportunity (you expose what it uses). Keep five to ten.
4. Extract techniques. Map each priority actor to ATT&CK techniques and combine them into a weighted heatmap.
5. Review on a schedule. Quarterly, or immediately after a major advisory, rebrand or takedown.

Small organisations can skip bespoke scoring: start with ransomware affiliates, initial access brokers and social engineering crews, which hit organisations of every size, and add a state actor only if your sector or supply chain makes you a target. Large organisations and critical infrastructure operators need the full process and a named owner.

Turning the landscape into defence

Across actor types, a small set of ATT&CK techniques recurs. Prioritising controls against them covers much of the landscape at once:

The Threat-Informed Defence Guide covers building the technique list, coverage mapping and adversary emulation in detail, and the Threat Hunting Guide covers hypothesis-led hunts drawn from actor reporting.

Where identity fits

The identity thread runs through every actor type. State groups harvest NTDS.dit and abuse OAuth applications, extortion crews reset MFA through the help desk and add their own identity provider, infostealer markets sell session cookies and API keys, and insiders already hold valid credentials. Non-human identities are a growing target: service accounts without MFA, long-lived cloud keys and SaaS tokens give quiet, durable access. Build actor-driven detections on identity telemetry first. See the Threat Intelligence for Identity and NHI Guide and the Identity Threat Hunting Guide.

Detection and measurement

• Priority actor coverage: share of techniques used by priority actors with a tested detection or preventive control.
• Exposure to actor entry points: count of internet-facing systems with KEV-listed vulnerabilities used by priority actors, and their age.
• Intelligence to action time: days from a relevant government advisory to completed review and backlog items.
• Emulation results: share of emulated priority-actor behaviours detected and the time to detect.
• List freshness: date of last review of the priority actor list and number of stale or rebranded entries corrected.

Framework mapping

Common failure patterns

• Chasing headlines: effort goes on the actor in the news rather than the ones with intent and a path to you.
• Indicator-only use: hashes and IP addresses from a profile are blocked and forgotten while the behaviours stay undetected.
• Treating names as identities: duplicate records for one group under three vendor names, or two different clusters merged under one.
• Ignoring the help desk: actor reporting on social engineering is read by the SOC but never reaches the service desk process, as the MGM Resorts case showed.
• Stale lists: disrupted or rebranded ransomware brands stay on the list while their affiliates operate under new names.
• Underweighting insiders and suppliers: external actor work crowds out insider and third-party scenarios that need different controls.

Practitioner checklist

• Write a one-page organisational threat profile: sector, regions, crown jewels, exposed technologies and high-risk people.
• Maintain a priority actor list of five to ten groups, keyed by ATT&CK group ID, with owner and review date.
• Record source and confidence for every actor claim and prefer government advisories for decisions.
• Map priority actors to ATT&CK techniques and track detection and control coverage.
• Close the recurring entry points first: edge device patching, MFA on remote access, help desk verification.
• Feed actor social engineering tactics into service desk and identity provider procedures.
• Run adversary emulation for at least one priority actor per year and fix the gaps found.
• Review the list quarterly and after any major advisory, takedown or rebrand.

Standards and references

• MITRE ATT&CK: Groups
• CISA: Nation-State Cyber Actors
• CISA, NSA and FBI: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
• FBI and CISA: Scattered Spider (AA23-320A)
• CISA: Defining Insider Threats
• Microsoft: How Microsoft names threat actors
• ENISA: Threat Landscape 2025

Related NHI Mgmt Group resources: Threat Intelligence Guide · Threat-Informed Defence Guide · Ransomware Groups Guide · Government Threat Actors Guide · Threat Intelligence for Identity and NHI Guide