Threat Actor.

What is a threat actor?

A threat actor is an individual or a group posing a threat. That is the wording in the NIST glossary. Other NIST publications describe the same idea in slightly different words. SP 800-221 calls it the source of risk that can result in harmful impact. NISTIR 8286 calls threat actors the instigators of risks with the capability to do harm.

The word “actor” is used because the person or group behind an attack matters as much as the tools they use. Defenders want to know who they face, what that party wants and what it can do.

How are threat actors described?

MITRE ATT&CK tracks Groups. MITRE says groups are activity clusters tracked by a common name in the security community. Different teams use different names, so one actor can have several names.

MITRE also says the technique information on its group pages is only a subset available from open source reporting. A group profile is therefore a useful starting point, not a complete picture.

Why does it matter?

Knowing the actor behind an attack can help a defender judge what to expect next. Different actors can use different methods, so the same warning signs may not apply to all of them. Public group profiles can give a security team behaviors to look for. Because group names and definitions overlap between organizations, the profile should be read with care.

How can you reduce the risk?

The practical step is to turn actor reporting into defense work. Teams can read published group profiles, note the techniques listed for the groups most relevant to them, and check whether their monitoring would notice those behaviors. MITRE says analysts should do additional research and should not treat associated group names as exact overlaps.

• Follow public reporting on groups that target your sector or region.
• Map the reported techniques to your own detection and response plans.
• Treat alias lists as hints, not proof that two names mean the same actor.

Is a threat actor the same as a threat?

No. A threat is the possible harm. The threat actor is the party that can cause it. NIST describes a threat actor as an individual or group posing a threat, so the actor is one source of a threat, not the threat itself.

Is a threat actor the same as an advanced persistent threat?

Not always. Threat actor is the wider term. It covers any individual or group that can do harm. An advanced persistent threat is one kind of threat actor, often described as a well resourced group that keeps targeting its victims over time. MITRE notes that some groups have multiple names because different organizations track similar activity.

Related terms on this site include advanced persistent threat, threat attribution and tactics, techniques and procedures.

Related pages in the Knowledge Hub

• Threat Actors Database
• Threat actor landscape

Sources

• NIST: NIST defines a threat actor as an individual or a group posing a threat (SP 800-150), the source of risk that can result in harmful impact (SP 800-221), and the….
• MITRE ATT&CK: MITRE says groups are activity clusters tracked by a common name, covering threat groups, activity groups and threat actors, mapped to a subset of publicly reported….