Threat Actor
What is Threat Actor?
An individual or group that conducts cyber attacks or exploits vulnerabilities. Threat actors include nation-states, organised crime groups, hacktivists, insider threats, and opportunistic attackers.
Terms that appear alongside threat actor
Each of these is named in at least one of the same controls as threat actor. The number is how many controls name both.
- malware 3 shared controls
- profiling 2 shared controls
- mitre 2 shared controls
- threat intelligence 2 shared controls
Frameworks that govern threat actor
What the standards actually require on threat actor
Requirements naming threat actor across 6 standards, quoted from the control text.
Remove threat actor artefacts including malware, web shells, accounts, scheduled tasks, services, and persistence mechanisms across all affected systems prior to recovery.
PICERL-E-02 · Eradication: Removal of Threat Actor Artefacts →Threat actors. The Guidelines require identifying the threat actors relevant to the maritime context (e.g. opportunists, activists, criminals, state-sponsored actors and insiders).
BIMCO-2.1 · Threat actors →FIRST CSIRT Services Framework v2.1 Service Area 4 - Situational Awareness. SCOPE: maintaining + sharing operational + tactical + strategic awareness of the cyber threat landscape relevant to the constituency.
FIRST-CSIRTF-SA4-SituationalAwareness · Service Area 4 - Situational Awareness and Threat Intelligence →Vulnerability Management is a core technical control area per FSA Cybersecurity Guidelines. (1) Vulnerability Discovery: (a) Authenticated and Unauthenticated Scanning - Nessus + Qualys + Rapid7 + open source; (b) DAST Dynamic Application Security Testing;
JP-FSA-CYB-Vulnerability-Management-Patching-CVE-Risk-Based-Prioritisation-Penetration-Testing-Red-Team · Japan FSA Cybersecurity Vulnerability Management + Patching + CVE Tracking + Risk-Based Prioritisation + Penetration Testing + Red-Team + Bug Bounty + Coordinated Vulnerability Disclosure + Zero-Day Response →Track adversary tradecraft via ATT&CK Groups (G-IDs) and Software (S-IDs). 130+ threat groups documented including APT1 (PLA Unit 61398) + APT28 Fancy Bear (Russia GRU) + APT29 Cozy Bear/Midnight Blizzard (Russia SVR) + APT38 Lazarus financial (DPRK) + APT41 W...
MITRE-ATTACK-Threat-Groups-Software-APT28-APT29-APT38-APT41-FIN7-Conti-LockBit-Lazarus-Cobalt-Strike-Mimikatz · MITRE ATT&CK Threat Groups + Software + APT28 + APT29 + APT41 + FIN7 + Conti + Lazarus + Cobalt Strike + Mimikatz →Maintains awareness of threat actors targeting the supply chain and feeds that awareness into decisions.
161R1-PM-16 · Threat Awareness Program →Questions people ask about threat actor
What is Threat Actor?
Why is Threat Actor important for compliance?
Which compliance frameworks address Threat Actor?
Where can I learn more about Threat Actor?
See how Threat Actor applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.