Page 320 - Cyber Defense eMagazine September 2025

Types of Threat Actors and Their Characteristics:

Advanced Persistent Threat (APT):

These are groups sponsored by the government, as they are well organized, backed financially, and
capable of carrying out long term strategic planning. They can fully resource and fund the operations and
exercise a lot of patience, which helps them achieve their goal. Their goal usually is to perform espionage
or sabotage.

Financially Motivated Advanced Persistent Threat (FIN):

These actors focus primarily on financial gain. Like other APTs, they too are state-sponsored and well-
organized. Their focus on financial systems allows them to exploit weaknesses within entire
infrastructures. They are capable of sustained, targeted, and precise attacks over long periods of time.

Hacktivist :

Hacktivists are driven by political or ideological reasons. They are usually less organized than state-
sponsored groups. Their goal is to promote a cause or disrupt their targets as a form of protest.

Leaktivists:
Leaktivists are motivated by political or ideological reasons. They specifically aim to obtain and leak
sensitive or classified information. Their goal is to reveal corruption, injustice, or secrecy.

Spiders:

These are cybercriminals driven by profit. They often run schemes like Ransomware-as-a-Service (RaaS)
or Malware-as-a-Service (MaaS), renting out tools or platforms to other criminals. Sometimes, they are
also hired by nation-states for certain operations.

What is Threat Actor Profiling? Threat actor profiling is the process of identifying attackers in
cyberspace. It involves understanding the different types of threat actors and their behaviors. However,
this profiling is difficult and complex because of the wide range of tools and research from companies
and researchers on the methods and techniques used by other groups. Attackers can exploit cloning and
copying the techniques of others, making changes or improvements to fit their needs.

Threat actor profiling involves several key categories:

- Personal Information: This refers to profiling based on the identity of the attacker, whether an individual
or a group. This category provides insight into who is behind the attack and can include factors such as
known aliases, past activities, and affiliations. By understanding who the attacker is, defenders can start
to anticipate their strategies and behaviors.

Cyber Defense eMagazine – September 2025 Edition 320
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.