Study Guide
Nation-State Actors, APTs and MITRE ATT&CK
What a nation-state actor is, what makes a threat advanced and persistent, why the two terms are not synonyms, how living off the land hides an intruder, and how MITRE ATT&CK describes what adversaries do.
Lesson 2.7 Threats, Vulnerabilities & Defence
Most attackers want a quick result: a password, a payment, a system to lock. This lesson looks at the other end of the range: the actors who can afford a very different approach, one real example, and the public reference that professionals use to describe what adversaries do.
Stage: Think
Two intruders
Two intruders get into the same office. The first grabs three laptops and runs. The second quietly copies a key, comes back every few weeks for a year, and photographs documents without moving anything.
Think it through
What would the second intruder need that the first does not?
- Hint 1: Think about how long the second intruder is involved.
- Hint 2: What would make a year of careful visits worth it?
Show what happens
Time, patience, skill, money to live on while waiting, and a goal worth a whole year. Very few attackers have all of those; the ones who do are the subject of this lesson.
Think it through
Show the answer
Answer: B. The first: the laptops are missed by morning.
The quick theft is obvious by morning. The patient intruder takes care to leave no sign, which is exactly what makes that style of attack so damaging.
Stage: Explain
Nation-state actors
A nation-state actor is a threat actor that is part of a government or is sponsored by one. Some are units inside military or intelligence services; others are outside groups that a state funds, directs or tolerates.
What they typically want:
- Espionage: obtaining political, military, economic or technical secrets.
- Strategic advantage: being better placed than another state, now or in a future crisis.
- Disruption: being able to interrupt services that a rival depends on.
- Influence: shaping what people believe, including through disinformation.
What sets them apart is capability and resources. A state can pay skilled people to work full-time on one objective for years, and can build or buy its own tools.
It is common to hear that nation-state actors have unlimited resources. More accurately, they may be extremely well resourced, but not literally unlimited. They have budgets, priorities and limited numbers of skilled staff like any organisation. The practical point survives the correction: they can sustain an effort that most other actors cannot.
Deniability and attribution
Think it through
Why might a government want one of its attacks to look as though a protest group carried it out?
- Hint 1: What would happen between two countries if the truth came out?
- Hint 2: What would investigators assume a protest group wanted?
Show what happens
To make it hard to prove who did it, to avoid diplomatic consequences, and to hide what it really wanted. The list below sets out the reasons; the difficulty of proving who did it has a name.
Attribution means working out who was really behind an attack. It is hard. Attackers route their activity through other countries, reuse tools that anyone can obtain, and copy each other’s methods. A defender usually sees what happened long before anyone can say with confidence who did it.
States make use of that difficulty. Plausible deniability means arranging things so that involvement can be credibly denied. One way of doing so is to pose as a different kind of actor, for example by presenting a state operation as the work of hacktivists. A state might do this to:
- obscure attribution;
- create plausible deniability;
- reduce diplomatic consequences;
- disguise its real strategic objective;
- manipulate perceptions of who carried out the operation.
This is sometimes called a false flag: an operation designed to look as though someone else carried it out. Treat such claims with caution in both directions. A group calling itself hacktivist may be exactly that, and a damaging incident is not evidence of state involvement by itself. Careful analysts say “linked to” or “assessed to be” for a reason.
Stage: Predict
Advanced persistent threats
Think it through
The second intruder’s style has a name: advanced persistent threat. What would you expect each of the three words to mean?
- Hint 1: Think back to the intruder who visited every few weeks for a year.
Show what happens
Advanced: highly capable. Persistent: stays, and comes back if removed. Threat: real people with an objective, not just a program.
APT stands for advanced persistent threat. Each word carries meaning:
- Advanced: highly capable, able to combine several methods and adapt or develop tools.
- Persistent: it does not give up and leave; it keeps access for a long time and returns if removed.
- Threat: there are people behind it with an objective, not just a piece of malware.
The key characteristics of an APT are that it is:
- highly capable;
- targeted at a chosen victim;
- persistent;
- stealthy;
- well resourced;
- able to carry out an intrusion in several stages;
- often tied to long-term strategic goals.
A memory shortcut: APT = patient, targeted, persistent, well resourced.
How a multi-stage intrusion unfolds
An APT does not achieve its goal in one step. A typical intrusion moves through stages such as these:
An original diagram of one possible flow. Real intrusions repeat, skip and reorder stages; the order shown is a learning aid, not a rule.
- Initial access
The intruder gets a first foothold, for example through a vulnerable internet-facing device or a phishing message.
- Persistence
The intruder makes sure the access survives restarts, password changes and clean-up.
- Privilege escalation
The intruder gains higher permissions than the first foothold provided.
- Lateral movement
The intruder moves from the first system to others, towards what it came for.
- Collection
The intruder gathers the information it wants.
- Exfiltration
The intruder copies that information out of the environment.
Attack Chain follows a simpler chain through one fictional incident. The difference here is patience: an APT may spend weeks on a single stage, taking care not to be noticed. Exfiltration is also not the only possible goal. Some operations aim only to hold access in case it is wanted later.
Stage: Predict
Nation-state and APT are not the same thing
Think it through
Show the answer
Answer: B. Yes: APT is a style, not a kind of actor.
APT describes how a threat operates; nation-state describes who acts. They often overlap, but a criminal group can run a patient, persistent campaign.
The two terms are used together so often that they are easy to treat as one.
Do not confuse: Nation-state and APT
- Who?Nation-state actor
- Who the actor is, or who sponsors it: a government.
- What style?APT
- The nature of the threat or campaign: sophisticated, targeted, stealthy and persistent.
They often overlap, because sustained, stealthy campaigns need the resources that states have. But a state can run a quick, noisy attack, and a well-funded criminal group can run a patient, persistent one.
Stage: Explain
APT and unskilled attacker compared
Putting the two ends of the range side by side makes both clearer.
| Characteristic | APT | Unskilled attacker |
|---|---|---|
| Capability | High | Limited |
| Choice of victim | Often targeted | Often opportunistic |
| Persistence | Stays for a long time | Usually moves on |
| Stealth | A priority | Often noisy |
| Complexity | Multi-stage | Usually simple |
| Resources | Substantial | Few |
| Tools | May develop or adapt sophisticated tooling | Relies on ready-made tools |
Notice that this table compares a style of threat (APT) with an actor type (unskilled attacker). That is deliberate: the contrast is in how they operate.
Stage: Predict
Living off the land
Think it through
Security software is good at spotting known malicious files. How could an intruder avoid giving it anything to find?
- Hint 1: What powerful tools does every Windows computer already have for administrators?
Show what happens
By using tools that are already on the computers and are used legitimately every day. That approach has a name.
Living off the land (LOTL) means using the legitimate tools and features that are already present in the victim’s environment, instead of relying solely on custom malware.
Every operating system ships with powerful administrative tools, because administrators need them. An intruder who has valid credentials can use the same tools. Examples include:
- PowerShell, the Windows scripting and administration shell;
- ordinary command-line utilities;
- WMI (Windows Management Instrumentation), which lets administrators query and manage Windows machines, including remotely;
- built-in networking and administrative tools.
Security tools are good at spotting known malicious files. LOTL gives them much less to find. The intruder brings little or no malware, and the activity can resemble legitimate administration: a command run by PowerShell looks much the same whether an administrator or an intruder typed it. Malicious behaviour becomes harder to tell apart from normal operations, and that is what makes LOTL stealthy.
Defending against it means looking at behaviour, not only at files: knowing what normal administration looks like, logging the use of administrative tools, limiting who can run them (least privilege) and investigating use that does not fit the pattern.
Stage: Explain
A real example: Volt Typhoon
Volt Typhoon is the name given to a group that United States and allied government agencies describe as state-sponsored and linked to the People’s Republic of China. It is a useful example because public reporting on it illustrates almost every idea in this lesson.
According to a joint advisory published by the US Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies in February 2024:
- State-linked, APT-style activity. The group compromised the IT environments of critical infrastructure organisations in sectors including communications, energy, transportation, and water and wastewater.
- Internet-facing infrastructure as the way in. The actors commonly gained initial access by exploiting vulnerabilities in internet-facing networking appliances.
- Living off the land. The advisory calls LOTL techniques a hallmark of the group’s activity, alongside the use of valid accounts.
- Long-term persistence and stealth. The agencies reported indications that the actors had maintained access to some victim IT environments for at least five years.
- A multi-stage intrusion. Access was gained, kept, extended and used to move towards more sensitive systems.
Two cautions keep this accurate. The “at least five years” figure is the agencies’ assessment for some victim environments, not a fixed fact about every intrusion by the group. And attribution here is the published assessment of those agencies; it is reported as such.
Check your understanding
Show the answer
Answer: C. An assessment for some victim environments.
It is the agencies’ assessment of how long access was kept in some victim environments, not a fixed fact about every intrusion.
What a learner should take from it: a capable actor does not need exotic malware to stay hidden. Valid accounts, built-in tools and patience were enough.
Stage: Predict
MITRE ATT&CK
MITRE ATT&CK (pronounced “attack”) is a free, public knowledge base of how real adversaries behave. It is maintained by MITRE, a not-for-profit organisation, and is available at attack.mitre.org.
ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge.
It is a reference, not a product. It does not block or detect anything. What it gives defenders is a shared vocabulary: instead of “the attacker did something to stay in”, an analyst can say exactly which technique was seen, and everyone understands the same thing.
Think it through
If you had to describe each thing an intruder did, so that another defender understood exactly what you meant, what two questions would you ask about every action?
- Hint 1: One question is about the goal of the action.
- Hint 2: The other is about the method.
Show what happens
Why did they do it (what were they trying to achieve at that point), and how did they do it. ATT&CK has a name for each.
Tactics, techniques and sub-techniques
ATT&CK is organised around three levels.
- A tactic is the why: the adversary’s goal at that point, the reason for performing an action.
- A technique is the how: the way the adversary achieves that goal.
- A sub-technique is a more specific form of a technique.
Some examples, using ATT&CK’s own names and identifiers:
| Tactic (why) | Technique (how) | Sub-technique (more specific) |
|---|---|---|
| Initial Access | Phishing (T1566) | Spearphishing Attachment (T1566.001) |
| Persistence | Scheduled Task/Job (T1053) | Scheduled Task (T1053.005) |
| Credential Access | Brute Force (T1110) | Password Spraying (T1110.003) |
Read the second row aloud: in order to keep access (the tactic, Persistence), the adversary created a scheduled task (the technique). The same technique can serve more than one tactic, and the list of tactics is revised between versions of ATT&CK, so treat these names as examples and check the site for the current matrix.
An investigator at a fictional engineering firm writes up what an intruder did, in plain words:
“They emailed one of our engineers a link to a fake sign-in page and captured her password. They used it to sign in to our remote-access service. Once in, they ran built-in commands to list our other computers. They then copied stored passwords from a server. Finally they sent a folder of design files to a computer on the internet.”
Take it one sentence at a time. For each action ask why the intruder did it (the tactic) and how (the technique).
| What the intruder did | Why: the tactic | How: the technique |
|---|---|---|
| Emailed a link to a fake sign-in page | Initial Access | Phishing: Spearphishing Link (T1566.002) |
| Signed in with the stolen password | Initial Access | Valid Accounts (T1078) |
| Listed the firm’s other computers | Discovery | Remote System Discovery (T1018) |
| Copied stored passwords from a server | Credential Access | OS Credential Dumping (T1003) |
| Sent design files to an outside computer | Exfiltration | Exfiltration Over C2 Channel (T1041) |
In the last row, C2 (command and control) means the connection an intruder uses to send instructions to the computers they have taken over.
What the mapping gives the firm. Five plain sentences have become five named behaviours that can be looked up. For each one the firm can ask the two defender’s questions: could we have prevented it, and would we have noticed it? The second row is the uncomfortable one: a sign-in with a valid password looks normal, which is why it is a technique in its own right.
Do not confuse: Tactic and technique
- Why?Tactic
- The adversary’s goal: the objective of this step.Persistence.
- How?Technique
- The method used to reach that goal.Creating a scheduled task.
Check your understanding
Show the answer
Answer: C. The tactic: it is why they did it.
Credential Access is the tactic, the goal. Trying one password against many accounts is the technique (Brute Force, sub-technique Password Spraying).
From adversary behaviour to threat knowledge
Threat Actor Types, Attributes and Motivations separated two ideas: adversary behaviour is what attackers do, and threat knowledge is what defenders know about it. ATT&CK is the bridge between them.
MITRE records which techniques particular threat groups, campaigns and pieces of software have been observed using. Volt Typhoon has its own group page, for example, listing the techniques reported for it. A defender can therefore ask useful questions:
- Which groups are known to target organisations like mine?
- Which techniques do they use?
- For each technique, could we prevent it, and would we notice it?
Exploring ATT&CK yourself
ATT&CK is worth exploring as a real professional resource. A good first visit takes ten minutes:
- Open the Enterprise matrix and read the tactic names across the top. They describe an intrusion from the adversary’s point of view.
- Click one technique, such as Phishing, and read its description, its sub-techniques and the “Mitigations” and “Detection” sections.
- Open Groups, find Volt Typhoon and look at the techniques listed for it.
ATT&CK describes observed behaviour. It is not a syllabus, a risk assessment or a checklist of everything that could happen, and it sits alongside exam objectives and accepted professional practice without replacing either.
Stage: Explain
Security+ terminology
The CompTIA Security+ SY0-701 exam objectives (objective 2.1) list nation-state as a threat actor and compare actors by whether they are internal or external, by their resources and funding, and by their level of sophistication and capability. A nation-state actor sits at the high end of the last two.
“APT” and “living off the land” are general professional vocabulary, used widely in advisories and reports, and this lesson uses them in that ordinary sense.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: What does a malware scan look for, and what did the intruder bring?
Show the answer
Answer: A. No: built-in tools leave little malware to find.
No. Living off the land uses legitimate tools, so a clean malware scan proves little. Unusual use, such as a teacher’s account at 3am, is the signal to investigate.
Stage: Check
Check your understanding
These questions come from the approved revision bank. They were approved under the site’s approval workflow, which includes owner-authorised delegated review: not every question was read individually by the site owner.
Nation-state actors and APTs
Show answer
Answer: Nation-state says who is acting; APT says how the threat operates. They often overlap.
Nation-state describes who the actor is or who sponsors it: a government. An advanced persistent threat describes the style of a threat or campaign: capable, targeted, persistent and stealthy. They often overlap, because sustained, stealthy campaigns need the resources that states have, but they are not synonyms. A state can run a quick, noisy attack, and a well-funded criminal group can run a patient one.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: An advanced persistent threat
An advanced persistent threat is patient, targeted, persistent and well resourced, working in stages such as initial access, privilege escalation, lateral movement and collection. All of that appears here. An unskilled attacker is usually opportunistic, relies on ready-made tools and tends not to stay hidden for months. Shadow IT is unapproved technology, not an intruder, and an unintentional insider causes harm by mistake.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: Using legitimate tools already present in the victim’s environment
Living off the land means attackers using tools already present in the victim’s environment, such as PowerShell, command-line utilities and Windows Management Instrumentation, which they use instead of relying solely on custom malware. The phrase is a figure of speech: it has nothing to do with farming, stolen electricity or the attacker’s location.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: The activity resembles legitimate administration
Living off the land aids stealth because the activity resembles normal administration. A command run through a built-in tool looks much the same whether an administrator or an intruder ran it, and there is little or no malware for security tools to find. Built-in tools can be logged and monitored, which is how defenders respond: by looking at behaviour and asking whether it fits the normal pattern.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Nation-state actors may be extremely well resourced, but are not literally unlimited. They have budgets, priorities and a limited number of skilled people, like any organisation. The practical point survives the correction: a state can sustain an effort over years that most other actors could not afford, which is why such actors are associated with patient, long-running campaigns.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: To obscure attribution and keep plausible deniability
A state may pose as hacktivists to obscure attribution and keep plausible deniability: if the operation appears to be someone else’s work, the state can credibly deny involvement and may face fewer diplomatic consequences. Posing as another actor gives no extra tools, no legal exemption and no technical persistence. Such claims need caution in both directions, because a group calling itself hacktivist may be exactly that.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: Initial access; Lateral movement; Exfiltration; Persistence
An intrusion has stages such as initial access, persistence, privilege escalation, lateral movement, collection and exfiltration. Initial access is the first foothold, persistence keeps that access, lateral movement spreads to other systems and exfiltration copies information out. Gap analysis and due diligence are governance activities that an organisation carries out on itself; they are not stages of an intrusion.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Questions on MITRE ATT&CK
Show answer
Answer: A tactic is the adversary’s goal; a technique is how that goal is achieved
A tactic is the why: the adversary’s goal at that point, such as keeping access. A technique is the how: the method used to reach that goal, such as creating a scheduled task. A sub-technique is a more specific form of a technique. Both tactics and techniques describe what adversaries do, so neither belongs to defenders, and neither is limited to networks or to people.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: Tactic: Persistence. Technique: Scheduled Task/Job.
Creating a scheduled task is a technique used for the Persistence tactic. The goal, keeping access after a restart, is the tactic, so the tactic is Persistence. The method, a scheduled task, is the technique. Reversing them confuses why with how. Exfiltration is the goal of copying data out, and Initial Access is the goal of getting a first foothold, neither of which is described here.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: False
False. MITRE ATT&CK is a public knowledge base of observed adversary behaviour, whose name stands for Adversarial Tactics, Techniques, and Common Knowledge. It gives defenders a shared vocabulary for describing what adversaries do. It does not detect or block anything; products and people do that, often using it as a reference.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Show answer
Answer: It shows which techniques groups have used, so defences can be checked against them
MITRE records which techniques threat groups, campaigns and software have been observed using. That turns adversary behaviour into threat knowledge: a team can ask which groups target organisations like theirs, which techniques those groups use, and whether each technique would be prevented or noticed. It is a reference, so it does not scan systems, award a compliance result or remove the need for monitoring.
Revision sources: Nation-State Actors, APTs and MITRE ATT&CK (Supplementary Study Guide explanation)
Study and revision
Practise through the Threat Actors & Attack Vectors topic. Questions cover the difference between nation-state and APT, APT against unskilled attacker, living off the land and why it is stealthy, resources, deniability, the stages of an intrusion, and ATT&CK’s tactics and techniques; four flashcards recall the APT shortcut, living off the land, what ATT&CK stands for and the difference between a tactic and a technique. Items that use this lesson’s supplementary explanation say so. They are learning-only, and the lesson does not establish exam alignment or practical experience.
Stage: Consolidate
What to remember
- Nation-state actors are part of, or sponsored by, a government: very well resourced, but not unlimited, and hard to attribute.
- An APT is a style: advanced, persistent, targeted and stealthy. It often, but not always, comes from a state.
- Living off the land uses legitimate built-in tools, so defenders must watch behaviour as well as files.
- Volt Typhoon shows that valid accounts, built-in tools and patience can keep an intruder hidden for years.
- MITRE ATT&CK is a free knowledge base: a tactic is why, a technique is how.
Key terms
- Nation-state actor
A threat actor that is part of a government or sponsored by one, typically pursuing espionage, strategic advantage, disruption or influence.
- APT (Advanced Persistent Threat)
A highly capable, well-resourced threat that targets a chosen victim, gains access in stages and stays hidden for a long time.
- Living off the land (LOTL)
Using legitimate tools and features already present in the victim’s environment, instead of relying solely on custom malware.
- MITRE ATT&CK (ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge)
A free, public knowledge base, maintained by MITRE, of the tactics and techniques that real adversaries have been observed using.
- Tactic
In MITRE ATT&CK, the adversary’s goal at one point in an attack: the reason for performing an action, such as Persistence.
- Technique
In MITRE ATT&CK, how an adversary achieves a tactical goal, such as creating a scheduled task in order to keep access.
Common misunderstandings
Nation-state says who is acting or sponsoring. APT says how the threat operates. They often coincide; they do not mean the same.
Living off the land shows the opposite. A capable intruder may bring almost no malware and rely on valid accounts and built-in tools.
Impact is not evidence of who was responsible. Attribution needs evidence, and capable criminal groups cause serious harm too.
It is a knowledge base. It describes adversary behaviour in a shared vocabulary; products and people do the preventing and detecting.
Further reading
- MITRE ATT&CK: the knowledge base itself. Recommended as a professional resource to explore.
- MITRE ATT&CK: Volt Typhoon (G1017): the group page, with the techniques reported for it.
- CISA advisory AA24-038A: “PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure”, 7 February 2024.
- MITRE ATT&CK: frequently asked questions: MITRE’s own definitions of tactics, techniques and sub-techniques.
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 8 (see the Session 8 Learning Log): nation-state actors, including state sponsorship, capability, resources and deniability; advanced persistent threats and multi-stage intrusion; Volt Typhoon and living off the land as an example; and MITRE ATT&CK as a resource.
- Accuracy qualifications: nation-state actors may be extremely well resourced but are not literally unlimited; nation-state and APT are related but are not synonyms; and the length of time Volt Typhoon stayed hidden is given only as the published agencies’ assessment for some victim environments, not as a fixed fact.
- Independently checked: the Volt Typhoon details against CISA advisory AA24-038A and MITRE’s group page, and the definitions of tactic, technique and sub-technique against MITRE’s own documentation. These are external references, not course evidence.
- Supplementary explanation: the description of nation-state aims, the reasons a state might pose as hacktivists and the false-flag caution, the meaning of each word in APT, the memory shortcut, the stage-by-stage diagram, the comparison with unskilled attackers, the explanation of why living off the land is stealthy and how it is defended against, the ATT&CK examples and identifiers, the questions a defender can ask, the suggested first visit, the worked mapping of a fictional incident at an invented engineering firm (its technique names and identifiers are ATT&CK’s own), the Security+ terminology note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the two-intruder opening questions, every question asked in the lesson with its feedback and hints, the bank, password-spraying, school remote-management and report-wording examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not investigated an intrusion, analysed Volt Typhoon activity or mapped a real incident to ATT&CK.
A highly capable, well-resourced threat that targets a chosen victim, gains access in stages and stays hidden for a long time.
An attack that tries every possible key, or every possible password, until one works.
The unauthorised transfer of information out of an environment.
A threat actor who attacks to advance a political or social cause, to attract attention or to disrupt a perceived opponent.
How serious the consequences of an event would be for the organisation and the people affected.
Using legitimate tools and features already present in the victim’s environment, instead of relying solely on custom malware.
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
A free, public knowledge base, maintained by MITRE, of the tactics and techniques that real adversaries have been observed using.
A threat actor that is part of a government or sponsored by one, typically pursuing espionage, strategic advantage, disruption or influence.
The software that runs a computer and lets other programs use it. Windows, macOS, Linux, Android and iOS are operating systems.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
In MITRE ATT&CK, the adversary’s goal at one point in an attack: the reason for performing an action, such as Persistence.
In MITRE ATT&CK, how an adversary achieves a tactical goal, such as creating a scheduled task in order to keep access.
A potential cause of harm, such as an attacker seeking unauthorised access.
A person or group that may cause harm to systems or information. Threat actors are often assessed by their motivation, capability and opportunity.
A threat actor with limited technical capability and resources, who relies on ready-made tools and scripts and looks for easy opportunities.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.