Skip to main content

Security+ — Part 4: Threat Actors & Attack Vectors

Jason J. Boderebe
4 min read
#security-plus #threat-actors #attack-vectors #cybersecurity #social-engineering #threat-intelligence
Security+ — Part 4: Threat Actors & Attack Vectors

Welcome Back!

One of the things that changes how you think about defense is understanding who you’re actually defending against. A nation-state actor with a team of engineers and zero-day exploits requires a completely different response than a script kiddie running automated tools. Knowing the threat actor helps you understand the likely attack vector — and that shapes your controls.

This is Part 4 of the Security+ series. Full notes on GitHub.

Threat Actors

Threat actors are individuals or groups that intentionally exploit vulnerabilities. They vary by motivation, capability, resources, and risk tolerance.

Script Kiddies

Inexperienced attackers using readily available tools and exploits. Motivation is usually curiosity or reputation. Low skill, but automated tools mean they can still cause damage at scale.

Hacktivists

Ideologically or politically motivated. The goal is disruption, attention, or protest — not financial gain. Think DDoS attacks against organizations they oppose.

Organized Crime

Well-funded criminal groups focused on financial gain. Their methods — ransomware, phishing campaigns, credential theft, extortion — are sophisticated and designed to maximize return.

Nation-State Actors (APTs)

State-sponsored teams with advanced capabilities, significant resources, and long-term objectives. They use zero-day exploits, custom malware, and maintain persistence inside environments for months or years without detection. Advanced Persistent Threat is the accurate label.

Insiders

Employees, contractors, or third parties with legitimate access. The risk is higher because they already have credentials and know the environment. Two types: malicious (intentional) and negligent (accidental data exposure).

Competitors

External entities seeking trade secrets or trying to disrupt operations. Less common but real — especially in industries where proprietary information has direct commercial value.

Threat Actor Attributes

Every actor can be assessed across four dimensions:

  • Sophistication — unskilled to advanced persistent threat
  • Resources — from hobbyist tools to custom malware and zero-days
  • Motivation — financial, ideological, competitive, or state objectives
  • Preferred Vectors — determined by their access level and goals

Attack Vectors

Attack vectors are the paths used to gain access. Most successful attacks start with one of these.

Email / Phishing

Malicious links or attachments that steal credentials or deliver malware. Still the most common initial access vector in real-world breaches.

Social Engineering

Pretexting, baiting, tailgating, or impersonation to manipulate people into giving up access or information. The human element is always the hardest to patch.

Removable Media

USB drives used to introduce malware or exfiltrate data. Less common now but still used in targeted attacks against air-gapped environments.

Wireless & Bluetooth

Rogue access points, weak encryption, or protocol-level exploits. Public Wi-Fi is a consistent risk for organizations without VPN enforcement.

Public-Facing Applications

Web apps or APIs vulnerable to injection attacks, misconfigurations, or unpatched flaws. The attack surface here grows with every new service an organization exposes.

Supply Chain

Compromised third-party hardware, software, or software updates. The SolarWinds attack is the most visible example — the vector was a trusted software update.

Cloud Services

Misconfigured storage buckets, weak credentials, or missing MFA. Cloud misconfigurations are consistently one of the top causes of data exposure.

Physical Access

Direct access to devices or facilities to install rogue hardware or extract data. Physical security and digital security are never fully separate.

Key Takeaways

  • Most attacks start with phishing or social engineering — the technical controls only matter after the human layer
  • Insiders are uniquely dangerous because they bypass perimeter defenses entirely
  • Supply chain and cloud misconfigurations are increasing in frequency and impact
  • Pairing actor profiles with likely vectors helps prioritize which threats to defend against first

For a hands-on look at how attacker behavior maps to detectable signals, see Splunk Part 3 on building ATT&CK-aligned searches.

Part 5 covers indicators of attack

Stay Curious!