Intelligence
What is Operator?
The group or individual actually running an intrusion or extortion, used when you can see the activity but do not want to claim an identity.
Operator is a neutral word for the person or group actually running an intrusion, campaign or extortion operation. Analysts use it when they can see the activity clearly but are not ready to claim who is behind it.
The distinction matters in ransomware, where the developers of the malware, the affiliates who break in, and the access brokers who sell entry can all be different people. Saying "the operator" keeps a report accurate while attribution is still open.