Intelligence
What is Threat actor?
The person or group behind an intrusion, tracked as one entity even when their tools change.
A threat actor is the person or group behind malicious activity, tracked as one entity over time even when their tools and infrastructure change. Actors range from state intelligence units to ransomware crews, hacktivists and lone fraudsters.
Security vendors give actors their own names, so one group can carry several labels, such as APT28, Fancy Bear and Forest Blizzard. Mapping these aliases is part of reading reports from different sources.