CompTIA Security+ SY0-701: Threat Types, Actors, Vectors, and Attack Surfaces

Fundamentals of Threats, Vulnerabilities, and Risks

  • Vulnerability: A weakness, flaw, or exposure in a system, network, application, or process that can be exploited by a threat actor to cause harm or damage to an organization's assets or operations.

    • Components of Vulnerability:
      • Asset Value: The monetary or operational value of the targeted asset to the organization. The higher the asset value, the more critical the protection measures required.
      • Ease of Exploit: The degree of technical difficulty involved for a threat actor to exploit the flaw. Vulnerabilities that are simple to exploit present an elevated threat profile.
    • Vulnerability Examples: Unpatched operating systems or applications, weak or default passwords, misconfigured firewalls, and unsecured open service ports.

  • Threat: Any potential event, action, or agent with the capability to exploit an existing vulnerability and cause destruction, disclosure, modification of data, or denial of service.

    • Components of Threat:
      • Internal vs. External: Originating either from within the enterprise or from an outside source.
      • Malicious vs. Accidental: Deliberate attacks (e.g., cyberattacks) versus human errors (e.g., unintentionally leaking sensitive data).
      • Threat Actor: The specific individual, group, or entity initiating the action (e.g., hackers, nation states, malicious insiders).
      • Threat Vector: The path, mechanism, or method utilized by the actor to deliver the payload or execute the exploit (e.g., phishing emails, malware attachments).
    • Threat Examples: A phishing email crafted to harvest user credentials, or malware designed to target unpatched software vulnerabilities.

  • Risk: The potential for harm, loss, or damage resulting from a threat actor successfully exploiting a specific vulnerability.

    • Components of Risk:
      • Impact: The absolute severity of the operational, financial, or reputational damage caused by the security incident.
      • Likelihood: The statistical probability that a specific threat will successfully encounter and exploit the vulnerability.
    • Mathematical Risk Calculation:         Risk=Impact×Likelihood\text{Risk} = \text{Impact} \times \text{Likelihood}
    • Risk Example: An outdated, mission-critical server that is simple to exploit presents both high impact and high likelihood, yielding a very high calculated risk.

  • Interplay and Assessment Workflow:

    • Assessment of Vulnerability: Identifies internal system weaknesses to map organizational exposure.
    • Assessment of Threat: Evaluates potential actors, methods, and external/internal dangers capable of exploiting those weaknesses.
    • Calculation of Risk: Synthesizes vulnerability and threat data using the risk equation to prioritize security controls. High-risk areas demand immediate resource allocation, whereas low-risk areas can be scheduled for delayed remediation or continuous monitoring.

Attributes and Classifications of Threat Actors

  • Known Threats vs. Adversary Behaviors:

    • Known Threats: Specific, previously identified threat actors or signature-based attacks that have documented historical records, tools, and targets, making their behavior predictable.
    • Adversary Behaviors: The overarching Tactics, Techniques, and Procedures (TTPs) deployed by threat actors. Focusing on TTPs allows security analysts to predict and block attacks even when the specific threat actor's identity is unknown.

  • Internal vs. External Actors:

    • Internal Threats: Threats originating from individuals who possess authorized access to internal networks, systems, and sensitive data (e.g., full-time employees, temporary contractors, third-party business partners). The defining attribute of an internal threat is the misuse of authorized access, regardless of where the physical attack execution occurs.
    • External Threats: Dangers originating outside the enterprise boundaries. External actors possess no legitimate authorization and must bypass physical, network, or logical security controls to breach the target.

  • Sophistication and Capabilities:

    • Low-Capability Actors: Entities relying on readily available, off-the-shelf tools, known as commodity tools. They lack the technical expertise to write original exploits or build custom attack vectors (e.g., Script Kiddies using basic pre-written scripts).
    • High-Capability Actors: Highly technical, well-resourced entities capable of researching zero-day vulnerabilities, building custom attack frameworks, and maintaining long-term persistent access within a compromised network (e.g., Advanced Persistent Threats [APTs], nation-state groups, and top-tier organized crime units).

  • Resources and Funding:

    • Low Resources: Actors operating on minimal or personal budgets, limiting their operations to short-duration, low-complexity attacks.
    • High Resources: Well-funded entities backed by nation-states or revenue-generating criminal syndicates. They deploy dedicated hardware, infrastructure, military-grade exploit development, and specialized teams over multi-year campaigns.

  • Threat Modeling Frameworks:

    • Definition: The formal process of identifying, categorizing, and analyzing potential threat actors, their specific capabilities, their probable objectives, and their potential avenues of attack against an organization.
    • Purpose: Enables defensive teams to construct targeted, threat-informed defense architectures based on who is most likely to attack, why they are targeting the organization, and how they execute their campaigns.

  • Defensive Strategy Tailoring:

    • For Internal Threats: Focus on least privilege access, continuous auditing, data loss prevention (DLP), and User and Entity Behavior Analytics (UEBA).
    • For External Threats: Prioritize robust perimeter defenses, firewalls, Intrusion Prevention Systems (IPS), and external threat intelligence feeds.
    • For Low-Capability Actors: Implement foundational security hygiene, including rigorous patching schedules and strong password enforcement.
    • For High-Capability Actors: Deploy advanced defense depth, anomaly detection engines, continuous endpoint detection and response (EDR), and active threat hunting.

Motivations, Intent, and Strategies of Threat Actors

  • Intent and Targeting Models:

    • Maliciously Targeted: Focused, deliberate attacks directed at a specific target organization or individual to steal precise data or ruin specific operations.
    • Opportunistic: Broad, automated attacks aimed at identifying and exploiting any vulnerable system encountered on the network, regardless of ownership, primarily to maximize financial extraction.
    • Accidental / Unintentional: Inadvertent security incidents caused by authorized users through operational error, poor configuration, or falling prey to social engineering.

  • Attack Strategies:

    • Service Disruption: Attacks structured to disrupt the availability of system resources, networks, or applications, primarily through Denial of Service (DoS) or Distributed Denial of Service (DDoS) campaigns.
    • Data Exfiltration: The unauthorized extraction, transfer, or theft of sensitive assets, such as Personally Identifiable Information (PII), proprietary source code, or internal financial records.
    • Disinformation: Strategic campaigns designed to broadcast false, deceptive, or manipulated information to alter public perception, erode institutional trust, or influence critical societal events.

  • Primary Motivation Categories:

    • Chaotic Motivations: Driven purely by the desire to inflict confusion, panic, or disorder without clear political or monetary goals, often for personal amusement or technical challenge.
    • Financial Motivations: Driven by direct financial profit through illicit mechanisms including ransomware extortion, financial fraud, wire diversion, and identity theft.
    • Political Motivations:
      • Whistleblowers: Internal actors leaking internal wrongdoings due to ethical concerns, though their actions can be weaponized politically.
      • Campaign Groups / Activists: Organizations leveraging technical disruption to highlight social, environmental, or political grievances.
      • Nation-State Actors: State-aligned cyber units executing cyber warfare, sabotage, or geopolitical manipulation to advance sovereign military or diplomatic agendas.

  • Evolution of the Threat Landscape:

    • Historical Context: Early cyber threats consisted primarily of opportunistic vandalism, where isolated individuals hacked systems for notoriety, bragging rights, or curiosity without structured financial or strategic backing.
    • Current Landscape: Cyber threats have transitioned into highly organized, corporate-style endeavors run by state-backed units and syndicated criminal enterprises operating with massive budgets, specialized divisions, and strategic long-term goals.

Detailed Profiles of Threat Actor Types

  • Hackers (Lone Hackers):

    • Authorized Hackers (White Hats): Security professionals contracted or employed with explicit permission to conduct security testing, identify vulnerabilities, and help remediate flaws ethically.
    • Unauthorized Hackers (Black Hats): Malicious actors who breach systems without permission to exploit vulnerabilities for personal financial gain, data theft, or service disruption.
    • Terminology Shift: Industry standards favor neutral language such as "authorized" and "unauthorized" over traditional color-hat designations.

  • Script Kiddies (Unskilled Attackers):

    • Attributes: Low technical proficiency; rely completely on pre-built scripts, automated scanning utilities, and open-source tools developed by others without comprehending the underlying execution code.
    • Motivations: Curiosity, peer recognition, bragging rights, or thrill-seeking.
    • Impact: Highly dangerous to unprepared systems due to the massive volume of automated tools available across the internet.

  • Hacker Teams and Hacktivists:

    • Hacker Teams: Organized collaborative units spanning from informal syndicates to structured criminal organizations. They possess high collective technical capabilities, enabling complex, multi-stage attacks driven by profit, corporate espionage, or revenge.
    • Hacktivists: Individuals or groups leveraging hacking techniques to advance ideological, political, or social causes. Capabilities range from basic script usage to advanced DDoS tools; motivations are ideological rather than financial.

  • Nation-State Actors and Advanced Persistent Threats (APTs):

    • Nation-State Actors: Highly sophisticated organizations backed by sovereign military or intelligence divisions.
      • Prominent Examples: China's People's Liberation Army (PLA), Russia's GRU, and North Korea's Reconnaissance General Bureau (RGB).
    • Advanced Persistent Threats (APTs):
      • Definition: Prolonged, highly targeted intrusions where an attacker establishes deep persistence within a target network, remaining hidden for months or years to exfiltrate intelligence or monitor operations continuously.
      • Key Examples: The 2014 Sony Pictures breach (attributed to North Korea; involving operational destruction and exfiltration), the 2017 global WannaCry ransomware outbreak (exploiting Windows vulnerabilities), and China's Great Cannon (a state-scale DDoS instrument used to neutralize online infrastructure deemed hostile to government interests).
    • Operative Frameworks: Utilize plausible deniability via third-party proxies and deploy False Flag Operations (disguising attack metrics to mislead forensic investigators into assigning blame to an unrelated nation or hacktivist group).

  • Organized Crime and Competitors:

    • Organized Crime: Well-funded, international criminal networks operating across jurisdictional boundaries to hinder law enforcement prosecution. Primary driver is illicit financial profit via ransomware operations, large-scale financial fraud, and identity theft.
      • SIM Swap Fraud: Criminals exploit mobile carriers via social engineering to migrate a victim's phone number to an attacker-controlled SIM card, enabling them to intercept single-use two-factor authentication (2FA) codes.
    • Competitors: Corporate entities engaging in corporate espionage or disinformation campaigns to steal intellectual property, extract trade secrets, or destroy market confidence. They frequently collude with internal insiders.
    • Garmin Ransomware Incident (2020): A major attack utilizing the Wasted Locker ransomware strain, demonstrating the convergence of organized crime tools with actors maintaining ties to Russian state entities.

  • Internal Threat Actor Types:

    • Malicious Insiders: Current or former employees, contractors, or business partners with authorized system credentials who intentionally misuse access for sabotage, corporate espionage, or financial profit.
      • Capital One Data Breach: A prominent breach where a former cloud provider employee exploited insider knowledge and misconfigurations to access millions of sensitive customer records.
    • Unintentional Insiders: Well-meaning internal staff who cause severe security breaches through operational negligence, lack of security awareness, failure to comply with policy, or deployment of unsanctioned software (Shadow IT).
    • Internal Threat Mitigation Tactics:
      • For Malicious Insiders: Continuous logging/monitoring, User and Entity Behavior Analytics (UEBA), least privilege enforcement, and rigorous access revocations.
      • For Unintentional Insiders: Continuous security awareness training, strict policy enforcement, and proactive network scanning for unauthorized Shadow IT tools.

Attack Surfaces and Scope

  • Definition of Attack Surface: The sum total of all potential entry points, vulnerabilities, interfaces, and pathways through which an unauthorized user or threat actor can attempt to input data into, extract data from, or execute commands within an IT environment.

  • Scope Levels:

    • Organizational Scope: Encompasses the entire operational technology footprint, including physical infrastructure, all cloud assets, network perimeters, supply chain vendors, and personnel.
    • System/Application Scope: Scoped narrowly down to a singular server, localized database, application, or software platform.

  • Categories of Attack Surfaces:

    • Network Attack Surface: Infrastructure entry points including open TCP/UDP ports, misconfigured firewalls, unpatched routers, and exposed routing equipment.
    • Software Attack Surface: Flaws present in system code, operating systems, applications, and web services (e.g., SQL Injection [SQLi] or Cross-Site Scripting [XSS] vulnerabilities).
    • Physical Attack Surface: Hardware and physical sites, including data center facility doors, unlocked server rooms, workstation consoles, and unencrypted lost/stolen mobile hardware or USB media.
    • Human Attack Surface: The operational personnel subjected to psychological manipulation, social engineering, insider errors, and policy violations.

Threat Vectors and Exploitation Channels

  • Definition of Threat Vector: The specific pathway, method, or transmission protocol deployed by an attacker to deliver an exploit or gain unauthorized entry into an attack surface.

  • Vulnerable Software Vectors:

    • Coding Flaws: Design defects or programming bugs causing exploitable conditions such as buffer overflows or code injection.
    • Patching Latency: Delays in applying critical security updates due to operational complexity or compatibility testing, leaving exposure windows for known exploits.
    • Unsupported / End-of-Life (EOL) Systems: Legacy systems no longer receiving security patches or operational vendor support, representing permanent vulnerabilities.
    • Scanning Strategies: Client-based scanning (installing endpoint agents for deep local visibility) vs. Agentless scanning (remote network probes that deploy quickly but lack endpoint granular depth).
    • Dual-Use Tools: Security utilities deployed defensively (e.g., vulnerability scanners) are actively weaponized by adversaries to map attack surfaces.

  • Network Vectors:

    • Remote vs. Local Exploits: Remote exploits launch over public networks without requiring physical proximity; Local exploits require physical terminal access or direct connection to local network segments.
    • Unsecured Networks: Open or poorly protected networks compromise the Security Triad:
      • Confidentiality: Intercepted via network eavesdropping on unencrypted Wi-Fi.
      • Integrity: Tampered with via Man-in-the-Middle (MitM) packet manipulation.
      • Availability: Targeted via volumetric DDoS floods.
    • Specific Network Entry Channels: Physical Ethernet connections, unmonitored remote services (VPN, Remote Desktop Protocol [RDP], Secure Shell [SSH]), weak wireless (WPA cracking, rogue APs), misconfigured cloud buckets, insecure Bluetooth pairing (bluejacking), default system credentials (e.g., admin/admin), and exposed service ports mapped using scanning platforms like Nmap.

  • Lure-Based Vectors:

    • Removable Device Drop Attacks: Dropping infected USB flash drives in public target spaces labeled with enticing tags (e.g., "Payroll" or "Confidential") to prompt unauthorized execution.
    • Executable Files: Disguising malware binaries inside Trojan horse attachments (e.g., invoice.exe).
    • Document Files: Embedding malicious VBA macros or scripts within productivity documents (e.g., contract.docx) that run when opened.
    • Image Files: Crafting specialized image formats designed to trigger buffer overflow vulnerabilities in web browsers or local image rendering software.

  • Message-Based Vectors:

    • Email: Phishing (broad fraudulent communications) and Spear Phishing (highly customized targeted emails).
    • Short Message Service (SMS): Smishing (text messaging attacks carrying malicious URLs or fraud prompts).
    • Instant Messaging: Delivering malware links across corporate or personal channels like WhatsApp, Telegram, or Slack.
    • Web and Social Media: Deploying malicious links, brand impersonation accounts, or fake profiles across public social channels.
    • Voice Calls: Vishing (voice phishing utilizing phone networks, caller ID spoofing, and scare tactics).
    • Advanced Message Exploits: Zero-click exploits that execute silently upon message reception without requiring victim interaction.

  • Supply Chain Attack Surface:

    • Lifecycle Stages: Vulnerabilities introduced across the end-to-end design, manufacturing, or distribution phases of hardware and software components.
    • Procurement Management: Failure to vet third-party component origins, introducing compromised hardware/software into production environments.
    • Vendor Risks: Third-party security failures exposing downstream clients. A prominent example includes global security concerns surrounding equipment from major suppliers like Huawei due to potential foreign government influence.
    • Managed Service Providers (MSPs): Third-party providers maintaining elevated access into target networks; compromising an MSP grants adversaries backdoor access into all customer networks.
    • Assessing Supply Chain Risk:
      • Standard Business Model: Focuses on acquiring hardware/software from reputable, audited vendors and restricting second-hand equipment usage.
      • High-Security / Defense Model: Requires full supply chain visibility, manual hardware component inspection, strict manufacturing controls, and independent vendor code auditing.

Social Engineering Principles and Tactics

  • Psychological Principles:

    • Authority: Faking command positions (e.g., executives or IT administrators) to compel compliance.
    • Intimidation: Deploying threats, fear, or harsh legal consequences to force rapid target obedience.
    • Consensus / Social Proof: Convincing a target that others have already verified or complied with the request.
    • Scarcity: Suggesting an offer, file, or access window is highly limited to induce hasty action.
    • Urgency: Establishing false, tight time constraints to force victims to bypass security procedures.
    • Familiarity / Trust: Establishing personal rapport to exploit a target's willingness to assist acquaintances.
    • Impersonation: Directly assuming the identity of a known individual, trusted third party, or authority figure.

  • Purposes and Attack Scenarios:

    • Primary Purposes: Reconnaissance (gathering target details) and unauthorized system or physical intrusion.
    • Common Scenarios: Tricking employees into launching malicious binaries, contacting help desks to bypass password authentication, or social engineering physical guards to place hardware keyloggers/surveillance devices inside data centers.
    • Key Domain Resources: Real-world social engineering frameworks and human vulnerability analyses are documented extensively across resources such as Kevin Mitnick's platform (mitnicksecurity.com) and Bruce Schneier's essays (schneier.com/essays/social).

  • Specific Social Engineering Tactics:

    • Pretexting: Crafting a detailed, fabricated backstory or scenario where identity verification is difficult, convincing the target to surrender sensitive data.
    • Tailgating: Following closely behind authorized personnel to pass through secure physical access controls without presenting credentials.
    • Baiting: Offering a enticing promise (e.g., free software downloads or physical giveaways) that infects the target upon interaction.
    • Dumpster Diving: Rummaging through discarded operational waste or hardware to collect unredacted sensitive documents or credential printouts.
    • Passive Phishing: Deploying benign-looking emails containing masked hyperlinks (e.g., an invoice link impersonating a trusted vendor such as Acme Corp) to trick targets into logging into malicious portals silently.
    • Farming: A passive network attack exploiting Domain Name System (DNS) cache poisoning to silently redirect valid browser requests from legitimate URLs to malicious clone sites without the user's knowledge.
    • Typosquatting: Registering domain variants containing common typographical mistakes or character substitutions (cousin domains like egg00gil.com instead of google.com or amaz0n.com instead of amazon.com) to deceive visitors.
    • Email Spoofing: Falsifying the header "From" address within email packets to trick mail clients and users into accepting sender authenticity.
    • Business Email Compromise (BEC): A highly sophisticated fraud scheme targeting high-value corporate operations through customized mechanisms:
      • Whaling: Spear phishing aimed specifically at executive-level targets (CEOs, CFOs).
      • CEO Fraud: Impersonating executive personnel to order subordinate finance officers to transfer funds immediately.
      • Angler Phishing: Impersonating official corporate customer support accounts across social media channels to divert upset customers to malicious portals.
    • Brand Impersonation & Disinformation: Cloning known corporate designs to manipulate trust. Disinformation refers to the intentional creation and distribution of false information to deceive targets; Misinformation is the unintentional distribution of incorrect information without malicious intent.
    • Watering Hole Attacks: Compromising a targeted third-party website known to be frequented by a specific corporate or demographic group, infecting targets indirectly upon their visit.
    • AI and Machine Learning Weaponization: Automated AI tools enable threat actors to craft context-aware, hyper-personalized brand impersonation and phishing lures at scale.

Real-World Case Studies and Group Activity Profiles

  • REvil Group (Sodinokibi):

    • Type: Organized Crime Syndicate / Ransomware-as-a-Service (RaaS) Operator.
    • Capabilities: Developed sophisticated custom ransomware platforms capable of silently compromising supply chain management tools (notably exploiting the Kaseya VSA vulnerability). Deployed double-extortion tactics—demanding cryptocurrency ransoms for decryption keys while threatening public leaks of stolen corporate records.
    • Motivations: Massive financial profit via extortion.

  • APT28 (Fancy Bear):

    • Type: Nation-State Advanced Persistent Threat.
    • Capabilities: Linked directly to Russian intelligence services (GRU). Uses zero-day exploits, advanced credential harvesting, custom malware platforms, and spear-phishing campaigns targeting critical infrastructure, defense sectors, and political operations worldwide.
    • Motivations: Geopolitical dominance, military intelligence collection, strategic sabotage, and foreign political disruption.

  • APT41:

    • Type: Dual-Nature Nation-State / Cybercriminal Actor.
    • Capabilities: Linked to Chinese state-sponsored operations. Demonstrates high technical capability by conducting state-directed espionage while simultaneously running financially motivated, non-sanctioned operations (e.g., targeting video game infrastructure or financial platforms).
    • Motivations: State-directed intellectual property theft, economic espionage, and financial profit.

  • DarkSide:

    • Type: Organized Crime Ransomware Syndicate.
    • Capabilities: Developers of targeted ransomware frameworks designed to shut down enterprise operations. Responsible for the high-profile 2021 Colonial Pipeline attack, which shut down major fuel supply systems across the United States Eastern Seaboard.
    • Motivations: Direct financial extortion.

  • Anonymous:

    • Type: Decentralized Hacktivist Collective.
    • Capabilities: Distributed network of actors utilizing open-source DDoS scripts, website defacement techniques, targeted data leaks, and social media campaigns.
    • Motivations: Promoting ideological causes, protesting government overreach, enforcing digital transparency, and attacking targeted corporate or state institutions.