A manufacturer threat report names a criminal group, the malware family that group sends, and the servers that group rents, and it lists the plant public website as a targeted asset. Which element is the threat actor?
Select an answer to reveal the explanation.
Short Explanation
A threat report is like a playbill: the cast, the tools, and the rented stage are separate lines. You want the people directing the campaign, and the malware plus the rented servers are what they bring. The trap is tagging the plant website, the malware, or those rented servers as the actor.
Full Explanation
The criminal group named as the organization directing activity against the plant is the threat actor because a threat actor is the person or organization that directs the campaign, and the report names that group as the party doing the directing. The malware, the leased systems, and the plant site answer different questions about tools, hosting, and the thing being aimed at. The malware family the report says that group sends to hosts inside the plant describes a capability, the instrument delivered to plant hosts, so it identifies what was sent rather than who decided to send it. The rented servers listed as machines the group pays to keep online for the campaign describes infrastructure, machines the group pays for so the campaign has somewhere to run, and a leased machine does not become the actor that leased it. The plant public website named in the report as an asset the campaign has targeted describes the manufacturer's asset, the site sitting on the receiving side of the campaign, so it is the target rather than the party running the activity. Exam caveat: one paragraph often stacks the directing group, the tool, the leased systems, and the target asset, and those four roles stay separate on the exam. Operational check: before the brief goes out, label the named group as the actor, the malware family as the capability, the leased servers as infrastructure, and the plant website as the affected asset.