A SOC sees attacks that use an unmodified public exploit kit with its default signatures, scan random address ranges rather than chosen targets, and stop as soon as the first attempt fails. Which threat actor best fits these attributes?
Select an answer to reveal the explanation.
Short Explanation
Think of someone who buys a lock-pick set online, tries every door on the street once and walks off when it doesn't open. That's the unskilled attacker: off-the-shelf tools, no targeting, no patience. Don't assume every attack is a mastermind -- when you see low sophistication and random targets, think unskilled.
Full Explanation
Threat actors are distinguished by attributes such as sophistication and capability, resources and funding, and whether they are internal or external. An unskilled attacker relies on tools, scripts and exploit kits created by others, runs them with default settings, and tends to target whatever is reachable rather than a chosen organization. Abandoning the effort after an initial failure also shows a lack of resources and determination. A state-sponsored group typically shows high sophistication, custom tooling, careful targeting and long-term persistence, the opposite of default signatures and random scanning. An organized crime syndicate is financially motivated and usually operates deliberate campaigns with developed infrastructure, affiliate programs and follow-through such as extortion, not one-shot noisy attempts. A competitor attacks a specific rival to obtain intellectual property or market advantage, so random address ranges do not fit its targeting. Exam caveat: unskilled does not mean harmless; public exploits succeed against unpatched systems, which is why basic hygiene matters. Operational check: confirm the activity matches known public tool signatures, verify that targeted services are patched, and ensure perimeter controls block the scanning sources without escalating the event to a major incident.