During reconnaissance against the city's 911 CAD, analysts recover a commodity scanner sample. Who or what is the threat actor (adversary) in this incident?
Select an answer to reveal the explanation.
Short Explanation
The adversary is the burglar, not the crowbar. A hash, a C2 domain, and a CVE are tools or flaws — the threat actor is the person or group aiming at 911 CAD. Keep the human (or crew) in the subject line of the incident.
Full Explanation
During reconnaissance against the city's 911 CAD, analysts recover a commodity scanner sample. The threat actor (adversary) is the person or group conducting the reconnaissance—not the tools or flaws recovered from the sample. Civic framing matters because public-safety CAD systems are high-impact municipal targets; incident language must keep the human or crew as the subject while hashes, domains, and CVEs remain attributes of the campaign.
Treating the scanner binary's SHA-256 hash as the adversary fails by concept: a hash is a technical indicator of a file, not the entity directing the reconnaissance. Calling the command-and-control domain listed in the sample the adversary fails by concept: a C2 domain is infrastructure used by an actor, not the actor itself. Naming the CAD application's CVE identifier as the adversary fails by concept: a CVE identifies a vulnerability in software, which an adversary may exploit, but it is not who is targeting 911 CAD.
Exam caveat: SPLK-5001 threat-actor questions expect adversary = person or group—do not promote IoCs or CVE IDs into the role of the threat actor on civic incident records.
Operational check: Title the incident with the suspected person or group (or "unknown adversary") targeting 911 CAD, attach hash, C2, and CVE as evidence fields, and keep leadership briefings clear that tools are not the actor.