In this chapter, we're going to discuss the fundamentals of threat intelligence.
As ac Ys A analyst,
you're expected to understand the trends and the
scope of different threat actors and how they proceed
through the act of acting maliciously whether it's
A P TS nation states or script kitties.
You need to understand how those different threat actors correspond
to the different threats associated to your specific network.
You need to understand the intelligence that
governs how they intercept different traffic patterns,
what threats
they utilize, what different technologies they utilize
and how their overall goals encompass what they're
trying to achieve within each individual network.
Cnys A really appreciates and goes into depth with the idea that
you need to understand at what level and what corresponding threat action,
each threat actor use and to accomplish their specific goal,
whether it's for funds or financial information,
maybe long term intelligence gathering information or
just wreaking havoc across your network.
Nation.
State threat actors are sophisticated and well funded and act on behalf
of a government or an agency that turn acts for the government itself
in the United States. That's usually the CI A or the NSA but it could be dod as well.
Uh Nation state actors have a specific goal
or agenda that they're trying to accomplish.
Now,
that could be something like the Russian Ukraine war where they
specifically were acting as a precursor to actions against Ukraine.
It could also be on a more level base where the nation state actor is acting
on behalf of say Iran where they took
over websites and are specifically targeting those websites
to provide uh propaganda to prop up their own side of the story,
regardless of where they're coming from a nation state actor.
You have to remember that those specific nation
state actors have a specific goal in mind
and they're very sophisticated and well funded.
They have no problem for a long executed plan of action.
They may invade a uh enterprise network and then hang tight
for six months to even two years before they actually act,
they're there for the long term and their plans are well executed and well funded.
So they have plenty of time to adopt and
utilize that uh internal network to their advantage.
They're really not in it for the short term kneejerk goal
that you might see with other actors in the threat.
Atmosphere.
Advanced,
persistent threats are most notably utilized
in correspondence with nation states,
but not always the big difference between
a nation state and advanced persistent threat.
And why most people get those two confused is that an advanced
persistent threat does not have to be funded by the government.
It could be a collaboration of different governments or it could be a part of, say,
the Taliban where we don't recognize the Taliban as an actual government.
They still are a terrorist organization that
has an advanced persistent threat arm.
They are high level security and stealthy,
they're well coordinated and they're in it again for the long term.
There's a lot of overarching goals and overarching complexities when
it comes to nation state versus advanced persistent threat.
And the goals are usually similar in make and in what they're trying to achieve.
But again,
the big difference between a nation state actor
versus advanced persistent threat is an advanced,
persistent threat.
Doesn't have to have the nation state backing
in order to move forward with its plans and goals.
Russia is usually a advanced persistent threat
that is not backed by the government.
They use highly intelligent and highly sophisticated attacks,
but they use it correspondingly within different groups.
Uh Their overarching goal may be for long
term or maintaining access and they're very coordinated,
but they're not really funded by the government in most, in most of their actions,
this would align more to advanced persistence threat as opposed to a nation state.
That doesn't mean the nation state can't come in and say, hey,
you're doing these types of things and if you don't do what we want you to do,
we're going to throw you in jail
that would then become a nation state actor that's utilizing advanced persist,
the threat.
The waters get really muddy between an A PT versus a nation state.
But just remember that an A PT doesn't have to be funded by a nation state.
A nation state is funded by the state itself or the government.
Those are really the big differences between the two
organized crime is usually in it for the financial gain or for the money,
they're often organized and they're utilizing
technology to extract or exploit financial gain
out of the opportunity that uses malware as our main form of Injection.
Meaning that their overall goal is financial game. And that's usually a short term
uh technology that they're exploiting.
So when with the colonial pipeline incident,
we saw that they had locked everything down with ransomware and
then they required Cryptocurrency in order for them to unlock something
that's organized crime.
Remember when it comes to organized crime as far as threat, actors are concerned,
it's all about the money.
Insider threats are intentional.
Usually disgruntled employees that are trying to do something
against the network because they're holding a grudge.
This is most related to somebody that maybe missed a promotion.
Maybe they feel the companies keep him down.
It could be a different and variety of different reasons.
But most often it's,
I've got a disgruntled employee that was recently fired or maybe they written up
for something and they're intentionally doing something
to the network out of a spite.
Now it's not always intentional.
Sometimes there's an unintentional consequence to that insider threat and
that can be clicking on a piece of phishing email,
accidentally downloading a piece of malware.
It could be either unintentional or intentional
and both are considered insider threats.
In cysa.
You need to understand that if it's an
employee and it's inside the internal network,
it's considered an insider threat,
regardless of it's intentional or unintentional.
Cys A doesn't care.
Script kitties are usually your young people that are looking for a kick out of it.
They really lack the technical expertise.
Maybe they're getting into technology or cybersecurity for the first time,
we often see this with college age students or even high
school students where they're really in it to show off to their
friends or get a kick out of the experience.
They have very low technical experience, low technical knowledge,
but they usually find a tool online or they watch
a video to show them how to hack into something.
And instead of keeping it in a virtual sandbox environment,
they decide to do it against a website or against the company.
Usually they're doing this for fun.
Script kitties are in most cases and I say most cases,
young adults who are just trying to get a kick out of doing something for fun,
they have very low technical expertise and they're doing it
with a makeshift tool that is already out there.
Think your maltego's your
metasploit technologies,
well adapted vulnerabilities that have already been
discovered and there's well documentation out there
as well as tools that they could utilize by mostly just pushing a button.
These are your script kitties hacktivists could
be either low technical or high technical.
It doesn't really matter.
But their overall goal is to wreak havoc on a
network or on an industry basically for political needs.
They're really kind of trying to change
the social perception of that organization.
So in our most recent activity here in the United States,
we saw a lot of different political gains that most people are trying to move
for the political system, either one way or another.
If a hacktivist were to come in and exploit a website and post a lot
of propaganda for a candidate or against a
candidate that would be considered a hacktivist.
But it doesn't just have to be for political candidates.
It could be, you know,
save the animals or save the whales or I
don't like the subway terminal because they let people off
when you think activists think inside the United
States or inside the country of origin,
trying to maneuver political perceptions and against or for a specific uh art.
Their aim is usually well stated and they
very clearly identify what they're trying to accomplish.
After all.
It does no good to do a hack on a system and have
it revealed to everybody if you can't tell them why you did it.
And this is really the hallmark of what a hacktivist is
all about when it comes to threat actors as far as
ISA is concerned,
you need to get past just understanding what a hacktivist is
using for or what a threat actor is trying to accomplish.
You need to understand the specific principles that make up that
threat actor and what their overarching goals look at different keywords.
Are they going for a political activity? Are they doing it for fun?
Are they trying to get financial gain out of it?
Maybe it's a long term experiment that they're trying to pull off to get
further information or industrial information further around the road.
Meaning it's a long term plan of action.
All of these are keywords that you need to be aware of for your cys A exam.
Expect to see scenario based questions that clearly identify what the goal
or how they're going to achieve that goal is right now.
Those will lead you clearly to the threat actor that you're trying to identify
and expect to see questions associated with that.