<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">It isn’t
always easy to isolate a threat actor and figure out their individual
motivations. Multiple threat actors can join a single group and unite behind a
cause, only to splinter when their interests diverge. Further complicating this
picture is the fact that a threat actor or group can have multiple motivations.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">For
example, a ransomware collective can be financially motivated and extort
ransoms from organizations, but only target entities in certain countries&nbsp; based on political or social motivations.
While most threat actors are motivated by money, they may also exhibit other
motivations, such as causing chaos.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><h3><span style="font-size:11.0pt;line-height:107%;font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;color:windowtext;mso-fareast-language:
EN-IN">Financially-motivated threat actors<o:p></o:p></span></h3><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Profit is
one of the most frequent motivations of cybercriminals at any level of
sophistication. Financially-motivated threat actors are opportunistic and
target low-hanging fruit; these threat actors are not concerned with the
discoverability of their attacks because they’re only interested in stealing
assets that they can convert into money as quickly as possible. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Cybercriminals<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">“Cybercriminal”
is a blanket term used to describe an individual who conducts illegal
activities online.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Cybercriminals
are also often referred to as “threat actors” or “cyber threat actors.” As
every country has different laws governing online activity, the label
“cybercriminal” is subjective. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Organized
crime: Ransomware<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Ransomware
is a type of cyber attack that renders a victim’s files inaccessible by
encrypting them and demanding a monetary ransom for the decryption key. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Recently,
the term “ransomware actors” has also come to be associated with groups
participating in data extortion, or the practice of exfiltrating and
threatening to publish or sell sensitive corporate or personal documents in
addition to, or instead of, encrypting them. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Ransomware
actors can operate individually or in specialized groups under the
Ransomware-as-a-Service (RaaS) model, where multiple threat actors specialize
in various aspects of an attack (initial access, encryption, negotiation, etc.)
each carry out a separate part of the attack and split the ransom amongst
themselves.&nbsp; <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Since the
May 2021 ban of ransomware activity on forums, operators began advertising on
the closed-membership forum RAMP. Analysts have also observed advertisements on
encrypted messengers like Jabber.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Insider
threats<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Insider
threats, or insider cyber threats, can be done intentionally—or not—and make up
about 30% of all data breaches.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Intentional
insider threats involve actions taken to harm an organization for personal
benefit or to act on a personal grievance. The intentional insider is often
synonymously referenced as a “malicious insider.”<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">However,
not all insider threats are intentional. A threat actor that is incompetent or
negligent puts an organization at risk through carelessness. Negligent insiders
are generally familiar with security policies and IT best practices but choose
to ignore them, thereby creating risk for the organization. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Out of
convenience or incompetence, these unintentional insider threats actively try
to bypass security controls. Against security policies, they leave vulnerable
data and resources unsecured, giving attackers easy access. Organizations can
take proactive steps to mitigate employee mistakes and follow best practices to
protect themselves from insider threats.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Carders<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">A carder
is an individual who is involved in credit card theft and subsequent fraudulent
activities associated with the stolen credit cards. Generally, carding doesn’t
require as much technical knowledge as other cybercrime activities, and it is
often seen as the stepping stone for many cybercriminals.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Scammers<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Scammers
are typically involved with various types of fraud. This may include tactics to
steal personally identifiable information, or payment card details. Other scams
may include perpetrating synthetic identity fraud to borrow lines of credit, or
more recently observed COVID-19 scams, like CARES Act Paycheck Protection
Program (PPP) or Small Business Association (SBA) loan fraud. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><h3><span style="font-size:11.0pt;line-height:107%;font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;color:windowtext;mso-fareast-language:
EN-IN">Ideologically motivated threat actors<o:p></o:p></span></h3><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">FUD:
Fear, uncertainty, and doubt<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">FUD-motivated
threat actors, motivated by certain political ideologies, disseminate false or
misleading information in a targeted manner. They also seek to influence public
perception of their capabilities or goals, thereby confusing law enforcement or
other adversaries. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Examples
include a ransomware collective sharing a message to call rivals to arms
against the United States, in order to achieve media exposure, or a threat
actor sharing publicly available voter information on an illicit forum in order
to create the semblance of election meddling.&nbsp;
<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Government/state-sponsored
and APT groups<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Advanced
Persistent Threat (APT) groups are threat actors or collectives that are
typically supported by a nation state either directly (e.g. units of an
intelligence agency) or indirectly (e.g. a syndicate supported by the state
through shell companies or similar entities)—and who are thus capable of using
advanced capabilities in a sustained manner to attack large entities to achieve
specific goals. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">APTs are
usually politically or economically motivated, often use spear phishing or
social engineering as initial attack vectors, and apart from doing harm to a
target by disrupting operations or stealing funds, will often also have
espionage capabilities. Their targets include state institutions, critical
infrastructure and large companies possessing key assets. APTs are typically
referred to with a number and various researchers and vendors may attach other
aliases to them. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Recent
examples include the SolarWinds cyberattack (also a supply chain attack) and
ransomware-driven cryptocurrency schemes being run out of North Korea.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Hacktivists,
Hacktivism<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Hacktivists
are individuals, or groups such as the decentralized group Anonymous, that act
as socially or politically active threat actors. They pose a medium-level
threat of carrying out an isolated but damaging attack. Most hacktivist groups
attempt to draw public attention to what they believe is an important issue or
cause using propaganda, rather than by causing damage to critical
infrastructures. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Their
goal is to support their own political or social agenda. Their sub-goals are
propaganda and causing reputational damage—such as the recent BlueLeaks hack or
Epik leak—to achieve notoriety for their cause to inspire social or political
change. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Insider
threats<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Insider
threats that are intentional involve actions taken to harm an organization for
personal benefit or to act on a personal grievance. The intentional insider is
often synonymously referenced as a “malicious insider” or “malicious actor.”
Their motivation is personal gain or harming an organization.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">However,
not all insider threats are intentional. A threat actor that is incompetent,
negligent, or inadvertent puts an organization at risk through carelessness.
Negligent insiders are generally familiar with security policies and IT best
practices, but choose to ignore them, creating risk for the organization. Out
of convenience or incompetence, these unintentional insider threats actively
try to bypass security controls. Against security policies, they leave
vulnerable data and resources unsecured, giving attackers easy access<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Therefore,
organizations should take proactive action to mitigate employee mistakes and
follow best practices to protect themselves from insider threats.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Script
kiddies (skiddies)<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">“Script
kiddies,” also known as “skiddies,” are threat actors with little
experience—newcomers to illicit online communities—who generally engage in
areas of cybercrime with a low barrier to entry.&nbsp; The term is used pejoratively to describe
actors who, for example, may not understand how a programming language works
but are able to download and use scripts written by others.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">For
example, there are many publicly available tools which can be used for
credential stuffing that do not require any real knowledge of penetration
testing or programming; therefore, script kiddies have a propensity to engage
in this activity.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><h3><span style="font-size:11.0pt;line-height:107%;font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;color:windowtext;mso-fareast-language:
EN-IN">Cyber threat actor tactics, techniques, and procedures (TTPs)<o:p></o:p></span></h3><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">DDoS<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">A
distributed denial of service (DDoS) attack is a malicious attempt to disrupt
the normal traffic of a targeted server, service, or network by flooding it
with internet traffic. DDoS attacks are most effective when utilizing multiple
compromised computer systems as sources of attack traffic. DDoS attacks are
often pivoted to enable threat actors to steal data from the victim. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Malware<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Malware
refers to software that is purposefully designed in order to cause damage to a
computer or other network resource. There are a variety of malware attack
types—including trojans, worms, stealers, rootkits, cryptojacking, keyloggers,
and ransomware—all of which allow actors to gain access to specific network
resources and steal data. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Ransomware<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Ransomware
is a type of malware wherein threat actors employ encryption in order to lock
up a victim’s data and then hold it ransom. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Extortionist
ransomware refers to the practice of publishing, or threatening to publish,
stolen data from an infected server in order to pressure the victim to pay the
ransom. This type of ransomware means that backing up data no longer mitigates
the threat of ransomware attacks.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Cloud<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Cloud
resources common vulnerabilities and misconfigurations are often exploited by
threat actors before or soon after they have been disclosed. From there, threat
actors can pivot their access to exfiltrate data to later resell in illicit
marketplaces, or attempt to move laterally through the cloud environment.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Third-party<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Threat
actors will target third party software or technology solutions providers in
order to infect a larger number of downstream customers. Managed service
providers, cloud service providers, and other IT services providers are
integrated into corporate environments and possibly interact with
organizational data. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Social
engineering<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Social
engineering methods are often leveraged by threat actors to serve as initial
entry points to a certain network or resource. This type of attack takes
advantage of the human element within any cyber environment. Phishing is a
popular form of social engineering that involves sending correspondence
(phishing email, e.g.) from a seemingly reputable source in order to manipulate
a human element and gain access to a cyber environment. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Brute
forcing and Credential Stuffing<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Brute
forcing is the act of programatically guessing all possible combinations of a
potential piece of data, such as a password.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Credential
stuffing is the act of using a previously obtained list of passwords to try to
gain access to a victim’s account. These two attacks are closely related, and
threat actors commonly use the term “brute forcing” or “brute” to refer to them
both. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">For
example, a threat actor who wants to gain access to streaming accounts might
buy a list of usernames and password hashes obtained from a compromised dating
site. They will then attempt to “crack” those password hashes by brute forcing
them—i.e. guessing and hashing all possible combinations of letters in order to
determine what plaintext passwords those hashes represent. <o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">Finally,
as an example of credential stuffing, the threat actor will take that list of
usernames—and, now, plaintext passwords from the dating site—and try all
username:password pairs on the streaming site in the hope that some users
signed up for both services using same username/password combination.<o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">&nbsp;</span></p><p>

































































































































































































</p><p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:10.5pt;
line-height:normal"><span style="font-family:&quot;Times New Roman&quot;,serif;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-fareast-language:EN-IN">There are
many variations on this kind of attack. For example, “reverse brute forcing”
tries one common password with a list of many usernames, and some attacks use
“brute forcing tools” in order to test username:password combinations on
multiple sites at the same time. However, ultimately, these attacks all have
unauthorized access to victim accounts as their goal.<o:p></o:p></span></p>