Know Your
Enemy

Each threat actor profile includes: known aliases and group names, country of origin or suspected attribution, motivation (financial, espionage, ideological, destructive), active since date, targeted industries and geographies, preferred attack techniques mapped to MITRE ATT&CK, malware families and tools used, associated campaigns, recent activity timeline, and key indicators of compromise (IOCs). Ransomware group profiles additionally include confirmed victim counts and leak site details.

Attribution is based on multiple convergent evidence sources: shared malware code and tooling, infrastructure overlaps (shared IPs, domains, hosting providers), operational patterns and working hours, language artifacts in malware samples, target selection consistency, and dark web communications. SOCRadar clearly distinguishes between high-confidence attribution (multiple corroborating sources) and low-confidence attribution (circumstantial evidence), following industry-standard intelligence assessment practices.

Identify which threat actors target your industry and geography, then use their known TTPs (tactics, techniques, and procedures) to assess your defensive coverage. If an actor known to target your sector uses specific attack vectors (spear-phishing, VPN exploitation, supply chain compromise), you can prioritize defenses accordingly. Threat actor IOCs can be loaded into SIEM, EDR, and firewall blocklists for proactive detection. During incident response, actor profiles help predict attacker behavior and lateral movement patterns.

APT (Advanced Persistent Threat) groups are typically state-sponsored or state-affiliated actors whose primary motivation is espionage, intellectual property theft, or strategic disruption. They operate with significant resources, sophisticated tooling, and long dwell times. Cybercriminal groups are primarily financially motivated — ransomware, fraud, credential theft, and cryptomining. The distinction matters for response: APT intrusions often require a full forensic investigation and potential law enforcement engagement, while criminal incidents typically follow faster remediation and recovery patterns.