Mod 07 · Adversary Ecosystem

Six archetypes. One ladder.

Threat actors come in stable archetypes — long-lived shapes that outlast specific group names, campaigns, and CVEs. The capability ladder runs from automated opportunists (most of the volume) up to nation-state operators (the smallest set, the most patient). Insiders sit outside the ladder: they're authorized, which is why they don't need any of it.

Tier 0

Opportunistic / commodity

Minimal — automated scanning, known exploits, reused credentials from public dumps. No targeting; whoever's exposed gets hit.

5 relevant defenses Open →
Tier 1

Commodity ransomware / RaaS affiliates

Moderate — purchased initial access from access brokers, RaaS kits with playbooks. Some targeting (sector preference, size).

5 relevant defenses Open →
Tier 2

Hacktivist / ideological

Variable — defacement, DDoS, document leaks. Sporadic but reputation-damaging.

4 relevant defenses Open →
Tier 3

Organized cybercrime

Well-resourced — BEC at scale, sophisticated ransomware ops, data theft for resale on dark markets.

5 relevant defenses Open →
Tier 4

Nation-state / APT

Top-tier — custom tooling, stealth, espionage, pre-positioning, destructive operations. Patient.

6 relevant defenses Open →
Insider

Insider (malicious + negligent)

Variable — legitimate access, mishandled or misused. Negligent insiders (most cases) bypass technical controls by being authorized.

5 relevant defenses Open →