Lesson 2 of 5

Threat Actors & Attack Vectors

Understanding who is attacking you and how they operate is essential for building effective defenses. You will learn the taxonomy of threat actors — from script kiddies to nation-state APTs — and the attack vectors they use to compromise systems. Threat modeling begins with understanding your adversaries, and this lesson gives you the vocabulary and framework to do that.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is about pattern recognition — training your eye to spot specific things in the wild. You are learning to look at a situation and immediately categorize it correctly. Think of it like learning to identify different types of birds: at first everything looks the same, but with practice you start seeing the distinguishing features instantly.

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Threat Actors & Attack Vectors · Objective 1 of 4

VIDEO

Loading video…

Research a real APT group

Choose an Advanced Persistent Threat group from MITRE ATT&CK's Groups page at attack.mitre.org/groups/ and read its full profile. APT29 (Cozy Bear, associated with Russian SVR), APT41 (a Chinese group conducting both espionage and financially motivated attacks), and Lazarus Group (North Korean, responsible for the Sony Pictures hack and WannaCry) are well-documented starting points. For your chosen group, note the sectors they target, the countries they operate from, their primary motivations (espionage, financial, disruption), and the specific techniques they use. Understanding real threat actors makes abstract security concepts concrete — you are not defending against a generic attacker but against specific groups with known TTPs (Tactics, Techniques, and Procedures).

Map an attack to the kill chain

Take a documented attack by your chosen APT group and map each phase of the attack to the Lockheed Martin Cyber Kill Chain: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives. For APT29's SolarWinds supply chain attack, Reconnaissance involved identifying SolarWinds as a trusted vendor to thousands of targets, Weaponization involved injecting malicious code into the Orion software build process, Delivery was the legitimate software update mechanism, and Actions on Objectives included accessing email systems at multiple US government agencies. The kill chain is useful because it shows that defenders have multiple opportunities to detect and stop an attack — breaking the chain at any stage prevents the attacker from reaching their objective.

Identify attack vectors

For each phase of your kill chain mapping, identify the specific attack vector used and the corresponding defensive control that could have broken the chain. Common initial access vectors include spear phishing (mitigated by email filtering and security awareness training), exploitation of public-facing applications (mitigated by vulnerability management), and supply chain compromise (mitigated by software integrity verification and vendor security assessments). The SolarWinds attack is particularly instructive because it bypassed most traditional perimeter defenses — the malicious code arrived as a signed, legitimate software update, demonstrating why zero-trust architecture and behavioral detection are necessary complements to signature-based security tools.

Browse MITRE ATT&CK

Navigate to attack.mitre.org and explore the Enterprise ATT&CK matrix, which organizes 14 tactic categories (columns) and hundreds of specific techniques (cells) used by real threat actors. Click on any technique to see its description, detection guidance, mitigation recommendations, and the specific APT groups known to use it. Use the ATT&CK Navigator (mitre-attack.github.io/attack-navigator/) to create a heatmap showing which techniques your chosen APT group uses — this visualization immediately shows where to focus defensive investments. Bookmark ATT&CK and make it a habit to reference it whenever you read about a new attack — mapping real incidents to the framework builds your threat intelligence vocabulary.

Previous: The CIA Triad Next Lesson