Threat Actor.

An individual or group that intentionally causes or attempts to cause harm to information systems, organisations, or people through cyber operations. It belongs to the Defense & Operations category of cybersecurity.

An individual or group that intentionally causes or attempts to cause harm to information systems, organisations, or people through cyber operations.

Threat actor is the umbrella term used by threat-intelligence and incident-response teams to describe any adversary observed in cyber operations. Categories include nation-state actors, organised cybercrime groups, hacktivists, insiders, terrorist organisations, lone-wolf attackers, and script kiddies. Each is profiled by motivation (espionage, financial gain, disruption, ideology), capability, sophistication, infrastructure, and TTPs mapped to MITRE ATT&CK. Vendors track them under their own naming schemes, such as APT, FIN, UNC, GROUP-IB, Mandiant temp names, CrowdStrike spider/panda/bear themes, Microsoft weather names, and Recorded Future TAGs. Understanding actor profiles informs detection priorities, intelligence requirements, and defensive controls.

Defences for Threat Actor typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Adversary, Cyber threat actor.