L4. Threat Actors, Attack Vectors & the Kill Chain
Course outlineLesson 4 of 20
Before you can defend a system, you need to understand who attacks it and how. This lesson maps threat actor types to their motivations and capabilities, and introduces the models defenders use to track and disrupt attacks.
Threat Actor Types
| Actor | Motivation | Capability | Persistence |
|---|---|---|---|
| Nation-state (APT) | Espionage, disruption | Very high | Very high |
| Organized crime | Financial gain | High | Medium |
| Insider threat | Revenge, financial, ideology | Variable | High (trusted access) |
| Hacktivist | Ideology, reputation | Medium | Low-medium |
| Script kiddie | Notoriety, curiosity | Low | Low |
Attack Vectors
An attack vector is the path an attacker uses to reach a target.
- Network-based: port scanning, MITM, packet sniffing, remote exploits
- Application-based: SQL injection, XSS, buffer overflows, API abuse
- Social engineering: phishing, vishing, pretexting
- Physical: tailgating, USB drops, dumpster diving, shoulder surfing
- Supply chain: compromising a vendor or software dependency to reach the real target
Cyber Kill Chain
The Lockheed Martin Cyber Kill Chain describes the 7 phases of a targeted attack:
- Reconnaissance: gather information about the target (OSINT, scanning)
- Weaponization: create the attack payload (malware + exploit)
- Delivery: transmit the payload (phishing email, USB, watering hole)
- Exploitation: execute the payload on the target system
- Installation: establish persistence (backdoor, scheduled task, registry key)
- Command & Control (C2): establish communication channel back to attacker
- Actions on Objectives: achieve the goal (data exfiltration, ransomware, sabotage)
Defenders break the chain at the earliest possible phase. Blocking delivery is cheaper than responding to a C2-connected intrusion.
MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary Tactics, Techniques, and Procedures (TTPs) observed in real attacks. Tactics are the "why" (e.g., Persistence, Lateral Movement); Techniques are the "how" (e.g., T1053 Scheduled Task).
- ✓Nation-state (APT) actors have the highest capability and longest dwell times; insider threats are hardest to detect
- ✓The Cyber Kill Chain has 7 phases: Recon, Weaponize, Deliver, Exploit, Install, C2, Actions on Objectives
- ✓Disrupting the kill chain at early phases (delivery/exploitation) is more cost-effective than late-phase response
- ✓Supply chain attacks compromise a trusted vendor or software dependency to reach the real target
- ✓MITRE ATT&CK maps real-world adversary Tactics (why) and Techniques (how) for defenders to use in detection
1. Which threat actor type is most likely to conduct a multi-year espionage campaign with sophisticated, custom tools?
2. An attacker sends a phishing email with a malicious PDF attachment. Which phase of the Cyber Kill Chain does this represent?
3. A security team uses a framework that maps adversary behaviors to specific Tactics and Techniques observed in real-world attacks. Which framework is this?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.