Skip to content
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Threat actors

Threat Actors are individuals, groups, or organizations who act with malicious intent. Threat actors applies for STIX 2.x.

A Threat Actor is not an Intrusion Set but may support or be affiliated with various Intrusion Sets, groups, or organizations over time.

Threat Actors use their resources, and the resources of an Intrusion Set, to conduct attacks, and run Campaigns against targets.

You can identify Threat Actors by their motives, capabilities, goals, sophistication level, past activities, resources they have access to, and their role in the organization.

  • Define threat actors
    Define threat actors who are individuals, groups, or organizations who act with malicious intent.

Parent Topic:IoC Repository

Related topics

Attack modes and methods

Indicators of compromise

Observables

Attack patterns

Campaigns

Course of actions

Identities

Infrastructure

Intrusion set

Locations

Malware

Malware analysis

Observed data

Threat groupings

Marking definitions

Threat notes

Threat opinions

Threat reports

Sightings

Tools

Vulnerabilities

Relationships

STIX Visualizer