Examkin

Question

Difficulty: MediumThreat Actors, Attributes, and Attack Vectors

A security team at a regional retail corporation is investigating a security incident involving unauthorized access to internal file servers. The attacker gained access using valid employee credentials purchased from an online broker, deployed commercially available ransomware within two hours of access, and left a ransom note demanding an immediate cryptocurrency payment. The investigation confirmed that no sensitive intellectual property was exfiltrated and no attempts were made to establish long-term persistence. Which threat actor category and attribute profile are most consistent with this attack?

  1. Organized crime motivated by financial gain utilizing commoditized toolsAnswer
  2. B
    Nation-state adversary motivated by strategic intelligence gathering utilizing custom zero-day exploits
  3. C
    Hacktivist collective motivated by ideological causes seeking public disruption
  4. D
    Malicious insider leveraging elevated administrative privileges for personal revenge

Answer

Organized crime motivated by financial gain utilizing commoditized tools
Organized crime threat actors are primarily motivated by financial profit. They frequently leverage compromised credentials purchased from access brokers and deploy off-the-shelf or ransomware-as-a-service (RaaS) toolkits to achieve fast monetization, matching all indicators in the scenario.

Step-by-Step Solution

1
Analyze the attacker's primary objective described in the scenario.
The adversary deployed ransomware and demanded a cryptocurrency ransom without exfiltrating espionage targets or maintaining persistence.
Immediate financial extortion directly aligns with the primary motivation of organized cybercrime groups.
2
Evaluate the tactics, techniques, and procedures (TTPs) and resource attributes.
The attacker used dark web brokers for credential access and deployed off-the-shelf commodity ransomware quickly.
These attributes indicate moderate sophistication and reliance on commoditized resources rather than state-funded custom exploits or insider privilege abuse.
3
Synthesize the actor profile based on motivation and capability.
The threat actor is an organized crime entity.
Matching financial motivation and commodity tool capability correctly identifies the threat actor type.

Key Concept

Threat Actor Classification and Motivation Profiling
Rate this question

Topics

Threat Actors, Attributes, and Attack Vectors

More questions from this topic