Threat Actors

Across five courses, the view was always from the defender’s side: how many paths each control closed, what it missed, and its legitimate-work cost were all counted. What was never addressed was who used the missed paths, in what order, and why. This course crosses to the other side — but it treats an attack not as an event, but as a sequence of steps with preconditions.

The chain model was built in the Introduction to Cybersecurity course: the Exploit and Payload lesson broke the sequence from vulnerability to effect into steps, and the Attack Surface lesson converted the access step into a path count. Here that model is inherited, and a single question is asked: at which link can this chain be broken, and what does breaking it late cost. The first step is to make measurable who is walking the chain.

An Actor Is a Capability-Motivation Pair

The structure below is a model: there is no real group, campaign, or incident name; actors are identified only by capability level and motivation. Trying the steps here against a real system is both illegal and unprofessional without written authorization and a defined scope.

TM1: the chain has eight steps; each step has a capability threshold (1–5), a duration cost, and a count of fictional items reached once it is completed. TM2: an actor is identified by three numbers — capability level, patience (a day budget), and target step, the chain’s counterpart to motivation. TM3: the actor walks the chain from the start and stops if the capability threshold is exceeded or the day budget runs out.

// threat/actor.mjs — model of actor capability against the chain steps: there is no running
// attack step here, only a data structure made of step names and numbers.
// No real actor, group, or campaign name appears; actors are identified by capability and motivation.

// TM1: the chain has eight steps; each step has a capability threshold (1..5), a duration
// cost (days), and a count of fictional items reached once it is completed. The item count is cumulative.
export const STEP = [
  { name: "recon", capability: 1, days: 3, items: 0 },
  { name: "initial-access", capability: 2, days: 2, items: 1 },
  { name: "execution", capability: 3, days: 1, items: 2 },
  { name: "persistence", capability: 3, days: 2, items: 3 },
  { name: "privilege-escalation", capability: 4, days: 5, items: 9 },
  { name: "lateral-movement", capability: 4, days: 14, items: 26 },
  { name: "collection", capability: 2, days: 21, items: 41 },
  { name: "exfiltration", capability: 3, days: 4, items: 48 },
];

// TM2: an actor is identified by three numbers: capability level (1..5), patience (day budget),
// and target step (the chain's counterpart to motivation). `skipped` is the steps the actor's position grants for free.
export const ACTOR = [
  { name: "low-capability-opportunist", capability: 2, patience: 6, target: "execution", skipped: [] },
  { name: "mid-capability-ideological", capability: 3, patience: 10, target: "persistence", skipped: [] },
  { name: "mid-capability-profit-driven", capability: 3, patience: 45, target: "exfiltration", skipped: [] },
  { name: "mid-capability-insider-access", capability: 3, patience: 120, target: "collection",
    skipped: ["recon", "initial-access", "privilege-escalation"] },
  { name: "high-capability-targeted", capability: 5, patience: 400, target: "exfiltration", skipped: [] },
];

// TM3: the actor walks the chain from the start; it stops if the capability threshold is exceeded
// or the day budget runs out. The item count reached at the point it stops is the previous step's item count.
export function walk(a, threshold = {}) {
  let days = 0, i = 0, blocker = "none";
  for (; i < STEP.length; i++) {
    if (a.skipped.includes(STEP[i].name)) continue;
    const y = STEP[i].capability + (threshold[STEP[i].name] || 0);
    if (y > a.capability) { blocker = "capability"; break; }
    if (days + STEP[i].days > a.patience) { blocker = "patience"; break; }
    days += STEP[i].days;
  }
  const targetIndex = STEP.findIndex((s) => s.name === a.target);
  return { stop: i, days, blocker, items: i === 0 ? 0 : STEP[i - 1].items,
    passed: STEP.slice(0, i).filter((s) => !a.skipped.includes(s.name)).length,
    haltedAt: i < STEP.length ? STEP[i].name : "-", succeeded: i > targetIndex };
}

// If the chain is broken at step k, the actor's reachable items are the smaller of its own stop and k.
export const itemsIfBroken = (a, k) => {
  const d = Math.min(walk(a).stop, k);
  return d === 0 ? 0 : STEP[d - 1].items;
};
export const totalItems = (k) => ACTOR.reduce((s, a) => s + itemsIfBroken(a, k), 0);

// threat/measure.mjs — which actor gets through how many steps of the chain, and which link eliminates whom.
import { STEP, ACTOR, walk, totalItems } from "./actor.mjs";

const print = (w, ...s) => console.log(s.map((v, i) =>
  (w[i] < 0 ? String(v).padEnd(-w[i]) : String(v).padStart(w[i]))).join(""));
const S = ACTOR.map((a) => ({ a, r: walk(a) }));

console.log(`${STEP.length}-step chain, ${ACTOR.length} actor levels; ` +
  `capability thresholds ${STEP.map((s) => s.capability).join("")}, ` +
  `${STEP.reduce((t, s) => t + s.days, 0)} days start to finish, ` +
  `items reached by the full chain ${STEP.at(-1).items}`);

const A = [-31, 12, 10, 18, 8, 6, 23, 8];
console.log("\n1. how many steps of the chain each actor level passes");
print(A, "actor", "capability", "patience", "target step", "passed", "days", "halted at", "items");
for (const { a, r } of S)
  print(A, a.name, a.capability, a.patience, a.target, r.passed, r.days, r.haltedAt, r.items);
console.log(`actors reaching target: ${S.filter((x) => x.r.succeeded).length}/${ACTOR.length} ` +
  `(${S.filter((x) => x.r.succeeded).map((x) => x.a.name).join(", ")})`);

const B = [-21, 11, 6, 16, 15, 8];
console.log("\n2. which link eliminates whom");
print(B, "step", "capability", "days", "actors passing", "stopped here", "items");
for (let i = 0; i < STEP.length; i++) {
  const passing = S.filter((x) => x.r.stop > i).length;
  const stopped = S.filter((x) => x.r.stop === i);
  print(B, STEP[i].name, STEP[i].capability, STEP[i].days, passing,
    stopped.length ? `${stopped.length} (${stopped[0].r.blocker})` : "-", STEP[i].items);
}

const C = [-21, 14, 18, 14, 20];
console.log("\n3. where the chain breaks (total items across five actors)");
print(C, "broken at", "total items", "items saved", "targets lost", "one step later");
const baseline = totalItems(STEP.length);
for (let k = 0; k <= STEP.length; k++) {
  const t = totalItems(k);
  const lost = S.filter((x) => x.r.succeeded &&
    k <= STEP.findIndex((s) => s.name === x.a.target)).length;
  print(C, k < STEP.length ? STEP[k].name : "never broken", t, baseline - t, lost,
    k < STEP.length ? totalItems(k + 1) - t : "-");
}

const D = [-21, 15, 14, 18, 14];
console.log("\n4. if a step's capability threshold is raised by one point");
print(D, "raised step", "new stoppers", "total items", "items saved", "targets lost");
for (const s of STEP) {
  const y = ACTOR.map((a) => walk(a, { [s.name]: 1 }));
  const t = y.reduce((n, r) => n + r.items, 0);
  print(D, s.name, y.filter((r, i) => r.stop < S[i].r.stop).length, t, baseline - t,
    y.filter((r, i) => S[i].r.succeeded && !r.succeeded).length);
}

8-step chain, 5 actor levels; capability thresholds 12334423, 52 days start to finish, items reached by the full chain 48

1. how many steps of the chain each actor level passes
actor                            capability  patience       target step  passed  days              halted at   items
low-capability-opportunist                2         6         execution       2     5              execution       1
mid-capability-ideological                3        10       persistence       4     8   privilege-escalation       3
mid-capability-profit-driven              3        45      exfiltration       4     8   privilege-escalation       3
mid-capability-insider-access             3       120        collection       2     3       lateral-movement       9
high-capability-targeted                  5       400      exfiltration       8    52                      -      48
actors reaching target: 2/5 (mid-capability-ideological, high-capability-targeted)

2. which link eliminates whom
step                  capability  days  actors passing   stopped here   items
recon                          1     3               5              -       0
initial-access                 2     2               5              -       1
execution                      3     1               4 1 (capability)       2
persistence                    3     2               4              -       3
privilege-escalation           4     5               2 2 (capability)       9
lateral-movement               4    14               1 1 (capability)      26
collection                     2    21               1              -      41
exfiltration                   3     4               1              -      48

3. where the chain breaks (total items across five actors)
broken at               total items       items saved  targets lost      one step later
recon                             0                64             2                   0
initial-access                    0                64             2                   5
execution                         5                59             2                   4
persistence                       9                55             2                   4
privilege-escalation             13                51             1                  12
lateral-movement                 25                39             1                  17
collection                       42                22             1                  15
exfiltration                     57                 7             1                   7
never broken                     64                 0             0                   -

4. if a step's capability threshold is raised by one point
raised step             new stoppers   total items       items saved  targets lost
recon                              0            64                 0             0
initial-access                     1            63                 1             0
execution                          3            52                12             1
persistence                        3            55                 9             1
privilege-escalation               0            64                 0             0
lateral-movement                   0            64                 0             0
collection                         0            64                 0             0
exfiltration                       0            64                 0             0

The numbers are in the measurement class; their inputs are TM1–TM3.

One of Five Levels Passes All Eight Steps

The first table identifies the actor not by a single label but by how many steps it passes. Of five levels, only one passes all eight steps of the chain. The low-capability opportunist stops after two steps, two mid-capability levels get stuck on the fifth step, and the level with insider access goes as far as the fifth step — thanks to the three steps its position grants for free — but stops at the sixth.

The reason for stopping is written on every row, and it is the same on all of them: capability. The patience budget stops no level, because the chain’s total duration is 52 days and the only level whose budget that would exceed is the six-day opportunist — and that one is already stopped by the capability threshold before it gets there. Duration is not a binding constraint in this lesson; the next lesson will turn duration itself into the measurement axis.

The level with insider access is a separate row. Its capability is mid-level, but its position grants three steps for free: recon, initial access, and privilege escalation. This level reaches nine items by walking only two steps; an outside level with the same capability walks four steps and reaches three items. How many steps are passed is not, by itself, the measure — where you start from multiplies it by three.

The Wall Sits in the Middle of the Chain

The second table lines the thresholds up in order: 1, 2, 3, 3, 4, 4, 2, 3. The two highest thresholds sit on the chain’s fifth and sixth steps; the last two steps then drop below them — collection at 2, exfiltration at 3. Carrying collected data out demands less capability than crossing the middle of the chain.

The consequence of this shows up in the actors-passing column. All five of the five levels pass recon and initial access; four pass execution, two pass privilege escalation, and one passes lateral movement. The chain is a sequence of elimination, and all of that elimination happens on the two middle steps. The steps at the ends eliminate no one: the first two steps are the ones everyone passes, and the last two are the ones only whoever already got there passes.

This bears directly on the question of where to place a defense. The two middle steps eliminate actors on their own; a control placed there already faces an already-thinned set. A control placed on one of the first two steps, by contrast, sees all five of the five levels at once. If the chain’s natural elimination and the defense’s elimination collect at the same place, the defense only stops the actors who would have been eliminated on their own.

The Target Step Redefines Success

The row of actors that reach their target lists two levels, and one of them is the mid-capability ideological level, with ten days of patience. It passes only four of the eight steps; even so, it reaches its target, because its target step is the fourth in line. The profit-driven level, with the same capability, passes exactly the same four steps, reaches the same three items, and does not reach its target, because its target step is the eighth.

The two rows are identical as a measurement and opposite as an outcome. Motivation here is not an adjective but a position number in the chain. An assessment that defines success as reaching the end of the chain would count the level that reaches its target on the fourth step as a failure and leave it out of the measurement. The same mistake also runs the other way: the highest-capability level passes all eight steps in 52 days and reaches all 48 items — while spending only an eighth of its patience budget.

The Cost of Breaking Late Is a Number

The third table gives this lesson’s final column. If the chain is never broken, the five actors’ combined reach is 64 items. If it is broken at recon or initial access, 0; at execution, 5; at privilege escalation, 13; at lateral movement, 25; at collection, 42 items. The last column reads the same numbers as a difference: the cost of breaking one step late is, in order, 0, 5, 4, 4, 12, 17, 15, and 7 items.

These numbers are the total across five actors, not a single attack. Levels with different capability on the same chain reach different depths; a single control point meets all of them at once. This is why the value of a breaking point is written not against a single actor but against the combined reach of every level that can get that far.

The distribution of the cost is not flat. The combined cost of being late across the first four steps is 13 items; across the three steps between privilege escalation and collection it is 44 items. Breaking one step late in the middle of the chain costs three times as much as breaking four steps late at the start. The fourth column, in turn, gives the effect of the break on the target: breaking at persistence or earlier lowers two actors’ targets at once, breaking after it lowers only one.

The fourth table tries the defender’s actual move: raising a step’s capability threshold by one point. On execution, this stops three actors earlier and saves 12 items; on persistence, it stops three actors and saves 9 items. On the chain’s two hardest steps — privilege escalation and lateral movement — the same move stops no actor and saves zero items: only one level already passes lateral movement, one of the two levels that pass privilege escalation never walks that step at all because of its position, and the other clears the threshold even after it is raised by one point. Piling hardening effort onto the hardest step is, once measured, a decision with no payoff.

Summary

• A threat actor is identified not by a name but by three numbers: capability level, patience budget, and target step. Of five levels, only one passes all eight steps of the eight-step chain.
• The capability wall sits in the middle of the chain: the thresholds follow the order 1, 2, 3, 3, 4, 4, 2, 3; all five of the five levels pass the first two steps, four pass the third, two pass the fifth, and one passes the sixth.
• Position changes how many steps are walked: the level with insider access takes three steps for free, walks only two steps, and reaches 9 items; an outside level with the same capability walks four steps and reaches 3 items.
• Motivation is a position number in the chain: of two levels that pass the same four steps, the one whose target is on the fourth step succeeds, and the one whose target is on the eighth does not.
• The breaking point determines the cost: 64 items if never broken, 0 if broken at recon. The cost of breaking one step late is 0, 5, 4, 4, 12, 17, 15, 7 items; the three middle steps carry two-thirds of the total.
• Raising a step’s threshold by one point saves 12 items at execution and 9 at persistence; on the chain’s two hardest steps it saves 0 items: one level is already the only one passing, and the two levels passing the other are unaffected by a one-point threshold rise.

Next Step

In every measurement in this lesson, duration was never binding. The patience budget stopped no actor, because the chain’s total cost was written as 52 days and the most patient level’s budget was 400 days. That level passed all eight steps, reached all 48 items, and spent an eighth of its budget — what it did with the remaining 348 days was never asked.

Yet in a long-running campaign, the real measure is duration itself. A step can take not days but months; over that month, a record is born on the defender’s side every day, and every record is a window of opportunity. The next lesson sets the chain on the time axis: how many days each step takes, how many windows of opportunity are born over that time, how many of those windows no control ever looks at, and how much the item count grows for every week that goes undetected.