Profiling Threat Actor Groups

When to Use

Use this skill when:

• Updating the organization's threat model with profiles of adversary groups recently observed targeting your sector
• Preparing an executive briefing on APT groups that align with geopolitical events affecting your business
• Enabling SOC analysts to understand attacker objectives and TTPs to improve detection tuning

Do not use this skill for real-time incident attribution — attribution during active incidents should be deprioritized in favor of containment. Profile refinement occurs post-incident.

Prerequisites

• Access to MITRE ATT&CK Groups database (https://attack.mitre.org/groups/)
• Commercial threat intelligence subscription (Mandiant Advantage, CrowdStrike Falcon Intelligence, or Recorded Future)
• Sector-specific ISAC membership for targeted intelligence (FS-ISAC, H-ISAC, E-ISAC)
• Structured profile template (see workflow below)

Workflow