Threat actor profiling is the intelligence discipline of building comprehensive profiles of adversaries based on their capabilities, motivations, infrastructure, tactics, techniques, and procedures (TTPs). Profiles encompass nation-state actors, cybercriminal organizations, hacktivists, insider threats, and lone operators. The goal is to understand who is targeting an organization, why they are targeting it, and how they are likely to attack, enabling defenders to anticipate and counter specific threats rather than defending against abstract risks.
Analysts compile threat actor profiles by correlating data from multiple intelligence sources. Technical indicators such as malware families, infrastructure patterns, and exploitation preferences are mapped to MITRE ATT&CK techniques. Operational characteristics including working hours, language artifacts, and targeting patterns help attribute activity to specific groups. Strategic intelligence about geopolitical motivations, organizational affiliations, and historical campaigns provides context for predicting future behavior. Profiles are maintained as living documents, updated as new intelligence becomes available. Diamond Model and Kill Chain frameworks structure the analysis.
Generic security controls cannot address the full spectrum of threats equally. By profiling the specific actors most likely to target an organization based on industry, geography, and asset value, defenders can prioritize controls that counter the most probable TTPs. Threat actor profiles inform red team exercises, detection engineering, and risk assessments. They transform security from a reactive posture into an intelligence-led discipline where resources are allocated based on adversary capability and intent.
CDA's TID domain missions include threat actor profiling as a standard deliverable in C-HARDEN and C-DRILL campaigns. Our theater maps adversary TTPs to specific missions, enabling organizations to build defenses tailored to their threat landscape. The CDA wiki maintains profiles of major APT groups and cybercriminal organizations, cross-referenced with MITRE ATT&CK mappings and PDM domain relevance.