Threat actor
threat_actor:nation_state_actor
Also: Nation State Actors, nation state
A government-affiliated cyber operator or team tasked with offensive cyber operations, intelligence collection, or disruption.
A government-affiliated cyber operator or team tasked with offensive cyber operations, intelligence collection, or disruption.
“otherwise known as Nation State Actors”
“I spent almost fifteen years with the US government running offensive cyber operations”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | ASSOCIATED_WITH | Central Intelligence Agency | Explicit | 10 |
| outgoing | ASSOCIATED_WITH | National Security Agency | Explicit | 10 |
| outgoing | USES | Cyber kill chain | Explicit | 10 |
| outgoing | USES | Reconnaissance | Explicit | 10 |
| outgoing | USES | Open-source intelligence | Explicit | 10 |
| outgoing | USES | Weaponization | Explicit | 10 |
| outgoing | USES | Known exploit | Explicit | 10 |
| outgoing | USES | Implant | Explicit | 10 |
| outgoing | USES | Credential capture | Explicit | 10 |
| outgoing | USES | lateral movement | Explicit | 10 |
| outgoing | USES | Installation | Explicit | 10 |
| outgoing | USES | Command and control | Explicit | 10 |
| outgoing | TARGETS | Peruvian Ministry of Foreign Affairs | Uncertain | 10 |
Nation State Actor ASSOCIATED_WITH Central Intelligence Agency
Nation State Actors are described as hacking groups operating inside government agencies; the CIA is given as an example of a U.S. intelligence agency.
Explicit Confidence 82% · Jack Rhysider EP 10 Details
“the hacking groups that are inside government agencies, otherwise known as Nation State Actors”
“The US has the Central Intelligence Agency and the National Security Agency and others.”
Nation State Actor ASSOCIATED_WITH National Security Agency
Nation State Actors are described as hacking groups operating inside government agencies; the NSA is given as an example of a U.S. intelligence agency.
Explicit Confidence 82% · Jack Rhysider EP 10 Details
“the hacking groups that are inside government agencies, otherwise known as Nation State Actors”
“The US has the Central Intelligence Agency and the National Security Agency and others.”
Nation State Actor USES Cyber kill chain
The anonymous operator describes planning and conducting the operation through the phases of the cyber kill chain.
Explicit Confidence 96% · Jack Rhysider EP 10 Details
“The cyber kill chain. This describes the different phases of a cyber-attack.”
Nation State Actor USES Reconnaissance
The operator performs passive reconnaissance and network mapping to identify exposed systems, software, and access vectors.
Explicit Confidence 98% · Nsa EP 10 Details
“now it’s things like passive reconnaissance and mapping”
Nation State Actor USES Open-source intelligence
The operator uses publicly available information from social networks, search engines, Reddit, and technical forums to map personnel and infrastructure.
Explicit Confidence 99% · Nsa EP 10 Details
“I have a team of people – I have like, fifteen people who do nothing other than spend eight hours a day for six to eight weeks, searching, scouring the internet”
“we had done a month of open-sourced research”
Nation State Actor USES Weaponization
After reconnaissance, the operator derives the tools and exploits to use and obtains operational approval for them.
Explicit Confidence 97% · Jack Rhysider EP 10 Details
“We now move on to Phase Two of the cyber kill chain; weaponization.”
“with those data points, I derive the tools and exploits that I need to use”
Nation State Actor USES Known exploit
The operator uses a known exploit against an unpatched, internet-facing web server to gain access.
Explicit Confidence 99% · Nsa EP 10 Details
“I was able to actually use the known exploit to gain the right access to that machine.”
Nation State Actor USES Implant
The operator installs an implant on the compromised web server and later on an administrator's machine to maintain remote access.
Explicit Confidence 99% · Nsa EP 10 Details
“Once I did that, I put an implant down on that machine”
“we put the implant on his machine”
Nation State Actor USES Credential capture
The operator plans to capture an administrator's credentials when the administrator logs into the compromised server.
Explicit Confidence 99% · Nsa EP 10 Details
“I’m probably going to be able to capture his credentials”
Nation State Actor USES lateral movement
The operator moves laterally from the compromised web server to the administrator's machine using credentials or an authenticated session.
Explicit Confidence 99% · Nsa EP 10 Details
“I’m probably going to be able to float across that authenticated session and move laterally to the admin’s machine.”
“We get the information that we need and move laterally onto his machine”
Nation State Actor USES Installation
The operator installs the implant on the target system after moving to the administrator's machine.
Explicit Confidence 99% · Jack Rhysider EP 10 Details
“You just heard the fifth phase of the cyber kill chain; installation. We’ve just installed an implant on the target system.”
Nation State Actor USES Command and control
The implant provides remote interactive access to the administrator's computer, which the episode identifies as command and control.
Explicit Confidence 99% · Jack Rhysider EP 10 Details
“we now have the ability to remotely access the network admin’s computer. This is our command and control over the target computer.”
Nation State Actor TARGETS Peruvian Ministry of Foreign Affairs
The Peruvian Ministry of Foreign Affairs is presented as a random example target; Jack explicitly says the actual target will remain anonymous.
Uncertain Confidence 93% · Jack Rhysider EP 10 Details
“for this story, let’s pick a random country to use as an example target”
“Let’s go with the Peruvian Ministry of Foreign Affairs.”
“The actual target will remain anonymous.”