Threat actor profiling is one of the most valuable — and misunderstood — disciplines in cyber threat intelligence. At its core, profiling is the systematic analysis of an adversary’s identity, motivations, capabilities, infrastructure, and behavior patterns. Done well, it transforms an anonymous alert into a known adversary whose next move you can anticipate.
I’m Reza Rafati. Over the years, I’ve built threat actor profiles ranging from nation-state APT groups to financially motivated ransomware gangs to hacktivist collectives. Each profile serves a single purpose: to give defenders the understanding they need to make better decisions. This guide shares the methodology, frameworks, and hard-won lessons I’ve accumulated along the way.
Profiling is not attribution. Attribution is a legal or political determination of who did it. Profiling is an intelligence activity that asks how do they operate, what do they want, and how can we defend against them? Attribution may never come — but a good profile delivers defensive value immediately.
Why Threat Actor Profiling Matters
If you don’t understand your adversary, you’re defending against a ghost. Profiling brings the adversary into focus and answers the questions that drive defensive decisions:
- Who is most likely to target us, and why?
- What techniques do they use, and what does that look like in our environment?
- What data or systems are they after — and therefore what should we protect most aggressively?
- What is their operational tempo — do they strike quickly or dwell for months?
- What mistakes do they make that we can exploit for detection?
A well-constructed profile directly feeds into detection engineering (build rules for their TTPs), threat hunting (hypothesize their presence based on known behaviors), incident response (accelerate scoping by knowing their playbook), and risk management (quantify the likelihood and impact of their attacks on your organization).
The Six Dimensions of a Threat Actor Profile
Every comprehensive threat actor profile should address these six dimensions. Think of them as the chapters of your adversary’s playbook:
1. Identity and Aliases
What names does the security community use for this actor? Different vendors may assign different names to the same group — APT29, Cozy Bear, The Dukes, and Nobelium all refer to the same Russian threat actor. A good profile maps these aliases and notes any naming controversies. Include suspected country of origin and any known affiliations (military unit, criminal syndicate, etc.) with appropriate confidence levels.
2. Motivation and Objectives
Why do they attack? The primary motivations in cyber threat intelligence are:
- Financial gain: Ransomware, business email compromise, carding, cryptocurrency theft
- Espionage: Theft of intellectual property, state secrets, competitive intelligence
- Disruption/Destruction: Sabotage, wiper attacks, denial of service
- Ideology/Hacktivism: Political statements, exposing perceived wrongdoing
- Reputation/Ego: Proving skill, gaining notoriety within underground communities
Motivation drives target selection, operational tradecraft, and risk tolerance. A financially motivated actor cares about ROI; a nation-state espionage actor cares about stealth and persistence. Understanding motivation helps you anticipate what they’ll do next.
3. Capability and Sophistication
How skilled is this actor? I assess capability across several axes: malware development sophistication, operational security (OpSec), use of zero-days vs. known vulnerabilities, lateral movement proficiency, and ability to evade detection. Capability is not binary — an actor may be highly sophisticated in initial access but sloppy in C2, and those gaps are opportunities for defenders.
I use a tiered model loosely aligned with industry conventions: Tier 1 (nation-state with custom tooling and zero-day capabilities), Tier 2 (well-resourced criminal groups with custom or customized malware), Tier 3 (commodity tool users, script kiddies, low-sophistication actors).
Dimensions 4-6: Infrastructure, Targeting, and TTPs
4. Infrastructure and Resources
What infrastructure does the actor use, and how do they manage it? Map their known domains, IP ranges, SSL certificates, and hosting providers. Document their infrastructure patterns: Do they use bulletproof hosting? Do they rotate domains rapidly or reuse infrastructure across campaigns? Infrastructure analysis reveals operational constraints — an actor who reuses infrastructure is easier to track and block. An actor who burns through domains in hours requires different detection strategies.
I pay special attention to pivot points — shared WHOIS registrant details, overlapping name servers, reused SSL certificates, common URL patterns. These connections often link seemingly separate campaigns to a single actor and reveal infrastructure you didn’t know about.
5. Targeting Patterns
Who does this actor target, and are there patterns in their victimology? Document targeted sectors (finance, energy, healthcare, government), geographies, organization sizes, and — where available — specific roles within target organizations. An actor who consistently targets finance departments with invoice-themed phishing is giving you intelligence you can use to train your users and tune your email filters.
Targeting patterns also inform threat prioritization. If an actor exclusively targets the oil and gas sector and you’re in healthcare, they may be a lower priority — unless they shift targeting, which is itself intelligence worth tracking.
6. Tactics, Techniques, and Procedures (TTPs)
This is the core of the profile and the most directly actionable dimension. Map every known TTP to the MITRE ATT&CK framework. Document the full attack lifecycle: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, C2, exfiltration, and impact.
For each technique, note: How consistently does the actor use it? Has usage increased or decreased over time? What tools or malware families are associated? Are there unique quirks that distinguish this actor’s implementation from others? These quirks — a specific command-line flag, an unusual registry key, a distinctive mutex name — are detection gold.
A TTP profile is never finished. Adversaries evolve. I review and update TTP profiles quarterly at minimum, and immediately whenever a major new campaign is reported. An outdated TTP profile is worse than no profile — it creates false confidence.
The Profiling Methodology: My Step-by-Step Approach
Over years of building profiles, I’ve developed a repeatable methodology. Here’s how I approach a new threat actor profile:
- Literature Review: Collect every publicly available report, blog post, and analysis about this actor. Vendor reports, government advisories, ISAC publications, conference talks — cast a wide net. Note disagreements between sources.
- Campaign Chronology: Build a timeline of known campaigns and incidents attributed to this actor. This reveals operational tempo, evolution of TTPs, and targeting shifts.
- Malware Analysis: If samples are available, analyze them (or review existing analyses). Understand the malware’s capabilities, compilation timestamps, code overlaps with known malware families, and anti-analysis techniques.
- Infrastructure Mapping: Use passive DNS, WHOIS history, SSL certificate transparency logs, and threat intelligence platforms to map the actor’s infrastructure footprint. Look for connections between campaigns.
- ATT&CK Mapping: Systematically map every observed TTP to MITRE ATT&CK technique IDs. This produces a structured, shareable representation of the actor’s behavior.
- Gap Analysis: What don’t we know? Document intelligence gaps explicitly. These become collection requirements for future research.
- Defensive Recommendations: Translate the profile into concrete actions: detection rules to write, hunts to conduct, controls to implement, users to train.
I deliver the finished profile as a living document — a structured report that’s version-controlled and updated as new intelligence emerges. The first version is never perfect, and that’s okay. Publish what you have with appropriate confidence levels and improve it over time.
Frameworks That Support Profiling
Several frameworks directly support the profiling process. Beyond the essential MITRE ATT&CK mapping, I regularly use:
- Diamond Model: Maps the Adversary-Victim-Capability-Infrastructure relationship for each intrusion event. Excellent for identifying patterns across campaigns.
- STIX 2.1 Threat Actor Object: Standardized structure for describing threat actors. If you share profiles with partners, use STIX — it makes your intelligence interoperable.
- VERIS (Vocabulary for Event Recording and Incident Sharing): Useful for categorizing threat actor actions and motivations in a standardized taxonomy, especially for cross-sector sharing.
Common Profiling Mistakes to Avoid
- Over-Attribution: Claiming to know exactly which country or group is responsible when the evidence only supports a moderate-confidence assessment. Be honest about what you don’t know.
- Static Profiles: Building a profile once and never updating it. Adversaries change tools and techniques. Your profile from 2023 may be dangerously outdated in 2026.
- Copy-Paste Intelligence: Regurgitating vendor reports without adding your own analysis. A profile should synthesize multiple sources and add original insight — otherwise it’s just a bibliography.
- Ignoring Uncertainty: Presenting assessments as facts. Every judgment in a profile should carry a confidence level. Stakeholders deserve to know when you’re guessing.
- No Defensive Takeaway: Building a beautiful profile that doesn’t tell defenders what to do differently. Every profile should answer: “So what? What do I do about this?”
Connecting Profiles to Operations
A threat actor profile is not an academic exercise. It should directly feed your security operations:
- SOC: Convert TTPs into detection rules. If the actor uses a specific PowerShell obfuscation technique, write a detection for it.
- Threat Hunting: Develop hunt hypotheses based on the profile. “If Actor X compromises us, their first persistence mechanism would likely be scheduled tasks — let’s hunt for anomalous scheduled task creation.”
- Incident Response: Use the profile as a reference during investigations. If you’re responding to an intrusion and see TTPs matching Actor X, you now have a head start on scoping and containment.
- Red Team/Purple Team: Emulate the actor’s TTPs to validate detection coverage. If the profile says they use technique Y, test whether your SOC can detect it.
- Risk Management: Quantify the threat. If Actor X targets your sector with high capability and has been active in the last 90 days, that’s a different risk level than a low-capability actor last seen in 2022.
At Threat Intelligence Lab, we treat profiling as a core CTI competency — and one that every CTI program should develop, whether you’re a one-person team or a mature intelligence function. Start with the actors most relevant to your organization. Build one good profile. Use it. Learn from the feedback. Then build the next one.
For a deeper understanding of how threat actor profiling fits into the broader CTI discipline, read our Definitive Guide to Cyber Threat Intelligence.
— Reza Rafati
Founder, Threat Intelligence Lab
Rotterdam, The Netherlands