What is Threat Actor?

Three nearby terms get mixed up

NIST's glossary collects several definitions of threat actor, among them an individual or a group posing a threat (SP 800-150) and the instigators of risks with the capability to do harm (NISTIR 8286).

Threat source is wider. NIST lists threat agent as its synonym and, following FIPS 200, defines it as the intent and method targeted at the intentional exploitation of a vulnerability, or a situation and method that may accidentally trigger one. NISTIR 8286 spells out what that second half includes: natural disasters, technical failure and human error. A burst pipe in the server room is a threat source. Only someone with intent is a threat actor.

Hacker is narrower. NIST, quoting CNSSI 4009, defines a hacker as an unauthorized user who attempts to or gains access to an information system. A payroll clerk who copies the customer list on their last day never needs unauthorized access and still counts as one.

No single official list of types exists

The Canadian Centre for Cyber Security sorts actors by primary motivation into six groups:

• nation-states (geopolitical),
• cybercriminals (financial),
• hacktivists (ideological),
• terrorist groups (ideological violence),
• thrill-seekers (satisfaction)
• and insiders (discontent).

The Centre adds that the groups overlap, since state-sponsored actors may also pursue financially motivated activity and an insider may be working with any of the other types. It also notes that hacktivists, terrorist groups and thrill-seekers often rely on widely available tools that need little technical skill, and that at times they have still caused physical and financial damage.

Microsoft cuts the field another way, into five categories:

• nation-state actors,
• financially motivated actors,
• private sector offensive actors (companies that build and sell cyberweapons to customers who pick the targets),
• influence operations,
• and groups in development.

The name on an alert depends on who wrote the detection

MITRE ATT&CK describes its groups as activity clusters tracked by a common name, and warns that organizations track similar activity under different names, that their definitions may only partly overlap, and that its Associated Groups lists are not claims of exact overlap. On 14 October 2026 the ATT&CK groups page listed 182 groups.

Take G0007, APT28, which ATT&CK attributes to military unit 26165 of Russia's GRU. Its page lists 15 associated names. Microsoft's naming table lists 12 other names for the same actor, which Microsoft calls Forest Blizzard. Only five appear in both lists word for word: Fancy Bear, Sednit, Sofacy, STRONTIUM and Tsar Team. Pawn Storm shows up on Microsoft's side as Operation Pawn Storm. ATT&CK also notes that Sofacy and Sednit have each been used in reporting for the group and for its malware, so a feed tag reading Sofacy can mean either.

Microsoft's scheme, announced in April 2023, uses weather

For nation-state actors the family name stands for a country:

• Typhoon is China,
• Blizzard is Russia,
• Sandstorm is Iran,
• Sleet is North Korea.

For other actors it stands for a motivation:

• Tempest for financially motivated groups,
• Tsunami for private sector offensive actors,
• Flood for influence operations.

An adjective separates groups within a family, which is why Forest Blizzard, Midnight Blizzard and Seashell Blizzard are three different Russian actors. A new or unidentified cluster gets a temporary name, Storm plus four digits, until Microsoft reaches high confidence about who is behind it; then it becomes a named actor or merges into an existing one. Storm-0558 now appears among the other names of Antique Typhoon. The 2023 change retired Microsoft's older element, tree, volcano and DEV names, so STRONTIUM became Forest Blizzard and DEV-0537 (LAPSUS$) became Strawberry Tempest.

Mandiant names in stages

An UNC (uncategorized) group is a cluster of intrusion activity, meaning infrastructure, tools and tradecraft, that Mandiant is not yet ready to classify, often anchored on something found in a single incident. UNC clusters can grow, merge or split, can be combined under a TEMP name such as TEMP.Warlock, and can graduate into a defined APT or FIN group, as UNC902 did when it became FIN11. Mandiant says the road from UNC to APT or FIN typically takes years.

Old labels survive in the crosswalks: Microsoft's table still lists TEMP.Periscope with APT40 under Gingham Typhoon, and UNC2452, the cluster Mandiant was writing about in December 2020, next to APT29 and COZY BEAR under Midnight Blizzard.

One alert worked through end to end

(Simulated example generated by SOCSimulator Research; the host, IP and feed record are invented.) A Defender XDR alert reaches the queue, shown in the columns of the AlertInfo table:

AlertInfo | Timestamp 2026-10-08T09:14:22Z | Title Forest Blizzard activity on lt-fin-07 | Category CommandAndControl | Severity High | ServiceSource Microsoft Defender for Endpoint

The evidence shows lt-fin-07 connecting to 203.0.113.45. You look the IP up in the threat intel platform and a commercial feed answers: indicator 203.0.113.45, type ipv4-addr, label Sofacy, confidence 70, first seen 2026-09-30. Two vendors have given you two names for the same connection. Before the ticket says APT28, check three things.

First, are the names linked in public reporting?

Microsoft's naming page publishes a KQL function, GetThreatActorAlias(), that looks names up in its mapping file on GitHub. The function was written for the 2023 version of that file, whose fields were Previous name and New name. Today the fields are Threat actor name, Origin/Threat and Other names, so the NewName and PreviousName columns the function compares against come back empty, and a lookup by a current name such as Forest Blizzard has nothing to match. This version keeps Microsoft's function and points NewName at the current field:

let TANames = externaldata(NewName: string, Origin: string, OtherNames: string)[@"https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json"]
    with(format="multijson", ingestionMapping='[{"Column":"NewName","Properties":{"Path":"$[\'Threat actor name\']"}},{"Column":"Origin","Properties":{"Path":"$[\'Origin/Threat\']"}},{"Column":"OtherNames","Properties":{"Path":"$[\'Other names\']"}}]');
let GetThreatActorAlias = (Name: string) {
    TANames
    | where Name =~ NewName or OtherNames has Name
};
GetThreatActorAlias("Sofacy")

The has operator matches whole terms, so look up one alias per call. In the file as published on 14 October 2026, the only row containing Sofacy is Forest Blizzard (Russia), whose other names also include FANCY BEAR and APT28, and ATT&CK's G0007 page lists both Sofacy and Forest Blizzard.

Second, does the feed mean the group or the malware?

Because Sofacy has named both, open the report behind the indicator before you cite a group.

Third, write down who said what

"Defender XDR (Microsoft): Forest Blizzard. Feed: Sofacy. Linked by Microsoft's naming table and ATT&CK G0007; not confirmed by our own evidence."

Then hunt with every alias. An indicator search for Forest Blizzard alone skips everything the feed tagged Sofacy or APT28.