Motives and methods
State-sponsored actors pursue espionage and pre-positioning; criminals chase profit via extortion and stolen data markets. Tooling overlaps: rapid vuln exploitation, valid accounts, and LOTL to blend in.
Preferred targets
- Government, defence, and suppliers.
- Telecom, finance, healthcare.
- Critical infrastructure and high-value SaaS.
Defensive pivots
- Identity-first security: MFA, JIT access, least-privilege.
- Hardening at the edge; continuous patching.
- Hunt for abnormal behaviour, not just indicators.