No threat actor recognized as an advanced persistent threat (APT) became an APT overnight. Every cybersecurity adversary capable of doing actual damage goes through a definable maturation process that transforms what the industry refers to as a ‘script kiddie’ into a formidable threat. Once a script kiddie becomes a recognized dark web threat actor, he must be treated accordingly.
So how does one get from script kiddie status to serious dark web threat actor? DarkOwl, a leading expert in dark web threat actor intelligence, explains that innocuous hackers become serious cybersecurity adversaries by working their way through a three-stage process.
Below are the three stages along with a description of each one. It’s crucial that security teams learn to identify the stages by paying attention to observable shifts in threat factors: Tactics, Techniques, and Procedures (TTPs), tooling, communication, and targeting. Otherwise, proactive defense tiering is more difficult than it needs to be.
Table of Contents
Stage 1: Script Kiddie
The initial stage is the script kiddie stage. Security experts consider this the entry-level phase of threat actor maturation. Script kiddies are easily recognized by their limited skills, minimal financial investment, and heavy dependence on pre-built tools and platforms.
- TTPs – Script kiddie TTPs are opportunistic and severely lacking in sophistication. Hackers rely on things like brute-force exploits and automated scanners. Most of their attacks are not targeted very well.
- Tooling – Script kiddie tools tend to be free and off-the-shelf products. They rely on publicly available scripts, malware, and other tools found across the dark web.
- Communication – Script kiddies don’t usually make a point of concealing their communications. They are typically public and loud about what they are doing.
- Targets – Non-specific and volume-based targets are preferred by script kiddies. A script kiddie will go after just about any organization he believes is vulnerable to exploitation.
Script kiddies are observably immature from a cybersecurity standpoint. They are the least threatening of all dark web threat actors.
Stage 2: Criminal Specialist
While the script kiddie is an opportunistic threat actor working solo, he takes the next step in his maturation when he joins an established Cybercrime-as-a-Service (CaaS) organization. He is now a criminal specialist.
- TTPs – The criminal specialist’s TTPs or targeted and structured. He employs specific tools and strategies, like lateral movement.
- Tooling – He uses customize tools that may be leased or purchased.
- Communication – The criminal specialist is more discreet with his communications. He communicates with tools like encrypted chat apps and invitation-only hacker forums.
- Targets – His targets are high value and based on the most attractive sectors. Healthcare and financial services are at the top of his list.
The criminal specialist is a formidable foe. Yet there is one more stage in his maturation.
Stage 3: Advanced Persistent Threat (APT)
A highly sophisticated criminal specialist becomes a recognized APT when he is associated with a highly funded criminal syndicate or a rogue nation-state. He is patient, stealthy, and invested for the long term.
The APT is evasive and patient in terms of his TTPs. His tooling is sophisticated and often custom-developed for his purposes. In terms of his communications, they are nearly invisible. The advanced persistent threat actor strategically selects their targets, frequently focusing on essential infrastructure, valuable intellectual property, or confidential government data.
Beating the Dark Web Threat Actor
It should be clear from the three stages of threat actor maturation that beating APTs requires knowing them inside and out. A successful security team knows how to identify observable changes so as to track script kiddies on their way to becoming formidable foes.
