Threat Actors Explained: Hacktivists and Advanced Persistent Threats

The Two Faces of Modern Cyber Adversaries

This tutorial breaks down the two threat actor categories that occupy opposite ends of the cyber spectrum: Hacktivists — the noisy, ideological, public-facing disruptors — and Advanced Persistent Threats (APTs) — the silent, patient, state-backed operators who represent the highest tier of cyber adversary in the world.

Threat Actor Taxonomy — Placing the Two Groups on the Map

Before diving in, it helps to see where hacktivists and APTs sit relative to every other type of adversary. Threat intelligence analysts typically map actors on two axes: motivation (why they attack) and capability (how sophisticated they are).

Hacktivists — Definition, Origin, and Modus Operandi

The word hacktivism is a portmanteau of "hack" and "activism", coined in 1996 by a member of the hacker collective Cult of the Dead Cow writing under the handle Omega. The idea was simple: transpose the tactics of civil disobedience — sit-ins, protest marches, leaflet drops — into cyberspace. A DDoS attack is a digital sit-in. A website defacement is a digital protest banner. A data dump is a whistleblower moment writ large.

Defining Characteristics of Hacktivist Groups

Case Study — Anonymous, the Blueprint Hacktivist Collective

Every discussion of hacktivism begins with Anonymous. Emerging in 2003 from the imageboard 4chan, Anonymous is not a group in any conventional sense — it is a brand that any collection of hackers can operate under. The Guy Fawkes mask from V for Vendetta became its symbol; a distorted voice-changer became its signature.

Case Study — LulzSec and the "50 Days of Lulz"

If Anonymous is the movement, LulzSec was the elite splinter cell. Founded in May 2011 by six core members — Sabu, Topiary, Kayla, Tflow, AVunit and Pwnsauce — LulzSec ran for exactly 50 days before disbanding. In that window they conducted some of the highest-profile hacks in history, and were then rapidly dismantled by law enforcement.

Modern Hacktivism — The Ukraine War Era

Hacktivism entered a new phase on February 26, 2022, when Ukraine's Vice Prime Minister and Minister of Digital Transformation, Mykhailo Fedorov, publicly called on volunteers to form an IT Army of Ukraine. Within days, over 300,000 people had joined a coordinating Telegram channel receiving daily target lists. The pro-Russian side responded with its own ecosystem. For the first time in history, hacktivism became a state-endorsed operational element of an active war.

Hacktivist Techniques — What They Actually Do

For all the mythology, hacktivist tradecraft is surprisingly consistent. Five techniques account for the vast majority of operations across two decades.

The Classic Hacktivist Tool — LOIC

# The Low Orbit Ion Cannon (LOIC) is a simple stress-testing tool
# that Anonymous famously repurposed for DDoS attacks in Operation Payback.
# It is public knowledge — documented in every security textbook — and
# reproduced here only for defensive awareness. Using it against a target
# without permission is a criminal offence in every major jurisdiction.

TOOL:       LOIC (Low Orbit Ion Cannon)
AUTHOR:     Praetox Technologies (originally, 2010)
PROTOCOL:   TCP / UDP / HTTP flood
MODE:       Manual target entry OR "Hivemind" IRC-controlled swarm
EFFECT:     Each user sends thousands of requests per second
FLAW:       Does NOT anonymise. Source IP is fully visible to the target.
RESULT:     Dozens of Anonymous participants were arrested after Operation
              Payback because LOIC gave the FBI their home IP addresses on
              PayPal's server logs. Reported by Wired and The Guardian.

Advanced Persistent Threats — Definition and Anatomy

An Advanced Persistent Threat (APT) is not a piece of malware or a specific attack. It is a description of an adversary: a well-resourced, patient, highly skilled actor — almost always state-sponsored — who conducts long-duration campaigns against specific strategic targets. The three words in the name are each doing serious work.

The Major APT Groups — A Field Guide

The intelligence community tracks hundreds of APT groups, but the vast majority of high-impact operations come from a handful of nation-state ecosystems. Vendors give them different names — APT29 to Mandiant is Cozy Bear to CrowdStrike is Midnight Blizzard to Microsoft — but they refer to the same operators.

The APT Kill Chain — How a Nation-State Attack Actually Unfolds

Lockheed Martin's Cyber Kill Chain, first published in 2011, remains the clearest way to visualise an APT operation. It breaks a campaign into seven ordered phases, each of which is a defender's opportunity to detect and disrupt.

Case Study — SolarWinds / SUNBURST (APT29, 2020)

If Muni was the definitive ransomware case study, SolarWinds is the definitive APT case study. It is the operation that made every CISO on the planet rethink the trust boundary between their organisation and its software vendors.

What Happened

In early 2020, APT29 operators quietly compromised the software build system at SolarWinds, a Texas-based network monitoring vendor. They injected a backdoor — dubbed SUNBURST by FireEye — into legitimate updates of the SolarWinds Orion product. Because the compromised binary was signed with SolarWinds's own valid code-signing certificate, it passed every trust check and was distributed to roughly 18,000 organisations as a routine software update between March and June 2020.

Who Was Hit

How It Was Discovered

# Timeline of discovery — reconstructed from FireEye,
# Microsoft, SolarWinds, and CISA public reporting.

Mar 2020  →  APT29 compromises SolarWinds build system.
              Malicious code shipped in Orion updates 2019.4 HF 5 through 2020.2.1

Apr–Nov 2020  →  Attackers operate inside 18,000 environments,
                     harvest data from a small chosen subset. No detection.

Early Dec 2020  →  FireEye's own SOC notices an anomaly:
                       a new device enrolled in MFA for an employee who
                       never travels. This ONE alert broke the case.

Dec 8, 2020  →  FireEye discloses its own red-team tools were stolen.
                    # Reported by Reuters, The New York Times, WSJ.

Dec 13, 2020  →  FireEye's Kevin Mandia publishes SUNBURST analysis.
                     SolarWinds confirms Orion compromise.

Dec 17, 2020  →  The New York Times (Sanger & Perlroth) publishes
                     the definitive early account: "grave risk" to US gov.

Apr 15, 2021  →  The Biden administration formally attributes the
                     attack to Russia's SVR (APT29 / Cozy Bear).
                     Announces sanctions and diplomatic expulsions.

Case Study — Lazarus Group (North Korea)

Lazarus is unique among APTs: it is a state-sponsored espionage group that also functions as a bank-robbing organisation to fund the North Korean regime under crippling international sanctions. Its combination of intelligence and financial motives makes it arguably the most impactful APT of the past decade in raw dollar terms.

Hacktivist vs APT — Side-by-Side

A defender's mental model is only useful if it produces different decisions for different actors. This is the reference table you should be able to reconstruct from memory.

Practical Defence — Different Playbooks for Different Enemies

Because the two threat actor types operate on fundamentally different tempos, defending against them requires distinct control sets. This section walks through what a mature organisation should have in place for each.

Defending Against Hacktivists — Absorb the Noise, Deny the Symbolism

Defending Against APTs — Assume Breach, Detect Movement

Detection Recipe — Spotting APT29-Style Behaviour

Below is a compact YARA-style ruleset and SIEM query pattern that a SOC would use to hunt for APT29's post-SolarWinds cloud tradecraft. It illustrates what "behavioural detection" actually looks like — no signatures of specific binaries, only patterns of behaviour.

// APT29 CLOUD IDENTITY ATTACK — DETECTION LOGIC
// Based on CISA advisory AA24-057A and MITRE ATT&CK G0016.

rule APT29_Golden_SAML_Suspected
{
    meta:
        author      = "SOC threat hunt team"
        description = "Detects likely Golden SAML token forgery"
        reference   = "SolarWinds, APT29 / SVR"
        severity    = "critical"

    strings:
        $adfs_export   = "Export-PfxCertificate"       ascii wide
        $adfs_dkm      = "ADFS DKM master key"          ascii wide
        $saml_forge_1  = "AADInternals"                 ascii wide
        $saml_forge_2  = "Set-AADIntSAMLToken"          ascii wide

    condition:
        2 of them
}

# === Splunk-style SIEM query — high-value APT29 patterns ===

index=azure_signin
| where ResultType=0
    AND UserAgent LIKE "%python-requests%"
    AND ConditionalAccessStatus="notApplied"
| stats count by UserPrincipalName, IPAddress, UserAgent

# Explanation: legitimate users don't sign in with programmatic user-agents,
# AND normal SAML flows should always trigger conditional access.
# Both conditions together = high-fidelity APT29 fingerprint post-SolarWinds.

index=o365_audit
| where Operation="Add service principal."
    OR Operation="Consent to application."
| where Actor NOT IN (approved_admin_list)
| table _time, Actor, Application, IPAddress

# Explanation: OAuth application registration is APT29's preferred cloud
# persistence technique in 2024-2026. Watch it like a hawk.

Newspaper and Reference Coverage

Every case cited in this tutorial is drawn from public reporting. Below is a curated list of the primary sources — for anyone building on this material for academic work, executive briefings, or their own threat modelling.

Golden Rules — What to Take Away in Ten Lines