Individual skill
profiling-threat-actor-groups
Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.
internal/tools/skills/data/threat-intelligence/profiling-threat-actor-groups/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,313
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- mitre-att&ck Declared skill tag
- threat-actor Declared skill tag
- apt Declared skill tag
- crowdstrike Declared skill tag
- mandiant Declared skill tag
- attribution Declared skill tag
- kill-chain Declared skill tag
- nist-csf Declared skill tag
- marketing Derived category
- data Derived category
- security Derived category
- docs Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Profiling Threat Actor Groups
## When to Use
Use this skill when:
- Updating the organization's threat model with profiles of adversary groups recently observed targeting your sector
- Preparing an executive briefing on APT groups that align with geopolitical events affecting your business
- Enabling SOC analysts to understand attacker objectives and TTPs to improve detection tuning
**Do not use** this skill for real-time incident attribution — attribution during active incidents should be deprioritized in favor of containment. Profile refinement occurs post-incident.
## Detection Gaps & Validation
- **Over-attribution is the cardinal error:** shared tooling (Cobalt Strike, public RATs), shared bulletproof hosting, and reused code do not prove a single actor - multiple groups buy from the same access brokers and use the same commodity malware. Require multiple independent corroborating data points (TTP overlap + infrastructure + victimology + timing) and state a confidence band (Low/Med/High), never a binary verdict.
- **False flags:** sophisticated actors deliberately plant another group's tooling, language artifacts, or compile-time zones to misdirect. Weight durable behavioral TTPs over easily spoofed artifacts (strings, PDB paths, timestamps) when attributing.