A threat actor is an individual or group that poses a threat to an organization’s systems, data or people. The term covers the source of the risk, not the tool or technique used.

Common categories

• Financially motivated criminals, such as ransomware crews, fraudsters and sellers of stolen data.
• State-sponsored groups that pursue espionage, disruption or strategic advantage.
• Hacktivists driven by political or social causes.
• Insiders, whether malicious or careless, who misuse legitimate access.

Analysts group related activity into clusters and give them tracking names. Different organizations often use different names for the same cluster, which is why public knowledge bases list known aliases side by side.

Why it matters for dark web monitoring

Many threat actors buy, sell and advertise on underground forums and messaging channels. Watching those spaces shows which actors are offering access to a company, selling its data, or discussing its brand. Knowing the actor behind a post helps estimate how credible and urgent it is: an established seller with a history of genuine leaks is a different case from a new account making claims. Profiles of actors and their TTPs are a core part of cyber threat intelligence.

Sources: NIST CSRC Glossary: threat actor, MITRE ATT&CK: Groups