A Threat actor is an attacker. In the following, we review the threat actors listed by CompTia:
Script kiddies
A Script Kiddie is an attacker that uses tools and scripts downloaded from the web to launch attack. It has little expertise, little knowledge and little funding. Anyway, if the scripts it launches are sophisticated, it could still make damage.
Hacktivist
An hacktivist is an attacker which is part of a group that launch attacks to foster a cause. Example: Anonymous.
Organized crime
Organize Crime is a dangerous threat actor that has both funding and skilled people to perform dangerous attacks. They use cyber attacks as another medium to make money.
Nation states/APT
An APT (Advanced Persistence Threat) is an organization, usually operating on behalf of a Nation or State, that has huge amount of funding and very advanced skills to launch very dangerous and stealth attacks. Their goal is usually to obtain confidential information from other States.
Insiders
An insider is an attacker that attacks the organization from the inside. It has valid credentials, and it is usually an employee of such organizations. Example: an employee that steals confidential information from the organization to sell to the best buyer.
Competitors
A competitor may use cyber attacks as a part of an industrial espionage tactics.
Each threat actor may be characterized by a list of attributes.
Internal/external
An internal threat actor is one acting from inside an organization, like an insider. An external threat actor is one acting from outside an organization, like a competitor that launches attacks from outside the organization's network.
Level of sophistication
Each threat actor is characterized by the level of sophistication of the attacks that it may launch. AS an example, a script kiddie is characterized by the lowest level of sophistication; organized crime may be characterized by a high level of sophistication; APTs are characterized by the highest level of sophistication.
Resources/funding
Each threat actor is characterized by distinct funding or resources. As an example, it may be hard to crack an encrypted text in reasonable time using a laptop, while it may be possible to do so if the attacker is using a cluster og high performance machines. Script Kiddie has the lest resource/funding; then you may find competitors and organized crime; at the top you find nation-sponsored APTs.
Intent/motivation
Threat actors launch attacks for different reasons. A script kiddie may launch an attack for fun; an hacktivist may launch an attack to foster a cause; organize crime and insiders may launch an attack for money; an APT may launch an attack to discover the secret of another State.
The first step of an attack is to gather information about the target. This step is called Reconnaissance. The first step of Reconnaissance is called Passive Reconnaissance (see 1.4). Passive Reconnaissance is characterized by the use of open-source intelligence(OSINT). Using OSINT means to collect all the possible information on a target by using exclusively public information, like data on social networks, articles on newspapers or data from the company's web site.