The New Threat Actor

Threat actors. We all know them. Hacktivist – Malicious intent to proof a political point. Organized crime – criminal organization hacking for self-profit. State – Government agencies hacking other government to create an edge in cyberwarfare. Insider threat – internal employees hacking their own corporation systems. Ladies and gentlemen, what would you say if I was to tell you there is a new threat actor out there and he doesn’t look like a shady figure hacking at a computer. He doesn’t look like a mysterious figure wearing an anonymous mask. Oh no, this one looks much more menacing.

                About a year ago, I gained the opportunity to engage with one of the brightest minds in the industry. The CEO and president of Pearl Technology, Anthony Mini in central Illinois. I was still in the early stages in my Cybersecurity career – and you know us in the early stages; we over analyze and over technical mindset. I wanted to talk about Metasploit this, nmap that, nessus this, burpsuit that. Amid my technical chaos, this man sat me down and said “Nick, what marketing techniques are threat actors using to gain a foot hold to perform attacks”. I walked away from that so angry. I wanted to talk computers and hacking with this man, and he wanted to talk marketing with me. For nearly a year, I struggled comprehending why marketing was such a concern to this man.

                A few weeks I was in the market for a new vehicle. The family was growing so we needed a larger vehicle. I walked into Car Wise of Peoria and was instantly greeted with warm, friendly smiles. You know those people. Those people that are cringingly nice, but you know it’s all an act so they can make a sale. Each time they feel you’re losing interest, they might say, “but wait, there’s more”. At one point, I snapped on this salesman, “why are you being over the top nice? Is it just to make a sale?” This man looked me straight in the eyes and firmly said “it’s not about making sales, it’s about building trust a rapport”. Though I didn’t buy a car that day, I shook that man’s hand and walked out with a different perspective on marketing.

                I recently started my CISSP class. Repeatedly in this class it has been molding my mind that Cybersecurity is a much bigger picture than just technical IT job. In physical security, I’ve been working in one of the CISSP domains for over 7 years. I have been a CISSP professional for years and didn’t even know it. Cybersecurity is much more than Metasploit this, nmap that, nessus this, burpsuit that. Cybersecurity is more than a career, it’s a lifestyle.

                Ladies and gentlemen, there is a new threat actor out there. This man isn’t going to hack your computer while wearing an anonymous mask. This entity isn’t going to install malware directly on your computer. This person is much worse. This person will do whatever it takes to gain your trust, so you gladly let him in on your systems. Willingly. These new threat actors are not hackers. They. Are. Marketers. With a smile. With a warm handshake. They are inviting. And we fall victim to it every day. There is an old parable that reads “a wolf will walk around in sheep skin”. This is exactly what these threat actors are doing. We can go into a full list of tools of what these “marketing actors” if you will, use; like deep fake, phishing, vishing, pretext, but we’ll save those each individually for their own deep dive blog.  

                But it doesn’t stop there. Obviously, a marketer has got to have a product. It would be so easy to just say that a threat actor is probably selling threat products. Selling malware as a service, deep fake as a service, ransomware as a service. Yes, this is absolutely happening in underground markets. But can I ask you, if it’s that easy for a threat actor to make a program that is malicious with malicious intent, how easy would it be for a threat actor to create a malicious program that doesn’t look malicious. Let that sink in for a moment. This person looks trustworthy. This person acted trustworthy, this person just sold me antimalware software, so he must be trustworthy. The moment you install that software on your computer from this “trusted” actor, you just gave this person back door VIP access to your systems.

                This new threat actor doesn’t look malicious. He doesn’t look evil. These new threat actors will come off as your friend. What puts these new actors on a new level is they trick you into giving them permission to do so without you even knowing.

And that’s the danger. The most powerful hack isn’t always in the code—it’s in the conversation. It’s in the carefully chosen words, the well-timed smile, the false sense of rapport that convinces you to hand over the keys willingly. We prepare for malware, ransomware, and zero-days, but the greatest vulnerability will always be human trust.

So the next time someone offers you a “solution,” a “tool,” or even just a warm handshake, pause and ask yourself: am I being sold security, or am I being sold a compromise in disguise? Because in this age, the sharpest weapon in a threat actor’s arsenal isn’t a keyboard—it’s persuasion. And the only real defense is awareness.