We all leave a trail of information online: photos on social networks, bank details, medical records, online purchases… and, although it may seem exaggerated, this information is valuable.
So-called threat actors try to exploit this data, whether for financial gain, espionage, extortion, or even for fun. Knowing who they are, how they operate, and what tools exist to protect us is essential to keeping our digital lives safe.
Before we dive in, it is worth introducing Qondar, Enthec’s cyber surveillance tool designed specifically for individuals. It is not an antivirus or a simple ad blocker: Qondar performs Continuous Threat Exposure Management (CTEM), proactively monitoring potential leaks or risks in your digital footprint, so you can act before an incident occurs.
What is a threat actor?
A threat actor is any person, group, or organization with the intent and capability to damage other people’s systems, networks, or data to gain an economic, political, or personal advantage. Simply put, it’s whoever is behind a cyberattack. While we often associate them with large corporations or governments, much of their activity still affects ordinary people.
What makes someone a threat actor isn’t technical skill, but the sum of three elements: intention, ability, and opportunity. If one is missing, the attack cannot occur. Therefore, the most effective protection for an individual is reducing opportunity, that is, how much of your information is exposed and accessible to anyone.
Threat actor, threat, vulnerability, and vector: they are not the same
These four terms often appear together, but they designate different things:
| Concept | What is | Example |
| Threat actor | Who attacks | A gang that steals bank credentials |
| Threat | The damage that can occur | Money stolen from your account |
| Vulnerability | The weakness that is exploited | Using the same password across multiple services |
| Attack vector | The entrance road | A fake SMS that impersonates your bank |
Understanding the difference helps you protect yourself better; you can’t make threat actors disappear, but you can reduce your vulnerabilities and close entry vectors.
Types of threat actors in cybersecurity
Cybersecurity experts classify threat actors according to their motivations, resources, and methods. The lines between categories are becoming increasingly blurred. The ENISA Threat Landscape 2026 report, published in September by the European Union Agency for Cybersecurity, indicates that cybercriminals, hacktivists, and state-backed groups are increasingly sharing tools and methods, making it difficult to identify who is behind each attack.
| Type of actor | Main motivation | Resources | How it might affect you as an individual |
| Cybercriminals | Money | Medium or high | Fraud, credential theft, extortion |
| Hacktivists | Ideology or protest | Low or medium | Data leak from companies you are a customer of |
| State actors (APT) | Espionage, sabotage, influence | Very tall | Disinformation and attacks on services you use daily |
| Internal threats | Self-interest, revenge, or negligence | Variables | Data leaks from organizations that hold your data. |
| Stalkers and doxers | Control, revenge, intimidation | Lows | Public exposure of your personal data |
| Script kiddies | Notoriety or fun | Lows | Opportunistic attacks using ready-made tools |
Cybersecurity experts typically classify threat actors into several categories based on their motivations, resources, and methods. Let’s look at the most common ones:
1. Cybercriminals
They seek direct financial gain and are the threat actors you are most likely to encounter. Today, they operate as an industry with divided roles. Some steal credentials with infostealers. Others sell that access, and still others exploit it through fraud or ransomware.
Their usual tools include phishing, credential theft, and selling data on the dark web.
2. Hacktivists
Motivated by political or social causes, they use cyberattacks to draw attention to a cause. They may leak confidential information from governments or companies to protest.
Their most common tactic is to saturate organizations’ and companies’ websites with distributed denial-of-service (DDoS) attacks, though they also leak databases as a form of protest.
3. Insiders or internal threats
These are current or former employees or collaborators who already have access to the information and use it for personal gain or revenge. This type of threat is difficult to detect because it originates from within.
4. States or groups sponsored by governments
These are state-linked groups known as APTs (Advanced Persistent Threats). They pursue espionage, sabotage, or influence, have ample resources, and can remain undetected within a system for months. They rarely target specific individuals, except for those with sensitive information such as public officials, executives, or journalists, but we all suffer the effects of their disinformation campaigns and attacks on essential services.
5. Script kiddies
These users have limited technical knowledge and launch attacks using tools created by others. Today, they are more dangerous than a few years ago because subscription-based cybercrime services and generative artificial intelligence let them carry out attacks that previously required an expert profile.
6. Stalkers and boxers
They are the most personal threat actor; someone who knows you or has chosen you as a target gathers information to intimidate, control, or expose you. Their main technique is doxing, collecting and publishing personal data without consent. They don’t need advanced skills; they only need information already available on social media, search engines, and in old leaks.
How threat actors operate
Most threat actor attacks against individuals follow four phases:
- Recognition. The attacker gathers information about you from social media, search engines, public records, and past leaks. The larger your digital footprint, the easier it is for them to construct a believable deception.
- Initial access. Uses that information to gain access: a fraudulent email or SMS, a call impersonating your bank, a reused password, or a glitch in an outdated device.
- Exploitation. Once inside, the attacker steals data, installs malware, takes control of your accounts, or impersonates you to your contacts.
- Monetization. Sells your data, empty accounts, demands a ransom, or uses your identity to commit new frauds.
Most commonly used threat actor techniques
Methods change over time, but some patterns repeat themselves:
- Phishing and smishing: emails or messages that impersonate companies to steal data.
- Malware and ransomware: malicious programs that steal information or block access in exchange for a ransom.
- Brute force attacks: automated attempts to guess passwords.
- Exploitation of vulnerabilities: exploiting security flaws in software or devices.
- Social engineering: manipulating people into handing over data or performing unsafe actions.
The key is that every attack has an actor behind it with a specific motivation. And that motivation determines the chosen technique and the type of threat.
Artificial intelligence has changed the rules
AI hasn’t invented new attacks, but it has made existing ones cheaper, faster, and more convincing. Messages without spelling mistakes, cloned voices, or deepfakes allow attackers to impersonate a family member or executive with unprecedented credibility.
According to Verizon’s 2026 Data Breach Investigations Report, attackers already use generative AI at various stages of their campaigns, from target selection and vulnerability research to malware development. ENISA, for its part, predicts that this year AI will directly assist even more phases of attacks.
Why private individuals are also targets
Many people mistakenly believe only large corporations or public figures interest cybersecurity threat actors. The data says otherwise.
In 2025, Spain saw 45,445 online fraud cases, up 19% from 2024, and INCIBE’s Cybersecurity Helpline 017 handled 142,767 inquiries. The most frequent causes included phishing, vishing, and smishing attempts (28%), fraudulent purchases (16%), and digital identity theft (14%).
There are two reasons behind these figures:
- You are a profitable target at scale. A cybercriminal doesn’t need to choose you because they send thousands of messages, and even a small percentage falling for it is enough.
- You are the gateway to others. Your personal credentials can open your company email, a family member’s account, or services you use.
According to Verizon’s Data Breach Investigations Report 2026, which analyzed more than 22,000 confirmed breaches in 145 countries, 62% of data leaks included a human element, up from 60% the previous year.
How to protect your information from threat actors
The good news is that you can protect yourself if you take preventive measures and use the right tools.
1. Control your digital footprint
Search your name online to see what information is publicly available. Set your social media privacy settings appropriately.
You may be interested in→ How to erase or reduce your digital footprint and minimize the risk of cyberattacks.
2. Use strong and unique passwords
Avoid using the same password for everything. Learn how to manage passwords, use a password manager, and enable two-step authentication.
3. Keep your devices updated
Updates not only improve performance, but also patch security vulnerabilities.
4. Be wary of links and attachments
Before clicking on a link or opening a file, verify its source. If in doubt, it’s best not to interact.
5. Use continuous threat exposure management solutions
This is where Qondar becomes an ally. This tool, developed by Enthec, continuously analyzes your digital footprint, detects whether your information appears in leaked databases or if your credentials pose a risk, and alerts you so you can act immediately.
Qondar: Your personal defense against threat actors
While many security solutions are reactive (acting only after an attack has already occurred), Qondar is proactive. Thanks to the CTEM (Continuous Threat Exposure Management) capabilities, the tool:
- Monitors continuously for possible leaks of your data.
- Identifies threats on forums, social media, the dark web, and other sources.
- Prioritizes the risks so you know what to attend to first.
- Notifies immediately when exposure is detected.
This means that it not only protects you from a targeted attack, but it also helps you reduce your exposure before threat actors can act.
Cybersecurity is not an issue exclusive to companies or governments. Every person is a potential target. While we can’t prevent them, we can reduce our exposure and respond in time.
With tools like Enthec’s Qondar, prevention stops being a complex task and becomes an accessible habit for anyone. Continuous threat exposure management isn’t just a technical concept; it’s one of the most effective ways to keep your information under control and out of reach of those who want to exploit it.
Kartos and Teron: when the threat goes beyond the individual
Many attacks against individuals begin or end within an organization. If a threat actor uses your credentials to access your company, or if a supplier is breached, Kartos lets the organization monitor its exposed surface and that of its third parties.
When you need to know who’s behind a campaign, Teron, Enthec’s research engine, lets intelligence teams track malicious actors, compromised infrastructure, and active campaigns from a single platform.
Start today to understand your digital footprint and protect it before it’s too late.
Frequently Asked Questions
Is a threat actor the same as a hacker?
No. A hacker is someone with advanced technical knowledge they can use to defend or attack systems. A threat actor is someone who intends to cause harm, with or without technical knowledge: a phone scammer or a stalker are also threat actors.
What is an APT?
An APT (Advanced Persistent Threat) is an advanced, persistent threat actor, usually linked to a state or organized crime, that gains access to a system and stays undetected for months to spy or sabotage.
Can a threat actor attack me even if they aren’t well known?
Yes. Most attacks on individuals are massive and automated: they don’t target anyone specific, but anyone who falls for it. Your data can also be exposed through a data breach at a company you’re a customer of, even if you did nothing wrong.
How do I know if my data is in the hands of a threat actor?
The most common red flags are unknown logins, unrecognized charges, or overly personalized messages. However, many leaks show no signs until they’re used, so the most reliable way to know is to continuously monitor your exposure with a solution like Qondar.
What do I do if I discover that my data has been leaked?
Immediately change any affected passwords and any passwords you reuse, activate two-step verification, and notify your bank if any financial data is involved. If you suspect fraud or identity theft, call INCIBE at 017 and file a report.
How do you identify a threat actor?
Identifying the perpetrator of an attack, known as attribution, is a task for specialized intelligence teams. They analyze the infrastructure used, the tools employed, behavioral patterns, and activity on forums and underground markets, relying on investigative platforms like Teron.
