Threat Actors, Attack Vectors, and Social Engineering on SY0-701
Map nation-states, insiders, shadow IT, and modern social engineering (BEC, smishing, deepfake-adjacent pretexting) to Security+ threat models.
Finance receives an urgent email from "the CFO" approving a wire to a new vendor account. The mailbox looks right; the phone callback goes to a mobile number in the signature, not the corporate directory. Meanwhile, an engineer spins up an unsanctioned file-sharing app because official tools are slow—and exports customer lists to "test a script." Two incidents, one week: the first is business email compromise from an organized crime playbook; the second is shadow IT creating insider-scale data exposure without malice. Domain 2 (22% of SY0-701) tests whether you can map actor → motivation → vector → mitigation faster than you can recite CVE prefixes.
Threat modeling vocabulary: keep terms separate
- Threat actor — who might attack (capabilities, resources, insider access).
- Threat — potential for harm (actor + intent + capability against assets).
- Vulnerability — weakness that can be exploited (misconfig, bug, weak process).
- Risk — likelihood and impact of threat exploiting vulnerability.
Exam trap: "The vulnerability is the nation-state." No—the nation-state is the actor; unpatched VPN is the vulnerability. Risk rises when high-capability actors meet easy vulnerabilities.
Threat actors and attributes
CompTIA groups actors you must recognize on sight:
| Actor | Capability / resources | Typical motivations | Mitigation mindset |
|---|---|---|---|
| Nation-state | Advanced, patient, funding | Espionage, disruption, geopolitical goals | Assume persistence; depth-in-depth, intel sharing |
| Organized crime | Specialized tooling, profit focus | Ransomware, fraud, carding, BEC | Financial controls, backup resilience, email auth |
| Hacktivist | Variable | Ideological visibility, defacement, leaks | Reputation monitoring, DDoS prep, PR/IR |
| Insider | Existing access, knowledge of gaps | Revenge, financial gain, negligence | Least privilege, DLP, UEBA, exit procedures |
| Unskilled attacker | Scripts, commodity kits | Easy wins, curiosity | Patch basics, disable defaults, awareness |
| Shadow IT user | Not classic "hacker" | Convenience, speed | Discovery, sanctioned alternatives, CASB/SaaS governance |
Track internal vs external, funding, sophistication. Attribution is hard live; exams give hints (state-sponsored timing, insider knowledge, commodity phishing kit).
Motivations cheat sheet (match to stem)
| Motivation | Clues in scenario |
|---|---|
| Financial gain | Wire fraud, crypto mining, card data |
| Espionage | Slow exfil, targeted research docs |
| Service disruption | DDoS, wipers, destructive payloads |
| Blackmail | Data theft + public deadline |
| Revenge | Disgruntled employee, timed deletion |
| Ideology | Public message, target choice symbolic |
| War / geopolitical | Critical infrastructure timing |
Worked example: classifying two incidents
Incident A: APT-style dwell time, custom malware, exfil to foreign IP ranges during merger talks.
- Actor: likely nation-state or well-funded espionage
- Motivation: espionage
- Controls emphasis: threat hunting, network segmentation, egress filtering, executive comms hygiene
Incident B: Mass phishing with off-the-shelf stealer, no targeting.
- Actor: unskilled or organized crime commodity campaign
- Motivation: financial gain (credential resale)
- Controls emphasis: MFA, mail filtering, awareness, EDR on endpoints
Same "phishing" vector, different capability assumptions change detection depth.
Attack vectors and surfaces
Vectors describe how attack delivery happens—not the vulnerability itself.
| Vector category | Examples | Why defenders care |
|---|---|---|
| Message-based | Email, SMS, Slack/Teams links | High volume; human click decisions |
| Image / file-based | Malicious attachments, weaponized docs | Macro and parser bugs |
| Voice | Vishing, callback scams | Bypasses email filters |
| Removable media | USB drops | Air-gap bypass, autorun legacy |
| Wireless | Evil twin Wi-Fi, Bluetooth pairing | Credential capture off-network |
| Network | Open ports, default creds, flat LAN | Lateral movement after foothold |
| Supply chain | Vendor compromise, malicious update | Trust inheritance breaks |
| Web / client | Drive-by, XSS (concept), malicious ads | User browsing becomes entry |
| Human / social | Pretexting, impersonation | Exploits process gaps, not CVEs |
Unsupported / end-of-life systems are a standing vector class—no patches means known exploits stay valid. Default credentials on IoT and management interfaces still appear in stems because they still work in the field.
Attack surface vs vector
Attack surface is the sum of exposed entry points (APIs, VPN, SaaS tenants, physical reception). Shrinking surface (disable unused ports, retire EOL, govern SaaS) reduces vectors reachable without guessing which phishing template arrives first.
Social engineering: modern catalog
Social engineering manipulates people into breaking security policy. SY0-701 includes classic and contemporary flavors:
| Technique | Delivery | What makes it work |
|---|---|---|
| Phishing | Bulk email | Urgency, authority, fear |
| Spear phishing | Targeted email | Personal context, plausible sender |
| Whaling | Targets executives | High-value fraud, BEC |
| Smishing | SMS | Shorter scrutiny, MFA fatigue prompts |
| Vishing | Voice calls | Real-time pressure, caller ID spoof |
| BEC | Compromised or lookalike business mail | Payment process gaps |
| Pretexting | Any channel | Fabricated scenario (IT support, audit) |
| Impersonation | Brand/role mimic | Trust in titles and logos |
| Typosquatting | Lookalike domains | examp1e.com vs example.com |
| Watering hole | Compromise frequented site | Targets specific community |
| Misinformation / disinformation | News, social feeds | Bad decisions, panic, divisive IR |
Deepfake-adjacent pretexting (voice clone + urgent wire) appears in modern curricula as evolution of vishing/BEC—exam logic stays: out-of-band verification and dual control beat trusting a single channel.
BEC deep dive (exam favorite)
Business Email Compromise rarely needs zero-days. It abuses trust in email and payment procedures:
- Attacker recons public roles (LinkedIn, press releases).
- Spoofed or compromised mailbox requests invoice change or urgent transfer.
- Finance skips callback policy because "CEO is traveling."
| Control type | BEC-specific control |
|---|---|
| Preventive | Dual authorization for payments, enforced callback to known directory numbers |
| Detective | DMARC/DKIM/SPF failures, impossible travel on mail account, finance mailbox rules flagging bank changes |
| Corrective | Recall procedures with bank, IR comms, policy reinforcement |
Exam trap: suggesting "more antivirus" for pure BEC wire fraud—wrong vector match.
Worked scenario: vendor bank detail change
Stem: Accounts payable receives PDF invoice with new routing numbers; email from vendor domain with valid-looking thread history.
Steps to reason:
- Actor: organized crime or compromised vendor mailbox
- Vector: message-based + BEC pattern
- Vulnerability: weak payment change verification process
- Best mitigations: out-of-band voice verification to known contact, dual approval, vendor portal instead of email-only changes, mail authentication monitoring
Not primary: network segmentation (helps post-compromise, not email fraud logic).
Supply chain and third-party angles
Managed service providers (MSPs), software updates, and hosted libraries extend trust. Compromise of a trusted updater (classic supply-chain narrative) hits many downstream clients. Controls map to Domain 5 vendor risk too: assessments, least privilege for vendor access, monitoring third-party connections, software bill of materials awareness at concept level.
Shadow IT expands supply chain informally—unsanctioned SaaS may lack DLP, MFA, or retention policy. Actor classification differs (employee), but data exposure risk resembles outsider exfil paths.
Matching mitigations to vectors (not generic buzzwords)
| Vector | Weak answer | Stronger answer |
|---|---|---|
| Smishing OTP steal | "Block all SMS" | FIDO2/phishing-resistant MFA, user reporting, carrier filtering where available |
| USB drop in parking lot | "Encrypt Wi-Fi" | Disable autorun, endpoint USB policy, awareness |
| Default creds on camera | "SIEM correlation" | Change defaults, network isolate IoT VLAN, vuln scan |
| Watering hole | "Password complexity" | Browser isolation, URL filtering, threat intel on visited sectors |
| Insider exfil | "Firewall only" | DLP, UEBA, least privilege, exit audits |
Always ask: does this control break the path described?
Indicators and detective layer (touchpoint to Domain 4)
While Domain 2 emphasizes threats and mitigations, stems reference IoCs (Indicators of Compromise): odd DNS, beaconing intervals, known-bad hashes, impossible travel. Detective controls translate IoCs into alerts—tie back to control types from Domain 1.
Common Domain 2 exam traps
- Confusing hacktivist with nation-state when stem shows low sophistication tools.
- Labeling shadow IT as external attacker.
- Picking technical control when process fix is clearly requested (payment verification).
- Treating phishing and spear phishing as identical mitigation depth—spear needs targeted training and executive protections.
- Ignoring internal actor when stem mentions "recent termination" or "disgruntled."
Comparison table: actor vs likely TTP depth
| Actor | Likely TTP depth | Example TTP |
|---|---|---|
| Unskilled | Commodity malware, mass mail | Stealer phishing |
| Organized crime | Ransomware affiliate, BEC playbooks | Double extortion |
| Nation-state | Custom tooling, long dwell | Living-off-the-land, supply chain |
| Insider | Direct access abuse | Bulk download before resignation |
Why it matters: detection investment follows capability. commodity noise needs scalable filtering; APT needs hunt teams and segmented crown jewels.
How to practice
- Triple control drill: for each vector (email, USB, vishing, supply chain), write one preventive, detective, and corrective control—forces Domain 1 linkage.
- Headline rewrite: take a real breach news item; label actor, vector, vulnerability, and one missed mitigation in SY0-701 vocabulary.
- BEC role-play: draft a fake "urgent wire" mail; then list three policy clauses that would stop payment without verification.
- Shadow IT inventory: list unsanctioned apps you've seen; map data types at risk and a governance alternative.
- Timed scenarios: 20 minutes, ten short stems—actor + vector + best control only, no over-explaining.
Domain 2 rewards pattern recognition under narrative load. When finance forwards that CFO email, you should hear BEC, organized crime motivation, message vector, and dual-control preventive—not a vague "raise awareness." Build that chain until it is reflex; the exam will wrap it in longer stories, but the skeleton stays the same.