Security+ Threat Actors, Attack Vectors, and Social Engineering

Introduction

This lesson opens Domain 2, Threats, Vulnerabilities, and Mitigations, which carries 22% of SY0-701 and is the second-heaviest domain after Security Operations. It covers objective 2.1 (compare common threat actors and motivations), objective 2.2 (explain common threat vectors and attack surfaces) and the social engineering part of objective 2.2. Distinguish the actor, motivation, and entry path before choosing a control. These clues support a hypothesis; they do not establish attribution by themselves.

By the end of the lesson you will be able to look at a short incident description, identify a plausible actor, infer the likely motivation, identify the vector used, and propose the most proportionate control.

Exam version: this lesson targets SY0-701 (V7). On 28 October 2026, CompTIA lists 11 June 2027 as the English retirement date and links to Security+ V8. Check the official page when booking; do not assume this course covers a successor exam’s objectives.

Learning objectives

After this lesson you will be able to:

• Compare nation-state actors, unskilled attackers, hacktivists, insider threats, organized crime, and shadow IT, including their typical resources and sophistication.
• Match motivations (data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical or political beliefs, ethical reasons, revenge, disruption or chaos, war) to actors.
• Explain the major threat vectors: message-based, image-based, file-based, voice call, removable device, vulnerable software, unsupported systems and applications, unsecure networks, open service ports, default credentials, and supply chain.
• Distinguish social engineering techniques: phishing, vishing, smishing, misinformation, impersonation, business email compromise, pretexting, watering hole, brand impersonation, typosquatting, and others.
• Reduce an organization's attack surface with practical controls.

1. Threat actors and motivations in SY0-701

A threat actor is a person or group that causes, or tries to cause, harm to an organization. The exam describes them using three attributes: sophistication (skill and tooling), resources and funding, and intent. Internal actors also have attributes of access: they are already inside.

A few points the exam likes to test:

• Advanced persistent threats (APTs) sustain targeted access over time. Nation-state sponsorship is a common association, but persistence and sophisticated tooling alone do not prove sponsorship. In a simplified scenario, combine those clues with the target and the stated motive.
• Organized crime commonly uses ransomware for extortion. If the prompt mentions a ransom note, cryptocurrency, and stolen data posted on a leak site (double extortion), the motive is financial gain.
• Hacktivists pursue political or ideological goals, often through publicity. Website defacement, distributed denial of service (DDoS) and public data leaks tied to a cause are classic examples.
• Insiders are either malicious (a departing employee copying a customer list) or unintentional (an employee who clicks a phishing link or misconfigures a storage bucket). Both count as insider threats, but only the first is driven by intent.
• Shadow IT is technology used without approval from IT or security, such as a personal file-sharing account holding company documents. It is not an attacker, but it appears in the "threat actor" list because it widens the attack surface and removes visibility.

Motivations in more detail

Example 1: classifying an incident

Scenario. A regional water utility notices that a contractor account logged in at 03:00 every night for four months, reading engineering diagrams and never touching billing data. No ransom was demanded. The malware was custom and has never been seen before.

Analysis. Long dwell time, custom tooling, interest in infrastructure diagrams, and no financial demand make a nation-state pursuing espionage a plausible hypothesis. Contractor misuse or another well-resourced group would still need investigation; the symptoms alone do not prove attribution. If the actor had encrypted files and asked for payment, organized crime and financial gain would fit better.

2. Threat vectors and attack surfaces

An attack surface is the sum of all points where an attacker can try to enter or extract data. A threat vector (or attack vector) is the path used. Shrinking the surface and monitoring the vectors is the heart of defensive work.

2.1 Message-based vectors

• Email: phishing, malicious attachments, links, business email compromise.
• SMS (smishing): text messages with malicious links, often claiming a parcel delivery or a bank alert.
• Instant messaging and collaboration tools: links sent in chat platforms, which users trust more than email.

2.2 Image-, file-, voice-, and device-based vectors

• Image-based: an image can carry a deceptive QR code, exploit a vulnerable image parser, or conceal data using steganography. Hidden bytes in an ordinary image do not execute automatically: execution requires a vulnerable parser or a separate loader. SVG can contain active content, depending on how it is rendered.
• File-based: documents, PDFs, archives and executables. Office macros remain a classic example.
• Voice call (vishing): a phone call impersonating the help desk or a bank.
• Removable devices: USB drives left in a car park ("baiting"), or a cable that behaves as a keyboard.

2.3 Weak technology vectors

• Vulnerable software: locally installed clients, agents, and remotely accessed services can all expose flaws. “Agentless” describes a deployment model, not immunity to exploitation. Prioritize supported versions, timely updates, and exposure reduction.
• Unsupported systems and applications: normal security updates have ended. Check whether a supported extended-security program exists; otherwise isolate the system and plan replacement.
• Unsecure networks: wireless (open Wi-Fi, weak encryption), wired (unauthenticated ports), and Bluetooth (pairing attacks).
• Open service ports: services such as RDP (3389) or SSH (22) reachable from the internet.
• Default credentials: routers, cameras and databases shipped with admin/admin.

2.4 Supply chain vectors

A supply chain attack compromises something the target already trusts:

• Managed service providers (MSPs): one compromised provider gives access to many customers.
• Vendors: a malicious update to software the customer installs.
• Suppliers: tampered hardware or firmware.

Example 2: choosing a control for a vector

Scenario. A retailer discovers that its point-of-sale terminals run a 12-year-old operating system that no longer receives updates, and the terminals are directly reachable from the store Wi-Fi.

Reasoning. The vectors are unsupported systems and unsecure network. The best short-term controls: place the terminals in an isolated VLAN, restrict traffic to the payment processor, and plan replacement. Patching is impossible because no patches exist. This applies the compensating security controls and core principles introduced earlier. Enforce filtering between segments: a VLAN alone does not restrict routed traffic.

3. Social engineering

Social engineering manipulates people into giving up information or access. It works because humans respond to authority, urgency, fear, familiarity, scarcity, and consensus. These are the principles of persuasion the exam may list.

Message-based attack details

Attackers often combine techniques. A spoofed sender changes the display name or domain. Email authentication records (SPF, DKIM, DMARC) help receivers detect forged domains, although they cannot stop look-alike domains. A quishing attack puts a malicious link inside a QR code. This can evade filters that inspect only text links; QR-aware scanning can still detect it. Domain authentication does not stop fraud sent from a genuinely compromised mailbox.

Worked example: analyzing a BEC attempt

Scenario. Maria in accounts payable receives an email from "the CFO" asking for an urgent transfer of 48,000 euros to a new supplier. The sender address is cfo@contoso-finance.example, but the real company domain is contoso.example. The email says the CFO is in a meeting and cannot take calls.

Step by step.

1. Identify the technique: this is business email compromise by impersonation, with a deceptive look-alike domain. Adding a plausible word is domain impersonation; it need not be a typing-error form of typosquatting. Urgency and authority are the persuasion levers.
2. Identify red flags: external domain that differs from the corporate one, request to change payment details, urgency, instruction to avoid verification.
3. Choose the control: out-of-band verification. Maria must call the CFO on a known number, and the payment policy should require dual approval for new beneficiaries above a threshold.
4. Why not simply block the sender? That helps once, but the attacker will register another domain. Process controls (callback verification, dual approval) address the root cause.
5. Why not just security awareness training? Training helps and is part of the answer, but a documented procedure is what catches the fraud even when a person is fooled.

For practical reporting and staff education, continue with phishing training and security awareness.

4. Attack surface reduction

Reducing the attack surface means giving the attacker fewer places to try. Typical actions:

Shadow IT deserves a closer look. If employees use a personal cloud drive because the approved tool is slow, blocking it without alternatives will drive them to something else. The better response combines discovery (a cloud access security broker or proxy logs), policy, and an approved alternative that meets the real need.

Apply these principles in segmentation, patching, and system hardening when choosing technical mitigations.

Example 3: supply chain exposure

Scenario. A software vendor's build server is compromised, and a signed update is pushed to 3,000 customers. The customers did nothing wrong.

Lessons. Preventive controls on the customer side are limited. Useful measures include staged rollouts, network segmentation so the software cannot reach everything, monitoring for unusual outbound traffic, a software bill of materials (SBOM) for component visibility, and contractual security requirements. An SBOM or valid signature does not prove that an update is benign. Questions about this scenario ask you to recognize the vector (supply chain) and choose a realistic mitigation.

5. Comparison: which actor or vector fits

6. Common pitfalls

• Treating every insider threat as malicious. Negligent or compromised users are insiders too.
• Calling spear phishing "phishing" when the question gives personal details. The tailored option is usually the right one.
• Confusing vishing (voice) with smishing (SMS), and whaling (executives) with spear phishing (specific individuals).
• Assuming that a hacktivist is always highly skilled. Many rely on volume and publicity.
• Recommending a technical control when the scenario is a human problem, or the reverse. Match the control to the vector.
• Forgetting that shadow IT is a risk created by well-meaning employees, not by an outside attacker.

7. Exam tips

• Use motivation clues to narrow possibilities: political motives can fit hacktivists or nation-states; profit and revenge can motivate several actor types. Confirm the choice against all stated evidence.
• For "most likely" and "best" questions, choose the answer that addresses the stated vector directly. A phishing scenario calls for email filtering or training, not a firewall rule.
• Out-of-band verification (call back on a known number) is a standard answer for payment fraud and impersonation.
• Look for the word trusted: a trusted vendor, trusted site or trusted update strongly suggests supply chain or watering hole.
• When a scenario explicitly says no security updates are available, look for isolation or replacement; verify support options before assuming every end-of-life product has no possible update.

8. Mini case study

Case. Fabrikam Logistics is a 600-employee freight company. In a single quarter it experiences the following:

1. An employee receives a text message saying a customs fee must be paid, and enters corporate credentials on a look-alike site.
2. The marketing team stores customer lists in a personal file-sharing account because the approved system limits attachments to 10 MB.
3. A warehouse scanner vendor's remote support tool is compromised, giving an attacker network access.
4. A former dispatcher, dismissed last month, still has a working VPN account and downloads the route database.

Tasks. Name the vector or actor in each case, and recommend one control.

Solution.

1. Smishing (message-based, SMS) with brand impersonation. Control: MFA that resists phishing (for example FIDO2 keys) so stolen passwords alone are useless, plus awareness training on reporting suspicious texts.
2. Shadow IT. Control: discover unsanctioned services with proxy logs or a CASB, then provide an approved large-file transfer service so the business need is met.
3. Supply chain through a trusted vendor tool. Control: segment the scanner network, require vendor access through a monitored, time-limited jump host with MFA, and write security requirements into the contract.
4. Former-insider misuse, enabled by a failure in offboarding. Revenge or financial gain is possible, but the facts do not establish the motive. Control: automate account deprovisioning on termination and review access logs for the affected period.

Key terms

• Threat actor: person or group that causes harm; described by sophistication, resources and motivation.
• APT: advanced persistent threat, sustained targeted access by a capable adversary; the behavior alone does not prove nation-state attribution.
• Hacktivist: attacker motivated by political or philosophical beliefs.
• Insider threat: harm from someone with legitimate access, malicious or negligent.
• Shadow IT: technology used without organizational approval.
• Attack surface / threat vector: all entry points / the path used.
• Social engineering: manipulation of people; includes phishing, vishing, smishing, pretexting, BEC, typosquatting, watering hole.
• Supply chain attack: compromise through a trusted vendor, supplier or service provider.

Summary checklist

• I can match actors to sophistication, resources and motivation.
• I can name the vector in a scenario: message, image, file, voice, removable device, unsupported system, unsecure network, open port, default credential, supply chain.
• I can tell phishing, spear phishing, whaling, vishing, smishing, pretexting and BEC apart.
• I know that out-of-band verification and dual approval counter payment fraud.
• I can list at least five ways to reduce an attack surface.
• I understand why shadow IT is a risk and how to address its cause.
• I can distinguish confirmed evidence from assumptions about an attacker’s identity or motive.

Sources

• CompTIA Security+ V7 objectives summary and exam information (opens in a new tab) — objectives 2.1–2.2.
• FBI: business email compromise and payment verification (opens in a new tab)
• MITRE ATT&CK: steganography (opens in a new tab)
• CISA, #StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide (opens in a new tab)
• NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management: https://csrc.nist.gov/pubs/sp/800/161/r1/final (opens in a new tab)