Docs

Appearance

Threat Actor Profiles ​

Companion doc (DOCS-145). The canonical, maintained threat-actor profiles are §3 of the Cirius Group Threat Model. This page is kept as a standalone companion; when the two differ, the canonical threat model is authoritative.

Purpose: Document the threat actors most likely to target Cirius Group, their motivations, their tactics and tools, and the specific mitigations that address each. These profiles inform the STRIDE analysis, the controls mapping, and the tabletop scenarios.

Owner: Rory (Security Officer) Audience: Security Officer, engineering, incident responders, auditors Review frequency: Annual in December, plus after any major incident or any material shift in the threat landscape Last reviewed: April 2026

Context — November 2024 incident ​

Cirius Group experienced a ransomware attack in November 2024. The detail of that incident informs Actor Profile 1 below. The procedures in runbooks/incident-response.md incorporate lessons learned. This document assumes the baseline that healthcare organizations of our size are a recurring target for ransomware-as-a-service affiliates.

Actor Profile 1 — Ransomware-as-a-Service (RaaS) affiliates ​

Motivation: Financial. The affiliate receives a share of the ransom paid; the RaaS operator takes the remainder.

Likelihood: HIGH. The November 2024 incident establishes a known pattern. RaaS groups recycle tooling and target lists; reappearance on the target list is common for 12–24 months after an initial incident.

Impact: CRITICAL. Production outage, PHI exposure risk, potential Breach Notification Rule obligations, reputational damage with customers (Paul's FTP customer relationship in particular).

Typical TTPs (MITRE-adjacent):

  • Initial access: Credential spray against Entra (TA0001, T1110.003), phishing for OAuth consent (T1528), exposed RDP (T1021.001 historically — now closed by Twingate-only access)
  • Execution: Beacon binaries dropped in %APPDATA%\Local\Temp (T1059), LOLBins (rundll32, mshta, wscript, regsvr32) (T1218)
  • Persistence: New services (EventID 7045) (T1543.003), scheduled tasks (EventID 4698) (T1053.005), registry run keys (T1547.001)
  • Credential access: LSASS memory dumping (T1003.001), DCSync against DC (T1003.006)
  • Lateral movement: RDP with stolen creds (T1021.001), Pass-the-Hash against DCs (T1550.002), admin share access (C$, ADMIN$) (T1021.002)
  • Defense evasion: Clearing Windows Security log (EventID 1102) (T1070.001), disabling AV agents (T1562.001)
  • Exfiltration: RClone to cloud storage (T1567.002), WinSCP, Mega.nz, double-extortion
  • Impact: Ransomware deployment via GPO scheduled task (T1486), shadow copy deletion (T1490), backup deletion attempts

Likely targets in our environment: CJ-2 (AD forests + KRBTGT), CJ-4 (Veeam), CJ-8 (break-glass), CJ-1 (DDE AVD via GPO ransomware)

Mitigations specific to this actor:

  • Kill-chain agent set — one agent per stage, fires before encryption
  • Cortex XDR behavioral detection of Cobalt Strike / LOLBin abuse
  • Arctic Wolf MDR with act-first authorization
  • Palo Alto DNS Security blocks C2 callbacks
  • RSV immutability + S3 Object Lock as ransom-resistant recovery
  • Kerberoasting / DCSync detection via 4662 SACL agent
  • Quarterly Conditional Access policy audit — service accounts excluded from MFA are reviewed (direct lesson from threat modeling the Nov 2024 attack vector)

Actor Profile 2 — Healthcare data thieves / fraudsters ​

Motivation: Financial via PHI monetization. Stolen records sold for fraudulent medical claims, identity theft, prescription fraud.

Likelihood: MEDIUM to HIGH. Healthcare data is persistently valuable. Unlike ransomware, data theft is stealthier and often goes undetected for months.

Impact: CRITICAL. HIPAA breach determination, HHS reporting window, regulatory penalties, civil exposure, customer confidence.

Typical TTPs:

  • Initial access: Spear phishing for OAuth consent (T1528), targeted credential theft via AiTM (Adversary-in-the-Middle) phishing kits (T1557)
  • Execution/persistence: Often app-registration-based — register a malicious OAuth app, persist via app token that survives password change (T1550.001)
  • Credential access: Token theft from browser session, refresh token abuse
  • Discovery: Graph API enumeration of M365 mailboxes, OneDrive files, and business document stores
  • Exfiltration: Slow-and-low egress of documents via Graph API; may span weeks
  • No visible encryption stage — theft-only

Likely targets in our environment: CJ-6 (psql-secops-prod if app creds stolen), CJ-7 (Key Vault with service principal creds), M365 business documents and email (not a crown jewel — no PHI in SharePoint — but a data exfiltration vector).

Mitigations specific to this actor:

  • Conditional Access app-protection and device-compliance controls
  • Maester M365 audit validates CA posture (already weekly in both tenants)
  • Anomalous OAuth consent review (SecOps identity agent)
  • Graph API activity correlation via Entra AuditLogs + SignInLogs
  • DLP policies on sensitive business data (M365)
  • First-time-sign-in-from-unmanaged-device detection (on the priority list)
  • BAA with Microsoft covers M365 data residency and audit coverage

Actor Profile 3 — Nation-state (low probability, high capability) ​

Motivation: Intelligence gathering, supply-chain compromise, long-dwell persistence for future leverage.

Likelihood: LOW for direct targeting of Cirius Group specifically. MEDIUM as a collateral-damage vector through supply-chain compromise of shared vendors (Microsoft, Palo Alto, Cortex, Arctic Wolf).

Impact: CRITICAL if realized. Nation-state actors have capabilities that exceed most commercial defense stacks.

Typical TTPs:

  • Supply-chain compromise of trusted vendors (SolarWinds-class, M365 token-signing key theft — Storm-0558-class)
  • Living-off-the-land with legitimate admin tools
  • Months-to-years dwell time before any actioning on objective
  • Highly-targeted custom malware, minimal telemetry
  • Use of legitimate cloud services for C2 to avoid anomaly detection

Likely targets in our environment: CJ-2 (AD forests), CJ-5 (Panorama — intelligence value), CJ-7 (Key Vaults if keys are extractable)

Mitigations specific to this actor:

  • SHA-pin every GitHub Action — no floating refs from compromised upstream
  • Defender for Cloud anomaly detection across tenant-wide identity operations
  • Vendor security attestations reviewed annually (see compliance/vendor-risk-inventory.md)
  • Monitor for token-signing key anomalies via Entra AuditLogs
  • Nation-state activity detection is a primary value of Arctic Wolf MDR subscription
  • Defense-in-depth: even assuming one layer is compromised, others surface the activity

We do not build custom nation-state-specific tooling — we rely on our vendor ecosystem and basic hygiene (patching, privilege minimization) to keep the attack surface narrow.

Actor Profile 4 — Insider threat (disgruntled or compromised employee) ​

Motivation: Varied. Revenge after termination or role change, financial gain, coerced action under duress, or negligence without malicious intent.

Likelihood: LOW to MEDIUM. Small workforce reduces the absolute count of possible insiders, but a single insider can have outsized impact because of granted access.

Impact: HIGH to CRITICAL depending on role. A T1 Domain Admin insider is a CRITICAL threat actor. A standard user insider is HIGH but bounded.

Typical TTPs:

  • Bulk data export via sanctioned tools (SharePoint download, database export)
  • Credential sharing or writing credentials outside Keeper (violates policy but may happen)
  • Unauthorized after-hours access when detection is quieter
  • Disabling or tampering with security tooling
  • On termination: rapid credential export, setting up hidden persistence

Likely targets in our environment: Any crown jewel the insider's role reaches

Mitigations specific to this actor:

  • Principle of least privilege via Entra PIM (nothing standing)
  • Quarterly LPRIV audit (compliance/annual-review-checklist.md)
  • Keeper PAM session recording — every privileged session recorded and reviewable
  • Monthly Keeper session log review (runbooks/monthly-security-review.md §3)
  • Immediate termination runbook (4-hour SLA) per compliance/hipaa-administrative-procedures.md §3.3
  • DLP alerts on bulk egress from M365
  • UBA baseline (in build) detects behavioral drift per user
  • 6-year immutable audit trail — tampering is detected even if the insider is the SO (would require Kevin or Greg to execute the audit in that edge case)

Threat actor summary matrix ​

ActorLikelihoodImpactPrimary targetsKey mitigation
RaaS affiliateHIGHCRITICALCJ-2 (AD+KRBTGT), CJ-4 (Veeam), CJ-8 (break-glass), CJ-1 (DDE)Kill-chain agents + Arctic Wolf + Object Lock backup
Data thief / fraudsterMEDIUM-HIGHHIGHM365 business data, CJ-6 (psql), OAuth appsCA + Maester + OAuth monitoring + DLP
Nation-stateLOWCRITICALCJ-2 (AD), CJ-5 (Panorama), CJ-7 (Key Vaults)SHA-pinning + vendor attestation + defense-in-depth
InsiderLOW-MEDIUMHIGH-CRITICALWhatever role grantsPIM + Keeper PAM + LPRIV audit + UBA

Document history ​

DateChangeAuthor
April 2026Initial threat actor profiles — four actors mappedKobe
June 2026Align CJ references to canonical threat-model.md §2 numberingKobe

Internal use only — Cirius Group