A tactic that indicates a sophisticated threat actor rather than a commodity malware campaign is:

Question

Options

• AUse of widely available exploit kits
• BTargeted spear-phishing emails
• CScanning the internet for vulnerable servers
• DPosting threats on social media

• A
  14% (7)
• B
  76% (38)
• C
  4% (2)
• D
  6% (3)

Explanation

Spear-phishing (B) is correct because it involves researching specific targets - their roles, relationships, and habits - to craft convincing, personalized lures. This level of reconnaissance and customization signals an adversary with specific objectives and resources, hallmarks of an Advanced Persistent Threat (APT) rather than a spray-and-pray campaign.

Why the distractors are wrong:

• A (exploit kits): Commodity tools sold or rented on underground markets, used by low-skill attackers with no specific targeting - the opposite of sophistication.
• C (internet scanning): Opportunistic and automated; anyone can run Shodan or Masscan with minimal skill. Sophisticated actors may do this too, but it alone signals nothing advanced.
• D (social media threats): Posting threats is noise, not tradecraft - sophisticated actors prefer stealth and deniability, not public announcements.

Memory tip: Think "sophistication = specificity." The more an attack is tailored to you specifically (your name, your org, your colleagues), the more sophisticated the actor. Spear-phishing is targeted by definition; everything else in this list is untargeted or unskilled.

No community discussion yet for this question.