Malicious Actors

Malicious actors are individuals, groups, or automated systems that intentionally exploit vulnerabilities, manipulate data, or disrupt operations for unauthorized purposes. In cybersecurity, understanding malicious actors -- their motivations, capabilities, tactics, and organizational structures -- is foundational to building effective defenses. Unlike accidental failures or software bugs, malicious actors apply intelligent, adaptive pressure against systems, evolving their methods in response to defensive measures.

Within the Prismatic Platform, the concept of malicious actors permeates multiple architectural layers. The platform's Prismatic Perimeter module performs External Attack Surface Management (EASM) to identify how an organization appears to potential attackers. The Color Teams architecture simulates malicious actor behavior through Red Team adversarial exercises, while the Blue Team develops and validates defensive postures. The OSINT toolbox with 120+ adapters gathers open-source intelligence that real-world threat actors might also collect, enabling proactive identification of exposure before exploitation occurs.

The Prismatic Platform treats malicious actor modeling not as an afterthought but as a first-class architectural concern. Every security decision -- from process isolation in the BEAM VM to the epistemic attack taxonomy used by the Red Team -- is informed by a clear understanding of who the adversaries are, what they want, and how they operate.

Technical Foundations

Threat Actor Classification

Security professionals classify malicious actors along several dimensions that determine appropriate defensive strategies. The Prismatic Platform's threat model incorporates all major actor categories.

Nation-state actors (Advanced Persistent Threats, or APTs) possess the highest capability levels, including zero-day exploits, custom tooling, and dedicated operational teams. They target critical infrastructure, intellectual property, and strategic intelligence. Their campaigns are characterized by patience, stealth, and willingness to invest months or years in a single target.

Organized cybercrime groups operate as profit-driven enterprises. They deploy ransomware, conduct business email compromise, steal financial credentials, and sell access to compromised systems. Their tools are increasingly sophisticated, often rivaling nation-state capabilities, but their motivations are purely economic.

Hacktivists are motivated by political, social, or ideological goals. They typically favor high-visibility attacks such as website defacement, distributed denial-of-service (DDoS), and data leaks designed to embarrass targets. Their technical sophistication varies widely.

Insider threats are individuals with authorized access who abuse their privileges. They may be disgruntled employees, compromised insiders recruited by external actors, or negligent users whose actions inadvertently enable attacks. Insider threats are uniquely dangerous because they bypass perimeter defenses entirely.

Automated threat actors include botnets, credential-stuffing frameworks, vulnerability scanners, and AI-driven attack tools that operate at scale without direct human oversight. The rise of AI-augmented attack tools has accelerated the pace and sophistication of automated attacks.

Attack Lifecycle (Kill Chain)

Understanding the attack lifecycle is essential for designing detection and prevention mechanisms. The Lockheed Martin Cyber Kill Chain and MITRE ATT&CK framework provide structured models that the Prismatic Platform uses for both offensive simulation and defensive design.

Phase	Description	Prismatic Defense Layer
Reconnaissance	Target information gathering	EASM + OSINT monitoring
Weaponization	Exploit/payload development	Not directly observable
Delivery	Attack vector execution	Network/application controls
Exploitation	Vulnerability exploitation	Input validation, process isolation
Installation	Persistence establishment	Integrity monitoring
Command & Control	Remote control channels	Network anomaly detection
Actions on Objectives	Data exfiltration, disruption	Audit logging, circuit breakers

Core Concepts and Principles

The Adversarial Mindset

Effective defense requires adopting the adversarial mindset -- thinking like an attacker to anticipate attack vectors before they are exploited. The Prismatic Platform institutionalizes this through its Red Team, which employs five epistemic attack primitives: truth distortion, confidence manipulation, signal poisoning, drift induction, and salience hijacking.

This approach extends beyond traditional technical attacks to include epistemic threats -- attacks against the system's ability to reason correctly about its own state. A malicious actor who can corrupt a platform's monitoring data or manipulate its decision-making processes poses a more fundamental threat than one who merely exploits a buffer overflow.

Zero-Trust Architecture

The zero-trust principle -- "never trust, always verify" -- is the architectural response to the reality that malicious actors may already be inside the network. The Prismatic Platform implements zero-trust at the process level through the BEAM VM's shared-nothing architecture. Every BEAM process is isolated, with no ability to access another process's memory. All inter-process communication occurs through explicit message passing, creating natural trust boundaries at every process interaction.

Defense in Depth

No single security control can stop all malicious actors. Defense in depth layers multiple independent controls so that the failure of any single layer does not compromise the system. The Prismatic Platform implements defense in depth through: BEAM process isolation (runtime layer), OTP supervision trees (recovery layer), circuit breakers (cascade prevention layer), authentication and authorization plugs (application layer), EASM scanning (perimeter layer), and Color Team exercises (validation layer).

Architecture and Design Patterns

Threat Modeling Architecture

The Prismatic Platform's threat model follows a structured approach where potential malicious actors are identified, their capabilities assessed, and defensive controls mapped to each threat scenario.

defmodule Prismatic.Security.ThreatModel do
  @moduledoc """
  Defines the threat actor taxonomy and maps actor capabilities
  to defensive controls. Used by the Color Teams and Perimeter
  modules to prioritize security assessments.
  """

  @type actor_type :: :nation_state | :cybercrime | :hacktivist | :insider | :automated
  @type capability_level :: :low | :medium | :high | :advanced

  @type threat_actor :: %{
    type: actor_type(),
    capability: capability_level(),
    motivation: String.t(),
    typical_ttps: [String.t()],
    detection_difficulty: :easy | :moderate | :hard | :very_hard
  }

  @spec actor_taxonomy() :: [threat_actor()]
  def actor_taxonomy do
    [
      %{
        type: :nation_state,
        capability: :advanced,
        motivation: "Strategic intelligence, IP theft, infrastructure disruption",
        typical_ttps: ["zero-day exploits", "supply chain compromise", "living-off-the-land"],
        detection_difficulty: :very_hard
      },
      %{
        type: :cybercrime,
        capability: :high,
        motivation: "Financial gain through ransomware, fraud, data theft",
        typical_ttps: ["phishing", "ransomware", "credential stuffing", "BEC"],
        detection_difficulty: :moderate
      },
      %{
        type: :hacktivist,
        capability: :medium,
        motivation: "Political or ideological statement",
        typical_ttps: ["DDoS", "defacement", "data leaks"],
        detection_difficulty: :easy
      },
      %{
        type: :insider,
        capability: :high,
        motivation: "Financial gain, revenge, ideological",
        typical_ttps: ["privilege abuse", "data exfiltration", "sabotage"],
        detection_difficulty: :hard
      },
      %{
        type: :automated,
        capability: :medium,
        motivation: "Opportunistic exploitation at scale",
        typical_ttps: ["vulnerability scanning", "credential stuffing", "bot attacks"],
        detection_difficulty: :easy
      }
    ]
  end

  @spec controls_for_actor(actor_type()) :: [String.t()]
  def controls_for_actor(:nation_state) do
    ["zero-trust architecture", "supply chain verification", "advanced threat detection",
     "network segmentation", "endpoint detection and response", "threat intelligence feeds"]
  end

  def controls_for_actor(:cybercrime) do
    ["email filtering", "endpoint protection", "backup and recovery",
     "security awareness training", "multi-factor authentication"]
  end

  def controls_for_actor(:insider) do
    ["least privilege access", "behavioral analytics", "data loss prevention",
     "audit logging", "separation of duties"]
  end

  def controls_for_actor(:hacktivist) do
    ["DDoS mitigation", "web application firewall", "content integrity monitoring"]
  end

  def controls_for_actor(:automated) do
    ["rate limiting", "CAPTCHA", "bot detection", "input validation", "WAF rules"]
  end
end

Adversarial Simulation Architecture

The platform's Red Team implements a controlled adversarial simulation environment where malicious actor behavior is modeled and executed against platform defenses in a sandboxed context.

defmodule Prismatic.Security.AdversarialSimulation do
  @moduledoc """
  Orchestrates adversarial simulation campaigns that model
  real-world malicious actor behavior. All simulations execute
  in isolated sandboxes with synthetic data only.

  The simulation engine supports five epistemic attack primitives
  from the AIAD Red Team taxonomy, enabling comprehensive testing
  of both technical and epistemic defenses.
  """

  @type simulation_config :: %{
    actor_profile: Prismatic.Security.ThreatModel.threat_actor(),
    target_surface: [String.t()],
    duration_minutes: pos_integer(),
    allowed_techniques: [atom()],
    sandbox_id: String.t()
  }

  @type simulation_result :: %{
    findings: [finding()],
    techniques_used: [atom()],
    defenses_bypassed: [String.t()],
    defenses_held: [String.t()],
    overall_score: float()
  }

  @type finding :: %{
    severity: :critical | :high | :medium | :low | :info,
    category: String.t(),
    description: String.t(),
    evidence: term(),
    remediation: String.t()
  }

  @spec run_simulation(simulation_config()) :: {:ok, simulation_result()} | {:error, term()}
  def run_simulation(config) do
    with :ok <- validate_sandbox(config.sandbox_id),
         :ok <- validate_techniques(config.allowed_techniques),
         {:ok, session} <- initialize_session(config),
         {:ok, result} <- execute_campaign(session) do
      emit_simulation_telemetry(result)
      {:ok, result}
    end
  end

  defp validate_sandbox(sandbox_id) do
    case PrismaticDark.Sandbox.verify(sandbox_id) do
      :isolated -> :ok
      _ -> {:error, :sandbox_not_isolated}
    end
  end

  defp validate_techniques(techniques) do
    allowed = MapSet.new([:truth_distortion, :confidence_manipulation,
                          :signal_poisoning, :drift_induction, :salience_hijacking,
                          :port_scanning, :credential_testing, :injection_testing])

    if MapSet.subset?(MapSet.new(techniques), allowed) do
      :ok
    else
      {:error, :unauthorized_techniques}
    end
  end

  defp initialize_session(config) do
    {:ok, %{config: config, started_at: DateTime.utc_now(), findings: []}}
  end

  defp execute_campaign(session) do
    results =
      session.config.allowed_techniques
      |> Enum.map(&execute_technique(&1, session))
      |> Enum.reduce(%{findings: [], bypassed: [], held: []}, &merge_results/2)

    {:ok, %{
      findings: results.findings,
      techniques_used: session.config.allowed_techniques,
      defenses_bypassed: results.bypassed,
      defenses_held: results.held,
      overall_score: calculate_score(results)
    }}
  end

  defp execute_technique(technique, session) do
    PrismaticDark.Technique.execute(technique, session.config.target_surface)
  end

  defp merge_results(result, acc) do
    %{
      findings: acc.findings ++ result.findings,
      bypassed: acc.bypassed ++ result.bypassed,
      held: acc.held ++ result.held
    }
  end

  defp calculate_score(%{bypassed: bypassed, held: held}) do
    total = length(bypassed) + length(held)
    if total == 0, do: 1.0, else: length(held) / total
  end

  defp emit_simulation_telemetry(result) do
    :telemetry.execute(
      [:prismatic, :security, :simulation, :complete],
      %{findings_count: length(result.findings), score: result.overall_score},
      %{timestamp: DateTime.utc_now()}
    )
  end
end

Implementation in Prismatic Platform

OSINT-Driven Threat Intelligence

The Prismatic Platform's OSINT toolbox with 120+ adapters provides the intelligence foundation for understanding malicious actor activity. By monitoring the same open sources that threat actors use for reconnaissance, the platform can identify exposure before it is exploited.

Key intelligence capabilities include:

Domain and IP monitoring: Tracking DNS changes, certificate issuance, and IP reputation through adapters like Shodan, Censys, and VirusTotal
Credential exposure monitoring: Detecting leaked credentials through breach databases and paste sites
Social engineering surface: Assessing publicly available information that could enable social engineering attacks
Dark web monitoring: Tracking mentions of protected assets on underground forums and marketplaces
Sanctions and compliance screening: Cross-referencing entities against EU, OFAC, and UN sanctions lists

Prismatic Perimeter EASM

The Prismatic Perimeter module implements External Attack Surface Management, which views the organization from the perspective of a malicious actor conducting reconnaissance.

defmodule PrismaticPerimeter.AttackerView do
  @moduledoc """
  Models the organization's attack surface as seen by an external
  malicious actor. Identifies exposed assets, services, and data
  that could be targeted during reconnaissance.
  """

  @type exposure :: %{
    asset_type: :domain | :ip | :certificate | :service | :cloud_resource,
    address: String.t(),
    risk_level: :critical | :high | :medium | :low,
    exposure_category: String.t(),
    first_seen: DateTime.t(),
    last_verified: DateTime.t()
  }

  @spec scan_attack_surface(String.t()) :: {:ok, [exposure()]} | {:error, term()}
  def scan_attack_surface(domain) do
    with {:ok, dns_records} <- discover_dns(domain),
         {:ok, certificates} <- discover_certificates(domain),
         {:ok, services} <- discover_services(dns_records),
         {:ok, cloud_assets} <- discover_cloud_resources(domain) do
      exposures =
        (dns_records ++ certificates ++ services ++ cloud_assets)
        |> Enum.map(&assess_risk/1)
        |> Enum.sort_by(& &1.risk_level)

      {:ok, exposures}
    end
  end

  defp assess_risk(asset) do
    risk = PrismaticPerimeter.RiskScorer.score(asset)
    Map.put(asset, :risk_level, risk)
  end

  defp discover_dns(domain) do
    PrismaticPerimeter.Discovery.DNS.enumerate(domain)
  end

  defp discover_certificates(domain) do
    PrismaticPerimeter.Discovery.Certificate.search(domain)
  end

  defp discover_services(dns_records) do
    PrismaticPerimeter.Discovery.Service.scan(dns_records)
  end

  defp discover_cloud_resources(domain) do
    PrismaticPerimeter.Discovery.Cloud.enumerate(domain)
  end
end

Process-Level Security Isolation

The BEAM VM provides inherent protection against certain classes of malicious actor behavior through its process isolation model. Each BEAM process operates in complete isolation with its own heap, stack, and garbage collector. A compromised or malicious process cannot access another process's memory, read its state, or corrupt its data. This architectural property means that even if a malicious actor exploits a vulnerability in one component, the damage is naturally contained to that process.

Operational Considerations

Operating in an environment where malicious actors are a constant presence requires continuous monitoring, rapid detection, and automated response capabilities. The Prismatic Platform implements several operational patterns for managing the threat landscape.

Continuous monitoring through the Perimeter module scans the organization's attack surface on configurable schedules, detecting new exposures, certificate changes, and service modifications that could indicate compromise or create new attack vectors.

Security ratings (A through F grades with numeric scores from 300 to 900) provide a quantitative measure of the organization's security posture from the perspective of a malicious actor. These ratings incorporate asset hygiene, vulnerability exposure, configuration quality, and compliance status.

Incident response integration ensures that when malicious actor activity is detected, the platform can trigger automated response workflows including process isolation, circuit breaker activation, and alert escalation through the incident response framework.

Audit trail completeness ensures that all security-relevant events are logged with sufficient detail for forensic analysis after a security incident. The platform's audit logging captures authentication events, authorization decisions, data access patterns, and configuration changes.

Security Implications

The security implications of malicious actor analysis extend beyond defensive controls to influence fundamental architectural decisions in the Prismatic Platform.

Trust boundaries are explicitly defined at every architectural layer. The BEAM VM provides hardware-like process isolation at the runtime level. OTP supervision trees define trust hierarchies where supervisors have authority over their children. The AIAD agent hierarchy implements tiered trust levels (L1 through L5) where higher-authority agents can override lower-tier decisions.

Input validation is enforced at every trust boundary. All data crossing process boundaries, API endpoints, and external interfaces is validated and sanitized. The platform uses Ecto changesets for structured validation, custom plugs for HTTP request validation, and protocol-level validation for inter-process messages.

Cryptographic controls protect data confidentiality and integrity. The platform uses TLS for all network communication, bcrypt for password hashing, HMAC for message authentication, and AES-256-GCM for encryption at rest. Key management follows the principle of separation of duties, with encryption keys stored separately from encrypted data.

Least privilege enforcement ensures that every component -- processes, agents, API endpoints, database connections -- operates with the minimum permissions necessary. The AIAD authority hierarchy (L1 through L5) implements this at the agent level, where each agent's capabilities are explicitly bounded by its tier.

Best Practices and Anti-Patterns

Best Practices

Model specific threat actors: Rather than defending against abstract "attackers," build threat models that identify the specific actor types relevant to your domain and design controls targeted at their capabilities
Assume breach: Design systems assuming that malicious actors will eventually gain some level of access, and ensure that breach containment mechanisms limit the blast radius
Automate detection: Manual security monitoring cannot keep pace with automated attacks; invest in automated anomaly detection, behavioral analytics, and real-time alerting
Test defenses adversarially: Use Red Team exercises to validate that defensive controls actually work against realistic attack scenarios, not just theoretical threats
Monitor the attack surface continuously: The attack surface changes constantly as new services are deployed, certificates expire, and configurations drift; continuous EASM is essential
Implement defense in depth: Layer multiple independent controls so that no single point of failure can be exploited by a malicious actor

Anti-Patterns to Avoid

Security through obscurity: Relying on hidden URLs, non-standard ports, or undocumented APIs as primary security controls; malicious actors will discover them through automated scanning
Perimeter-only defense: Protecting only the network boundary while leaving internal systems unprotected; insider threats and lateral movement render perimeter-only defense insufficient
Alert fatigue: Generating so many security alerts that operators ignore them; prioritize high-fidelity detections over comprehensive but noisy monitoring
Static threat models: Building a threat model once and never updating it; the threat landscape evolves continuously, and defensive strategies must evolve with it
Ignoring epistemic attacks: Focusing exclusively on technical exploits while neglecting attacks against decision-making processes, monitoring integrity, and trust relationships

Industry Standards and Compliance

The Prismatic Platform's approach to malicious actor defense aligns with major industry frameworks and regulatory requirements.

MITRE ATT&CK provides the most comprehensive public taxonomy of adversary tactics, techniques, and procedures (TTPs). The platform's Red Team simulation engine maps its attack scenarios to ATT&CK technique IDs, enabling standardized reporting and cross-reference with threat intelligence feeds.

OWASP Top 10 identifies the most critical web application security risks. The platform's web layer (PrismaticWeb) implements controls for all Top 10 categories including injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialization, using components with known vulnerabilities, and insufficient logging and monitoring.

NIS2 Directive (EU 2022/2555) mandates comprehensive cybersecurity risk management for essential and important entities. The Prismatic Perimeter's compliance module assesses NIS2 readiness across its required domains: risk analysis, incident handling, business continuity, supply chain security, and vulnerability disclosure.

ZKB 264/2025 Sb. (Czech cybersecurity regulation) establishes national cybersecurity requirements that the platform assesses through its compliance engine, ensuring alignment with Czech-specific regulatory expectations.

Integration with Platform Ecosystem

The malicious actor concept integrates deeply with multiple platform components, creating a comprehensive security ecosystem.

The Color Teams architecture provides the operational framework for malicious actor simulation and defense. The Red Team (4 agents) simulates adversarial scenarios, the Blue Team (4 agents) develops and validates defenses, and the Purple Team (4 agents) synthesizes findings into actionable improvements. The Black Team (2 agents) operates in maximum isolation to model theoretical worst-case threat scenarios.

The OSINT intelligence layer feeds threat data into the platform through 120+ adapters spanning Czech registries (28 adapters), global intelligence sources (84 adapters), sanctions databases (3 adapters), and specialized regional sources.

The Prismatic Perimeter module translates malicious actor understanding into actionable security ratings, asset inventories, and compliance assessments.

Related glossary terms:

Attack Surface -- The sum of all points where a malicious actor can attempt access
Red Team -- Adversarial simulation team modeling malicious actor behavior
Blue Team -- Defensive team protecting against malicious actor threats
Cyber Threat Intelligence -- Intelligence about malicious actor capabilities and activities
Incident Response -- Procedures for responding to confirmed malicious actor activity
Security Operations -- Ongoing operational security management

Future Directions

The malicious actor landscape is evolving rapidly, driven by several converging trends that the Prismatic Platform is positioning to address.

AI-augmented attacks represent the most significant near-term evolution. Large language models enable more convincing phishing campaigns, automated vulnerability discovery, and adaptive attack tools that modify their behavior in response to defensive measures. The platform's Red Team is expanding its simulation capabilities to model AI-augmented attack scenarios.

Supply chain attacks are increasing in frequency and sophistication, targeting the software dependencies that modern platforms rely upon. The platform is developing supply chain verification capabilities that assess dependency integrity, monitor for compromised packages, and enforce provenance requirements for all third-party code.

Quantum computing threats pose a longer-term challenge to current cryptographic controls. Post-quantum cryptography migration planning is on the platform roadmap, ensuring that encryption schemes are updated before quantum-capable adversaries emerge.

Autonomous attack systems that operate without direct human control are becoming more prevalent. Defending against autonomous adversaries requires equally autonomous defensive capabilities -- a direction the platform is pursuing through its AIAD agent framework, where defensive agents can detect and respond to attacks at machine speed.

Regulatory expansion continues globally, with new cybersecurity regulations creating compliance requirements that must be mapped to specific threat actor scenarios. The platform's compliance engine is designed to be extensible, supporting new regulatory frameworks as they emerge.

Summary

Malicious actors represent the intelligent, adaptive adversary that security architectures must defend against. The Prismatic Platform addresses this challenge through a multi-layered approach: threat modeling that classifies actor types and their capabilities, EASM that views the organization from the attacker's perspective, OSINT that monitors the intelligence sources attackers use, Color Team exercises that simulate and validate defenses, and OTP-based runtime architecture that provides inherent process isolation and fault recovery. Understanding malicious actors is not a one-time exercise but an ongoing operational discipline that must evolve as the threat landscape changes.

Connect & Contribute

Created by Tomas Korcak (korczis) | Open Source under GHL

GitHub | GitLab | LinkedIn | Contact
Developer Portal | Architecture | Meet the Creator

Malicious Actors