What is a threat actor?

Threat actor is a common name for the person, group or organisation behind a cyber attack. The NCSC uses the term, and close variants such as malicious actors, more often than it gives a formal glossary definition. For most families, criminals or attackers is clearer. ¹²

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

An NCSC page or advisory describes the person, group or organisation behind an attack as a threat actor, or as a malicious actor. ¹²
The NCSC 10 Steps hub refers to the common threat actors behind cyber attacks. A later advisory with allied agencies discusses malicious actors exploiting vulnerabilities. ¹²
Named campaign actors also appear in specific NCSC advisories, including spear-phishing analysis. Those names illustrate the word in use, not a list the reader must memorise. ³¹

How it can look

The NCSC 10 Steps hub refers to the common threat actors behind cyber attacks. NCSC advisories also describe named campaign actors in specific cases, including in spear-phishing analysis. Those names are illustrations of the word in use, not a list the reader must memorise. ¹³

Warning signs

A message uses the phrase threat actor to create panic, without pointing to a specific, checkable report. ¹
A news story, message or advisory lists a named group and treats that list as something you must memorise. ³¹²

What to do now

When you see threat actor, or malicious actor, on an NCSC alert, read it as the person, group or organisation behind that activity. ¹²
Focus on the practical pages for ransomware, phishing and social engineering, rather than memorising actor names. ¹³
Treat this page as vocabulary, not as a how-to for identifying a particular group. ¹

UK reporting and support

For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud (opens in a new tab). In Scotland, call Police Scotland on 101. ⁴⁶⁷
For a live cyber attack in England, Wales or Northern Ireland, use Report Fraud (opens in a new tab). Telephone support is also available on 0300 123 2040. ⁵
If someone is in danger, call 999. ⁶⁷

How to protect yourself

Use the practical steps on the ransomware, phishing and social engineering pages, which apply whoever is behind an attack. ¹
Keep software updated and important accounts protected with MFA or a passkey. ¹
Treat a named actor in an NCSC advisory as an illustration of the term, not as a list you need to learn. ³¹

Frequently asked questions

What does threat actor mean on an NCSC alert?

It means the person, group or organisation behind the cyber activity described in that alert. The NCSC uses the term, and close variants such as malicious actors, more often than it gives a formal glossary definition. ¹²

Does threat actor always mean a foreign state?

Not necessarily. In NCSC usage, it means the person, group or organisation behind the activity described. ¹²

Should I learn the names of particular groups?

Not for everyday use. Named campaign actors appear in specific NCSC advisories. They are illustrations of the word in use, not a list you must memorise. The practical steps sit on the ransomware, phishing and social engineering pages. ¹³

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

NCSC, 10 Steps to Cyber Security | National Cyber Security Centre (opens in a new tab). Accessed 10 November 2026 (Europe/London).
NCSC, UK and allies warn about shift in cyber attackers exploiting zero-day vulnerabilities | National Cyber Security Centre (opens in a new tab). Accessed 10 November 2026 (Europe/London).
NCSC, Spear-phishing campaigns: targets of interest | National Cyber Security Centre (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Guide to reporting cyber crime and fraud - Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Police Scotland, How to report a crime - Police Scotland (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).