Modus Operandi (MO) in Cybersecurity

Table of Contents

Introduction

Cybersecurity threats are not defined only by the tools or technologies used to conduct malicious activities. They are also shaped by the behaviour, intentions, decisions, and operational methods of the individuals and groups behind them. Understanding these behavioural characteristics provides valuable insight into how cyber threats develop, how attacks are conducted, and how adversaries pursue their objectives.

Modus Operandi (MO) is a concept used to describe the characteristic methods and behavioural patterns through which an individual or group carries out an activity. In cybersecurity, it provides a behavioural perspective for examining threat actors and understanding how they operate across different digital environments. It helps distinguish recurring operational characteristics from isolated attack techniques and individual incidents.

The study of Modus Operandi has relevance beyond enterprise cybersecurity. Individuals, communities, governments, businesses, industries, financial systems, critical infrastructure, and interconnected digital ecosystems can all be affected by adversaries employing identifiable operational patterns. Understanding these patterns contributes to threat intelligence, security analysis, investigation, and the development of appropriate security measures.

Understanding Modus Operandi (MO)

Definition of Modus Operandi

Modus Operandi is a Latin expression meaning “method of operating” or “mode of operation.” It refers to the characteristic way in which an individual or group performs an activity to accomplish a particular objective. The term is used across several disciplines, including criminology, law enforcement, intelligence, behavioural analysis, and cybersecurity.

In cybersecurity, Modus Operandi refers to the characteristic methods, behaviours, and operational patterns adopted by a threat actor when conducting malicious activities. It encompasses the adversary’s preferred approaches, recurring practices, operational decisions, and methods of achieving specific objectives.

An MO may include the selection of targets, preferred attack approaches, exploitation methods, infrastructure choices, communication patterns, and techniques used to maintain access or extract information. These characteristics can vary depending on the threat actor’s capabilities, motivations, resources, operating environment, and objectives.

Unlike an isolated technical indicator, Modus Operandi represents a broader behavioural perspective. Individual tools, malware samples, IP addresses, or attack techniques may change over time, while certain operational preferences and behavioural characteristics may remain recognisable. However, an MO is not necessarily fixed. Threat actors can modify their methods in response to defensive measures, changes in technology, operational requirements, and lessons learned from previous activities.

Origin and Meaning of Modus Operandi

The expression Modus Operandi originated from Latin and has long been used to describe the characteristic manner in which a person performs an action. It became particularly established in criminology and law enforcement, where investigators examine recurring methods used by offenders to identify behavioural similarities across separate incidents.

In criminal investigations, an offender’s MO may involve recurring approaches to target selection, preparation, execution, and the completion of an offence. Investigators examine these characteristics to understand how an individual operates and whether separate incidents may be connected.

The concept was subsequently applied across intelligence and security disciplines to examine the operational behaviour of individuals, groups, and adversaries. In cybersecurity, it provides a useful way to interpret recurring patterns in malicious digital activities and understand the methods through which threat actors pursue their objectives.

Modus Operandi in Cybersecurity

In cybersecurity, Modus Operandi provides a behavioural understanding of how threat actors conduct cyber operations. It considers the relationship between an adversary’s motivation, capabilities, preferred methods, target characteristics, and operational environment.

For example, a financially motivated cybercriminal group may repeatedly target organisations through phishing campaigns, exploit exposed services, deploy ransomware, and demand payment. A nation-state threat actor may focus on intelligence collection, maintain long-term access, and use carefully selected infrastructure to avoid detection. An insider may exploit legitimate access privileges to obtain information or disrupt business operations.

These examples demonstrate that MO is not limited to a particular technology, attack type, or threat category. It describes the broader operational characteristics that help explain how an adversary conducts activities.

A threat actor’s MO can be examined through multiple sources, including incident reports, malware analysis, forensic evidence, threat intelligence reports, network telemetry, and observed attack behaviour. Correlating these sources helps analysts identify recurring patterns and develop a more complete understanding of adversary operations.

Characteristics of a Threat Actor’s Modus Operandi

A threat actor’s Modus Operandi is influenced by several characteristics that collectively shape its operational behaviour. These characteristics may differ between adversaries and can evolve as their capabilities and operating environments change.

Motivation and Intent: The adversary’s underlying purpose influences its target selection, operational priorities, and the activities it performs. Motivations may include financial gain, espionage, political influence, disruption, ideological objectives, or personal interests.
Target Preferences: Threat actors may demonstrate recurring preferences for particular industries, geographic regions, individuals, technologies, or types of information. These preferences often reflect their objectives and the value they associate with potential targets.
Operational Methods: The adversary may repeatedly use particular approaches, such as phishing, exploitation of exposed services, credential theft, social engineering, or abuse of legitimate access.
Technical Capabilities: The availability of tools, malware, infrastructure, vulnerabilities, and technical expertise influences the methods an adversary can employ.
Operational Infrastructure: Threat actors may use recurring infrastructure patterns involving domains, servers, command-and-control systems, hosting providers, and compromised devices.
Behavioural Patterns: Repeated decisions, timing, communication practices, operational sequences, and responses to defensive measures may reveal identifiable characteristics.
Adaptability: Adversaries may change their methods to overcome security controls, exploit new opportunities, or reduce the likelihood of detection.

These characteristics should be interpreted collectively rather than treated as independent proof of an adversary’s identity. Similar methods may be adopted by unrelated threat actors, and a single threat actor may employ different approaches across separate operations.

Importance of Understanding Modus Operandi

Understanding Modus Operandi helps cybersecurity professionals move beyond examining individual incidents and develop a broader understanding of adversary behaviour. Recognising recurring operational patterns can provide context for assessing threats, interpreting suspicious activities, and anticipating possible attack approaches.

Its importance extends across several cybersecurity activities:

Threat Understanding: Provides insight into the behaviour, operational preferences, and objectives of different threat actors.
Threat Intelligence: Helps analysts develop behavioural profiles and correlate intelligence from multiple incidents and sources.
Threat Detection: Supports the identification of recurring activities and suspicious behavioural patterns that may not be detected through individual indicators alone.
Threat Hunting: Helps security teams investigate activity based on known adversary behaviours and operational characteristics.
Security Assessment: Provides context for evaluating whether security controls can withstand the methods and approaches associated with relevant threat actors.
Incident Response: Helps investigators understand an incident, identify related activities, and determine whether the observed behaviour is consistent with previously identified operations.
Risk Management: Supports the evaluation of threats based on adversary intent, capabilities, target preferences, and potential impact.

Threat Actor Modus Operandi

Understanding Threat Actor Behaviour

Threat actor behaviour refers to the actions, decisions, and operational methods adopted by an adversary while conducting malicious activities. These behaviours are influenced by the actor’s motivation, capabilities, available resources, target environment, and desired outcome.

Different threat actors may exhibit different behavioural characteristics even when they use similar tools or techniques. For example, a cybercriminal seeking financial gain may prioritise rapid compromise and monetisation, whereas an espionage-oriented actor may favour stealth, persistence, and prolonged information collection.

Understanding threat actor behaviour involves examining both technical and non-technical activities. Technical activities may include exploiting vulnerabilities, deploying malware, and manipulating network communications. Non-technical activities may include social engineering, impersonation, target research, and exploiting human trust.

The combination of these behaviours provides a broader picture of how an adversary operates and helps analysts distinguish between isolated technical events and activities that may form part of a coordinated operation.

Target Identification and Selection

Target identification and selection involve determining which individuals, systems, organisations, or environments an adversary intends to attack. The selection process is influenced by the actor’s objectives, perceived value of the target, accessibility, vulnerabilities, and expected operational benefits.

Threat actors may identify targets through publicly available information, industry research, exposed digital assets, social media, business relationships, and previously compromised information. Some adversaries select targets opportunistically based on available weaknesses, while others conduct deliberate research to identify specific individuals, organisations, or infrastructure.

Target selection can also reflect strategic considerations. Nation-state actors may focus on government institutions, defence organisations, research establishments, or critical infrastructure. Financially motivated actors may target financial institutions, retailers, healthcare providers, or businesses that possess valuable information or are more likely to pay ransom demands.

Examining target preferences helps analysts understand the interests and priorities of an adversary. When combined with other behavioural evidence, these preferences can contribute to threat actor profiling and intelligence assessments.

Reconnaissance and Information Gathering

Reconnaissance involves collecting information about a potential target to understand its characteristics, technologies, users, infrastructure, and possible weaknesses. It provides the adversary with contextual knowledge that may influence subsequent operational decisions.

Threat actors may use passive reconnaissance methods, such as examining public websites, domain records, social media, public documents, and other open-source information. Active reconnaissance may involve interacting directly with target infrastructure through scanning, service enumeration, and other probing activities.

The information gathered may include employee details, email addresses, technology platforms, network architecture, exposed services, third-party relationships, and publicly accessible information. These findings can help an adversary identify potential attack paths and opportunities.

Reconnaissance is not necessarily limited to the initial stages of an operation. Threat actors may continue gathering information throughout an intrusion to understand the environment, identify additional targets, and support subsequent activities.

Initial Access Methods

Initial access refers to the methods used by an adversary to obtain an entry point into a target environment. The chosen approach depends on the target’s exposure, security posture, available vulnerabilities, and the threat actor’s capabilities.

Common initial access methods include phishing, exploitation of internet-facing applications, abuse of compromised credentials, exploitation of remote access services, supply chain compromise, and exploitation of misconfigured systems.

Social engineering is another important method, where adversaries manipulate individuals into disclosing credentials, opening malicious attachments, executing harmful files, or approving unauthorised access. In some cases, attackers exploit trust relationships with suppliers, partners, or service providers to reach their intended targets.

The preference for particular initial access methods can form part of a threat actor’s MO. Repeated use of specific approaches across multiple incidents may reveal operational characteristics and provide useful intelligence for defensive planning.

Exploitation and System Compromise

Exploitation involves taking advantage of vulnerabilities, weaknesses, or misconfigurations to perform unauthorised actions within a target environment. Successful exploitation may allow an adversary to execute code, obtain sensitive information, bypass security controls, or gain elevated privileges.

Threat actors may exploit software vulnerabilities, insecure configurations, weak authentication mechanisms, unpatched systems, and application-level weaknesses. The exploitation approach depends on the nature of the weakness and the actor’s technical capabilities.

System compromise may involve deploying malware, executing scripts, abusing legitimate administrative tools, or establishing unauthorised access through compromised accounts. Some adversaries rely on custom-developed malware, while others use publicly available tools and built-in system utilities.

The methods used during exploitation can reveal an adversary’s technical sophistication, operational preferences, and familiarity with the target environment. However, exploitation of the same vulnerability does not necessarily indicate that two incidents are associated with the same threat actor.

Persistence and Privilege Escalation

Persistence refers to the methods used by an adversary to maintain access to a compromised environment, including after system restarts, credential changes, or other defensive actions. It allows the threat actor to retain access for continued operations.

Common persistence methods include modifying system configurations, creating unauthorised accounts, installing malicious services, manipulating scheduled tasks, and establishing mechanisms that enable recurring access. Threat actors may also compromise legitimate accounts or authentication mechanisms to maintain access without relying entirely on malware.

Privilege escalation involves obtaining higher levels of access than those initially available. An adversary may exploit vulnerabilities, abuse misconfigured permissions, obtain privileged credentials, or misuse legitimate administrative functions to gain elevated privileges.

These activities are particularly important when analysing an MO because they can reveal how an adversary maintains operational control and expands its capabilities within a compromised environment.

Lateral Movement

Lateral movement refers to the techniques used by an adversary to move from one compromised system or account to another within a target environment. It enables the threat actor to expand its reach and access systems, applications, or information beyond the initial point of compromise.

Threat actors may use stolen credentials, remote administration protocols, compromised accounts, exploitation of internal services, and legitimate management tools to move between systems. In some cases, they exploit trust relationships and weaknesses in identity and access management to access additional resources.

Lateral movement may involve movement across endpoints, servers, cloud environments, identity platforms, and interconnected networks. In industrial environments, adversaries may attempt to move from corporate IT networks towards operational technology environments where connectivity and security weaknesses permit such movement.

The methods and sequence of lateral movement can provide valuable behavioural evidence. Analysts can examine which systems were targeted, how access was obtained, and whether similar movement patterns have appeared in other incidents.

Data Collection and Exfiltration

Data collection involves identifying and gathering information of interest within a compromised environment. The nature of the collected information depends on the adversary’s objectives and may include personal information, intellectual property, financial records, credentials, business documents, operational data, or government information.

Threat actors may locate valuable information through file system searches, database queries, application access, cloud storage enumeration, and examination of shared resources. Some adversaries may collect information gradually to reduce the likelihood of detection, while others may gather large volumes of data during a shorter operational period.

Exfiltration refers to the unauthorised transfer of collected information from the target environment to infrastructure controlled by the adversary. Methods may include encrypted network communications, cloud storage services, file transfer protocols, email, and other communication channels.

The selection of data, collection methods, staging practices, and exfiltration channels can reveal important aspects of a threat actor’s operational behaviour. These characteristics are particularly relevant when investigating espionage, intellectual property theft, data extortion, and other information-driven cyber operations.

Achieving Attack Objectives

The final activities of a cyber operation are determined by the threat actor’s intended outcome. These objectives may involve financial gain, intelligence collection, disruption, destruction, unauthorised access to information, political influence, or the establishment of long-term strategic access.

A financially motivated adversary may deploy ransomware, steal sensitive information for extortion, conduct fraudulent transactions, or sell compromised credentials. An espionage-oriented actor may focus on collecting confidential information and maintaining access without causing noticeable disruption. A hacktivist group may attempt to deface websites, disrupt services, or publish stolen information to advance an ideological cause.

Some operations involve multiple objectives. For example, a ransomware operation may combine data theft, encryption, and public disclosure threats to increase pressure on the victim.

Understanding the intended outcome is essential when interpreting an adversary’s MO. The objective provides context for evaluating why particular targets were selected, why certain methods were employed, and what the adversary was attempting to accomplish.

Modus Operandi Analysis

Understanding Modus Operandi Analysis

Modus Operandi Analysis is the systematic examination of an adversary’s methods, behavioural characteristics, and recurring operational patterns to understand how it conducts malicious activities. It involves interpreting evidence from cyber incidents and intelligence sources to identify similarities, differences, and relationships between observed activities.

The analysis considers more than individual indicators or isolated technical events. It examines the broader context surrounding an operation, including the threat actor’s motivations, target preferences, technical capabilities, infrastructure, methods, and operational objectives. This helps analysts develop a behavioural understanding of the adversary rather than relying solely on individual malware samples, IP addresses, domains, or vulnerabilities.

MO analysis draws on information from multiple sources, including incident response investigations, digital forensics, malware analysis, security telemetry, threat intelligence reports, open-source intelligence, and information-sharing communities. Correlating these sources can help establish whether separate activities share meaningful behavioural characteristics.

The findings may support threat actor profiling, intelligence assessments, threat hunting, detection engineering, security testing, and incident investigations. However, behavioural similarities should be evaluated carefully because different threat actors may adopt similar methods, share tools, or operate within the same digital infrastructure.

Threat Actor Profiling

Threat actor profiling involves developing an analytical understanding of an adversary based on its observed behaviour, motivations, capabilities, targets, and operational characteristics. It helps security analysts organise available information into a meaningful representation of the threat actor.

A profile may include the actor’s suspected motivation, preferred targets, geographic interests, technical capabilities, commonly observed tools, infrastructure patterns, and operational methods. It may also include historical activity, known campaigns, relationships with other threat groups, and confidence assessments associated with attribution.

Threat actor profiles are developed using multiple sources of intelligence rather than a single incident or indicator. Analysts may correlate incident reports, malware characteristics, infrastructure relationships, public disclosures, and observed tactics and techniques to identify recurring characteristics.

Profiling does not always establish the real-world identity of an adversary. Threat actors may operate under different aliases, share infrastructure, imitate other groups, or deliberately manipulate evidence. Consequently, profiles should distinguish between confirmed facts, analytical assessments, and assumptions.

Identifying Behavioural Patterns

Behavioural pattern identification involves examining recurring characteristics across incidents to understand whether an adversary follows recognisable operational practices. These patterns may be reflected in target selection, timing, access methods, infrastructure usage, tool selection, communication behaviour, and operational sequencing.

For example, an adversary may repeatedly target organisations within a particular industry, use similar phishing approaches, and rely on comparable infrastructure to deliver malicious payloads. Another actor may demonstrate recurring preferences for exploiting exposed remote access services and using legitimate administrative tools after gaining access.

Analysts examine these characteristics across multiple incidents to identify similarities and determine whether they represent meaningful behavioural patterns. The analysis should account for environmental differences, changes in adversary capabilities, and the possibility that unrelated actors may use similar methods.

Identified patterns can help security teams develop hypotheses about potential adversary activity, improve threat detection, and prioritise monitoring based on relevant behavioural evidence.

Correlating Attack Activities

Attack activity correlation involves examining relationships between events, indicators, techniques, infrastructure, and operational behaviour to determine whether they are connected. It helps analysts move from isolated observations towards a more complete understanding of an adversary’s activities.

Correlation may involve examining common infrastructure, malware characteristics, command-and-control communication patterns, compromised accounts, attack timing, targeted industries, and similarities in operational methods. Analysts may also compare forensic evidence and intelligence reports from different incidents to identify relationships.

For example, two incidents may involve different malware samples but share similar command-and-control infrastructure, credential theft methods, and target selection patterns. These similarities may justify further investigation into a possible operational relationship.

Correlation does not automatically establish attribution. Shared tools, infrastructure, and techniques may be used by multiple actors. Analysts must evaluate the reliability, uniqueness, and context of each observation before drawing conclusions.

Identifying Recurring Attack Patterns

Recurring attack patterns are repeated approaches or sequences observed across different cyber incidents. They may represent common methods used by a particular threat actor, a broader threat category, or adversaries targeting similar environments.

Analysts can identify these patterns by comparing incident timelines, initial access methods, exploitation activities, privilege escalation, lateral movement, data collection, and other operational characteristics. The comparison may reveal similarities in the order of activities, the tools employed, or the methods used to overcome defensive controls.

Attack patterns can also be examined across different sectors and environments. For example, ransomware operations may demonstrate recurring characteristics across healthcare, manufacturing, government, and financial services, even though the targeted systems and business impacts differ.

Understanding recurring patterns helps security professionals identify likely attack paths, improve defensive controls, and develop detection strategies that address common adversary behaviours.

Analysing Changes in Threat Actor Behaviour

A threat actor’s MO is not necessarily static. Operational methods may evolve in response to changes in technology, security controls, intelligence exposure, law enforcement activity, and the availability of new tools or capabilities.

An adversary may shift from custom malware to legitimate system utilities, adopt new initial access methods, change infrastructure providers, or modify its target selection. It may also alter its operational tempo, communication practices, and methods of maintaining persistence to reduce detection.

Analysing these changes helps identify shifts in adversary capabilities, priorities, and operational strategies. It also helps determine whether previously established threat profiles and detection assumptions remain relevant.

A change in behaviour does not automatically indicate the emergence of a new threat actor. Analysts should examine the broader operational context and supporting evidence before revising an existing assessment or establishing a new attribution hypothesis.

Modus Operandi vs. Tactics, Techniques, and Procedures (TTPs)

Understanding the Differences

Modus Operandi and Tactics, Techniques, and Procedures (TTPs) are related concepts used to understand adversary behaviour. Both help security professionals examine how threat actors conduct malicious activities, but they differ in their scope and analytical emphasis.

Modus Operandi provides a broader behavioural perspective that considers an adversary’s characteristic way of operating. It may include motivation, target preferences, operational habits, methods, and recurring patterns across multiple activities.

TTPs provide a more structured description of the specific actions and methods used by an adversary. Tactics describe the adversary’s tactical objectives, techniques explain how those objectives are achieved, and procedures describe the specific implementation or sequence of activities observed in an operation.

The distinction is important because TTPs can describe individual components of an attack, while MO helps place those components within the broader context of an adversary’s operational behaviour.

Aspect	Modus Operandi (MO)	Tactics, Techniques, and Procedures (TTPs)
Meaning	Describes the characteristic way an adversary operates.	Describes the tactical objectives and specific methods used by an adversary.
Scope	Broader behavioural and operational perspective.	More structured and detailed description of adversary actions.
Focus	Operational habits, preferences, patterns, and objectives.	Tactics, techniques, and procedures used during operations.
Context	Considers the broader characteristics of an adversary.	Examines how particular attack activities are performed.
Application	Threat actor profiling, behavioural analysis, and intelligence assessment.	Threat detection, threat hunting, intelligence mapping, and security testing.
Change	May evolve as the adversary changes its operational behaviour.	Individual TTPs may change, be replaced, or be adopted by other actors.

Relationship Between MO and TTPs

MO and TTPs complement each other when analysing adversary behaviour. MO provides the broader context, while TTPs offer a more detailed understanding of the methods used to perform specific activities.

For example, a financially motivated threat actor may repeatedly target organisations through phishing, compromise user credentials, move laterally across networks, and deploy ransomware. This broader pattern may form part of its MO. The specific phishing techniques, credential access methods, lateral movement techniques, and ransomware deployment procedures can be examined through TTPs.

By combining both perspectives, analysts can understand not only which techniques were observed but also how those techniques fit into the adversary’s overall operational approach.

This relationship is particularly valuable in threat intelligence and security operations. TTPs can support the development of detection rules and security controls, while MO analysis helps provide context for prioritising threats and understanding likely adversary behaviour.

Role of MITRE ATT&CK in Analysing Adversary Behaviour

MITRE ATT&CK is a globally recognised knowledge base that documents adversary tactics and techniques based on observed cyberattack behaviour. It provides a structured framework for understanding how adversaries operate across different platforms and environments.

ATT&CK organises adversary activities into tactics representing the objectives an adversary seeks to achieve. Techniques and sub-techniques describe the methods through which those objectives may be accomplished. The framework also provides information on groups, software, campaigns, and mitigations.

In MO analysis, ATT&CK can be used to map observed adversary activities to recognised tactics and techniques. This helps analysts compare attack behaviour across incidents, identify similarities, and understand the technical methods associated with a particular operation.

However, MITRE ATT&CK is not a formal Modus Operandi classification system. It provides a structured representation of adversary behaviour that can contribute to MO analysis, threat actor profiling, threat hunting, and detection engineering.

Modus Operandi Across Different Threat Environments

Individual and Personal Digital Environments

Individuals are exposed to cyber threats through personal devices, online accounts, digital communications, financial services, social media, and connected applications. Threat actors may exploit human behaviour, weak authentication practices, exposed personal information, and insecure devices to conduct malicious activities.

Common operational approaches include phishing, identity theft, account takeover, impersonation, online fraud, malicious applications, and exploitation of personal information. Adversaries may use information gathered from public sources and social media to make their activities more convincing.

The MO of an attacker targeting individuals may differ significantly from that of an actor targeting a large enterprise. However, the underlying behavioural patterns, such as target research, social engineering, credential theft, and financial exploitation, may be similar.

Social and Community Environments

Social and community environments include online communities, digital communication platforms, social networks, forums, and interconnected groups of individuals. Threat actors may exploit trust relationships, shared interests, community identities, and communication channels to influence or manipulate users.

Operational approaches may include coordinated misinformation, impersonation, account compromise, harassment, social engineering, malicious content distribution, and manipulation of online discussions. Some campaigns may involve automated accounts or coordinated groups operating across multiple platforms.

Understanding MO in these environments requires examining not only technical compromise but also behavioural manipulation, communication patterns, and the relationships between individuals and communities.

Government and Public Sector

Government and public-sector environments contain sensitive information, citizen records, public services, administrative systems, and national-level information assets. Threat actors may target these environments for espionage, political influence, financial gain, disruption, or strategic advantage.

Nation-state actors may focus on intelligence collection and long-term access to government systems, while financially motivated groups may target public services and government-related organisations for extortion or fraud. Hacktivist groups may conduct website defacement, service disruption, or information disclosure to advance political or ideological objectives.

MO analysis helps government agencies understand adversary interests, identify recurring operational patterns, and assess the potential impact of threats against public institutions and national digital services.

Business and Enterprise Environments

Business and enterprise environments consist of interconnected applications, users, networks, cloud services, business processes, information systems, and third-party relationships. Their operational complexity and dependence on digital services create opportunities for different categories of threat actors.

Threat actors may target enterprises for financial gain, intellectual property theft, espionage, data extortion, business disruption, or competitive advantage. Common approaches include business email compromise, ransomware, supply chain compromise, credential theft, exploitation of exposed services, and insider activities.

The MO of an adversary targeting an enterprise may reflect an understanding of business operations, organisational structure, technology dependencies, and information value. Analysing these characteristics helps security teams understand relevant threats and align defensive measures with the organisation’s exposure and risk profile.

Industrial and Manufacturing Environments

Industrial and manufacturing environments include production systems, industrial control platforms, engineering workstations, manufacturing execution systems, supply chains, and operational technologies. Disruption in these environments can affect production, product quality, safety, and business continuity.

Threat actors may target industrial environments to steal intellectual property, disrupt production, conduct espionage, or cause operational damage. Their activities may involve compromising corporate IT systems, exploiting remote access pathways, targeting engineering workstations, or attempting to reach industrial control environments.

Some adversaries may prioritise data theft and espionage, while others may seek to interrupt manufacturing processes or affect operational availability. Understanding their MO requires considering the relationship between IT systems, operational technology, physical processes, and safety requirements.

Critical Infrastructure and Operational Technology

Critical infrastructure includes essential services and systems such as energy, electricity, water, transportation, telecommunications, healthcare, and other nationally important services. Operational technology (OT) environments are often responsible for monitoring and controlling physical processes within these sectors.

Threat actors may target critical infrastructure for espionage, disruption, sabotage, financial gain, or geopolitical objectives. Their operational approaches may include compromising remote access systems, exploiting vulnerabilities in industrial platforms, manipulating control systems, and disrupting essential services.

The consequences of such activities can extend beyond information security to public safety, economic stability, national security, and societal wellbeing. MO analysis in these environments must therefore consider the adversary’s objectives alongside the potential physical and operational consequences of an attack.

Financial Systems and Economic Ecosystems

Financial systems and economic ecosystems include banks, payment networks, insurance providers, financial markets, fintech platforms, digital payment services, and supporting technology providers. These environments attract financially motivated cybercriminals as well as sophisticated actors seeking economic intelligence or strategic advantage.

Threat actors may conduct payment fraud, account takeover, credential theft, ransomware, extortion, business email compromise, market manipulation, and attacks against financial infrastructure. Some operations may target individuals and businesses, while others may focus on financial institutions and interconnected service providers.

Analysing the MO of these actors helps identify recurring fraud patterns, understand attack methods, and examine how adversaries exploit financial processes, digital transactions, and trust relationships.

Digital Platforms and Connected Ecosystems

Digital platforms and connected ecosystems include cloud services, software platforms, Internet of Things (IoT) devices, application ecosystems, digital marketplaces, and interconnected online services. Their interconnected nature creates opportunities for adversaries to exploit dependencies and relationships between platforms.

Threat actors may target platform providers, compromise developer accounts, exploit software vulnerabilities, abuse APIs, manipulate digital identities, or compromise third-party services. Supply chain attacks are particularly relevant because a single compromised provider or software component may affect numerous downstream users and organisations.

MO analysis in these environments involves examining how adversaries exploit platform relationships, interconnected services, shared infrastructure, and technology dependencies to achieve their objectives.

Modus Operandi Classification

Modus Operandi can be examined across different categories of cyber operations based on the adversary’s motivation, objectives, operational methods, and target preferences. These categories are analytical groupings rather than a formally standardised or mutually exclusive classification system. A threat actor may demonstrate characteristics associated with more than one category, and its operational methods may evolve over time.

Ransomware Operations

Ransomware operations involve the use of malicious software or other techniques to deny access to systems or information, typically through encryption, and demand payment from affected victims. Some threat actors also steal information and use threats of disclosure to increase pressure on victims.

The MO of ransomware groups may include identifying vulnerable targets, obtaining initial access, escalating privileges, disabling security controls, moving across networks, collecting sensitive information, and deploying ransomware. The specific sequence and techniques vary between groups and campaigns.

Ransomware operations may affect individuals, businesses, healthcare providers, government agencies, educational institutions, manufacturing environments, and critical infrastructure. Their impact can extend beyond data availability to operational disruption, financial loss, reputational damage, and public safety.

Advanced Persistent Threat (APT) Operations

Advanced Persistent Threat (APT) operations are generally associated with sophisticated adversaries that conduct targeted and sustained cyber activities over extended periods. These operations are frequently linked to nation-state interests, although the term is also used more broadly to describe highly capable and persistent threat activity.

APT operations may involve extensive reconnaissance, carefully selected targets, customised malware, credential compromise, stealthy persistence, and long-term intelligence collection. Some actors may use multiple access methods and infrastructure to maintain operational continuity.

Their MO often reflects strategic objectives, patience, operational discipline, and an emphasis on avoiding detection. However, the methods and capabilities of APT groups vary, and the term should not be interpreted as implying that every operation uses highly sophisticated technology.

Financially Motivated Cybercrime

Financially motivated cybercrime involves malicious activities conducted primarily to obtain monetary benefits. Threat actors may operate independently, as organised criminal groups, or through specialised criminal service models.

Their activities may include credential theft, payment fraud, identity theft, ransomware, extortion, card fraud, business email compromise, and the sale of stolen information. Some groups specialise in particular stages of criminal operations, while others conduct the entire operation.

The MO of financially motivated actors is often influenced by the potential financial return, operational cost, target accessibility, and likelihood of success. Their methods may be adapted to exploit new payment technologies, online services, and digital business processes.

Business Email Compromise (BEC)

Business Email Compromise (BEC) is a form of cyber-enabled financial fraud in which an adversary manipulates email communications or impersonates trusted individuals to induce victims into performing unauthorised financial or information-related actions.

Common approaches include impersonating executives, suppliers, employees, or business partners. Threat actors may compromise legitimate email accounts, create deceptive domains, monitor business communications, and exploit existing relationships to make fraudulent requests appear authentic.

BEC operations often involve extensive target research and an understanding of organisational roles, payment processes, approval mechanisms, and communication practices. Their MO is primarily based on deception and the exploitation of trust rather than the deployment of sophisticated malware.

Hacktivist Operations

Hacktivist operations involve cyber activities conducted to promote political, social, ideological, or other causes. The objectives may include raising awareness, expressing opposition, influencing public opinion, or disrupting organisations and institutions.

Common activities include website defacement, distributed denial-of-service attacks, unauthorised information disclosure, account compromise, and online campaigns. Some hacktivist groups may also use social engineering or collaborate with other threat actors.

Their MO is often influenced by ideological objectives, target symbolism, public visibility, and the intended communication impact. Operational methods may range from relatively simple online disruption to coordinated campaigns involving multiple technical capabilities.

Insider Threat Activities

Insider threats involve malicious or unauthorised activities conducted by individuals who have legitimate access to an organisation’s systems, information, or facilities. These individuals may include employees, contractors, service providers, and other trusted parties.

An insider may intentionally steal information, misuse privileged access, manipulate records, disrupt systems, or disclose confidential information. In other cases, individuals may unintentionally contribute to security incidents through negligence, poor security practices, or susceptibility to social engineering.

The MO of insider threats may involve abusing legitimate privileges, accessing information outside assigned responsibilities, bypassing internal controls, or exploiting knowledge of organisational processes. Analysing these activities requires considering user behaviour, access patterns, role responsibilities, and the context of legitimate business operations.

Nation-State Cyber Operations

Nation-state cyber operations are activities conducted, sponsored, directed, or supported by governments to advance national interests. Their objectives may include espionage, intelligence collection, strategic positioning, political influence, disruption, and preparation for potential conflict.

These operations may target government institutions, defence establishments, critical infrastructure, research organisations, private enterprises, and strategically important technology providers.

The MO of nation-state actors may involve long-term reconnaissance, targeted intrusion, covert infrastructure, exploitation of trusted relationships, and persistent access. Some operations may be designed to remain undetected for extended periods, while others may seek visible disruption or strategic signalling.

Attribution in this category requires careful analysis because threat actors may use proxies, shared infrastructure, false flags, and other methods to conceal their origins or create misleading associations.

Modus Operandi in Threat Intelligence

Threat Actor Identification and Attribution

Threat actor identification involves determining which adversary or threat group may be responsible for observed malicious activities. Attribution is the analytical process of associating an incident or campaign with a specific actor, group, or origin based on available evidence.

MO contributes to this process by providing behavioural context. Analysts may compare target preferences, operational methods, infrastructure patterns, technical capabilities, and recurring activities with previously documented threat actor profiles.

However, behavioural similarity alone is insufficient to establish attribution. Different actors may share tools, techniques, infrastructure, and access methods. Attribution should therefore be based on multiple sources of evidence, assessed according to their reliability and confidence.

Threat Intelligence Collection and Analysis

Threat intelligence collection involves gathering information about threats, adversaries, vulnerabilities, indicators, campaigns, and malicious activities. Sources may include open-source intelligence, commercial intelligence providers, government advisories, industry information-sharing communities, internal security telemetry, and incident investigations.

MO analysis adds behavioural context to the collected information. Instead of examining indicators in isolation, analysts can assess how an adversary uses them within an operational campaign and whether similar methods have been observed elsewhere.

For example, an IP address associated with suspicious activity may provide an individual indicator, while its relationship with recurring malware delivery methods, target selection, and command-and-control behaviour may provide a broader operational picture.

This combination supports the development of contextual and actionable threat intelligence.

Threat Hunting and Detection Engineering

Threat hunting involves proactively searching for malicious or suspicious activities that may not have been identified by existing security controls. It relies on hypotheses, intelligence, behavioural analysis, and examination of telemetry from systems and networks.

MO can support threat hunting by providing insight into how relevant adversaries operate. Security analysts can develop hunting hypotheses based on known target behaviours, access methods, persistence mechanisms, lateral movement patterns, and other operational characteristics.

Detection engineering translates threat knowledge and security requirements into detection logic, rules, analytics, and monitoring capabilities. Analysts may use observed TTPs and behavioural patterns to develop detection content for security platforms such as SIEM, EDR, NDR, and other monitoring technologies.

This approach helps improve detection coverage by considering adversary behaviour rather than depending exclusively on known malicious files, domains, or IP addresses.

Cyber Threat Intelligence Sharing

Cyber Threat Intelligence sharing involves exchanging information about threats, adversaries, vulnerabilities, indicators, and malicious activities between organisations, sectors, communities, and government agencies.

Sharing information about an adversary’s MO can provide valuable context beyond the exchange of individual indicators. It may help other recipients understand the actor’s target preferences, operational methods, attack patterns, and potential objectives.

Structured information-sharing standards such as STIX and TAXII support the representation and exchange of cyber threat intelligence. These standards can help organisations communicate relevant threat information in a consistent and machine-readable manner.

Effective intelligence sharing requires attention to information quality, source reliability, confidence, context, handling restrictions, and the relevance of the information to recipients.

Security Assessment and Testing

Security assessment and testing evaluate the effectiveness of security controls, processes, and technologies against identified threats and risks. Understanding an adversary’s MO can help make these activities more representative of relevant threat behaviour.

Threat-informed assessments may use known adversary techniques, attack patterns, and operational methods to develop realistic test scenarios. These scenarios can be used in penetration testing, red team exercises, adversary emulation, and other security validation activities.

For example, an assessment may simulate the access methods, privilege escalation techniques, lateral movement, and data collection approaches associated with a relevant threat actor. The objective is to evaluate whether existing controls can prevent, detect, and respond to such activities.

The use of MO in security testing helps connect threat intelligence with practical security validation. It also supports the identification of control weaknesses and opportunities to improve defensive capabilities.

Incident Response and Investigation

Incident response involves the activities performed to prepare for, detect, analyse, contain, eradicate, and recover from cybersecurity incidents. Investigation focuses on understanding the nature, scope, cause, and impact of an incident.

MO analysis helps investigators interpret the activities observed during an incident and compare them with known adversary behaviours. This may provide insight into the attack approach, potential objectives, related incidents, and possible follow-on activities.

Investigators may examine forensic artefacts, system logs, network traffic, malware characteristics, user activity, and infrastructure relationships to reconstruct the sequence of events. Comparing these findings with known threat actor profiles can help develop investigative hypotheses.

Although MO can support investigation and attribution, conclusions should be based on corroborated evidence. The objective is to establish a reliable understanding of the incident and support appropriate containment, remediation, and recovery decisions.

Modus Operandi – Tools, Frameworks and References

Several frameworks, models, and standards support the analysis and documentation of adversary behaviour. They do not all define Modus Operandi directly. Instead, they provide complementary methods for describing attack patterns, analysing intrusions, representing threat intelligence, and understanding the operational characteristics of adversaries.

MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on observations from real-world cyber operations. It provides a structured way to describe adversary behaviour across enterprise, mobile, and industrial control system environments.

The framework organises adversary activities into tactics, techniques, and sub-techniques. It also provides information about threat groups, software, campaigns, mitigations, and detection opportunities.

In MO analysis, ATT&CK helps map observed activities to recognised adversary techniques and compare behavioural patterns across incidents. It is particularly useful for threat intelligence analysis, threat hunting, detection engineering, and adversary emulation.

MITRE CAPEC

Common Attack Pattern Enumeration and Classification (CAPEC) is a publicly available catalogue of common attack patterns. It describes how adversaries exploit weaknesses in systems, applications, and technologies to achieve malicious outcomes.

CAPEC provides structured information about attack patterns, including their descriptions, prerequisites, execution flows, and potential mitigations. It helps security professionals understand how attacks may be conducted and how weaknesses can be exploited.

In MO analysis, CAPEC can provide additional context about recurring attack approaches and the relationship between system weaknesses and adversary activities. It complements ATT&CK by offering a focus on attack patterns rather than primarily organising observed adversary behaviour around tactical objectives.

Lockheed Martin Cyber Kill Chain

The Cyber Kill Chain is a model developed by Lockheed Martin to describe stages commonly associated with a cyber intrusion. It provides a structured way to understand the progression of an attack and identify opportunities for defensive intervention.

The model consists of seven stages:

Reconnaissance: The adversary gathers information about a potential target.
Weaponization: The adversary prepares a malicious payload or exploit capability.
Delivery: The malicious payload or attack mechanism is introduced into the target environment.
Exploitation: A vulnerability or weakness is exploited to execute malicious activity.
Installation: Malicious components are installed to establish a foothold.
Command and Control: The compromised environment communicates with infrastructure controlled by the adversary.
Actions on Objectives: The adversary performs activities intended to achieve the operation’s objectives.

The Cyber Kill Chain helps analysts examine attack progression and identify defensive opportunities at different stages. It can contribute to MO analysis by providing a structured view of how an adversary conducts an intrusion.

Diamond Model of Intrusion Analysis

The Diamond Model of Intrusion Analysis is a framework for examining relationships between the key elements of an intrusion event. It focuses on four core components: adversary, capability, infrastructure, and victim.

The adversary represents the threat actor responsible for the activity. Capability refers to the tools, techniques, and resources used. Infrastructure includes the systems and services used to conduct the operation. Victim represents the targeted individual, organisation, or environment.

The model helps analysts examine how these elements relate to one another and how multiple events may be connected. It can support intrusion analysis, threat intelligence development, and the identification of relationships between adversaries, their resources, and targeted environments.

In MO analysis, the Diamond Model provides a useful structure for correlating behavioural and technical evidence across incidents.

STIX and TAXII

Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII) are standards developed to support the representation and exchange of cyber threat intelligence.

STIX provides a structured language for describing threat intelligence, including threat actors, campaigns, indicators, malware, attack patterns, vulnerabilities, and relationships between intelligence objects. TAXII provides a protocol for exchanging cyber threat intelligence between systems and organisations.

Together, STIX and TAXII support consistent and structured intelligence sharing. They can help represent information associated with threat actor activities and operational patterns, enabling organisations to exchange intelligence in a machine-readable format.

These standards support the communication and operational use of threat intelligence but do not independently perform MO analysis or establish threat actor attribution.

Conclusion

Modus Operandi provides a behavioural perspective for understanding how threat actors operate and pursue their objectives. It brings together recurring methods, operational preferences, target characteristics, and behavioural patterns to develop a broader understanding of adversary activities.

Its value lies in connecting individual observations and technical evidence to the wider context of a threat actor’s operations. When combined with threat intelligence, TTP analysis, intrusion investigation, and security testing, MO can help improve threat understanding and support more informed defensive decisions.

As cyber threats affect individuals, communities, governments, enterprises, industries, financial systems, and critical infrastructure, understanding adversary behaviour remains an important part of cybersecurity. A structured approach to analysing Modus Operandi helps strengthen the ability to identify threats, interpret malicious activity, and develop appropriate security responses.

References

Online Sources

MITRE – MITRE ATT&CK – Adversarial Tactics, Techniques, and Common Knowledge
Provides a knowledge base of adversary tactics and techniques based on observed cyberattack behaviour, supporting the analysis of threat actor activities and operational patterns.

MITRE – Common Attack Pattern Enumeration and Classification (CAPEC)
Provides a catalogue of common attack patterns describing how adversaries exploit weaknesses in systems, applications, and technologies.

Lockheed Martin – Cyber Kill Chain
Describes the stages of a cyberattack, providing a framework for understanding and analysing adversary activities throughout an intrusion.

OASIS Open – Cyber Threat Intelligence (CTI) Documentation – STIX and TAXII
Provides documentation on STIX and TAXII standards for representing, structuring, and exchanging cyber threat intelligence.

National Institute of Standards and Technology (NIST) – SP 800-150: Guide to Cyber Threat Information Sharing
Provides guidance on establishing and operating cyber threat information-sharing relationships, including the development, use, and exchange of threat information.

National Institute of Standards and Technology (NIST) – SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
Provides recommendations for incorporating incident response activities into cybersecurity risk management, supporting preparation, detection, response, and recovery processes.