Adversary Tracking And All The Lies We Tell Ourselves by Joe Slowik

## Overview

In the presentation *"Adversary Tracking And All The Lies We Tell Ourselves,"* Joe Slowik—head of threat detection/intelligence development, detection engineering, and threat hunting at Huntress, as well as founder of Perales—examines how the cybersecurity industry defines and conceptualizes threat actors. Slowik argues that traditional mental models and industry tropes surrounding adversaries are often overly simplistic and fail to reflect the operational realities of modern offensive campaigns.

## Defining the "Adversary"

Slowik contrasts common cultural tropes—such as the stereotypical hoodie-wearing hacker, official state-sponsored wanted posters, or flamboyant e-crime figures posing with Lamborghinis—with standard industry definitions. Referencing the National Institute of Standards and Technology (NIST), an adversary is formally defined as:

* A person, group, organization, or government that conducts or has the intent to conduct detrimental activities against an entity.

While many in the security community use the word "attack," Slowik highlights that NIST's phrasing of "detrimental activities" is intentional, noting that "attack" can be unnecessarily narrow or strong for certain cyber activities.

## The Myth of the Monolithic Threat Actor

A primary flaw in contemporary threat intelligence is the assumption that adversaries (such as Lazarus Group, Conti, Equation Group, or APT28) operate as unified, monolithic single entities handling every phase of an operation.

Slowik explains that modern offensive operations—whether state-sponsored, criminal, or even red team/penetration testing—are fundamentally complex and specialized:

* **Specialization and Division of Labor:** Single individuals or groups rarely manage every stage of the cyber kill chain or fill out every category in the MITRE ATT&CK matrix alone. Doing everything in-house is inefficient and impractical. * **Cooperation and Ecosystems:** Operators rely on teams with specialized skill sets. Different entities specialize in developing malware, managing infrastructure, or executing initial access, and then interoperate, collaborate, or broker/sell access to other actors. * **Separation of Roles:** In state-centric and organized cyber environments, operations are structured with distinct layers: an overriding authority or customer providing strategic direction and mission objectives, distinct groups responsible for developing technical capabilities and writing malware, and dedicated operators executing the intrusion.

## Key Takeaways for Security Disciplines

Treating sophisticated adversaries as single, monolithic actors creates blind spots for defenders. Understanding the distributed nature of modern cyber operations—disentangling capability developers, access brokers, and operators—is essential not only for threat intelligence analysts, but also for detection development, red teaming, and adversary emulation exercises.