Security Skills Atlas
threat intelligence

Performing Threat Landscape Assessment for Sector

Conduct a sector-specific threat landscape assessment by analyzing threat actor targeting patterns, common attack vectors, and industry-specific vulnerabilities to inform organizational risk management.

ctiindustry-targetingrisk-assessmentsector-analysisstrategic-intelligencethreat-intelligencethreat-landscape
Install this skill
npx skills add mukul975/Anthropic-Cybersecurity-Skills
Framework mappings

MITRE ATT&CK

T1566 on the official MITRE ATT&CK siteT1589 on the official MITRE ATT&CK siteT1591 on the official MITRE ATT&CK siteT1592 on the official MITRE ATT&CK siteT1593 on the official MITRE ATT&CK site

NIST CSF 2.0

DE.AE-02 on the official NIST CSF 2.0 siteDE.CM-01 on the official NIST CSF 2.0 siteID.RA-01 on the official NIST CSF 2.0 siteID.RA-05 on the official NIST CSF 2.0 site

MITRE D3FEND

Application Protocol Command Analysis on the official MITRE D3FEND siteContent Format Conversion on the official MITRE D3FEND siteFile Metadata Consistency Validation on the official MITRE D3FEND siteIdentifier Analysis on the official MITRE D3FEND siteMessage Analysis on the official MITRE D3FEND site

Overview

A sector-specific threat landscape assessment analyzes the cyber threat environment facing a particular industry vertical (healthcare, financial services, energy, government, manufacturing) by examining which threat actors target the sector, their preferred attack vectors and TTPs, common vulnerabilities exploited, historical incident data, and emerging threats. This produces actionable intelligence for risk management, security investment prioritization, and board-level reporting.

When to Use

  • When conducting security assessments that involve performing threat landscape assessment for sector
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Python 3.9+ with attackcti, requests, pandas, matplotlib libraries
  • Access to threat intelligence feeds (AlienVault OTX, MISP, vendor reports)
  • MITRE ATT&CK knowledge base for TTP mapping
  • Industry-specific ISAC membership (FS-ISAC, H-ISAC, E-ISAC, etc.)
  • Understanding of sector-specific regulatory requirements

Key Concepts

Sector Targeting Analysis

Different sectors face different threat profiles. Financial services face sophisticated nation-state actors (Lazarus Group) and cybercriminal groups focused on financial fraud. Healthcare faces ransomware groups exploiting urgency and legacy systems. Energy and critical infrastructure face nation-state groups (TEMP.Veles, Sandworm) with destructive capabilities. Government faces espionage-focused APTs (APT29, APT28, Turla).

Threat Landscape Components

A comprehensive assessment includes: threat actor profiling (groups targeting the sector), attack vector analysis (initial access methods observed), TTP mapping (techniques commonly used against sector), vulnerability landscape (CVEs commonly exploited), incident trend analysis (breach frequency, impact, recovery time), and emerging threats (new groups, evolving techniques, supply chain risks).

Intelligence Sources

Sector-specific intelligence comes from ISACs (Information Sharing and Analysis Centers), government advisories (CISA, FBI, NSA), vendor threat reports (CrowdStrike Annual Threat Report, Mandiant M-Trends, Verizon DBIR), and academic research on sector-specific attacks.

Workflow

Step 1: Identify Threat Actors Targeting the Sector

from attackcti import attack_client
import json
 
class SectorThreatAssessment:
    SECTOR_GROUPS = {
        "financial": ["FIN7", "FIN8", "FIN11", "Carbanak", "Lazarus Group",
                       "Cobalt Group", "TA505", "GOLD SOUTHFIELD"],
        "healthcare": ["FIN12", "Ryuk", "Conti", "Wizard Spider",
                        "GOLD ULRICK", "Vice Society"],
        "energy": ["TEMP.Veles", "Sandworm Team", "Dragonfly",
                    "XENOTIME", "ERYTHRITE", "Berserk Bear"],
        "government": ["APT29", "APT28", "Turla", "Gamaredon Group",
                        "Mustang Panda", "APT41", "Lazarus Group"],
        "manufacturing": ["APT41", "TEMP.Veles", "Dragonfly",
                           "HEXANE", "MAGNALLIUM"],
        "technology": ["APT41", "Lazarus Group", "APT10",
                        "HAFNIUM", "Winnti Group"],
    }
 
    def __init__(self, sector):
        self.sector = sector.lower()
        self.lift = attack_client()
        self.groups = self.lift.get_groups()
        self.assessment = {
            "sector": sector,
            "threat_actors": [],
            "common_techniques": {},
            "attack_vectors": {},
            "risk_summary": {},
        }
 
    def analyze_sector_actors(self):
        """Analyze threat actors known to target this sector."""
        target_groups = self.SECTOR_GROUPS.get(self.sector, [])
        actor_profiles = []
 
        for group_name in target_groups:
            group = next(
                (g for g in self.groups
                 if g.get("name", "").lower() == group_name.lower()
                 or group_name.lower() in [a.lower() for a in g.get("aliases", [])]),
                None
            )
            if group:
                group_id = ""
                for ref in group.get("external_references", []):
                    if ref.get("source_name") == "mitre-attack":
                        group_id = ref.get("external_id", "")
                        break
 
                techniques = []
                if group_id:
                    techs = self.lift.get_techniques_used_by_group(group_id)
                    for t in techs:
                        for ref in t.get("external_references", []):
                            if ref.get("source_name") == "mitre-attack":
                                techniques.append({
                                    "id": ref.get("external_id", ""),
                                    "name": t.get("name", ""),
                                })
                                break
 
                profile = {
                    "name": group.get("name", ""),
                    "aliases": group.get("aliases", []),
                    "description": group.get("description", "")[:300],
                    "attack_id": group_id,
                    "technique_count": len(techniques),
                    "techniques": techniques[:20],
                }
                actor_profiles.append(profile)
                print(f"  [+] {group.get('name')}: {len(techniques)} techniques")
 
        self.assessment["threat_actors"] = actor_profiles
        print(f"[+] Profiled {len(actor_profiles)} threat actors for {self.sector}")
        return actor_profiles
 
    def identify_common_techniques(self):
        """Find the most commonly used techniques across sector actors."""
        from collections import Counter
        technique_counter = Counter()
 
        for actor in self.assessment["threat_actors"]:
            for tech in actor.get("techniques", []):
                technique_counter[f"{tech['id']}:{tech['name']}"] += 1
 
        common = technique_counter.most_common(20)
        self.assessment["common_techniques"] = [
            {
                "technique": tech.split(":")[0],
                "name": tech.split(":")[1] if ":" in tech else "",
                "actor_count": count,
                "actors_using": [
                    a["name"] for a in self.assessment["threat_actors"]
                    if any(t["id"] == tech.split(":")[0] for t in a.get("techniques", []))
                ],
            }
            for tech, count in common
        ]
 
        print(f"\n=== Top Techniques for {self.sector.upper()} ===")
        for entry in self.assessment["common_techniques"][:10]:
            print(f"  {entry['technique']} {entry['name']}: "
                  f"used by {entry['actor_count']} groups")
 
        return self.assessment["common_techniques"]
 
assessment = SectorThreatAssessment("financial")
assessment.analyze_sector_actors()
assessment.identify_common_techniques()

Step 2: Analyze Attack Vectors and Initial Access

def analyze_attack_vectors(assessment):
    """Analyze initial access vectors common for the sector."""
    initial_access_techniques = [
        t for t in assessment.assessment["common_techniques"]
        if t["technique"].startswith("T1566") or t["technique"].startswith("T1190")
        or t["technique"].startswith("T1133") or t["technique"].startswith("T1078")
        or t["technique"].startswith("T1195")
    ]
 
    # Supplement with known sector-specific vectors
    sector_vectors = {
        "financial": {
            "primary": ["Spearphishing (T1566)", "Exploit Public-Facing App (T1190)",
                        "Valid Accounts (T1078)", "Supply Chain Compromise (T1195)"],
            "emerging": ["MFA Fatigue/Push Bombing", "QR Code Phishing (Quishing)",
                         "Business Email Compromise", "API Key Theft"],
        },
        "healthcare": {
            "primary": ["Spearphishing (T1566)", "Exploit Public-Facing App (T1190)",
                        "External Remote Services (T1133)", "Valid Accounts (T1078)"],
            "emerging": ["IoMT Device Exploitation", "Telehealth Platform Attacks",
                         "Medical Device Firmware Attacks", "Supply Chain via EHR Vendors"],
        },
        "energy": {
            "primary": ["Spearphishing (T1566)", "Exploit Public-Facing App (T1190)",
                        "External Remote Services (T1133)", "Supply Chain Compromise (T1195)"],
            "emerging": ["OT/ICS Protocol Exploitation", "Remote Access to SCADA",
                         "Engineering Workstation Compromise", "Vendor VPN Exploitation"],
        },
    }
 
    vectors = sector_vectors.get(assessment.sector, {})
    assessment.assessment["attack_vectors"] = vectors
    return vectors

Step 3: Generate Sector Threat Report

def generate_sector_report(assessment):
    data = assessment.assessment
    report = f"""# {data['sector'].title()} Sector Threat Landscape Assessment
Generated: {datetime.datetime.now().isoformat()}
 
## Executive Summary
This assessment analyzes the cyber threat landscape for the {data['sector']} sector,
identifying {len(data['threat_actors'])} active threat groups, their preferred techniques,
and recommended defensive priorities.
 
## Threat Actor Summary
| Actor | ATT&CK ID | Techniques | Key Focus |
|-------|-----------|------------|-----------|
"""
    for actor in data["threat_actors"]:
        report += (f"| {actor['name']} | {actor['attack_id']} "
                   f"| {actor['technique_count']} | {actor['description'][:60]}... |\n")
 
    report += f"""
## Most Common Techniques
| Rank | Technique | Name | Groups Using |
|------|-----------|------|-------------|
"""
    for i, tech in enumerate(data.get("common_techniques", [])[:15], 1):
        actors = ", ".join(tech["actors_using"][:3])
        report += f"| {i} | {tech['technique']} | {tech['name']} | {actors} |\n"
 
    vectors = data.get("attack_vectors", {})
    report += f"""
## Attack Vectors
### Primary Vectors
"""
    for v in vectors.get("primary", []):
        report += f"- {v}\n"
    report += "\n### Emerging Vectors\n"
    for v in vectors.get("emerging", []):
        report += f"- {v}\n"
 
    report += """
## Recommendations
1. Prioritize detections for the top 10 techniques used by sector-targeting groups
2. Conduct threat-informed red team exercises mimicking identified actors
3. Join sector ISAC for real-time threat sharing
4. Implement controls for identified initial access vectors
5. Review supply chain security posture for sector-specific risks
"""
    with open(f"threat_landscape_{data['sector']}.md", "w") as f:
        f.write(report)
    print(f"[+] Sector report saved: threat_landscape_{data['sector']}.md")
 
generate_sector_report(assessment)

Validation Criteria

  • Sector-specific threat actors identified and profiled
  • Common techniques across actors analyzed and ranked
  • Attack vectors mapped for the target sector
  • Emerging threats identified based on recent intelligence
  • Comprehensive sector threat report generated
  • Recommendations actionable for security investment decisions

References

Source materials

References and resources

Everything below is rendered for inspection. Script files are read-only and never run.

References 1

api-reference.md1.9 KB

API Reference: Threat Landscape Assessment for Sector

attackcti Library (MITRE ATT&CK Python Client)

Method Description
attack_client() Initialize ATT&CK STIX client
client.get_groups() Get all threat groups
client.get_techniques_used_by_group(group_id) Get techniques for a group
client.get_techniques() Get all techniques
client.get_mitigations() Get all mitigations
client.get_software() Get all tools/malware

Group Object Fields

Field Description
name Primary group name
aliases Alternative group names
description Group overview
external_references ATT&CK ID, URLs
created First catalogued date

Sector ISACs

ISAC Sector URL
FS-ISAC Financial Services https://www.fsisac.com/
H-ISAC Healthcare https://h-isac.org/
E-ISAC Energy https://www.eisac.com/
IT-ISAC Technology https://www.it-isac.org/
MS-ISAC State/Local Gov https://www.cisecurity.org/ms-isac

Sector Threat Reports

Report Publisher URL
Verizon DBIR Verizon https://www.verizon.com/business/resources/reports/dbir/
Global Threat Report CrowdStrike https://www.crowdstrike.com/global-threat-report/
M-Trends Mandiant https://www.mandiant.com/m-trends
X-Force Threat Index IBM https://www.ibm.com/reports/threat-intelligence

Python Libraries

Library Version Purpose
attackcti >=0.4 Query MITRE ATT&CK STIX data
collections stdlib Technique frequency counting
json stdlib Report generation

References

Scripts 1

agent.py6.2 KB
Display-only source. This catalog never executes bundled scripts.
#!/usr/bin/env python3
"""Agent for sector-specific threat landscape assessment.

Uses the attackcti library to query MITRE ATT&CK for threat groups
targeting a sector, analyzes common techniques, maps attack vectors,
and generates a strategic threat landscape report.
"""

import json
import sys
from datetime import datetime
from collections import Counter

try:
    from attackcti import attack_client
    HAS_ATTACKCTI = True
except ImportError:
    HAS_ATTACKCTI = False


SECTOR_GROUPS = {
    "financial": ["FIN7", "FIN8", "FIN11", "Carbanak", "Lazarus Group",
                  "Cobalt Group", "TA505"],
    "healthcare": ["FIN12", "Wizard Spider", "Vice Society", "Conti"],
    "energy": ["Sandworm Team", "Dragonfly", "TEMP.Veles", "XENOTIME"],
    "government": ["APT29", "APT28", "Turla", "Gamaredon Group",
                   "Mustang Panda", "APT41"],
    "manufacturing": ["APT41", "TEMP.Veles", "Dragonfly", "HEXANE"],
    "technology": ["APT41", "Lazarus Group", "APT10", "Winnti Group"],
    "retail": ["FIN7", "FIN8", "Carbanak", "Magecart"],
}

SECTOR_VECTORS = {
    "financial": {
        "primary": ["Spearphishing (T1566)", "Exploit Public-Facing App (T1190)",
                     "Valid Accounts (T1078)", "Supply Chain (T1195)"],
        "emerging": ["MFA Fatigue", "QR Phishing", "BEC", "API Key Theft"],
    },
    "healthcare": {
        "primary": ["Spearphishing (T1566)", "Exploit Public-Facing App (T1190)",
                     "External Remote Services (T1133)", "Valid Accounts (T1078)"],
        "emerging": ["IoMT Exploitation", "Telehealth Attacks",
                     "EHR Supply Chain"],
    },
    "energy": {
        "primary": ["Spearphishing (T1566)", "Supply Chain (T1195)",
                     "External Remote Services (T1133)"],
        "emerging": ["OT/ICS Protocol Exploitation", "SCADA Remote Access",
                     "Vendor VPN Exploitation"],
    },
}


class ThreatLandscapeAgent:
    """Conducts sector-specific cyber threat landscape assessment."""

    def __init__(self, sector):
        self.sector = sector.lower()
        self.client = attack_client() if HAS_ATTACKCTI else None
        self.actor_profiles = []
        self.technique_ranking = []

    def profile_sector_actors(self):
        """Query ATT&CK for groups known to target this sector."""
        target_names = SECTOR_GROUPS.get(self.sector, [])
        if not self.client:
            return [{"name": n, "source": "static_mapping"} for n in target_names]

        all_groups = self.client.get_groups()
        for group_name in target_names:
            group = next(
                (g for g in all_groups
                 if g.get("name", "").lower() == group_name.lower()
                 or group_name.lower() in
                 [a.lower() for a in g.get("aliases", [])]),
                None)
            if not group:
                self.actor_profiles.append({"name": group_name, "found": False})
                continue

            attack_id = ""
            for ref in group.get("external_references", []):
                if ref.get("source_name") == "mitre-attack":
                    attack_id = ref.get("external_id", "")
                    break

            techniques = []
            if attack_id:
                techs = self.client.get_techniques_used_by_group(attack_id)
                for t in techs:
                    for ref in t.get("external_references", []):
                        if ref.get("source_name") == "mitre-attack":
                            techniques.append({
                                "id": ref.get("external_id", ""),
                                "name": t.get("name", ""),
                            })
                            break

            self.actor_profiles.append({
                "name": group.get("name", ""),
                "attack_id": attack_id,
                "aliases": group.get("aliases", [])[:5],
                "description": (group.get("description", "") or "")[:300],
                "technique_count": len(techniques),
                "techniques": techniques[:25],
            })
        return self.actor_profiles

    def rank_techniques(self):
        """Rank techniques by how many sector actors use them."""
        counter = Counter()
        for actor in self.actor_profiles:
            for tech in actor.get("techniques", []):
                key = f"{tech['id']}|{tech['name']}"
                counter[key] += 1

        self.technique_ranking = [
            {"technique_id": k.split("|")[0],
             "name": k.split("|")[1] if "|" in k else "",
             "actor_count": count,
             "actors": [a["name"] for a in self.actor_profiles
                        if any(t["id"] == k.split("|")[0]
                               for t in a.get("techniques", []))]}
            for k, count in counter.most_common(20)
        ]
        return self.technique_ranking

    def get_attack_vectors(self):
        """Return known attack vectors for this sector."""
        return SECTOR_VECTORS.get(self.sector, {
            "primary": ["Spearphishing (T1566)",
                         "Exploit Public-Facing App (T1190)"],
            "emerging": ["Supply Chain Compromise"],
        })

    def generate_report(self):
        """Generate sector threat landscape report."""
        self.profile_sector_actors()
        self.rank_techniques()

        report = {
            "sector": self.sector,
            "report_date": datetime.utcnow().isoformat(),
            "threat_actors": len(self.actor_profiles),
            "actor_profiles": self.actor_profiles,
            "top_techniques": self.technique_ranking[:15],
            "attack_vectors": self.get_attack_vectors(),
            "recommendations": [
                "Prioritize detections for top 10 techniques",
                "Conduct threat-informed red team exercises",
                "Join sector ISAC for real-time sharing",
                "Map defenses to MITRE ATT&CK Navigator",
                "Monitor sector-specific threat advisories",
            ],
        }

        print(json.dumps(report, indent=2, default=str))
        return report


def main():
    sector = sys.argv[1] if len(sys.argv) > 1 else "financial"
    agent = ThreatLandscapeAgent(sector)
    agent.generate_report()


if __name__ == "__main__":
    main()
Keep exploring
Analyzing Threat Landscape with MISPAnalyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type breakdowns, identify top threat actors and malware families, and generate threat landscape reports with temporal trends.Analyzing Campaign Attribution EvidenceCampaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.Analyzing Threat Actor TTPs with MITRE ATT&CKMITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor behavior to the ATT&CK framework, building technique coverage heatmaps using the ATT&CK Navigator, identifying detection gaps, and producing actionable intelligence reports that link observed IOCs to specific adversary techniques across the Enterprise, Mobile, and ICS matrices.Building IOC Enrichment Pipeline with OpenCTIOpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and scores them for analyst prioritization.Building Threat Intelligence PlatformBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX/TAXII interoperability, and building analyst dashboards for CTI operations.Collecting Threat Intelligence with MISPMISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or counter-terrorism information. This skill covers deploying MISP, configuring threat feeds, using the PyMISP API for programmatic access, and building automated collection pipelines that aggregate IOCs from multiple community and commercial sources.