Which statement about threat actors is true?