Canon schema vocabulary

Threat Actor

extends schema.org/Thing

A Threat Actor is a named adversary group tracked by the security research community — such as APT28 or Leviathan — with a profile of aliases, a description, and the MITRE ATT&CK techniques it has been observed using. On Whisper Internet Directory, each actor is published at /actor/{slug} as a schema.org Thing, carrying its aliases, techniques grouped by tactic, and any infrastructure publicly attributed to it — sourced from the MITRE ATT&CK corpus in WhisperGraph. © The MITRE Corporation; reproduced and distributed with permission.

About this type identifier

This page is the canonical definition of the Threat Actor type in the Whisper Internet Directory vocabulary. Every /actor entity page references it from its structured data via the additionalType field, extending the schema.org Thing base type so crawlers and LLMs can resolve the Canon-specific meaning of the entity.

Type identifier (IRI): https://canon.whisper.security/schema/ThreatActor
schema.org base type: Thing
Entity pages: /actor/{id}

Example Threat Actor pages

Representative entities of this type in the Whisper Internet Directory directory.