Threat actor
A threat actor is an individual or group that poses a security threat; a name used in threat reporting may identify an observed activity cluster rather than a conclusively identified organization.
Read the name with its evidence
NIST includes an individual or group posing a threat in its definition. Threat intelligence reports also use actor names to organize observations. MITRE ATT&CK describes its Groups as activity clusters and warns that names used by different organizations may overlap only partly.
When using an actor name, say whose reporting you mean and which activity it covers. Two vendors may use related names without tracking exactly the same people or incidents.
Applying a report without claiming attribution
A report about employee impersonation can help a team choose what to test in account recovery. Using the same technique does not establish that the named group made a suspicious call to your help desk. Many attackers can use the same method.
The UNC3944 recovery article follows a reported set of behaviors. Use the report’s attribution for those observations, and describe your own findings separately.
Use behavior to choose the review
For a local review, focus on the reported access requirements and actions your systems could support. The sector-reporting article explains how to judge that fit.
You do not need to settle attribution before investigating an unauthorized recovery. Work on the behavior you can see, and be clear about what you do not yet know.