This hands-on workshop explores the world of cyber threat actors and the intelligence that helps us understand and counter their activity. Participants will learn how to identify threat actor tactics, techniques, and procedures (TTPs), and apply threat intelligence models to real-world case studies. They will also learn how to pivot from a single indicator of compromise (IoC) to build a picture of threat activity. Through collaborative exercises, attendees will analyze incidents using frameworks such as MITRE ATT&CK and build actionable threat intelligence profiles.