A company discovered that terabytes of data have been exfiltrated over the past year after an employee clicked
on an email link. The threat continued to evolve and remain undetected until a security analyst noticed an
abnormal amount of external connections when the employee was not working. Which of the following is the
MOST likely threat actor?


A. Shadow IT
B. Script kiddies
C. APT
D. Insider threat