A distributed adversary is an attacker model spread across multiple systems, accounts, locations, or infrastructure providers so that no single point of failure can stop it quickly. The operator may use separate command servers, proxy chains, compromised hosts, or different teams to run the same campaign while hiding the full picture.
This matters because cyber defense often depends on disruption. If an attacker is centralized, defenders can block one server, seize one account, or interrupt one network path. If the adversary is distributed, takedowns are harder, detection is noisier, and investigators may only see fragments of the operation. Real-world examples include botnets, phishing kits hosted on rotating infrastructure, and criminal groups that shift malware delivery, payment channels, and communication routes to stay alive. Defenses rely on correlation: threat intelligence, cross-team coordination, rapid incident response, and blocking patterns rather than single indicators.