“Threat actor” is more formal. Hacker is a more colloquial term with historically ambiguous meaning.

I don’t even understand the phrase? Are they a threat or are they only acting? It’s a Jerry Seinfeld routine.

Because they never actually hack anything. Either they fish someone’s password, find an email and password combo someone reusedfrom a different site, or someone left root with ssh access and a default password.