2.1

Nation-state

• Definition: Government-backed groups targeting other nations for intelligence, disruption, or advantage.

• Example: A country's cyber unit hacking another nation's critical infrastructure.

• Methods: Advanced persistent threats, zero-day exploits, espionage, sabotage.

Unskilled attacker

• Definition: Individuals with limited technical knowledge using available hacking tools (“script kiddies”).

• Example: Teenagers running a password-cracking tool they downloaded.

• Methods: Pre-made malware, basic phishing, brute-force attacks.

Hacktivist

• Definition: Activists using hacking to promote political, social, or ideological causes.

• Example: A group defacing government websites to protest policy.

• Methods: Website defacement, DDoS attacks, information leaks.

Insider threat

• Definition: Current or former employees or contractors who misuse access to harm an organization.

• Example: A disgruntled employee stealing customer data before leaving.

• Methods: Data theft, sabotage, privilege abuse.

Organized crime

• Definition: Criminal groups that use cyberattacks for financial gain.

• Example: A ransomware group targeting hospitals for payouts.

• Methods: Ransomware, phishing, fraud, identity theft.

Shadow IT

• Definition: Employees using unauthorized technology or software within an organization.

• Example: Staff using unapproved file-sharing apps to transfer work documents.

• Methods: Unapproved cloud apps, personal devices, unauthorized software installations.

Internal/External

• Definition: Whether the threat comes from inside (employee) or outside (hacker) the organization.

• Example: External—A hacker tries to breach the network; Internal—An employee leaks data.

• Methods: Insider—privilege misuse, sabotage. Outsider—phishing, exploiting vulnerabilities

Resources/funding

• Definition: The amount of money, tools, and training available to the attacker.

• Example: Nation-states have more resources than unskilled attackers.

• Methods: Sophisticated attacks require significant resources; simple attacks use basic methods.

sophistication/Capability

• Definition: The skill level and technical expertise of the attacker.

• Example: A script kiddie has low sophistication, while an APT group has high.

• Methods: High sophistication—custom malware, zero-days. Low—common malware, simple emails.

Data exfiltration

(Motivation)

• Definition: Stealing data from a network or system.

• Example: Hackers extracting customer credit card information.

• Methods: Phishing, malware, exploiting misconfigurations.

Espionage

(Motivation)

• Definition: Spying to gather confidential or classified information.

• Example: Nation-state actors stealing defense secrets.

• Methods: Email phishing, social engineering, spyware.

Service disruption

(Motivation)

• Definition: Interrupting or degrading normal system operations.

• Example: Launching a DDoS attack to take down a website.

• Methods: DDoS attacks, ransomware, disabling services.

Blackmail

(Motivation)

• Definition: Forcing action by threatening to release damaging information.

• Example: Ransomware gangs threatening to leak data unless paid.

• Methods: Ransomware, sextortion, Doxxing.

Financial gain

(motivation)

• Definition: Making money through cybercrime.

• Example: Stealing and using credit card data for fraud.

• Methods: Fraud, theft, ransomware, phishing.

Philosophical/political beliefs

(motivation)

• Definition: Attacks motivated by ideology or moral views.

• Example: Hacktivists attacking organizations they oppose.

• Methods: DDoS, website defacement, leaking documents.

Ethical

Motivation:

• Definition: Attacking systems to identify and fix vulnerabilities (with or without consent).

• Example: White-hat hackers performing penetration testing.

• Methods: Penetration testing, vulnerability scanning.

Revenge

(Motivation)

• Definition: Retaliation for perceived wrongs.

• Example: An ex-employee erasing company databases.

• Methods: Data deletion, sabotage, leaks.

Disruption/chaos

• Definition: Causing confusion or disorder without financial or ideological motive.

• Example: Spreading malware just to watch systems fail.

• Methods: Worms, viruses, random attacks.

War

• Definition: National conflicts carried out through cyberattacks targeting an adversary’s infrastructure.

• Example: State-sponsored attacks disabling power grids during conflict.

• Methods: Advanced persistent threats, infrastructure sabotage.