2.1 Threat Actors, Attributes, and Motives

Advanced Persistent Threat (APT)

🕵 Motive: Espionage/Sabotage.

Highly skilled, well-funded (often State-Sponsored). Their goal is long-term, stealthy access to steal data or disrupt systems.

State Sponsored/Nation-State

🏛 Motive: Espionage, Warfare, Political Power.

The source of funding and direction for many APTs. Any entity working on behalf of a government ex: Russia, Israel, North Korea.

Unskilled Attacker

💻 Motive: Curiosity, Bragging Rights. (Also called a "Script Kiddie"). (Attribute: External, Low resources/sophistication, uses others' tools).

Hacktivist

📣 Motive: Philosophical/Political Beliefs. (e.g., Defacement, DDoS). (Attribute: External, Low-to-Medium sophistication).

Insider Threat

😠 Motive: Revenge, Financial Gain (or accidental). (Attribute: Internal, sophistication varies, has trusted access).

Organized Crime

💰 Motive: Financial Gain. (A "Criminal Syndicate"). (e.g., Ransomware, fraud). (Attribute: External, High resources/sophistication).

Shadow IT

🤷 Motive: Convenience (not malice). (An internal risk, not an actor). An employee uses an unauthorized app/service (e.g., personal Dropbox).

Internal vs. External

Internal: Has existing access (e.g., employee, contractor). External: No prior access (e.g., most hackers).

Resources/Funding

The level of support an actor has. (e.g., Nation-State = High, Unskilled Attacker = Low)

Sophistication

The skill level of the actor. (e.g., APT = High, Unskilled Attacker = Low).

Motive: Data Exfiltration

📁 Theft. The act of stealing data from a network.

Motive: Espionage

🕵 Spying. Stealing secrets for a nation-state or competitor.

Motive: Service Disruption

⛔ Taking systems offline. (e.g., a DDoS attack).

Motive: Blackmail

🤫 Extortion. Threatening to release stolen data unless a ransom is paid.

Motive: Financial Gain

💰 Money. The primary motive for Organized Crime.

Motive: Philosophical/Political

📣 Ideology. The primary motive for Hacktivists.

Motive: Ethical

😇 For the common good. The primary motive for White Hat Hackers.

Motive: Revenge

😠 Getting even. A primary motive for a malicious Insider Threat.

Motive: Disruption/Chaos

💥 Causing damage for its own sake or to create a diversion.