Who Are Threat Actors and What Do They Want?
Cybercriminals, hacktivists, state-sponsored groups, and insider threats: understand threat actor motives to better prioritize your defense strategy.
Why it matters
Understanding your adversary helps you prioritize what to defend. While a fraudster seeks financial gain, a hacktivist looks for publicity; consequently, the strategies required to protect against each differ significantly.
Key concepts
Primary threat actor profiles:
- Cybercriminals: The largest group. Their primary objective is financial gain: ransomware, banking fraud, and selling stolen data. Most operate using off-the-shelf tools and Ransomware-as-a-Service packages, requiring minimal technical expertise.
- Hacktivists: Driven by political or social agendas. Typical tactics include website defacement, distributed denial-of-service (DDoS) attacks, and data leaks.
- State-sponsored groups: Patient, well-funded, and focused on long-term operations. Their targets include espionage, critical infrastructure, and supply chains. Rather than attacking an organization directly, they often compromise a smaller vendor in its supply chain.
- Insider threats: Current or former employees. While some act with malicious intent (such as data theft), most incidents stem from negligence (e.g., misdirected emails or unauthenticated file shares).
- Opportunists and hobbyists: Individuals who tamper with exposed systems found online or experiment with automated scanning tools. They do not target specific organizations; they simply exploit whatever vulnerabilities they encounter.
Motivations: financial gain, espionage (intelligence gathering), ideology, revenge, notoriety, and occasionally mere curiosity.
A realistic scenario
A departing employee's account is left active. Six months later, that account is used to download the customer database and sell it to a competitor. The real vulnerability here was not a sophisticated hacker, but an unrevoked account.
Action items
- Deprovision all access and accounts immediately on an employee's last day.
- Enforce the principle of least privilege: grant users only the access strictly required for their role.
- Evaluate the question "Who would target us and why?" on an annual basis.
Key takeaway: Most attackers do not target you specifically; they target the doors you leave open.
*This article is part 2 of the 14-part Cybersecurity Awareness series.* Next up: How a cyber attack unfolds step by step.