CoreQ Academy2.1 Compare and contrast common threat actors and motivations.
Knowing who is likely to attack you, and why, tells you which threats to prioritise. A clinic worries about ransomware gangs; a defence contractor worries about nation-states.
Threat actors
- Nation-state
- Government-backed groups with large budgets and patience. Often called advanced persistent threats (APTs). Goals: espionage, sabotage, influence.
- Unskilled attacker
- Uses tools and scripts written by others with little understanding of them. Noisy but can still do damage against unpatched systems.
- Hacktivist
- Attacks to promote a political or social cause: defacements, leaks, DDoS.
- Insider threat
- A current or former employee, contractor or partner who misuses legitimate access, deliberately or by mistake.
- Organized crime
- Profit-driven groups running ransomware, fraud and data theft like a business.
- Shadow IT
- Systems or services employees adopt without IT approval (personal cloud storage, unapproved SaaS). Not malicious, but creates unmanaged risk.
Attributes of actors
- Internal/external
- Whether the actor already has authorized access (internal) or is outside the organization (external).
- Resources/funding
- How much money, people and time the actor has. Nation-states and organized crime are well funded.
- Level of sophistication/capability
- From script use to custom zero-day exploits and stealthy long-term operations.
Motivations
- Data exfiltration
- Stealing data to sell, leak or use.
- Espionage
- Gathering secrets for political, military or commercial advantage.
- Service disruption
- Taking systems offline, for example with DDoS.
- Blackmail
- Threatening to release data or keep systems locked unless paid (extortion).
- Financial gain
- Making money through ransom, fraud or selling access/data. The most common motive.
- Philosophical/political beliefs
- Acting on ideology, as hacktivists do.
- Ethical
- Authorized or well-intended hacking, such as bug bounty work, to improve security.
- Revenge
- Retaliation, often by a disgruntled current or former insider.
- Disruption/chaos
- Causing damage for its own sake or for notoriety.
- War
- Cyber operations as part of military conflict, for example attacks on infrastructure.
Check your understanding
Knowledge quiz · pass mark 80%
- Employees store customer files in a personal cloud drive without approval. This is:
- The most common motivation behind ransomware is:
- An insider threat is always intentional.
- Which attributes are used to compare threat actors? (choose all)
- Which actor is most associated with long-term, well-funded espionage campaigns?
Original CoreQ Academy material, mapped to objective 2.1 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.