Threat Actors: Who Is Actually Attacking, and Why

The 30-second explanation

Some attackers want money, some want secrets, some want attention, and some are simply angry insiders. What they're after decides how patient they're willing to be and what they go for.

How it works

1. 1

   1. Motivation

   Money, secrets, a cause, or a grievance.

2. 2

   2. Capability

   Ranges from opportunistic to highly resourced.

3. 3

   3. Behaviour

   How they get in, and what they do once they're there.

4. 4

   4. Priority

   Defend against whatever actually fits your risk.

Criminals mostly chase money, through ransomware, fraud and stolen data sold on afterwards. State-linked groups chase intelligence or a strategic edge instead, and tend to be patient and well-resourced. Hacktivists want publicity for a cause, and lean on defacement, leaks or floods of traffic to get it. Insiders already have the access everyone else is trying to steal, and may act out of carelessness or genuine grievance. A single group can straddle more than one category, which is why defenders focus on behaviour and evidence rather than labels, and stay careful about attribution.

Real-world example

How to spot it

• Fast, noisy activity

  Usually points to an opportunistic or financially motivated actor.

• Slow, careful access

  Often a sign of longer-term intelligence gathering instead.

• Public claims and messages

  A telltale sign of publicity-seeking activity.

• Access from trusted accounts

  Can point to an insider, or just as easily to stolen credentials.

What to do

1. 1List who is most likely to target you and why, then match your defences to that list.
2. 2Stay cautious with attribution: treat any label as a hypothesis until the evidence supports it.
3. 3Revisit the list whenever your business, data or public profile changes meaningfully.