GO KALI FREE
BeginnerSecurity

Threat Actors: Understanding Cyber Attackers and Their Motivations

Learn about different types of cyber threat actors — nation-states, criminal groups, hacktivists, insiders — their motivations, methods, and how to defend against each.

#threat actors#cyber attacks#nation-state#hacktivism#insider threats

The Night the Power Grid Went Silent

In December 2015, a nation-state threat actor remotely accessed Ukraine's power grid control systems and switched off electricity to over 230,000 people. The attackers had spent months inside the network — studying SCADA systems, capturing credentials, and preparing the attack. It was the first confirmed cyber attack to cause a power outage, and it revealed a new era of state-sponsored warfare targeting critical infrastructure.

Threat actors are individuals, groups, or organizations that conduct cyber attacks. Understanding who threatens your systems and why is essential for effective defense.

Prerequisites

Basic understanding of cybersecurity concepts. Familiarity with common attack types is helpful.

Nation-State Actors

Description

State-sponsored attackers operate on behalf of governments. They have the highest levels of funding, training, and resources. Their operations are often sustained for years (advanced persistent threats — APTs).

Motivations

  • Espionage — stealing government and corporate secrets
  • Cyber warfare — disrupting critical infrastructure
  • Intellectual property theft — stealing research and technology
  • Political influence — election interference, propaganda
  • Military advantage — reconnaissance of adversaries

    • Notable Examples

    APT28 (Fancy Bear): Russian GRU-linked group behind the DNC hack (2016), Olympic Destroyer, and ongoing targeting of governments.

    APT38 (Lazarus Group): North Korean group behind the Sony Pictures hack (2014), Bangladesh Bank heist ($81M), and WannaCry ransomware.

    APT10: Chinese group targeting aerospace, technology, and healthcare sectors worldwide for intellectual property.

    Capabilities

    Zero-day exploit development, custom malware that evades detection, supply chain compromise, sophisticated social engineering, long-term persistence (years), and extensive infrastructure.

    Defending Against Nation-States

    Defense in depth, air-gapped systems for critical data, strict supply chain security, threat intelligence feeds, advanced endpoint detection, and proactive threat hunting. Most organizations are unlikely targets — focus on making yourself harder to compromise than others.

    Criminal Groups

    Description

    Cybercriminals are financially motivated groups ranging from individual hackers to organized crime syndicates. They operate ransomware-as-a-service (RaaS) models, run botnets, and maintain underground marketplaces.

    Motivations

  • Financial gain — ransomware, fraud, theft
  • Data for resale — credit cards, credentials, personal data
  • Cryptocurrency mining — deploying miners on compromised systems
  • Fraud — Business Email Compromise (BEC), invoice fraud

    • Notable Examples

    REvil (Sodinokibi): RaaS group demanding millions in ransom. Targeted Kaseya supply chain attack (2021).

    DarkSide: Responsible for the Colonial Pipeline attack (2021), causing fuel shortages across the US East Coast.

    FIN7: Sophisticated group targeting POS systems and financial data. Stole millions from US businesses.

    Capabilities

    Ransomware deployment, credential theft, phishing at scale, malware development, money laundering through cryptocurrency, and access to exploit markets.

    Defending Against Criminal Groups

    Robust backups (3-2-1 rule), patch management (especially for RDP and VPNs), MFA everywhere, email security (anti-phishing, DMARC), endpoint protection (EDR), network segmentation, and incident response planning.

    Hacktivists

    Description

    Hacktivists conduct attacks to promote political or social causes. Their goals are typically disruption and publicity rather than financial gain.

    Motivations

  • Political protest — defacing websites, DDoS attacks
  • Social justice — exposing perceived wrongdoing
  • Censorship bypass — providing tools to evade restrictions
  • Transparency — leaking documents (WikiLeaks model)

    • Notable Examples

    Anonymous: Decentralized group behind operation against the Church of Scientology, Operation Payback (anti-piracy), and support for Arab Spring protests.

    LulzSec: Splinter group known for high-profile but short-lived attacks against Sony, PBS, and the CIA website (2011).

    Killnet: Pro-Russian hacktivist group targeting government infrastructure in NATO countries.

    Capabilities

    DDoS attacks (often using botnets), website defacement, doxing (publishing personal information), data leaks, and basic web application exploitation.

    Defending Against Hacktivists

    DDoS protection services (Cloudflare, AWS Shield), web application firewalls, proper access controls, and incident response for defacement. Many hacktivist attacks are low-sophistication — basic security hygiene prevents most.

    Insider Threats

    Description

    Insider threats come from people within the organization — employees, contractors, or partners — who misuse their access.

    Categories

    Malicious Insiders: Employees who intentionally steal data, sabotage systems, or cause harm. Often motivated by financial gain, revenge, or ideology.

    Negligent Insiders: Well-meaning employees who cause breaches through mistakes — falling for phishing, misconfiguring systems, losing devices.

    Compromised Insiders: Employees whose credentials are stolen by external attackers and used to access systems.

    Motivations

    Financial pressure, disgruntlement, corporate espionage, carelessness, or coercion from external parties.

    Notable Examples

    Edward Snowden: NSA contractor who leaked classified documents about global surveillance programs (2013).

    Tesla Sabotage: Employee modified manufacturing software and exported proprietary data (2018).

    Waymo vs Uber: Employee downloaded 14,000+ confidential files before joining Uber (2017).

    Defending Against Insider Threats

    Principle of least privilege, user behavior analytics (UBA), data loss prevention (DLP), separation of duties, background checks, exit procedures (immediate access revocation), and security awareness training.

    Script Kiddies

    Description

    Inexperienced attackers who use pre-existing tools and scripts without understanding how they work. Often teenagers seeking notoriety or fun.

    Motivations

    Bragging rights, curiosity, proving themselves in hacker communities, and occasionally vandalism.

    Capabilities

    Limited to running existing tools (Metasploit, LOIC). Cannot develop their own exploits or custom malware. Easily deterred by basic security controls.

    Defending Against Script Kiddies

    Basic security hygiene — patching, strong passwords, firewalls. Most script kiddie attacks fail against organizations with even minimal security posture.

    Real-World Example: Multi-Actor Scenario

    A financial institution might face threats from all actor types simultaneously:

  • Nation-states seeking economic intelligence
  • Criminal groups deploying ransomware for profit
  • Hacktivists protesting the institution's policies
  • Insiders stealing customer data for personal gain
  • Script kiddies defacing the public website

    • Each requires different defenses — threat intelligence for nation-states, backups for ransomware, DDoS protection for hacktivists, DLP for insiders, and basic hygiene for script kiddies.

    Common Mistakes

    Assuming all attackers are the same. Over-investing in defenses against threats that do not apply (most organizations face criminals, not nation-states). Underestimating insider threats. Ignoring basic hygiene while chasing advanced threats.

    Best Practices

    Conduct threat modeling to identify which actors are likely to target your organization. Tailor defenses to your specific threat profile. Maintain basic security hygiene regardless of threat level. Monitor for insider threats through access audits and behavioral analytics. Participate in threat intelligence sharing communities.

    Related Tools

    MITRE ATT&CK — Framework of adversary tactics and techniques. ThreatConnect — Threat intelligence platform. MISP — Open-source threat intelligence sharing. OpenCTI — Open-source threat intelligence platform.

    Related Articles

  • what-is-cybersecurity
  • cia-triad
  • phishing-attacks
  • social-engineering-awareness
  • malware-basics

    • Summary

    Threat actors range from nation-state APTs (espionage, high capability) to cybercriminals (financial gain, ransomware) to hacktivists (protest, DDoS/defacement) to insiders (accidental or malicious) to script kiddies (notoriety, basic tools). Each requires a different defense strategy. Threat modeling helps identify which actors are relevant to your organization and prioritize defenses accordingly.

    Knowledge Check

  • What motivates nation-state attackers?
  • What is ransomware-as-a-service (RaaS)?
  • What is the difference between hacktivists and cybercriminals?
  • What are the three types of insider threats?
  • What is a script kiddie?

    • Frequently Asked Questions

    What are threat actors?

    Threat actors are individuals, groups, or organizations that conduct cyber attacks. They range from nation-state APTs with massive resources to casual script kiddies using pre-built tools. Understanding who threatens your systems and why is essential for designing an effective defense strategy — see our [What is Cybersecurity](/articles/what-is-cybersecurity) guide for context.

    What motivates nation-state attackers?

    Nation-states are motivated by espionage (stealing government and corporate secrets), cyber warfare (disrupting critical infrastructure), intellectual property theft, political influence (election interference), and military advantage. Groups like APT28 (Fancy Bear) and APT38 (Lazarus) operate with government funding and can sustain campaigns for years.

    What is ransomware-as-a-service (RaaS)?

    RaaS is a business model where ransomware developers lease their malware to affiliates who carry out attacks, sharing profits with the developers. This lowers the barrier to entry for cybercriminals. Groups like REvil and DarkSide operated RaaS platforms responsible for attacks on Colonial Pipeline and Kaseya.

    What is the difference between hacktivists and cybercriminals?

    Hacktivists attack for political or social causes — their goal is disruption and publicity, not money. Groups like Anonymous use DDoS attacks and website defacement. Cybercriminals are financially motivated, deploying ransomware, stealing data for resale, and running fraud schemes. Hacktivists typically have lower technical capability than organized criminal groups.

    What are the three types of insider threats?

    Malicious insiders intentionally steal data or sabotage systems (often motivated by revenge or financial gain). Negligent insiders cause breaches through mistakes — falling for phishing, misconfiguring systems. Compromised insiders have their credentials stolen by external attackers. All three require different defenses including DLP, behavioral analytics, and access controls.

    What is a script kiddie?

    Script kiddies are inexperienced attackers who use pre-existing tools and scripts without understanding how they work. They cannot develop custom exploits or malware. Most are teenagers seeking notoriety. Basic security hygiene — patching, strong passwords, firewalls — easily deters script kiddie attacks.

    How do I defend against nation-state attacks?

    Defense in depth is essential: air-gapped systems for critical data, strict supply chain security, threat intelligence feeds, advanced endpoint detection (EDR), and proactive threat hunting. Most organizations are unlikely nation-state targets — focus on being harder to compromise than others through fundamental security hygiene.

    What is APT28 and what do they target?

    APT28 (Fancy Bear) is a Russian GRU-linked group known for the DNC hack (2016), Olympic Destroyer, and ongoing government targeting. They use zero-day exploits, custom malware, and sophisticated social engineering. APT28 exemplifies the advanced persistent threat model — long-term, stealthy operations against high-value targets.

    How do criminal groups make money from cyber attacks?

    Primary revenue streams include ransomware payments, stolen credit card and credential sales on dark markets, cryptocurrency mining on compromised systems, Business Email Compromise (BEC) fraud, and selling access to compromised networks. Criminal groups operate like businesses with customer service, affiliate programs, and regular updates.

    What is the difference between black hat and white hat hackers?

    Black hat hackers break into systems illegally for personal gain or malicious purposes. White hat hackers (ethical hackers) operate with explicit permission to find vulnerabilities so organizations can fix them. The distinction is legal authorization — the same technical skills used for good or evil. See our [Ethical Hacking Fundamentals](/articles/ethical-hacking-fundamentals) guide.

    How do I identify which threat actors target my organization?

    Conduct threat modeling to assess your industry, data types, and geopolitical exposure. Financial institutions face criminal groups, defense contractors face nation-states, and any organization can face hacktivists or insiders. Threat intelligence feeds and industry ISACs (Information Sharing and Analysis Centers) help identify relevant threats.

    What is an advanced persistent threat (APT)?

    An APT is a prolonged, targeted cyber attack where an attacker gains access to a network and remains undetected for an extended period. APTs are typically associated with nation-states and involve multiple attack phases: initial compromise, lateral movement, privilege escalation, and data exfiltration. The goal is sustained access, not immediate damage.