Threat actors and motivations in Cybersecurity - Step-by-Step Execution

Concept Flow - Threat actors and motivations

Identify Target

↓

Threat Actor Chooses Motivation

↓

Plan Attack Based on Motivation

↓

Execute Attack

↓

Achieve Goal or Fail

↓

Repeat or Change Strategy

Threat actors pick a target, choose why they attack, plan and execute, then either succeed or fail, possibly repeating.

Execution Sample

Cybersecurity

Threat Actor: Hacker
Motivation: Financial Gain
Action: Phishing Attack
Result: Steal Money

Shows a hacker motivated by money using phishing to steal funds.

Analysis Table

Step	Threat Actor	Motivation	Action	Result
1	Hacker	Financial Gain	Phishing Email Sent	Waiting for Victim
2	Hacker	Financial Gain	Victim Clicks Link	Credentials Stolen
3	Hacker	Financial Gain	Use Credentials	Money Transferred
4	Hacker	Financial Gain	Cover Tracks	Attack Hidden
5	Hacker	Financial Gain	Goal Achieved	Funds Stolen

💡 Attack ends after funds are stolen or detected.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Threat Actor	None	Hacker	Hacker	Hacker	Hacker	Hacker
Motivation	None	Financial Gain	Financial Gain	Financial Gain	Financial Gain	Financial Gain
Action	None	Phishing Email Sent	Victim Clicks Link	Use Credentials	Cover Tracks	Goal Achieved
Result	None	Waiting for Victim	Credentials Stolen	Money Transferred	Attack Hidden	Funds Stolen

Key Insights - 3 Insights

Why does the threat actor choose a specific motivation before acting?

The motivation guides the type of attack planned and the target chosen, as shown in Step 1 and 2 of the execution_table.

What happens if the victim does not click the phishing link?

The attack cannot proceed to steal credentials or money, so the result stays at 'Waiting for Victim' as in Step 1.

Why does the threat actor cover their tracks after stealing money?

To avoid detection and continue attacks or keep stolen funds, shown in Step 4 where 'Cover Tracks' leads to 'Attack Hidden'.

Visual Quiz - 3 Questions

Look at the execution_table, what is the 'Result' after Step 2?

A Money Transferred

B Waiting for Victim

C Credentials Stolen

D Attack Hidden

💡 Hint

Check the 'Result' column in row for Step 2.

At which step does the threat actor 'Cover Tracks'?

A Step 4

B Step 5

C Step 3

D Step 2

💡 Hint

Look at the 'Action' column to find when 'Cover Tracks' happens.

If the victim never clicks the phishing link, what would the 'Result' remain as?

A Credentials Stolen

B Waiting for Victim

C Funds Stolen

D Attack Hidden

💡 Hint

Refer to Step 1 where the phishing email is sent but no victim action yet.

Concept Snapshot

Threat actors are people or groups who attack systems.
They have motivations like money, politics, or fun.
They plan attacks based on these reasons.
Actions include phishing, malware, or hacking.
Success depends on victim response and actor skill.

Full Transcript

Threat actors choose targets and motivations before attacking. Motivations guide their actions, such as financial gain leading to phishing attacks. The attack progresses step-by-step: sending phishing emails, victim interaction, stealing credentials, transferring money, and hiding tracks. If victims do not engage, the attack stops early. Covering tracks helps avoid detection. Understanding these steps helps recognize and defend against cyber threats.

Practice

1. What is a threat actor in cybersecurity?

easy

A. A device that stores data securely

B. A software program that protects computers

C. A person or group that causes harm using computers

D. A law that regulates internet use

Solution

1. Step 1: Understand the term 'threat actor'

   A threat actor is someone who causes harm or attacks in the cyber world.

2. Step 2: Match the definition to options

   A person or group that causes harm using computers correctly describes a person or group causing harm using computers.

3. Final Answer:

   A person or group that causes harm using computers -> Option C

4. Quick Check:

   Threat actor = person/group causing harm [OK]

Hint: Threat actors cause harm; defenders protect [OK]

Common Mistakes:

• Confusing threat actor with security software
• Thinking threat actor is a device
• Mixing threat actor with laws or rules

2. Which of the following is a common motivation for cyber attackers?

easy

A. To improve computer speed

B. To update operating systems

C. To install antivirus software

D. To steal sensitive information

Solution

1. Step 1: Identify common attacker motivations

   Attackers often want to steal sensitive data like passwords or credit card info.

2. Step 2: Compare options to motivation

   Only To steal sensitive information matches a common motivation: stealing sensitive information.

3. Final Answer:

   To steal sensitive information -> Option D

4. Quick Check:

   Motivation = steal info [OK]

Hint: Attackers want data, not system improvements [OK]

Common Mistakes:

• Choosing options about improving or updating systems
• Confusing attacker goals with defender tasks
• Ignoring the goal of stealing or damaging

3. A hacker group targets a company to demand money in exchange for not leaking stolen data. What is their motivation?

medium

A. Financial gain

B. Political influence

C. Hacktivism

D. Security testing

Solution

1. Step 1: Understand the scenario

   The group demands money to avoid leaking data, which means they want financial benefit.

2. Step 2: Match motivation to options

   Financial gain fits best because they want money, not political or social change.

3. Final Answer:

   Financial gain -> Option A

4. Quick Check:

   Demanding money = financial gain [OK]

Hint: Money demand means financial motivation [OK]

Common Mistakes:

• Confusing financial gain with political motives
• Thinking it's security testing
• Assuming hacktivism without social cause

4. Identify the error in this statement: "Hacktivists attack systems mainly to steal money."

medium

A. Hacktivists focus on political or social causes, not money

B. Hacktivists only protect systems, not attack

C. Hacktivists are government employees

D. Hacktivists use viruses to improve security

Solution

1. Step 1: Understand hacktivist motivation

   Hacktivists attack to promote political or social causes, not for money.

2. Step 2: Check options for correct error

   Hacktivists focus on political or social causes, not money correctly states the error: hacktivists do not mainly steal money.

3. Final Answer:

   Hacktivists focus on political or social causes, not money -> Option A

4. Quick Check:

   Hacktivists ≠ money theft [OK]

Hint: Hacktivists want change, not cash [OK]

Common Mistakes:

• Thinking hacktivists are defenders
• Assuming hacktivists work for governments
• Believing hacktivists improve security

5. A company wants to protect itself from attackers motivated by political reasons and those seeking financial gain. Which two threat actor types should it focus on?

hard

A. Cybercriminals and Insiders

B. Hacktivists and Cybercriminals

C. Nation-states and Hacktivists

D. Script Kiddies and Insiders

Solution

1. Step 1: Identify political motivation actors

   Hacktivists attack for political or social causes.

2. Step 2: Identify financial motivation actors

   Cybercriminals attack for money or financial gain.

3. Step 3: Match both types to options

   Hacktivists and Cybercriminals correctly pairs hacktivists (political) and cybercriminals (financial).

4. Final Answer:

   Hacktivists and Cybercriminals -> Option B

5. Quick Check:

   Political + Financial = Hacktivists + Cybercriminals [OK]

Hint: Political = hacktivists, financial = cybercriminals [OK]

Common Mistakes:

• Mixing insiders with political motives
• Confusing nation-states with financial criminals
• Ignoring hacktivists' political goals