In this lesson,
we are going to discuss
the different threat actor motivations.
In the world of cybersecurity,
there is always an ongoing battle between the good folks
and the bad folks.
And in order to defend ourselves better
against those bad folks
or threat actors, as we like to call them,
we need to understand the motivations behind their attacks.
By understanding and acknowledging
what drives these individuals or groups,
we can better calculate their moves,
develop effective protective measures,
and ultimately better protect our enterprise networks.
It's important to remember that there is a difference
between the intent behind an attack
and the motivation that fuels that attack.
The threat actor's intent refers to the specific objective
or goal that a threat actor is aiming to achieve
through their attack.
Their motivation, on the other hand,
is really their underlying reasons
or driving forces that pushes a threat actor
to carry out the attack.
So in this lesson, we'll consider the different motivations
behind threat actors,
including data exfiltration, blackmail, espionage,
service disruption, financial gain,
philosophical or political beliefs,
ethical reasons, revenge, disruption or chaos, and war.
First, we have data exfiltration.
Data exfiltration refers to the unauthorized transfer
of data from a computer.
For example, if an attacker is able to log
into one of your organization's computers
and steal your client contact information,
this means that they have successfully exfiltrated data
from your organization.
Threat actors motivated by this
want to access your organization's sensitive information
such as IP or intellectual property,
personal identifiable information or PII, or trade secrets.
This stolen data can be used for various purposes
including selling it on the dark web,
using it for identity theft,
or leveraging it for a competitive advantage,
which is why data exfiltration
is one of the biggest motivations
for many of the different threat actors out there.
Second, we have financial gain.
Financial gain is one of the most common motivations
for cyber criminals.
At the end of the day,
what is something that all criminals like to do?
That's right.
Steal something and gain money from that crime,
and cyber criminals are no different.
Achieving financial gain as a criminal
can be achieved through various means,
such as ransomware attacks
where a threat actor encrypts a victim's data
and demands for a ransom,
or through banking Trojans that allow them
to steal financial information
in order to gain unauthorized access
into the victim's bank accounts.
Third, we have blackmail.
Blackmail is another motivation
that drives certain threat actors.
In these cases, the attacker obtains sensitive
or compromising information
about an individual or an organization
and threatens to release that information to the public
unless certain demands are met.
These demands often involve a financial transaction,
typically requested in the form
of untraceable cryptocurrencies like Bitcoin.
The threat of reputational damage, legal repercussions,
or financial loss can be a strong motivator
to convince victims that they should comply
with the blackmailer's demands.
Cyber blackmail can take many forms,
including ransomware, doxxing, or even sextortion
where a person's own lewd photos are stolen
and the attacker demands a payment
or else they will publicly release
the victim's photos online.
Fourth, we have service disruption.
Some threat actors aim to disrupt the services
of various organizations
either to cause chaos, make a political statement,
or to demand a ransom.
This is often achieved by conducting
a distributed denial of service attack
to overwhelm a network, service, or server
with excessive amounts of traffic
so that becomes unavailable to its normal users.
These service disruptions can lead to significant financial
and reputational damages for the affected organizations.
For example, GitHub,
a popular website used by software developers,
was the victim of a large DDoS attack in 2018
that lasted for about 20 minutes,
and during the time, millions of GitHub users
were unable to access the site
since their servers were being flooded
with excessive traffic from the DDoS attack.
Fifth, we have philosophical or political beliefs.
Attacks that are conducted due to the philosophical
or political beliefs of the attackers
is known as hacktivism.
And this is a common motivation
for a specific type of threat actor known as a hacktivist.
These individuals or groups use hacking
to promote a political agenda, social change,
or to protest against organization they perceive as ethical.
Their actions can range
from website defacement to data leaks.
This type of hacktivism usually targets different types
of organizations and groups,
including those in the political, financial,
and media industries.
Six, we have ethical reasons.
Contrary to malicious threat actors,
ethical hackers, also known as authorized hackers,
are motivated by a desire to improve security.
These are your pen testers and your bounty hunters.
They mimic the way a malicious threat actor operates
in order to further improve an organization's security.
These ethical hackers and penetration testers
focus on identifying vulnerabilities
in an organization's systems and networks
with the intention of patching
and mitigating those vulnerabilities
to prevent a potential exploit by a malicious threat actor.
Seventh, we have revenge.
Revenge is a powerful motivation for some threat actors.
An employee who is disgruntled
or one who has recently been fired or laid off
might want to harm their current or former employer
by causing a data breach, disrupting services,
or leaking sensitive information.
Similarly, revenge can also be a motivation
for a threat actor that wants to target an entity
that they believe has wronged them in some way.
Eight, we have disruption or chaos.
Some threat actors are motivated
by a desire to create disruption or chaos.
These actors, often refer to as unauthorized hackers,
engage in malicious activities for the thrill of it
to challenge their skills or simply to cause harm.
As Alfred Pennyworth, Batman's infamous butler,
said in "The Dark Knight,"
"Some men just want to watch the world burn."
The actions of a threat actor
who is focused on disruption or chaos
could range from creating and spreading malware
to launching sophisticated cyber attacks
against critical infrastructure in populated city.
Ninth, we have espionage.
Espionage is another common motivation for threat actors,
and this one involves spying on individuals, organizations,
or nations to gather sensitive or classified info.
Cyber espionage is often motivated
by national security interests
when conducted by a nation state,
or gaining competitive business intelligence
when conducted by a rival company,
or to gain political advantage
when being conducted by hacktivists or nation state actors.
Often, you will find espionage activities are conducted
by nation state actors who are seeking
to gain strategic advantages over other nations
that they view as their adversaries.
And 10th, we have war.
In the context of modern warfare,
cyber attacks have increasingly become a tool for nations
to attack each other both on and off the battlefield.
Cyber warfare can be used
to disrupt a country's infrastructure,
compromise its national security,
and to cause economic damage.
Nation state threat actors
are most often found to be the source of attacks
that are motivated by geopolitical objectives.
So remember, in cybersecurity,
it is important to understand the motivations
behind different types of threat actor attacks
to help formulate an effective defense against them.
Threat actors are driven by diverse motivations
that range from those seeking data exfiltration
and financial gain
to those pursuing blackmail, service disruption,
or actions aligned with a philosophical or political belief.
Some hackers are driven by ethical reasons
and help us enhance the security
of our organization's networks
while others may act out of revenge,
a desire for chaos, espionage,
or even trying to use cyber warfare
to achieve their nation's geopolitical objectives.
By properly recognizing the driving forces
behind these threat actors,
we can better predict how they might attack us
and develop protective countermeasures
to prevent a future attack against our organization.