Security+ SY0-801 Threat Actors and Motivations

A threat actor profile describes who might attack, why they would do it and what they are able to do. Security+ objective 2.2 breaks this into three lists: eight threat actor types, twelve motivations and three attributes (internal/external, resources/funding, and level of sophistication/capability). Together they answer the questions a defender needs before choosing controls: which adversaries are realistic for this organization, what they will go after, and how hard they will try.

The three lists are separate dimensions, not synonyms. An actor type is a label for the attacker; a motivation is the goal of a particular attack; an attribute is a measurable property of the attacker. The same actor type can act on different motivations (organized crime may steal card data for sale one month and run an extortion campaign the next), and two different actor types can share a motivation (a competitor and a state-sponsored group may both want intellectual property). Many scenario questions ask for one dimension at a time, and the harder ones ask for two at once, so it pays to classify each dimension on its own before combining them.

Attributes describe an actor's starting position and capacity, and they are what decides how much effort a defense must withstand.

• Internal vs external is about whether the actor begins inside the trust boundary with access the organization granted. An internal actor starts from credentials or physical access that the organization itself provided, so the attack begins from a trusted position rather than at the perimeter. That includes employees, but also contractors, managed service provider staff and partners using access the organization issued to them: what matters is the trusted access, not whose payroll the person is on. The same third-party relationship is also treated as a supply-chain or vendor threat vector under objective 2.3; for this objective, the question is only where the actor starts. An external actor has to break in or trick someone first.
• Resources/funding is what the actor can buy and sustain: full-time staff, tools and access bought rather than built, infrastructure that can be paid for and rebuilt at will, and the patience to run a campaign for months or years.
• Level of sophistication/capability is what the actor can build and do with their own skill: writing custom exploits and malware, adapting quickly when a defense blocks one technique, hiding their tracks from investigators, and avoiding mistakes that reveal who they are.

Funding and sophistication usually rise together, which is why they are easy to confuse, but they are independent. Money can purchase a powerful tool, yet it does not make the operators skilled: an actor that can afford premium commercial tooling but operates it clumsily has money without skill. Reverse the evidence and you get the opposite combination: a small group with no visible spending that writes clever custom tooling is capable but poorly funded.

Crime syndicates/organized crime are external, well-funded and capable groups whose defining trait is that they attack for profit, run like a business. Card-fraud rings that split work between people who steal data, people who cash it out and people who launder the proceeds, or business email compromise crews that run invoice-redirection schemes at scale, are organized crime. Skill alone does not separate them from a state-sponsored group, because both can be highly capable; what separates them is the goal the evidence points to, profit for organized crime and national interest for a state.

An unskilled attacker sits at the other end of the scale: external, low funding and low sophistication. They rely on ready-made tools, scripts and tutorials that they could not have written themselves, and they usually run them with default settings against whatever target is convenient. Older material calls this a script kiddie. Unskilled attackers can still cause real outages, because a downloaded denial-of-service tool works whoever presses the button, but they rarely adapt when a defense blocks them.

A state-sponsored actor works for or on behalf of a government. It has the most resources and capability of any actor type, and it serves national goals: espionage against other governments and defense suppliers, influence over foreign opinion and elections, or disruption of a rival's economy during a dispute. Typical evidence is long-lived covert access measured in months or years, custom tooling, targets that line up with one nation's strategic interests, no ransom demand or public claim. Sustained, stealthy campaigns of this kind are often described as an advanced persistent threat (APT); Security+ places APT under threat vectors and sources (objective 2.3), so here the point is simply that state backing is what makes that persistence affordable.

State-sponsored groups sometimes disguise destructive attacks as crime. A destructive attack disguised as criminal activity, which never actually produces money for the attacker, suggests a state hiding its hand rather than a criminal group seeking profit.

A terrorist actor aims to cause fear and physical or societal harm, typically by attacking critical infrastructure and public services such as water treatment, power, emergency dispatch or hospitals, and then publicizing the threat of more to come. The target alone does not decide the label (a hacktivist may knock an energy company's public website offline); the intent does. Endangering the public to spread fear is terrorism; a claimed, cause-driven disruption that deliberately avoids harming people is hacktivism.

A hacktivist attacks to advance a cause, whether social, environmental, religious or political. Common methods are website defacement, denial of service and leaking documents, and the actor wants publicity for the cause: attacks are announced, claimed, and accompanied by a message or manifesto. Hacktivist groups are usually loosely organized, recruit in the open and have modest funding, which separates them from state-sponsored groups even when both act for political reasons.

A competitor is a rival organization seeking market advantage. It steals intellectual property such as prototype designs, pricing and bid documents, or disrupts a rival at a commercially decisive moment, for example by sabotaging a rival's product launch or a major sales event. Competitors make no ransom demand and no public statement, and stolen data does not appear for sale or online; instead the benefit shows up later in the market. The most useful question is who benefits? When stolen work reappears in a rival's product, or a disruption is timed to help one bidder, the competitor is the likely actor.

The table gives the typical profile; a real incident is classified by its evidence, not by the stereotype.

An insider threat is a person who already holds legitimate access and knowledge of the organization and deliberately misuses it. A warehouse clerk altering stock records to cover goods he is reselling, a sales representative forwarding a customer export before joining a rival, or an engineer sabotaging a release after being passed over for promotion are all insiders. Because their access is authorized, perimeter controls do not stop them; least privilege, separation of duties, monitoring and prompt deprovisioning on departure do. What separates a malicious insider from an honest mistake is evidence of intent, such as concealment, and that evidence carries more weight than the explanation the person gives afterwards.

An accidental/unintentional actor causes harm through error with no malicious intent: an HR assistant sends a salary spreadsheet to the wrong distribution list, a manager leaves an unlocked laptop on a train, someone disables a firewall rule while troubleshooting and forgets to restore it. The damage can be serious, but there is no motivation in the objective 2.2 sense. Classify these cases on two axes: internal or external (usually internal) and malicious or unintentional.

When several people are involved in one incident, classify each person separately. If an outside fraud ring recruits a help-desk agent to reset account passwords on request, the ring is organized crime, while the agent is a separate actor, an insider, with a motivation of their own. Likewise, a facilities contractor who uses a building badge the client issued to enter a restricted room without reason is an internal actor from the client's point of view.

Financial motivation is direct monetary gain: stealing card numbers to sell, committing payment fraud, redirecting payroll, or hijacking servers to mine cryptocurrency (cryptojacking). The attacker takes value without asking the victim for anything.

Extortion is coercion: pay, or we will leak, keep encrypting, or keep disrupting. Ransomware, threatening to publish stolen records unless paid by a deadline, and denial-of-service attacks that stop once a fee is paid are all extortion. The test is whether the harm is presented as reversible or avoidable on payment. Extortion still involves money, but Security+ treats it as its own motivation because of the threat that drives it.

A grievance does not change this. A laid-off developer who plants a logic bomb and offers to disarm it for a fee is acting on extortion, even though resentment set it off, because the harm is held hostage against a demand.

Intellectual property theft takes a protected creation: designs, formulas, source code, prototypes. The goal is the asset itself, and the theft can be a single grab-and-leave intrusion.

Espionage is covert intelligence gathering, usually by watching over time: reading diplomatic traffic, strategy memos or bid plans to learn what the target knows and plans. The value is in decisions and secrets as they develop, which is why espionage campaigns try to stay hidden for months. Both state-sponsored actors and competitors may be motivated by espionage.

Influence aims to shape what people think or decide. Disinformation campaigns and doctored leaks serve influence. The common thread is that nothing needs to be kept or sold: the payoff is a change in public opinion. One campaign can combine two motivations: quietly collecting a public figure's private messages is espionage, while later publishing altered extracts to turn opinion is influence.

The remaining motivations split into those driven by a cause (ideological, political, fear/chaos, ethical) and those driven by the attacker's own wants (notoriety, general curiosity, revenge).

Cause-driven

Ideological motivation comes from a belief system, such as a religion, an economic philosophy or a moral cause, and shows in how targets are chosen: every victim is something the belief system condemns, and the attacker typically asks for nothing specific.

Political motivation targets a government, party, law, policy or vote and usually carries a concrete demand about it, for example a demand that a regulator reverse a ruling. The working distinction: a belief system driving target choice is ideological; a demand aimed at a law, policy, government or vote is political. A hacktivist group can act on either, so classify the actor and the motivation separately.

Fear/chaos is the motivation when panic and disruption are the goal in themselves: attacks designed to make the public feel unsafe, with nothing asked of anyone. With no way to pay and nothing asked for, it is not extortion.

Ethical motivation means the actor believes the action is right and seeks no gain. Responsible vulnerability disclosure and good-faith whistleblowing about genuine wrongdoing, with no payment sought, are the typical forms. What makes it ethical is real wrongdoing or risk disclosed to someone able to fix it, without personal gain or grievance; publishing data that exposes no wrongdoing is not ethical disclosure.

Personal

Notoriety is the desire for fame, status or bragging rights. The attacker claims credit under a known handle, posts screenshots and invites others to admire the work. Notoriety is about the attacker's own reputation, whereas a hacktivist's publicity is for a cause.

General curiosity is exploring to see what is possible or what is there, with no gain and no audience. Notoriety needs an audience; curiosity does not.

Revenge is retaliation for a perceived wrong, most often by disgruntled current or former staff right after a firing, a non-renewal or a dispute. The harm is the point, and nothing is demanded: sabotaged systems or embarrassing leaks. If the same person attaches a demand and offers to undo the damage on payment, the motivation becomes extortion.

Classify actor, motivation and attributes from the evidence, one dimension at a time:

1. Start with access. Did the person use access the organization granted (internal) or have to break in (external)? Was there intent, or was it a mistake (insider vs accidental)?
2. Follow the outcome. What happened after access was gained? Money taken directly (financial), a demand with a threat (extortion), secrets watched over time (espionage), a creation copied (intellectual property), opinion manipulated (influence), harm with no demand (revenge or fear/chaos).
3. Look at publicity. A public claim with a cause points to a hacktivist; a claim for personal fame points to notoriety; silence fits state-sponsored actors, competitors and curious explorers.
4. Ask who benefits. A rival company, a government, a criminal business or a cause.
5. Read capability and funding separately. Bought tools show funding; custom tools and evasion show sophistication.

Capability narrows the field but rarely decides it: both organized crime and state-sponsored groups can use custom malware, so let the motivation settle the label. Equally, a single target type such as critical infrastructure can attract terrorists, hacktivists and states; the intent decides.