Threat Actor Motivations
Understanding why threat actors attack, including data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical/political beliefs, revenge, chaos/disruption, and warfare. Motivation determines targets, methods, and persistence.
Understanding Threat Actor Motivations
Understanding WHY threat actors attack is as important as knowing WHO they are. Motivation drives everything—the targets chosen, methods used, persistence level, and what success looks like to the attacker.
The main motivations include: • Financial gain — Profit through ransomware, fraud, theft • Espionage — Stealing secrets for competitive or national advantage • Service disruption — Taking systems offline • Philosophical/Political beliefs — Advancing a cause • Revenge — Retaliation for perceived wrongs • Chaos — Disruption for its own sake • Warfare — Military/strategic objectives
Knowing the motivation helps predict behavior and prioritize defenses around what attackers actually want.
Why This Matters for the Exam
SY0-701 frequently tests the connection between actor types and motivations. Scenario questions ask you to identify likely motivation based on attack characteristics, or match motivations to actor types.
Understanding motivation helps with incident response—a ransomware attack (financial) requires different handling than espionage (data protection). It also helps with threat modeling—if you have valuable intellectual property, espionage-motivated actors are your primary concern.
Motivation also affects whether negotiation is possible, how persistent the attacker will be, and what "winning" means to them.
Deep Dive
Data Exfiltration
Stealing data to use, sell, or leverage elsewhere.
What Gets Stolen:
- •Intellectual property (designs, formulas, code)
- •Personal information (PII, PHI)
- •Financial data (credit cards, bank accounts)
- •Credentials (usernames, passwords)
- •Strategic information (plans, communications)
Who Does It:
- •Nation-states (for espionage)
- •Organized crime (for sale or fraud)
- •Competitors (for business advantage)
- •Insiders (for personal gain or revenge)
Methods:
- •Malware with exfiltration capabilities
- •Cloud storage abuse
- •Email forwarding
- •Physical media (USB drives)
- •Covert channels
Espionage
Gathering intelligence for competitive, political, or military advantage.
Types of Espionage:
| Type | Target | Actor |
|---|---|---|
| National | Government secrets, military | Nation-states |
| Corporate | Trade secrets, strategies | Competitors, nation-states |
| Political | Campaign info, policies | Nation-states, political opponents |
Characteristics:
- •Long-term, persistent access preferred
- •Stealth is paramount (don't want to be detected)
- •High-value targets carefully selected
- •May not cause obvious damage (just watches/copies)
Espionage vs. Data Exfiltration:
- •All espionage involves data exfiltration, but not all data exfiltration is espionage. Stealing credit cards for fraud isn't espionage—it's financial crime.
Service Disruption
Taking systems or services offline, making them unavailable.
Methods:
- •DDoS attacks (overwhelming with traffic)
- •Ransomware (encrypting systems)
- •System destruction (wiping data)
- •Infrastructure attacks (power, network)
Motivations for Disruption:
- •Extortion (pay to restore service)
- •Political statement (hacktivism)
- •Military objective (warfare)
- •Competitive sabotage
- •Revenge
- •Pure chaos
Impact:
- •Business revenue loss
- •Reputation damage
- •Operational paralysis
- •Public safety risks (critical infrastructure)
Blackmail and Extortion
Threatening to cause harm unless demands are met.
Forms of Cyber Blackmail:
Ransomware
- •Encrypt data, demand payment for key
- •Double extortion: encrypt + threaten to leak
- •Triple extortion: add DDoS or contact victims' customers
Data Exposure Threats
- •Steal sensitive data
- •Threaten public release
- •Demand payment for silence
Sextortion
- •Threaten to release compromising images/information
- •Often uses fake claims in mass emails
Who Uses Blackmail:
- •Organized crime (ransomware operations)
- •Individual criminals
- •Some hacktivists (data exposure threats)
Financial Gain
Profit-motivated attacks—the most common motivation for cybercrime.
Methods:
| Attack Type | How Money Is Made |
|---|---|
| Ransomware | Direct payment from victims |
| BEC (Business Email Compromise) | Fraudulent wire transfers |
| Card theft | Selling cards or making purchases |
| Banking trojans | Stealing from bank accounts |
| Cryptojacking | Mining cryptocurrency on victim systems |
| Fraud | Various scams and deceptions |
Who Is Financially Motivated:
- •Organized crime (primary motivation)
- •Individual criminals
- •Some insiders
- •NOT typically nation-states or hacktivists
Philosophical/Political Beliefs (Hacktivism)
Attacking to advance ideological, political, or social causes.
Characteristics:
- •Target selection based on beliefs
- •Seek publicity for their cause
- •Want to embarrass or expose targets
- •May release stolen data publicly
- •Variable technical sophistication
Common Tactics:
- •Website defacement
- •DDoS against target organizations
- •Data leaks (exposing wrongdoing)
- •Doxing (exposing individuals)
Examples:
- •Attacking companies seen as unethical
- •Targeting government policies
- •Exposing corruption or abuse
Revenge
Retaliation for perceived wrongs, real or imagined.
Who Seeks Revenge:
- •Disgruntled employees (fired, passed over)
- •Former partners or associates
- •Unhappy customers
- •Anyone with a grievance
Revenge Actions:
- •Data destruction
- •Data theft and exposure
- •System sabotage
- •Reputation damage
- •Harassment
Insider Advantage: Revenge-motivated insiders are particularly dangerous because they have access and knowledge.
Chaos and Disruption
Causing damage and disorder for its own sake, without clear profit or political motive.
Characteristics:
- •No specific goal beyond disruption
- •May be random targeting
- •"Watch the world burn" mentality
- •Sometimes testing skills
Who Causes Chaos:
- •Some script kiddies
- •Nihilistic hackers
- •Thrill-seekers
War and Cyber Warfare
Military or strategic attacks by or on behalf of nation-states.
Objectives:
- •Degrade enemy capabilities
- •Gather military intelligence
- •Disrupt critical infrastructure
- •Support kinetic military operations
- •Influence operations
Characteristics:
- •State-sponsored or directed
- •May target military, government, critical infrastructure
- •Can include sabotage (Stuxnet)
- •May be part of hybrid warfare
- •Often highly sophisticated
Motivation by Actor Type
| Actor Type | Primary Motivations |
|---|---|
| Nation-State | Espionage, warfare, disruption |
| Organized Crime | Financial gain, blackmail |
| Hacktivist | Philosophical beliefs, exposure |
| Insider (Malicious) | Revenge, financial gain |
| Script Kiddie | Chaos, reputation, curiosity |
How CompTIA Tests This
Example Analysis
Scenario: A major retailer announces a data breach where attackers stole 40 million credit card numbers. The stolen data later appears for sale on dark web marketplaces. Investigation reveals the attackers used point-of-sale malware similar to known criminal tools.
Motivation Analysis:
Primary Motivation: Financial Gain • Credit card data stolen (high financial value) • Data sold on dark web (monetization) • POS malware is standard criminal toolkit • No political statements or demands • No data destruction or service disruption
Supporting Evidence: • Retail target = high-volume card data • Sale of data = clear profit motive • Known criminal tools = organized crime methods • No ransom demand = just theft for resale
Actor Type: Organized Crime
What This Rules Out: • Not espionage — Credit cards aren't intelligence • Not hacktivism — No political message or public statement • Not warfare — Retail isn't military/infrastructure target • Not revenge — Too sophisticated and profit-focused
Key insight: The monetization method (selling on dark web) is the clearest indicator of financial motivation.
Key Terms to Know
Common Mistakes to Avoid
Exam Tips
Memory Trick
"DEFBRPCW" - Motivations
- •Data exfiltration (stealing data)
- •Espionage (intelligence gathering)
- •Financial gain (profit)
- •Blackmail/extortion
- •Revenge (retaliation)
- •Philosophical beliefs (hacktivism)
- •Chaos (disruption for its own sake)
- •Warfare (military objectives)
- •Actor-Motivation Matching:
- •Nation-state = National interests (espionage, warfare)
- •Organized crime = Only money matters
- •Hacktivist = Heart-driven (beliefs)
- •Insider = Injury perceived (revenge) or financial
- •Script kiddie = Seeking thrills (chaos, reputation)
Ransomware Motivation Check: Ransomware = Financial (they want payment) NOT service disruption (disruption is the leverage, not the goal)
Test Your Knowledge
Q1.A hacker group attacks a company and publicly releases internal documents showing environmental violations, along with a manifesto about corporate responsibility. What is the PRIMARY motivation?
Q2.An organization experiences a ransomware attack demanding Bitcoin payment. What is the attacker's PRIMARY motivation?
Q3.A nation-state actor maintains long-term access to a defense contractor's network, carefully avoiding detection while copying documents about military projects. What is the PRIMARY motivation?
Want more practice with instant AI feedback?
Practice with AIContinue Learning
Ready to test your knowledge?
Practice questions on threat actor motivations and other Objective 2.1 concepts.