5 Threat Actors and Motivations · Security+

Exam objective 2.2: Describe common threat actors and motivations.

This objective is about the people behind attacks. It covers eight types of threat actors—organized crime, terrorists, unskilled attackers, hacktivists, insiders, accidental or unintentional actors, competitors, and state-sponsored groups—along with the twelve motivations the objectives list and the three attributes used to compare actors: whether they are internal or external, how much funding and resources they have, and how sophisticated and capable they are.

This is a "describe" objective. You will not be asked to attribute a real-world attack to a named group, but you will be asked to read a short scenario and identify the most likely type of actor, the most likely motivation, or the attribute that distinguishes one actor from another. The skill to build is pattern recognition: certain combinations of target, method, and outcome point clearly to one actor type. Understanding actors also feeds directly into threat modeling and risk assessment, because the likelihood of an attack (Chapter 4) depends heavily on who might want to attack you and what they are capable of.

Why Threat Actors Matter

Defenders cannot protect equally against everything. Knowing which actors are likely to target an organization—and what those actors want—helps prioritize controls. A small accounting firm is far more likely to face financially motivated criminals than a foreign intelligence service, and should invest accordingly in phishing defenses, backups, and payment-fraud controls. A defense contractor, by contrast, must assume that well-funded state-sponsored groups want its designs and will be patient and stealthy in pursuing them.

Threat actor analysis also guides incident response. If an incident shows the hallmarks of a ransomware affiliate, responders expect data theft followed by encryption and an extortion demand. If it shows the hallmarks of an espionage group, responders expect stealthy persistence, multiple backdoors, and careful exfiltration—so a hasty eradication that tips off the attacker could cause them to go deeper underground.

Note

The term threat actor (or malicious actor) refers to the individual or group responsible for a threat. Older materials used "hacker" generically; modern usage reserves "hacker" for anyone with deep technical skill, malicious or not. Some sources also describe hackers by "hat color": black hat (malicious, unauthorized), white hat (authorized, ethical), and gray hat (unauthorized but without clear malicious intent). CompTIA's current terminology prefers unauthorized, authorized, and semi-authorized.

Threat Actor Attributes

Before looking at each actor type, it helps to know the three attributes the objectives use to compare them. These attributes appear repeatedly in exam questions as the distinguishing detail.

Internal vs. External

An internal threat actor has legitimate, authorized access to the organization's systems, facilities, or information: employees, contractors, temporary workers, and sometimes trusted partners with network connections. An external threat actor has no authorized access and must gain it through an attack. The distinction matters because the two require different defenses. External actors must breach the perimeter or trick someone inside, so perimeter defenses, email filtering, vulnerability management, and MFA are central. Internal actors are already past those controls, so defenses focus on least privilege, separation of duties, monitoring of user activity, data loss prevention, and strong offboarding. Insider incidents are often harder to detect because the actor's activity looks legitimate.

Note that an external actor who steals an employee's credentials acts with internal access but is still an external threat actor. Questions sometimes test this distinction.

Figure 5.1: Internal actors already hold authorized access while external actors must breach or trick their way in, which calls for different defenses

Resources and Funding

Resources and funding describe how much money, time, staff, infrastructure, and tooling an actor can bring to bear. Resources determine how persistent an actor can be, whether it can buy or develop zero-day exploits, whether it can run large botnets, and whether it can afford to wait months for an opportunity.

High resources: state-sponsored groups (government budgets) and large organized crime syndicates (proceeds of crime).
Moderate resources: competitors engaging in corporate espionage, well-organized hacktivist collectives, and terrorists in some cases.
Low resources: unskilled attackers, most individual hacktivists, and most insiders (though insiders compensate with access).

Level of Sophistication and Capability

Sophistication and capability describe technical skill and the ability to develop custom tools, find new vulnerabilities, evade detection, and adapt. Highly capable actors write their own malware, develop or purchase zero-days, chain exploits, use living-off-the-land techniques to blend in, and operate stealthily for long periods. Low-capability actors depend on tools, scripts, and services built by others. Resources and sophistication often go together, but not always. A brilliant lone researcher may be highly capable with almost no funding, and a well-funded but poorly organized criminal group may rely mostly on purchased tools. Ransomware-as-a-service illustrates the gap: an affiliate with modest skill can rent highly sophisticated tooling.

Actor Internal/External Resources/Funding Sophistication
State-sponsored External Very high Very high
Organized crime External High Moderate to high
Competitor External (may recruit insiders) Moderate to high Varies
Terrorist External Low to moderate Low to moderate

Hacktivist External (sometimes internal) Low to moderate Low to moderate Unskilled attacker External Low Low

Insider (malicious) Internal Low Varies; high access

Accidental/unintentional Internal Not applicable Not applicable

If a question asks which attribute BEST distinguishes an insider from other actors, the answer is internal versus external—the insider already has authorized access. If it asks why a state-sponsored group can maintain an operation for years or develop zero-days, the answer is resources/funding or sophistication/capability.

Threat Actors

State-Sponsored (Nation-State) Actors

State-sponsored actors are groups directly employed by, directed by, or supported by a national government. They include military cyber units, intelligence services, and contractor or proxy groups that operate with government backing and protection.

Characteristics:

Very high resources and sophistication. They can develop custom malware, discover and stockpile zero-day vulnerabilities, compromise supply chains, and maintain large operational teams.
Patience and persistence. They are the classic source of the advanced persistent threat (APT)— an attacker that gains access and remains undetected for months or years (Chapter 6 discusses APT as a threat source). The term APT is now often used as a label for specific state-linked groups.
Strategic objectives. Their goals serve national interests: espionage (military, political, economic), disruption of adversaries' critical infrastructure, influence operations during elections, theft of intellectual property to benefit domestic industries, and, for some states, revenue generation through cryptocurrency theft to evade sanctions.
Plausible deniability. States often use proxies, false-flag techniques (planting misleading clues pointing to another country), and infrastructure in third countries to make attribution difficult. Targets include government agencies, defense contractors, critical infrastructure (energy, water, telecommunications), technology companies, research institutions, and the supply chains that serve them. Well-known examples of state-attributed activity include the Stuxnet attack on Iranian uranium enrichment centrifuges, the SolarWinds Orion supply-chain compromise, and attacks on the Ukrainian power grid.

An aerospace manufacturer discovers that an attacker has had access to its engineering network for fourteen months. The attacker used a previously unknown vulnerability in a VPN appliance, deployed custom malware that existed nowhere else, moved slowly to avoid detection, and exfiltrated design files for a new aircraft in small, encrypted chunks disguised as normal HTTPS traffic. No ransom was demanded and nothing was destroyed. The long dwell time, custom tools, zero-day exploit, focus on design data, and absence of a financial demand all point to a state-sponsored actor motivated by espionage.

Organized Crime and Crime Syndicates

Organized crime (crime syndicates) are criminal groups that operate like businesses to make money through cybercrime. Modern cybercrime is an industry with specialization: some groups develop malware, some sell initial access to compromised networks (initial access brokers), some run ransomware operations, some launder cryptocurrency, and some operate the infrastructure (bulletproof hosting, botnets) others rent.

Characteristics:

Financial motivation above all. Activities include ransomware and extortion, business email compromise (BEC), payment card theft, banking trojans, cryptojacking, identity theft, and selling stolen data.
Substantial resources from criminal proceeds, enabling them to purchase exploits, hire specialists, and run professional operations with help desks for ransom victims.
Moderate to high sophistication, especially in ransomware groups that perform careful reconnaissance, disable backups, and steal data before encrypting.
Ransomware-as-a-service (RaaS), where developers lease their ransomware to affiliates in exchange for a share of the ransom.

Figure 5.2: The specialized cybercrime ecosystem behind a ransomware-as-a-service attack

Organized crime typically chooses targets by ability to pay and likelihood of paying—hospitals, manufacturers, local governments, schools, and companies with cyber insurance—as well as by opportunity, such as a widely exploitable vulnerability.

Exam tip

When a scenario involves a ransom demand, stolen card data sold online, BEC wire fraud, or a professional "customer service" portal for ransom negotiation, think organized crime with a financial motivation.

Terrorists

Terrorists use violence or the threat of violence to advance political, religious, or ideological goals, typically by creating fear in a population. In cyberspace, terrorist groups use the internet for propaganda, recruitment, fundraising, and communication, and some have attempted cyberattacks intended to cause physical harm or widespread disruption—cyberterrorism.

Characteristics:

Motivations: ideological, political, and fear/chaos.
Targets: critical infrastructure (power, water, transportation), high-profile organizations, and anything whose disruption would generate fear and publicity.
Resources and sophistication are generally lower than those of nation-states, though a terrorist group could buy capabilities from criminals or receive support from a sponsoring state. The distinguishing feature is intent to intimidate or coerce through fear, often with the goal of physical consequences. Defacing a website with a political message is more characteristic of a hacktivist; attempting to manipulate a water treatment plant's chemical levels to harm the public is closer to terrorism.

Hacktivists

Hacktivists (hacker + activist) use cyberattacks to promote a political, social, or ideological cause. They want attention for their cause and to embarrass, expose, or disrupt organizations they oppose. Common hacktivist techniques:

Website defacement that replaces content with a political message.
Distributed denial-of-service (DDoS) attacks to take a target offline, sometimes using volunteer-run tools.
Doxing: publishing personal information about individuals, such as executives or officials.
Data leaks: stealing and publishing internal documents to expose perceived wrongdoing. Hacktivist groups vary widely in skill. Many members are low-skill volunteers, but some collectives include capable individuals. Some groups that present themselves as independent hacktivists have been linked to state sponsors, who use the hacktivist label as cover.

Common trap

Hacktivists and terrorists both have ideological or political motivations, so look at the intended outcome. Hacktivists seek publicity, exposure, and disruption to promote a cause. Terrorists seek to create fear, often through physical harm. Whistleblowers who expose wrongdoing through proper channels are not hacktivists, and they are not acting as threat actors.

Unskilled Attackers

An unskilled attacker has little technical knowledge and relies on tools, exploits, and scripts written by others. Older materials call this actor a script kiddie. The term "unskilled" refers to the actor's own capability, not the danger of their tools: freely available frameworks, exploit code published on code-sharing sites, DDoS-for-hire (booter or stresser) services, and ransomware-as-a-service give unskilled attackers access to powerful capabilities. Generative AI tools may also lower the barrier further. Characteristics:

Low resources and sophistication. They do not develop exploits and often do not fully understand the tools they use.
Opportunistic targeting. They scan the internet for known vulnerabilities and hit whatever is exposed, rather than targeting specific organizations.
Motivations: notoriety, general curiosity, thrill-seeking, revenge, or small-scale financial gain.
Noisy. Because they lack skill, their attacks are often detectable and may cause collateral damage. Unskilled attackers are best defended against by basic hygiene: patching, removing unnecessary services, changing default credentials, and using standard security tools. A well-maintained environment defeats most of them.

Insiders (Malicious)

An insider threat is a current or former employee, contractor, or business partner who has or had authorized access and intentionally misuses it to harm the organization. Insiders are dangerous because they already have access, know where valuable data resides, understand internal processes and controls, and are trusted.

Common insider scenarios:

A disgruntled employee who has been passed over for promotion or is about to be terminated sabotages systems or deletes data (revenge).
An employee who plans to join a competitor copies customer lists or source code (financial gain, intellectual property theft).
An employee recruited or bribed by a foreign intelligence service or competitor passes information (espionage).
An employee commits fraud, such as creating fictitious vendors and approving payments to them (financial).
An administrator plants a logic bomb that will delete data if their account is ever disabled (revenge, extortion).

Defenses include least privilege, separation of duties, job rotation and mandatory vacations, user behavior analytics (UEBA), DLP, logging of privileged actions, background checks, and prompt access revocation at termination. Chapter 18 covers access reviews and deprovisioning.

Real-world scenario

Two days after being told her position is being eliminated, a database administrator at an insurance company runs a script that copies the claims database to a personal cloud storage account. The DLP system flags the large upload, and a review shows she accessed tables unrelated to her current project. The actor is internal, the access was authorized but misused, and the likely motivations are financial (selling or using the data at a new employer) or revenge. Prompt revocation of privileged access when the termination decision was made would have reduced the risk.

Accidental or Unintentional Insiders

An accidental or unintentional threat actor causes harm without malicious intent—through mistakes, negligence, or being manipulated. Accidental insiders are responsible for a large share of security incidents.

Examples:

An employee emails a spreadsheet of customer data to the wrong external recipient.
An administrator misconfigures a cloud storage bucket, making it publicly readable.
A developer accidentally commits an API key to a public code repository.
A user clicks a phishing link and enters credentials on a fake page.
An employee loses an unencrypted laptop.
A technician deletes the wrong virtual machine during maintenance.

Accidental actors have no motivation in the attacker sense—they did not want the outcome. Defenses focus on security awareness training (Chapter 27), guardrails that make mistakes harder (DLP, configuration policies, secret scanning), encryption of portable devices, change management (Chapter 2), and backups.

Exam tip

If a scenario describes harm caused by a well-meaning employee who made an error or was tricked, the actor type is accidental/unintentional, not malicious insider. An employee who is phished is a victim whose mistake enables an external attacker; the attacker is the threat actor, and the employee's error is the unintentional component.

Competitors

Competitors are rival businesses that may engage in illegal activity to gain a market advantage. This is often called corporate espionage or industrial espionage.

Competitor activities can include:

Stealing trade secrets, product designs, pricing, customer lists, and bid information.
Recruiting or bribing a target's employees to provide information (creating an insider).
Launching DDoS attacks to disrupt a rival during a peak sales period.
Sabotaging a rival's reputation through leaked data or disinformation.

Competitors generally have moderate to substantial resources and may hire skilled contractors or criminal groups to do the work. Their main motivations are financial gain and intellectual property, with espionage as the method. Distinguishing competitors from state-sponsored actors in IP-theft scenarios usually comes down to scale and context: a rival company stealing a bid is a competitor; a sustained, highly sophisticated campaign against an entire industry for national economic advantage points to a nation-state.

Threat Actor Motivations

Motivation is why an actor attacks. Motivation shapes target selection, methods, and what the attacker does after gaining access. The objectives list twelve motivations.

Financial

Financial motivation is the most common motivation overall. Methods include ransomware, extortion, theft of payment card and banking data, BEC and invoice fraud, cryptojacking (using victims' computers to mine cryptocurrency), selling stolen data and network access, and insider fraud. Organized crime is the archetype, but insiders, competitors, unskilled attackers, and even some state-sponsored groups pursue money.

Influence

Influence operations aim to shape opinions, decisions, or behavior—of voters, consumers, governments, or markets. Techniques include disinformation and misinformation campaigns, hack-and-leak operations timed to affect elections, fake social media accounts and bot networks, and deepfakes. Influence is commonly associated with state-sponsored actors and some hacktivists.

Intellectual Property

Intellectual property (IP) motivation targets valuable non-public knowledge: trade secrets, designs, source code, formulas, research data, and manufacturing processes. IP theft lets the attacker or its sponsor avoid years of research cost. State-sponsored groups, competitors, and malicious insiders are the usual actors.

Notoriety

Notoriety (fame or bragging rights) motivates attackers who want recognition from peers or the public. Defacements signed with a handle, attacks on high-profile targets, and boasting on forums or social media indicate notoriety. Unskilled attackers and some hacktivists are commonly motivated this way.

Espionage

Espionage is the covert gathering of confidential information—military, political, diplomatic, or economic. It is the primary motivation of state-sponsored intelligence operations and also underlies corporate espionage by competitors. Espionage favors stealth: the attacker wants long-term undetected access, not disruption.

Fear and Chaos

Fear and chaos (also called disruption) motivate attackers who want to cause panic, undermine trust in institutions, or create widespread disorder. Destructive attacks on critical infrastructure, wiper malware disguised as ransomware, and attacks timed to coincide with physical events fit this motivation. Terrorists and some state-sponsored actors pursue it.

Extortion

Extortion is obtaining money or concessions through threats. Ransomware is the leading example, and modern operations use double extortion (encrypt data and threaten to leak stolen copies) or triple extortion (adding DDoS attacks or contacting the victim's customers). Data-theft-only extortion, without encryption, is also common. Other forms include DDoS extortion ("pay or we take you offline") and sextortion scams. Extortion is a method of achieving financial gain, so questions may offer both; choose extortion when the threat-for-payment dynamic is the focus.

General Curiosity

General curiosity drives individuals who break into systems to see whether they can or to learn how things work, without a clear intent to profit or cause harm. Curiosity-driven intrusions are still unauthorized and can cause damage, and curious attackers sometimes escalate. Unskilled attackers and young hobbyists are commonly associated with curiosity.

Revenge

Revenge motivates attackers who believe they have been wronged—most often a disgruntled current or former employee, but also a former customer or business partner. Revenge attacks frequently involve sabotage: deleting data, planting logic bombs, leaking embarrassing information, or locking the organization out of systems.

Ideological

Ideological motivation stems from a belief system—religious, social, environmental, or philosophical. Hacktivists and terrorists are the typical actors. Targets are organizations seen as opposing the actor's beliefs.

Political

Political motivation aims to influence government policy, elections, or political outcomes, or to retaliate against political decisions. Hacktivists, terrorists, and state-sponsored actors may all be politically motivated. Political and ideological motivations overlap heavily; questions typically point to political when a government, election, policy, or geopolitical conflict is involved.

Ethical

Ethical motivation describes actors who hack to improve security or serve what they believe is the greater good. Authorized penetration testers and bug bounty participants act ethically and with permission—they are not threat actors. The motivation becomes a threat concern when someone acts without authorization, for example a researcher who probes a company's systems without permission to "prove a point" and then publicly discloses the flaw (a gray-hat behavior). Even with good intentions, unauthorized access is illegal and can cause disruption. Responsible disclosure programs (Chapter 16) give ethical researchers a legitimate channel.

Motivation Typical actors Telltale scenario clue

Financial Organized crime, insiders, competitors Ransom, fraud, stolen card data, cryptojacking Influence State-sponsored, hacktivists Disinformation, election-timed leaks, bot networks Intellectual property

State-sponsored, competitors, insiders Theft of designs, source code, research Notoriety Unskilled attackers, hacktivists Signed defacement, bragging online Espionage State-sponsored, competitors Long dwell time, stealthy exfiltration Fear/chaos Terrorists, state-sponsored Destructive attacks on infrastructure, wipers Extortion Organized crime "Pay or we leak/encrypt/DDoS"

General curiosity

Unskilled attackers, hobbyists "Wanted to see if I could"

Revenge Disgruntled insiders, former employees Sabotage after termination or dispute Ideological Hacktivists, terrorists Attacks on organizations opposing a belief Political Hacktivists, state-sponsored, terrorists Attacks tied to policy, elections, conflicts Ethical Unauthorized researchers (gray hat) Unrequested testing followed by disclosure

Memory aid

Match actor to motive with short pairings: crime = cash, state = secrets (espionage), hacktivist = cause, terrorist = terror, insider = grudge or greed, competitor = edge, unskilled = fame and fun, accidental = no motive at all.

Reading Scenario Questions

Actor questions usually give you three or four clues. Look for:

Who has access? Authorized access points to an insider (malicious or accidental).
What did they take or do? Money and ransom point to organized crime; designs and secrets point to state-sponsored or competitor espionage; defacement and DDoS with a message point to hacktivists.
How skilled was it? Custom malware, zero-days, and long dwell time point to state-sponsored actors. Off-the-shelf tools and noisy scanning point to unskilled attackers.
What was the intended outcome? Fear and physical harm point to terrorists; publicity for a cause points to hacktivists; private profit points to criminals or competitors.

Figure 5.3: Four questions that turn scenario clues into the most likely threat actor

Common trap

Do not choose "state-sponsored" just because an attack was serious. Ransomware that shut down a hospital was serious, but if the attacker demanded payment and used a commercial RaaS kit, the best answer is organized crime with a financial or extortion motivation. Pick the actor whose motivation and attributes best fit the clues.

During a dispute over logging in a national forest, a timber company's website is replaced with a page reading "Stop destroying our forests," signed by an environmental collective. A week later, the company's investor-relations site is hit with a DDoS attack announced in advance on social media. The attackers used freely available tools and caused no lasting damage. The actor is a hacktivist group; the motivation is ideological (environmental belief), with elements of notoriety; the attributes are external, low to moderate resources, and modest sophistication.

Defending Based on Actor Profiles

Threat modeling uses actor profiles to tailor defenses:

Against unskilled attackers: baseline hygiene—patching, hardening, removing defaults, perimeter filtering.
Against organized crime: phishing-resistant MFA, EDR, immutable and offline backups, email security, payment verification procedures for BEC, and an incident response plan for ransomware.
Against hacktivists: DDoS protection, web application hardening, monitoring for defacement, and preparing communications for public incidents.
Against insiders: least privilege, separation of duties, UEBA, DLP, logging privileged activity, and fast deprovisioning.
Against accidental actors: training, guardrails, DLP, encryption, and backups.
Against competitors: protecting IP with classification, access control, DLP, and insider monitoring; NDAs and legal protections.
Against state-sponsored actors: defense in depth, threat hunting, supply-chain risk management, segmentation, Zero Trust, and assume-breach monitoring.
Against terrorists: hardened critical infrastructure, OT segmentation, and coordination with government agencies.

Chapter Summary

Threat actors are compared by three attributes: internal vs. external (authorized access or not), resources/funding, and level of sophistication/capability.
State-sponsored actors are external, very well funded, and highly sophisticated; they pursue espionage, IP, influence, political goals, and disruption, and are associated with APTs.
Organized crime is financially motivated and professional, using ransomware, extortion, BEC, and data theft, often through RaaS affiliate models.
Terrorists seek fear and chaos for ideological or political ends, often targeting critical infrastructure.
Hacktivists promote causes through defacement, DDoS, doxing, and leaks; they seek publicity.
Unskilled attackers rely on others' tools, attack opportunistically, and seek notoriety or curiosity.
Malicious insiders misuse authorized access for revenge, money, IP theft, or espionage. Accidental/unintentional actors cause harm through mistakes, with no malicious motive.
Competitors engage in corporate espionage for financial advantage and IP.
The twelve motivations: financial, influence, intellectual property, notoriety, espionage, fear/chaos, extortion, general curiosity, revenge, ideological, political, and ethical.

Key Terms

Threat actor; internal threat actor; external threat actor; resources and funding; sophistication and capability; state-sponsored actor; nation-state; advanced persistent threat (APT); false flag; organized crime; crime syndicate; initial access broker; ransomware-as-a-service (RaaS); affiliate; terrorist; cyberterrorism; hacktivist; defacement; doxing; unskilled attacker; script kiddie; insider threat; disgruntled employee; accidental/unintentional threat; competitor; corporate espionage; black hat; white hat; gray hat; financial motivation; influence; intellectual property; notoriety; espionage; fear/chaos; extortion; double extortion; general curiosity; revenge; ideological; political; ethical; responsible disclosure.

Review Questions

1. A ransomware group encrypts a manufacturer's servers, threatens to publish stolen engineering files unless paid, and directs the company to a professionally run negotiation portal. Which threat actor is MOST likely responsible?

A. Hacktivist
B. Organized crime
C. Unskilled attacker
D. Competitor

2. Which threat actor attribute BEST explains why a malicious employee can steal data without triggering perimeter defenses?

A. Level of sophistication
B. Resources and funding
C. Internal vs. external
D. Motivation

3. An attacker remains undetected in a government agency's network for two years, uses custom malware and a zero-day exploit, and quietly exfiltrates diplomatic cables. Which actor and motivation BEST fit this scenario?

A. Organized crime; financial
B. Hacktivist; ideological
C. State-sponsored; espionage
D. Insider; revenge

4. A teenager downloads an exploit tool from a public code repository and uses it against random internet-facing servers, then posts screenshots of the compromised systems on social media. Which of the following BEST describe this actor and motivation? (Select TWO.)

A. Unskilled attacker
B. State-sponsored
C. Notoriety
D. Espionage
E. Extortion

5. A system administrator accidentally configures a cloud storage container to allow anonymous public read access, exposing customer records. How should this actor be classified?

A. Malicious insider
B. Accidental/unintentional
C. Hacktivist
D. Competitor

6. A group defaces a pharmaceutical company's website with messages protesting drug prices and leaks executives' home addresses online. Which actor type and technique are described?

A. Terrorist; logic bomb
B. Hacktivist; doxing
C. Competitor; corporate espionage
D. Organized crime; cryptojacking

7. Which motivation is MOST closely associated with an attacker who manipulates the control systems of a city's water treatment plant to make the public afraid to drink tap water?

A. Notoriety
B. Fear/chaos
C. General curiosity
D. Financial

8. A security researcher, without permission, scans a retailer's website, finds a SQL injection flaw, and posts details publicly to pressure the company to fix it. Which motivation does this BEST represent?

A. Ethical
B. Extortion
C. Espionage
D. Influence

9. Shortly after receiving a negative performance review, a network engineer modifies a script so that core switch configurations will be erased if his account is disabled. Which motivation is MOST likely?

A. Ideological
B. Revenge
C. Influence
D. General curiosity

10. A company discovers that an employee was paid by a rival firm to copy the source code of an unreleased product. Which TWO threat actors are involved? (Select TWO.)

A. Competitor
B. Hacktivist
C. Insider
D. Terrorist
E. Unskilled attacker

11. During an election campaign, thousands of fake social media accounts spread fabricated documents purportedly stolen from a candidate. Which motivation does this BEST illustrate?

A. Intellectual property
B. Influence
C. Extortion
D. Notoriety

12. Which of the following threat actors typically has the HIGHEST combination of resources and sophistication?

A. Hacktivist
B. Unskilled attacker
C. State-sponsored
D. Accidental insider

Answers and Explanations

1. B. Encryption plus a threat to leak stolen data (double extortion) and a professional negotiation portal are hallmarks of financially motivated organized crime. Hacktivists seek publicity for a cause, not payment. Unskilled attackers lack the operational maturity described. A competitor would want the files, not a ransom.
2. C. The insider already has authorized access, so perimeter controls designed to stop external actors do not apply. Sophistication and resources are not what make insiders hard to stop, and motivation is not one of the three attributes.
3. C. Long dwell time, custom malware, a zero-day, and theft of diplomatic information point to a state-sponsored actor motivated by espionage. Organized crime would seek payment. Hacktivists would publicize the leak. Nothing indicates an insider.
4. A, C. Using someone else's exploit tool against random targets marks an unskilled attacker, and posting screenshots for recognition is notoriety. State-sponsored groups are sophisticated and targeted. Espionage is stealthy, and no payment demand indicates extortion.
5. B. The administrator caused harm through a mistake, with no malicious intent, making this an accidental/unintentional threat. A malicious insider acts intentionally. Hacktivists and competitors are external actors with clear motives.
6. B. Protesting a cause with defacement and publishing personal information (doxing) is classic hacktivism. Terrorists aim to create fear, typically through physical harm. Competitors seek advantage, not public protest, and organized crime seeks money.
7. B. Tampering with public utilities to frighten the population reflects fear/chaos, typical of terrorists. Notoriety seeks fame, curiosity seeks knowledge, and financial motivation seeks money; none matches the stated goal of public fear.
8. A. The researcher's goal is to get the flaw fixed, an ethical motivation, though acting without permission makes it unauthorized (gray-hat) activity. No payment was demanded (extortion), no secrets were gathered covertly (espionage), and the goal was not shaping opinion (influence).
9. B. A logic bomb set to trigger on account disablement following a negative review indicates a disgruntled insider seeking revenge. There is no ideological cause, no attempt to shape opinion, and no indication of curiosity.
10. A, C. The rival firm is a competitor engaged in corporate espionage, and the employee who copied code is a malicious insider. No cause (hacktivist), terror goal, or tool-dependent opportunism is described.
11. B. Disinformation spread through fake accounts to affect an election is an influence operation. Intellectual property involves trade secrets, extortion involves threats for payment, and notoriety seeks fame for the attacker.
12. C. State-sponsored actors have government budgets and the capability to develop custom tools and zero-days. Hacktivists and unskilled attackers generally have limited resources and skills, and an accidental insider is not a deliberate attacker at all.