Threat Intelligence · 4 min
Threat Actors & Motivation
Who acts, why it matters, and why attribution is hard
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Broad actor categories
Categories describe behavior patterns, not people or places. They overlap constantly, and individuals move between them.
- Financially motivated cybercrime — ransomware, fraud, data theft for resale
- State-aligned or state-sponsored activity — espionage, disruption, long dwell time
- Hacktivism — visibility and disruption around a cause
- Insider activity — malicious or negligent, already inside the trust boundary
- Opportunistic actors — scanning for whatever is exposed and easy
Motivation drives targeting
Knowing what an actor wants helps you predict what they will do next inside your environment.
- Money → data to monetize, encryption for extortion, payment systems
- Espionage → quiet persistence, research and communications
- Disruption → availability and visibility
- Grievance → whatever hurts the target most
Loading the interactive lesson…