Threat actors and motivations

This objective focuses on understanding who is attacking, what their capabilities are, and why they are doing it. In the real world, profiling your adversary dictates how you build your defenses.

Let’s break this down by analyzing the threat actors, their key attributes, and the drivers that drive them.

1. Threat Actors & Their Attributes

CompTIA evaluates threat actors based on three critical attributes:

Location: Are they inside or outside the perimeter? (Internal/External)
Funding: Do they have a multi-million dollar budget or zero dollars?
Sophistication: Are they writing custom zero-day exploits or just copying and pasting scripts?

Nation-State (Advanced Persistent Threats – APTs)

These are highly trained, state-sponsored cyber warfare units working for a government.

Attributes: External (usually), extremely high sophistication, and practically unlimited funding/resources. They operate quietly, often staying hidden inside a network for months or years.
Example: A military cyber unit deploying a highly sophisticated, custom-built malware payload to infiltrate a foreign country’s nuclear facility and sabotage its centrifuges.

Unskilled Attacker (Script Kiddie)

Amateur attackers with little to no coding knowledge who use pre-made tools, scripts, and exploits found on the internet.

Attributes: External, very low sophistication, and minimal to no funding. They don’t understand how the underlying exploits work; they just look for easy, unpatched targets.
Example: A teenager downloading an open-source Automated DDoS tool to flood their school’s website and knock it offline during exam week.

Hacktivist

An attacker or group of attackers who hack to make a political statement, promote a social cause, or express philosophical beliefs.

Attributes: External, low– to medium-sophistication, and limited funding. They rely heavily on public disruption, web defacement, and leaked data to gain media attention.
Example: A cyber group hacking into a major oil corporation’s public website and replacing the homepage with climate change awareness statistics.

Insider Threat

Anyone with authorized access to an organization’s internal network, systems, or data who uses that access maliciously or carelessly.

Attributes: Internal (employees, contractors, vendors), low– to high-sophistication, and backed by the resources of their existing access (which makes them incredibly dangerous).
Example: A disgruntled database administrator who knows he is getting laid off next month uses his admin credentials to download the company’s proprietary source code to sell to a competitor.

Organized Crime

Professional syndicates or gangs operating online solely to make illicit money. They operate like a corporate business, complete with help desks for ransomware victims and developers specializing in writing malware.

Attributes: External, high sophistication, and heavily funded by their criminal profits.
Example: A cartel deploying ransomware across a major hospital network, encrypting all patient records, and demanding a $5 million Bitcoin payout to release the decryption key.

Shadow IT

The deployment of IT systems, software, or hardware by an employee or department without the explicit approval or knowledge of the central IT/Security department. While not inherently “malicious,” Shadow IT is classified as a threat actor because it drastically introduces unmanaged risk and security gaps.

Attributes: Internal, varies in sophistication, and funded by standard departmental budgets.
Example: A marketing team found the company’s approved file-sharing app too slow, so they set up an unapproved public Dropbox account to share sensitive client files, entirely bypassing the corporate DLP (Data Loss Prevention) controls.

2. Threat Actor Motivations (The “Why”)

CompTIA will test your ability to look at an incident scenario and determine the attacker’s underlying motive.

Motivation	Description	Real-World Scenario
Data Exfiltration	Stealing data from a network to copy it elsewhere.	A hacker targeting an e-commerce site solely to download a database of 50,000 customer credit card numbers.
Espionage	Long-term spying to steal trade secrets, intellectual property, or government secrets.	A nation-state actor infiltrating an aerospace corporation to steal the blueprints for a new fighter jet.
Service Disruption	Intentionally knocking a system or network offline, preventing business operations.	A competitor launching a massive DDoS attack against a retail site during Black Friday to cripple their sales.
Blackmail / Extortion	Threatening to release sensitive or embarrassing data unless a demand (usually money) is met.	Threatening a CEO to leak confidential internal emails detailing corporate fraud unless they pay a ransom.
Financial Gain	Purely motivated by making money. (The primary driver for Organized Crime).	Phishing campaigns, cryptocurrency theft, and selling stolen credentials on the Dark Web.
Philosophical / Political	Driven by ideology, social justice, or regime change.	A group hacking a government entity to protest a controversial piece of legislation.
Ethical	Hacking with permission to find vulnerabilities so they can be fixed before bad actors find them.	A Bug Bounty researcher identifying a flaw in a bank’s mobile app and reporting it responsibly to their security team.
Revenge	Driven by a personal vendetta or anger against an organization.	An ex-employee logging into an administrative account they still have access to and wiping out virtual machines out of anger.
Disruption / Chaos	Hacking simply for the thrill of destruction, ego, or bragging rights.	Defacing a random local government website with memes just to prove it could be done.
War	State-level kinetic operations using cyberattacks to degrade an adversary’s military capabilities.	Launching a cyber attack to disable an enemy nation’s power grid, air defense radar systems, or communications array right before a physical military deployment.

Quick Exam Tip: Spotting the Nuance

Watch out for questions where multiple motivations overlap. For example:

If a hacker steals data and demands money to prevent it from being leaked, the motive is Blackmail / Financial Gain.
If a hacker deletes a system because they were fired, the motive is Revenge.
If a group disables a power grid during a military conflict, the motive is War.