1.3 Threat Actors, Motives, and Common Terms
A Capability Ladder, Not a Morale Ladder
Model actors by what they can spend, not by how evil they seem. At the base, script kiddies run other people's tools — sqlmap -r login.req --level=3, a stock Metasploit module — with minutes of dwell time and near-zero targeting. Above them, hacktivists add motive and coordination through public channels, producing defacements, DDoS, and doxxing bursts. Organized crime brings budgets: initial access brokers sell a foothold, ransomware-as-a-service affiliates pay a 20–30% revenue share to the toolkit author, and operators even run help desks that "negotiate" with victims. At the top, nation-states buy or build zero-days — exploit brokers have quoted browser chains in the seven-figure range — and can hold a network quietly for months.
Motive Predicts the Playbook
Money-driven actors want fast, monetizable outcomes: encrypt endpoints, exfiltrate to staging, then threaten publication — double extortion with 48-hour countdown timers. Ideology-driven actors want an audience: public defacement, leaked internal mail, name-and-shame posts. Intelligence-driven actors want persistence: credential harvesting, VPN appliance implants, and supply-chain compromise (ATT&CK technique T1195.002) with dwell measured in quarters. When you triage an incident, the dwell pattern and the exit path — crypto payment address versus a press release — fingerprint the actor class faster than malware names do, because families are reused and resold across groups.
Vocabulary That Carries Weight
A vulnerability is a flaw, tracked as a CVE with a severity score: CVE-2021-44228 (Log4Shell) scored CVSS:3.1/AV:N/AC:L/PR:N/UI:N, a 10.0 because an unauthenticated network packet triggers it. An exploit is the code that converts that flaw into execution; a zero-day is an exploit for a flaw no vendor has patched yet. The payload is what runs after execution. Defenders track indicators of compromise (file hashes, ASNs, URLs) and TTPs — tactics, techniques, procedures — which survive malware renaming. The attack surface is everything exposed at once, and the working definition of risk stays simple: threat capability times vulnerability prevalence times asset impact.
The Base Rate for a Beginner
Statistically, the threat most likely to hit a home user or small network is untargeted: mass scanning, commodity stealers, and stuffed credentials. APT-grade actors do not bother with you unless you touch something they want. Spend the first month killing the 90% case — patching, MFA, unique passwords, backups — before worrying about adversaries with budgets.
Architecture Diagram
Key Takeaways
- Rank actors by budget, skill, and dwell time — the four tiers differ by spend, not by intent alone.
- Motive shows in the exit path: crypto payment for profit, public post for ideology, silence for espionage.
- Separate flaw (CVE), mechanism (exploit), and aftermath (payload); Log4Shell's CVSS 10.0 came from unauthenticated network reachability.
- Track TTPs and indicators, not malware names, because tooling is resold across groups.
- Most beginners face untargeted commodity attacks first; fix patching, MFA, and backups before APT worries.