5.2 How Attackers Choose Targets and Goals
Recon Before Intrusion
Attackers rarely pick targets by accident, and they rarely start by touching them. Passive scanning opens the pipeline: adversary-controlled infrastructure indexes the public internet continuously -- open ports, service banners, TLS certificates, application fingerprints -- so no packet ever needs to reach the victim at all. From that index, an intruder filters like a recruiter filters resumes: by technology stack and patch age (is this an unpatched Exchange?), by capacity to pay or value of data (finance, healthcare, SaaS vendors), and by breadth of exposure (autonomous system ranges, wildcard domains, recently acquired subsidiaries). The distinction matters defensively: passive recon triggers no firewall alert, no WAF event, no IDS signature. The only honest detection is knowing that something sensitive sat exposed long enough to be indexed.
OSINT Turns Hosts Into Victims
Open-source intelligence converts an anonymous hostname into a named victim with reachable humans. Job postings leak the exact stack and the security tools being migrated away from. Corporate registries and press releases supply org charts and executive names for pretexting. Public calendars reveal meeting patterns; code hosting leaks tokens and internal URLs; historical breach dumps and infostealer logs hand over credential-reuse candidates mapped to corporate email addresses. OSINT is cheap, deniable, and scalable, so the goal is not to hide it but to remove what it can reach: retire forgotten subdomains, purge secrets from public repositories, and assume every published mailbox will appear in the next credential-stuffing list.
Motive Sets the Method
Selection then feeds motive. Extortion operations -- ransomware and its data-theft-plus-leak-site variant -- prefer targets that can pay but cannot afford a long incident: mid-sized firms, hospitals, logistics. Their intrusion is fast and loud because dwell time is expensive. Intellectual-property theft operates the opposite way: long dwell, low noise, targeted collection against research and development, and non-destructive payloads that keep access valuable; those operators select where the crown jewels are exportable. Motive even predicts which chain link gets pulled: extortion commonly enters through exposed remote access or a phished credential, while IP theft often arrives through trusted vendors or supply chain. Motive is not profiling trivia -- it is a forecast of dwell time, noise budget, and first link.
Architecture Diagram
Key Takeaways
- Targeting starts passively: internet-wide indexes let attackers filter you without sending a packet.
- OSINT merges registries, job ads, calendars, code leaks, and breach dumps into a usable target package.
- Defend OSINT by removing reachable payloads: retire subdomains, purge repo secrets, expect published mailboxes to be sprayed.
- Extortion is fast and loud; IP theft is slow and quiet -- motive forecasts dwell time and noise.
- Expect entry at the cheapest link your motive profile implies: remote access for extortion, trust relationships for theft.