Threat actors and their motives

When Sam sat down with Rosa to plan the security review, the first question was not about firewalls or passwords. It was about people: who might want to harm Ridgeline, what they would want, and what they could realistically do. A threat actor is any person or group that could cause a security incident, deliberately or by accident. Understanding threat actors helps a business spend its limited time and money on the dangers it actually faces rather than the ones that make the most dramatic headlines.

This lesson describes the main kinds of threat actor, what drives them, the attributes that make some more dangerous than others, and the routes, called attack vectors, by which they reach their targets. It ends with a simple threat profile for Ridgeline, which the rest of the course builds on.

Attributes that describe a threat actor

Security professionals describe threat actors by a few attributes. The first is whether they are internal or external: an insider already has some access, such as an employee account, a key to the office or knowledge of how things work, while an external actor has to break in or trick their way in. The second is their resources and funding. A teenager experimenting with tools found online has a laptop and some free time; an organized crime group may have specialist staff, rented servers and money to buy stolen credentials; a nation-state intelligence agency may have hundreds of skilled people and years of patience.

The third attribute is sophistication: how skilled the actor is, and whether they can write their own tools or only use tools made by others. The fourth is motivation, which explains what the actor wants and therefore what they are likely to target. The fifth is intent and targeting: some actors attack whoever is easiest to hit, while others choose a particular victim and keep trying until they succeed. Most of what reaches a small business is opportunistic, but a business can become a deliberate target, for example if it holds something valuable or has upset someone.

Motives

Motive is the most useful attribute for a small business, because it predicts what an attacker will go after. Financial gain is by far the most common motive. Criminals steal card data and sell it, divert payments, take over email accounts to send fake invoices, encrypt data and demand ransom, or steal personal information to commit identity fraud. Other motives include espionage (stealing secrets for a competitor or a government), disruption or chaos, revenge (often from a former employee or contractor), political or ideological causes, blackmail, and simple curiosity or the wish to show off.

For Ridgeline, financial motives dominate. The card payments, the payroll account, the business bank account and the online shop's customer list are all valuable to criminals. Revenge is a smaller but real possibility, since any business with staff turnover has former employees. Espionage is unlikely; nobody is going to great lengths to steal a roast profile for a single-origin Colombian, although a competitor tempted by a supplier price list is not unheard of.

The main kinds of threat actor

Unskilled attackers

Unskilled attackers, sometimes unkindly called script kiddies, use ready-made tools and scripts written by others. They often scan large ranges of internet addresses looking for devices with default passwords or known, unpatched vulnerabilities, and they attack whatever they find. Individually they lack skill, but they are numerous, and their automated tools never sleep. A router with a default admin password exposed to the internet will be found within hours. Basic hygiene, such as changing default passwords and installing updates, defeats almost all of them.

Organized crime

Organized criminal groups run cybercrime as a business, complete with specialists, customer support for their ransomware victims and partnerships with other groups. Some develop ransomware and rent it to affiliates who carry out the attacks, a model known as ransomware as a service. Others specialize in breaking into networks and selling the access, or in business email compromise, where they take over or imitate an email account to redirect payments. These groups are the most significant threat to small businesses, because they are well resourced, financially motivated and happy to hit thousands of small targets.

Insiders

An insider threat comes from someone with legitimate access: an employee, contractor, cleaner, supplier or former staff member whose access was never removed. Malicious insiders might steal customer lists before joining a competitor, sabotage systems after being fired, or commit fraud. But many insider incidents are unintentional. An employee who emails a spreadsheet to the wrong address, falls for a phishing message or connects an infected USB stick causes real harm without meaning to. Controls include giving each person only the access they need, removing access promptly when someone leaves, logging what accounts do, and training.

Hacktivists

Hacktivists attack to promote a political or social cause. Their typical methods are defacing websites, flooding sites with traffic so they go offline, and leaking embarrassing data. They usually choose targets connected to their cause, such as a government agency or a company in a controversial industry. A coffee roaster is an unlikely target unless it becomes caught up in a public controversy, for example over where its beans are sourced.

Nation-state actors

Nation-state actors work for or on behalf of governments. They are the best-resourced attackers, often described as advanced persistent threats because they gain access quietly and stay for months or years. They target governments, defence suppliers, critical infrastructure, research and large companies, usually for espionage, and sometimes to prepare for disruption. Small businesses are rarely their intended target, but they can be used as stepping stones: a small supplier with weak security may be the easiest way into a larger customer's network.

Shadow IT and accidental threats

Shadow IT is technology that staff use without the knowledge or approval of whoever manages IT: a personal file-sharing account used to send invoices, a free online form builder that collects customer details, or a home Wi-Fi extender plugged into the office network. People adopt shadow IT to get work done, not to cause harm, but it creates risks nobody is managing. At Ridgeline, Sam's inventory walk found that the cafe's music player was a cheap streaming box plugged into the same network as the point-of-sale tablets, with its default password unchanged.

actors = [
    {"name": "Unskilled attacker", "resources": 1, "skill": 1},
    {"name": "Organized crime", "resources": 4, "skill": 4},
    {"name": "Hacktivist", "resources": 2, "skill": 3},
    {"name": "Nation-state", "resources": 5, "skill": 5},
    {"name": "Insider", "resources": 2, "skill": 3},
]

def rank_by_capability(actors):
    # sort by resources + skill, highest first, ties alphabetical
    return [a["name"] for a in actors]

print(rank_by_capability(actors))

Attack vectors

An attack vector is the route an attacker uses to reach a target. The attack surface is the sum of all the vectors an organization exposes. Reducing the attack surface, by removing services that are not needed, closing ports and limiting who can reach what, is one of the most effective things a defender can do. The most common vectors for a small business are these.

Email is the leading vector: phishing messages that steal passwords, attachments that install malware, and messages that impersonate managers or suppliers to request payments. Messaging and phone calls are close behind, including text-message phishing (smishing) and voice calls (vishing) from people pretending to be the bank or Microsoft support. The fake support page that appeared on Theo's computer in NET-101 lesson 12 was an example of a vector that combines a malicious website with a phone call.

Other vectors include vulnerable software, such as an unpatched router, an outdated website plugin or an old version of Windows; exposed services, such as remote desktop left open to the internet; stolen or guessed credentials; removable media such as USB sticks; unsecured wireless networks; the supply chain, meaning a supplier's software or service that is compromised and then used to reach its customers; and physical access, such as someone walking into the back office while everyone is busy at the counter.

# Ridgeline's first attack-surface list from Sam's walk-through
surface = {
    "email accounts": "internet",
    "online shop admin page": "internet",
    "router admin page": "office network",
    "remote desktop on OFFICE-01": "turned off",
    "guest Wi-Fi": "cafe customers",
    "music streaming box": "same network as point of sale",
}
exposed = [name for name, reach in surface.items() if reach != "turned off"]
print(len(exposed), "items exposed:")
for name in sorted(exposed):
    print(" -", name, "(reachable from:", surface[name] + ")")

5 items exposed:
 - email accounts (reachable from: internet)
 - guest Wi-Fi (reachable from: cafe customers)
 - music streaming box (reachable from: same network as point of sale)
 - online shop admin page (reachable from: internet)
 - router admin page (reachable from: office network)

Threat intelligence for a small business

Large organizations subscribe to threat intelligence services that report on attackers' current methods. A small business does not need a subscription, but it does benefit from paying attention to free sources. In Canada, the Canadian Centre for Cyber Security publishes alerts and advice for small and medium organizations; in the United States, the Cybersecurity and Infrastructure Security Agency (CISA) publishes alerts and maintains a list of vulnerabilities known to be exploited in real attacks. Vendors such as Microsoft and the point-of-sale provider publish security notices for their products, and industry groups share warnings about current scams.

Sam suggested a simple routine for Jordan: once a week, skim the national cyber agency's alerts for anything affecting Ridgeline's equipment, check the router and NAS makers' update pages, and read any security notices from the payment and shop providers. Fifteen minutes a week keeps Ridgeline informed about the threats that matter to it.

reports = ["money", "revenge", "money", "curiosity", "money", "revenge", "cause"]

def top_motive(reports):
    counts = {}
    for m in reports:
        counts[m] = counts.get(m, 0) + 1
    # return the motive with the highest count (ties: alphabetical)
    return None

print(top_motive(reports))

Thinking like an attacker, defensively

A useful habit for defenders is to look at their own organization the way an opportunistic criminal would, without ever attacking anything. What would someone see from the internet? Which accounts would be worth stealing, and how are they protected? What happens if a laptop goes missing? Which employee receives invoices, and would a fake one get paid? Asking these questions during a walk-through turns abstract threats into concrete items for the review.

Ridgeline's walk-through produced a short list that will reappear throughout the course: a payroll account protected only by a password, the music box on the point-of-sale network, a former barista whose shop login was never removed, and an office door left propped open on delivery days. None of them would make the news, and all of them are exactly what real attackers exploit.