Why Did They Do It? — TechKnowSurge

About this interactive

What you are doing: reading what an adversary did and naming why. The lesson's motivations: financial gain is about the money, including cyber crime, blackmail or extortion, and stealing for a competitive advantage. Revenge is getting even, like the fired employee who leaves a logic bomb. A political or philosophical cause drives the hacktivist, who acts for something bigger than themselves. Challenge and notoriety are emotional: the curiosity of getting around a barrier, or the fame of a big name to brag about. And getting work done is the most common inside the company: an employee who goes around IT for a business reason, which is shadow IT. How to use it: ask who benefits and how. The attacker's wallet? Their feelings about one target? A cause? Their ego? The employer's deadline?

What you'll learn

Identify an adversary's motivation from what they did: financial gain, revenge, political or philosophical belief, challenge or notoriety, or an insider simply getting work done

Aligned to

CompTIA Security+

2.1 Compare and contrast common threat actors and motivations.

Key terms

Threat Actor: An individual or group responsible for a security incident or attack.
Hacktivist: A threat actor who conducts hacking activities to promote political, ideological, or social change.
Shadow IT: The use of unauthorized software, systems, or services within an organization without IT department knowledge or approval. Shadow IT creates security blind spots because unmanaged assets fall outside standard patching, monitoring, and access controls.
Blackmail: An overt social engineering attack in which an adversary threatens to release damaging information about a victim unless the victim complies with demands such as payment, access credentials, or sensitive data.
Insider Threat: A security risk that originates from individuals who have authorized access to an organization's systems — such as employees, contractors, or partners — and misuse that access either maliciously or through negligence.

Topics

Threat Actor Hacktivist Shadow It Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →