Skip to content
EN

Lesson 2 of 8 · 6 min · +100 XP

What are the main types of hackers?

The main types of hackers, or threat actors, are cybercrime gangs, who want money; nation-state groups, who want intelligence and influence; hacktivists, who want attention for a cause; insiders, who already have access; and script kiddies, who use ready-made tools for fun. Their motive predicts who they target and how they attack.

▶ Try it

Why it matters

Criminal gangs want money, states want intelligence, hacktivists want attention, and insiders already have access. Knowing the motive helps predict both the target and the method.

In 6 minutes you'll be able to

  • Criminal gangs, states, hacktivists, insiders and amateurs want different things.
  • Motive predicts method and target.
  • For most people and companies, financially motivated crime is the main threat.

What you'll practise

  1. Villain cards

    Flip each card to see the attacker's motive and favourite moves.

    💰 Cybercrime gang
    Motive: money. Phishing, ransomware, selling stolen data. Runs like a business, with help desks and partners.
    🏛️ Nation-state group
    Motive: intelligence and influence. Patient and well funded. Targets governments, infrastructure and suppliers, and can hide for months.
    📣 Hacktivist
    Motive: a cause and attention. Defaces websites, leaks data, floods services offline to make a point.
    🧑‍💼 Insider
    Motive: money, revenge, or simply a mistake. Already has access. Many insider incidents are accidents, not malice.
    🧒 Script kiddie
    Motive: fun and bragging rights. Uses ready-made tools without deep skills, but still breaks into unpatched systems.
    🧩 Ransomware affiliate
    Motive: money. Rents ransomware from its developers and splits the profit: the gig economy of cybercrime.

  2. Who did it?

    Five realistic incidents. Which attacker fits best?

    1. A hospital's files are encrypted overnight. A note demands $2 million in cryptocurrency.

      • Cybercrime gang (Answer)
      • Hacktivist
      • Script kiddie
      • Nation-state group

    2. A sales manager downloads the full customer list the week before joining a competitor.

      • Insider (Answer)
      • Cybercrime gang
      • Hacktivist
      • Script kiddie

    3. Diplomats receive carefully tailored emails for six months. Attackers quietly read their mail for a year.

      • Nation-state group (Answer)
      • Script kiddie
      • Hacktivist
      • Insider

    4. After a controversial vote, a city council website suddenly shows protest slogans.

      • Hacktivist (Answer)
      • Cybercrime gang
      • Nation-state group
      • Insider

    5. A teenager uses a downloaded tool to knock a game server offline to impress friends.

      • Script kiddie (Answer)
      • Nation-state group
      • Cybercrime gang
      • Insider

  3. NovaCorp's threat list

    NovaCorp is a mid-sized online retailer. Pick the threats most likely to hit it.

    • Criminal gangs phishing staff for passwords
    • Ransomware affiliates looking for an easy way in
    • Careless or unhappy insiders
    • Fraudsters testing stolen cards in the web shop
    • A foreign spy agency after the canteen menu
    • A movie-style hacker breaking in live while typing very fast

Remember

Defend against the likely attacker, not the movie hacker.

Defend against the likely adversary, not the movie hacker.

Key facts

  • Most data breaches are financially motivated, and most are carried out by external attackers rather than insiders. · Source: Verizon Data Breach Investigations Report 2024
  • Ransomware is often sold as a service: developers rent their malware to affiliates, who break in and share each ransom with them.
  • ENISA counts ransomware, malware, social engineering, threats against data and denial-of-service attacks among the prime cyber threats. · Source: ENISA Threat Landscape 2024
  • Many insider incidents are accidents, such as an email sent to the wrong person or a file shared too widely, not deliberate attacks.

Updated:

Questions people ask

What is a threat actor?

A threat actor is any person or group that tries to harm computer systems or data: criminals, state-backed groups, activists, insiders or amateurs. The term covers mistakes by insiders as well as deliberate attacks.

Who are the most common threat actors?

For most people and companies, financially motivated cybercriminals are the most common, followed by insiders who misuse access or make mistakes. State-backed groups mostly target governments, infrastructure and their suppliers.

What is an insider threat?

An insider threat comes from someone who already has legitimate access, such as an employee or contractor. It can be deliberate, like stealing data before leaving, or accidental, like sending a file to the wrong person.

What is a script kiddie?

A script kiddie is an unskilled attacker who uses ready-made hacking tools, usually for fun or bragging rights. They can still do real damage to systems that aren't patched.

Related terms