We are often asked what motivates cyberattacks — why attackers do what they do. Sometimes it’s obvious: If a data breach yields credit and debit card details that are then sold on the Dark Web, profit is quite clearly the motive. Then again, an obvious motivation such as money can be a smokescreen hiding a different, deeper motivation for an attack.

What’s the Motivation for Attackers?

The single greatest motivator for cyberattacks in today’s world is, arguably, profit. It comes as no surprise that cybercrime is estimated to become a $2.1 trillion problem by 2019 — and there’s no shortage of attackers who want a share of the pie.

Methods of attack that lead to monetary gain abound. Cybercriminals use financial malware such as Carbanak, Dyre, Dridex, Rovnix and Shifu to steal funds directly from victims’ bank accounts. Or they extort money from victims through ransomware such as Cryptolocker and Tesla. Another profit-motivated attack is extortion by distributed denial-of-service (DDoS) attacks, which has grown in popularity over the last few years.

Retailers, both online and physical, face a serious threat from profit-motivated attackers who are after user and financial transaction details. Such attacks can involve malware that targets point-of-sale (POS) systems.

It’s Not Always About Money

But profit isn’t always the motive for cybercrime. For example, a private company that develops technology for the military can be the target of industrial espionage. At risk is sensitive information that could have military, economic and political value to the attacker or to the attacker’s paying customer. In this case, attackers could be state-sponsored or a for-profit criminal group acting on behalf of a state or even corporate entity.

Organizations that run industrial control systems (ICS) — power companies, chemical companies, water systems and the like — could be the target of attackers motivated by sabotage. These cybercriminals in turn can be motivated by underlying political, patriotic or ideological beliefs.

Vanity, Revenge, Outrage and More

There are also more personal — or more vindictive — reasons to explain why attackers do what they do. Companies or individuals can be the target, and the consequences can range from annoying to downright dangerous.

Interested in emerging security threats? Read the latest IBM X-Force Research

More from Threat Intelligence

Hive0051 goes all in with a triple threat

13 min read - As of April 2024, IBM X-Force is tracking new waves of Russian state-sponsored Hive0051 (aka UAC-0010, Gamaredon) activity featuring new iterations of Gamma malware first observed in November 2023. These discoveries follow late October 2023 findings, detailing Hive0051's use of a novel multi-channel method of rapidly rotating C2 infrastructure (DNS Fluxing) to deliver new Gamma malware variants, facilitating more than a thousand infections in a single day. An examination of a sample of the lures associated with the ongoing activity reveals…

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed ITG05…

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today