March 31, 2016 By Lyndon Sutherland 2 min read


We are often asked what motivates cyberattacks — why attackers do what they do. Sometimes it’s obvious: If a data breach yields credit and debit card details that are then sold on the Dark Web, profit is quite clearly the motive. Then again, an obvious motivation such as money can be a smokescreen hiding a different, deeper motivation for an attack.

What’s the Motivation for Attackers?

The single greatest motivator for cyberattacks in today’s world is, arguably, profit. It comes as no surprise that cybercrime is estimated to become a $2.1 trillion problem by 2019 — and there’s no shortage of attackers who want a share of the pie.

Methods of attack that lead to monetary gain abound. Cybercriminals use financial malware such as Carbanak, Dyre, Dridex, Rovnix and Shifu to steal funds directly from victims’ bank accounts. Or they extort money from victims through ransomware such as Cryptolocker and Tesla. Another profit-motivated attack is extortion by distributed denial-of-service (DDoS) attacks, which has grown in popularity over the last few years.

Retailers, both online and physical, face a serious threat from profit-motivated attackers who are after user and financial transaction details. Such attacks can involve malware that targets point-of-sale (POS) systems.

It’s Not Always About Money

But profit isn’t always the motive for cybercrime. For example, a private company that develops technology for the military can be the target of industrial espionage. At risk is sensitive information that could have military, economic and political value to the attacker or to the attacker’s paying customer. In this case, attackers could be state-sponsored or a for-profit criminal group acting on behalf of a state or even corporate entity.

Organizations that run industrial control systems (ICS) — power companies, chemical companies, water systems and the like — could be the target of attackers motivated by sabotage. These cybercriminals in turn can be motivated by underlying political, patriotic or ideological beliefs.

Vanity, Revenge, Outrage and More

There are also more personal — or more vindictive — reasons to explain why attackers do what they do. Companies or individuals can be the target, and the consequences can range from annoying to downright dangerous.

Interested in emerging security threats? Read the latest IBM X-Force Research

More from Threat Intelligence

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on unsuspecting victims' search activity, which we analyze further in the blog. The Gootloader group’s introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

“Authorized” to break in: Adversaries use valid credentials to compromise cloud environments

4 min read - Overprivileged plaintext credentials left on display in 33% of X-Force adversary simulations Adversaries are constantly seeking to improve their productivity margins, but new data from IBM X-Force suggests they aren’t exclusively leaning on sophistication to do so. Simple yet reliable tactics that offer ease of use and often direct access to privileged environments are still heavily relied upon. Today X-Force released the 2023 Cloud Threat Landscape Report, detailing common trends and top threats observed against cloud environments over the past…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today