We are often asked what motivates cyberattacks — why attackers do what they do. Sometimes it’s obvious: If a data breach yields credit and debit card details that are then sold on the Dark Web, profit is quite clearly the motive. Then again, an obvious motivation such as money can be a smokescreen hiding a different, deeper motivation for an attack.

What’s the Motivation for Attackers?

The single greatest motivator for cyberattacks in today’s world is, arguably, profit. It comes as no surprise that cybercrime is estimated to become a $2.1 trillion problem by 2019 — and there’s no shortage of attackers who want a share of the pie.

Methods of attack that lead to monetary gain abound. Cybercriminals use financial malware such as Carbanak, Dyre, Dridex, Rovnix and Shifu to steal funds directly from victims’ bank accounts. Or they extort money from victims through ransomware such as Cryptolocker and Tesla. Another profit-motivated attack is extortion by distributed denial-of-service (DDoS) attacks, which has grown in popularity over the last few years.

Retailers, both online and physical, face a serious threat from profit-motivated attackers who are after user and financial transaction details. Such attacks can involve malware that targets point-of-sale (POS) systems.

It’s Not Always About Money

But profit isn’t always the motive for cybercrime. For example, a private company that develops technology for the military can be the target of industrial espionage. At risk is sensitive information that could have military, economic and political value to the attacker or to the attacker’s paying customer. In this case, attackers could be state-sponsored or a for-profit criminal group acting on behalf of a state or even corporate entity.

Organizations that run industrial control systems (ICS) — power companies, chemical companies, water systems and the like — could be the target of attackers motivated by sabotage. These cybercriminals in turn can be motivated by underlying political, patriotic or ideological beliefs.

Vanity, Revenge, Outrage and More

There are also more personal — or more vindictive — reasons to explain why attackers do what they do. Companies or individuals can be the target, and the consequences can range from annoying to downright dangerous.

Interested in emerging security threats? Read the latest IBM X-Force Research

more from Threat Intelligence

A Response Guide for New NSA and CISA Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) recently published a report highlighting a range of critical security vulnerabilities requiring attention from organizations of all types. The report was published with input from the National Security Agency (NSA) and similar agencies worldwide. It should be considered essential reading.  Many of the vulnerabilities in the report are not new. Instead, the report…

Old Habits Die Hard: New Report Finds Businesses Still Introducing Security Risk into Cloud Environments

While cloud computing and its many forms (private, public, hybrid cloud or multi-cloud environments) have become ubiquitous with innovation and growth over the past decade, cybercriminals have closely watched the migration and introduced innovations of their own to exploit the platforms. Most of these exploits are based on poor configurations and human error. New IBM Security X-Force data reveals that…

Raspberry Robin and Dridex: Two Birds of a Feather

IBM Security Managed Detection and Response (MDR) observations coupled with IBM Security X-Force malware research sheds additional light on the mysterious objectives of the operators behind the Raspberry Robin worm. Based on a comparative analysis between a downloaded Raspberry Robin DLL and a Dridex malware loader, the results show that they are similar in structure and functionality. Thus, IBM Security…