Threat Actors and Motivations

The overview gave you the three-axis model and a one-line profile per actor. This section is the deep dive: for each of the six types CompTIA names under objective 2.1^[1], nation-state, unskilled attacker, hacktivist, insider threat, organized crime, and shadow IT, what defines it, what it can actually do, and the forensic signature it tends to leave. Read this so that, given a scenario, you can do more than recite the label: you can predict the behavior the rest of the exam will describe. The cleanest way to hold all six in mind is to split them by where they sit relative to your trust boundary, the figure groups the four external adversaries apart from the two internal conditions, because that single split decides which control fails first.

Nation-state actor (APT)

NIST defines an advanced persistent threat as "an adversary with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors ... to ... establish and extend its presence ... continually exfiltrating information and/or to undermine or impede critical aspects of a mission ... repeatedly over an extended period of time, adapting to a defender's efforts to resist it"^[2]. Unpack that definition because the exam tests every clause of it: sophisticated expertise (writes custom malware and burns zero-day exploits), significant resources (government funding, full-time operators), multiple vectors (phishing plus physical plus supply-chain), extended period (long dwell time, months of undetected residence, not a smash-and-grab), and adapts to defenders (re-tools when caught rather than giving up). "APT" and "nation-state" are used interchangeably on SY0-701; the distinguishing motives are espionage and war. The exam tell is the combination of patient, well-funded, custom/zero-day tooling, and long undetected presence in one stem.

Organized crime

A well-funded, capable, external group whose purpose is profit, not statecraft. This is the ransomware-as-a-business and large-scale-fraud profile: it may rival a nation-state in resourcing and operational discipline (it can buy zero-days and run affiliate programs) but its motivations are financial gain, blackmail/extortion, and selling exfiltrated data. The discriminator versus a nation-state is the motive in the stem: if the goal is money, it is organized crime; if the goal is intelligence or strategic disruption, it is a nation-state, even when the techniques look identical.

Hacktivist

Defined by cause, not by budget or skill. A hacktivist acts on philosophical or political beliefs and seeks to disrupt, embarrass, or publicize, common techniques are website defacement, data leaks meant to expose, and DDoS to silence a target. Sophistication varies widely (from coordinated skilled collectives to point-and-click participants), so never infer hacktivist from skill level; infer it from a stated ideological or political motive plus a public, attention-seeking outcome.

Insider threat

NIST defines this as "the threat that an insider will use her/his authorized access, wittingly or unwittingly, to do harm to the security of organizational operations and assets, individuals, other organizations, and the Nation"^[3]. Two exam-critical clauses: (1) authorized access, the defining attribute is that the actor is already legitimately inside, so it bypasses the perimeter and most network-edge controls; (2) wittingly or unwittingly, an insider threat includes both the malicious employee (revenge, financial gain, espionage) and the careless one who clicks a phish or misconfigures a share with no ill intent. The advantage an insider brings is trust and placement, not technical skill, a single authorized copy to a USB drive can be a major insider incident with zero sophistication.

Unskilled attacker

The term SY0-701 uses in place of the older 'script kiddie': a low-capability actor who runs tools, scripts, and exploits written by others without understanding the internals. Low sophistication does not mean low impact, a borrowed but potent tool (a leaked ransomware builder, a public Metasploit module against an unpatched CVE) can still cause serious damage. Motives skew toward chaos/disruption, notoriety, or opportunistic financial gain. The exam tell is language like "used a downloaded tool," "followed an online tutorial," or "did not appear to understand the exploit."

Shadow IT

The odd one out: shadow IT is not a person who attacks you. It is hardware, software, or cloud services deployed inside the organization without IT/security approval, an employee spinning up an unsanctioned SaaS app, a department's rogue cloud account, an unauthorized wireless access point. The harm is that these assets are unmanaged, unpatched, and invisible to defenders, so they widen the attack surface and escape monitoring. Treat shadow IT as a self-inflicted risk condition, and remember the actual adversary is whoever later exploits the unmanaged asset.

Type alone rarely settles a scenario; SY0-701 objective 2.1 makes you reason from attributes and motivations too. This section drills the two axes the overview only sketched, because the exam's hardest items are the ones where two actor types share a technique and you must pick using attributes and motive.

The attribute axis, precisely

Three attributes appear on the objectives^[1], and the figure ranks the actors along the two graded ones:

• Internal vs. external. Internal means the actor already holds authorized access from inside the trust boundary (the defining trait of an insider threat, and the condition shadow IT creates). External means the actor must first breach the perimeter (nation-states, organized crime, hacktivists, most unskilled attackers). This attribute changes the first control that fails: an external actor is stopped by edge controls; an insider sails past them and is caught only by least privilege, separation of duties, and behavior analytics (UEBA).
• Resources / funding. This is the budget and manpower behind the actor and it tracks with sustained, complex operations. Very high (nation-state) and high (organized crime) at the top; low (unskilled attacker) at the bottom; hacktivists range low-to-moderate. Funding is what buys zero-days, full-time operators, and the patience for long dwell times.
• Sophistication / capability. The technical skill and tooling maturity. Highest for nation-states (custom zero-days), high for organized crime, lowest for the unskilled attacker (borrows others' tools). Critically, resources and sophistication usually track together at the top but do not for the unskilled attacker (low skill yet potentially high impact via borrowed tools), and a sophisticated actor may deliberately use crude tools for deniability, so high impact never proves high skill.

The motivation catalog, mapped to actors

Objective 2.1 enumerates the motivations explicitly, and each biases toward a likely actor, the motive is frequently the single strongest disambiguator:

Motivation	Most-implied actor(s)	Why
Data exfiltration	Nation-state (intel) or organized crime (resale)	Whose benefit (strategic vs. profit) picks between them
Espionage	Nation-state	Stealing secrets for strategic advantage
Service disruption	Hacktivist, nation-state	DDoS/defacement to silence, or strategic sabotage
Blackmail	Organized crime	Extortion / ransomware leak-threats for money
Financial gain	Organized crime (also opportunistic unskilled / insider)	Profit motive
Philosophical / political beliefs	Hacktivist	Ideology-driven, attention-seeking
Ethical	Penetration tester / bug-bounty researcher	Authorized, lawful, NOT an adversary
Revenge	Insider threat	Disgruntled employee abusing access
Disruption / chaos	Unskilled attacker, hacktivist	Notoriety or ideological noise
War	Nation-state	State-on-state cyber operations

Two motivations are recurring traps. 'Ethical' is the lawful intent of an authorized tester operating under rules of engagement, it is a motive in the list but it maps to a sanctioned researcher, never to a malicious actor or an incident to contain. 'Financial gain' is over-attributed to organized crime when the stem actually points elsewhere (a disgruntled insider selling data acts for financial gain too), always combine motive with the internal/external attribute before committing.

Domain 2 (Threats, Vulnerabilities, and Mitigations) is 22% of the scored SY0-701 exam^[1], the second-heaviest domain, and threat-actor items follow a small set of repeatable shapes. Naming the shape lets you answer on recognition. Scope note: this objective is about who and why; the how (phishing, malware, specific vulnerabilities, log indicators) belongs to the sibling subtopics, so do not let a vivid attack technique pull you into answering a different objective.

Pattern 1: "Which threat actor is this?"

The stem narrates an incident and the options are actor types. Do not classify from the technique; classify from access + resources + sophistication + motive together. Run the three-axis check: is the actor internal or external? How well-resourced and skilled does the stem say it is? What is the stated motive? Then pick the type all clues converge on. The classic trap is a low-skill action attributed to a high-tier actor (a nation-state running a simple command for deniability) or a sophisticated outcome attributed to an unskilled attacker, weigh every clue, not the flashiest one.

Pattern 2: "Nation-state vs. organized crime" (same techniques, different motive)

Both are external, well-funded, and capable, so, as the actor profiles above established, the technique cannot separate them and only the motive does. The pattern-specific tell is what the stem stresses: patience and stealth over months with no monetization leans nation-state even if no payment is mentioned, whereas ransom, fraud, or resale leans organized crime.

Pattern 3: "Insider vs. external attacker"

The single decisive word is access: if the actor already holds legitimate, authorized access (employee, contractor, partner), it is an insider threat, including the careless employee, since the NIST clause from the actor profiles above covers wittingly or unwittingly^[3] misuse, regardless of how unsophisticated the act is. A simple authorized copy to removable media counts. The right mitigations for this pattern are least privilege, separation of duties, mandatory vacations / job rotation, and user-behavior analytics, not perimeter firewalls, which the insider bypasses.

Pattern 4: "Is this even an attacker?" (shadow IT and 'ethical')

Two entries on the objective look like answers but are not adversaries, as the profiles above explained: shadow IT is unsanctioned, unmanaged assets the organization itself introduced, and the 'ethical' motive describes an authorized tester under rules of engagement. The pattern-specific move is reading what the stem actually asks: shadow IT is the wrong pick for "which threat actor" unless the question targets the internally created risk that widened the attack surface, and its response is discovery, asset inventory, and policy, not incident containment; a scoped, sanctioned test points to a legitimate researcher with no incident to contain.

Pattern 5: "Pick the BEST mitigation for THIS actor"

The stem fixes an actor and asks for the control. Chain actor → its defining attribute → the control that addresses that attribute (the figure traces all four chains against the objective 2.1 actor list): insider threat → already inside → least privilege, separation of duties, UEBA; nation-state/APT → long dwell + custom tooling → defense in depth, threat hunting, and detective/behavioral controls (you cannot prevent a zero-day, so you must detect the residence); unskilled attacker → uses known public exploits → patch management and basic hardening close the borrowed tools' targets; shadow IT → unmanaged assets → asset discovery, inventory, and acceptable-use policy. The wrong answer is usually a perimeter-only control offered against an insider, or 'add another preventive control' offered against an APT where detection is the actual gap.