Cyber Attack Motivations: Connecting Actors with Event Types

1. Introduction

In recent years, particularly following the advent of the COVID-19 pandemic, there has been an unrelenting acceleration in the process of digitization that pervades all facets of our lives. Concurrently, the proliferation of cyber threats has escalated, resulting in the compromise of various systems and data. The motives underlying cyberattacks are multifaceted, encompassing a broad spectrum of factors, including economic interests and various ideological beliefs. It is imperative for professionals engaged in the realm of cybersecurity to comprehend these motivations, as this knowledge is instrumental in enhancing their contributions to cybersecurity measures and more effectively countering cyber-attacks.

It is imperative to acknowledge that disparate actors—be they individuals or groups of individuals—operate with a diverse array of motivations. These motivations significantly influence the methods employed to exploit vulnerabilities and achieve desired outcomes. For instance, actors motivated by ideology primarily seek to disseminate or project messages that align with their ideological framework, often without prioritizing economic gain. Furthermore, they perceive themselves as contributing to the justice or desired change they are promoting, vis-à-vis entities or situations that perceive them as opponent [1,2]. A close examination of the extant literature reveals that the motivations of attackers vary according to the prevailing socio-political context. In particular, the pursuit of material gain or reputation appears to be a less significant factor in certain circumstances.

Conversely, cyberattacks driven by financial motives represent an emerging threat to organizations and individuals. The proliferation of cybercrime can be attributed to the increasing prevalence of financial transactions conducted online. Ransomware and phishing attacks are frequently employed by attackers due to their effectiveness against online transactions. This phenomenon can be attributed to the growing vulnerabilities of digital infrastructures, which renders businesses and organizations susceptible to exploitation [3]. In the contemporary landscape of cybersecurity, the integration of artificial intelligence (AI) has profoundly transformed the landscape of cyberattacks, rendering traditional defense techniques increasingly obsolete. This paradigm shift underscores the imperative for the development of innovative, cutting-edge defense methodologies.

Furthermore, the role of state actors, whether directly or indirectly, in cyber espionage or the dissemination of disinformation, introduces an additional layer of complexity to the motivations underlying cyberattacks. The objectives of the aforementioned assailants are commensurate with the realms of national security or industrial espionage, with the objective of acquiring classified information and attaining an advantage over competitors [4] [5] .

This research study examines the existence, if any, of relationships between the motives of the attackers and the motives of the attacks. The data from past attacks (2014–2024) are utilized to draw safe conclusions by employing the chi-square test [6], a widely used statistical method for examining relationships between categorical variables. The corroboration of these relationships has the potential to enhance defense mechanisms and improve security policies, as it facilitates the generation of knowledge derived from real-world events.

2. Materials and Methods

In order to develop a more profound comprehension of the threats posed by cybercrime, it is imperative to undertake a thorough investigation into the motivations that underpin the actions of both the perpetrators and the attacks themselves. The conventional classification of hackers into two categories, namely ethical hackers, who seek to identify vulnerabilities in various systems in a timely manner, and black hackers, who exploit existing vulnerabilities, is insufficient to comprehensively understand the motivations behind their actions.

The issue of motivation must be approached with a multifaceted and nuanced perspective, especially in the dynamic and ever-evolving field of cybersecurity. It is essential to conduct analyses that consider motivations related to incidents and those related to different types of actors. To better assess them, a review of the literature is sought in accordance with the type of cyber incidents, the different types of actors and their motivations, based on the interaction they have with each other.

2.1. Cyber Events Database: University of Maryland NIS360 [7,8]

The University of Maryland's database, which has been in operation since 2014, systematically documents various cyber incidents that occur in different countries. A comprehensive internet scan was conducted to identify sources that highlight cyberattacks. These sources were then confirmed and systematically categorized to map the current state of cyber security issues.

The following variables are distinguished among the elements contained in the database:

• Actor Type: The actor type is a critical factor in distinguishing the perpetrators of cyberattacks. These perpetrators include criminal organizations, nation-state actors, terrorist groups, hacktivists, and hobbyists. This categorization facilitates the discernment of potential motives and methods employed by the actors in question by cybersecurity researchers and policymakers.
• Motive: The motivation behind each cyberattack is a critical factor in its classification. The motives can be categorized into four distinct groups: economic gain, espionage, protest, and sabotage. The utilization of this categorization facilitates the identification of potential trends and patterns that may emerge in future analyses, thereby providing a framework for anticipating future outcomes.
• Mixed: Cyber incidents are classified into three categories: disruptive, exploitative, or mixed. This categorization facilitates comprehension of the repercussions that cyberattacks have on various organizational systems and the consequences that ensue from these events.

2.2. A Profile of Actor Types in Cyber Threats

An analysis of the various types of actors reveals the following classification:

• Cybercriminals are individuals or associations of individuals who commit illegal acts in cyberspace with the primary objective of financial gain. These actors leverage vulnerabilities to compromise the security of systems, with the aim of perpetrating financial fraud, stealing the identity of their victims, and obtaining sensitive personal data or confidential information [9,10,11]. A marked increase in cyber activity has been observed, accompanied by the implementation of advanced methodologies involving ransomware and phishing attacks [10,11].
• Actors operating under the auspices of a state entity, either directly or indirectly, seek to gather intelligence for the purpose of espionage and to inflict a blow against other state entities [12,13]. Furthermore, these actors frequently pursue acts of sabotage against critical infrastructure and surveillance systems in matters of geopolitical concern [14,15]. The primary objective of the aforementioned actions is to diminish national security and to acquire a technological superiority over states that are antagonistic towards them.
• Terrorist groups are non-state entities that seek to alter political situations through the instigation of fear. These actors leverage cyberspace to launch attacks against various institutions and beyond. The tactics employed by these actors pose a significant threat to national security and the prestige of the state entity in question. These threats manifest through attacks on critical information systems or infrastructure, which can severely compromise the entity's ability to function effectively [16,17]. The subjects' objectives are driven by a specific ideological framework that guides their actions. These actions are intended to instill fear, modify political circumstances, and, in general, radicalize protest movements.
• Hacktivists who adhere to political or social criteria employ cyberattacks as a medium to articulate their protest against situations that they deem to be in violation of their sense of justice. The objective of these actors is to create problems in the operations of organizations or state entities, thereby promoting their message in specific situations [18,19]. The objective of cyberattacks is twofold: to exploit and to disrupt various services.
• Hobbyists are individuals who engage in activities for the sake of personal interest and enjoyment, often driven by a desire to satisfy their curiosity and receive acknowledgment for their pursuits. While their actions in cyberspace are not inherently malicious, they may unintentionally engage in practices that compromise cybersecurity [20,21]. While not necessarily driven by the same motivations as cybercriminals, the actions of these entities can potentially result in the exploitation of vulnerabilities or service disruption.

2.3. Motives Underlying Cyber Events

A multitude of factors underpin the motivations, which, to enhance comprehension of the subject matter, are delineated as such in light of extant literature.

• Financial Gain: The primary motivation for cybercriminals is typically economic gain. This is achieved through data breach or data theft attacks, or ransomware [22,23]. These actors employ sophisticated methods to exploit vulnerabilities, guided by the pursuit of optimal economic gain [24]. Cyberattacks driven by economic gain can be categorized as exploitative in nature, as they focus on targeting data that is being utilized for economic gain.
• Espionage: Espionage is the prevailing motive for state entities, with the objective being the collection of information and the procurement of classified data, ultimately leading to the attainment of a strategic advantage [25,26]. The phenomenon under consideration combines both disruptive and exploitative cyber events.
• Protest: The impetus behind the various activists seeking the shutdown of online services is protest, which is motivated by socio-political reasons [27,28]. These actors typically engage in actions directed towards governments or corporate entities, often achieving their objectives through the orchestration of disruptive cyber events. In recent years, there has been an observed increase in the use of exploitative cyber events [29,30].
• Sabotage: Sabotage is typically characterized as either ideologically motivated or a tactic employed by state entities to neutralize systems or networks [31,32]. The cyber events that achieve this objective are classified as disruptive cyber events, with the aim of either inflicting a loss of reputation or imposing a significant financial burden.

2.4. The Interaction of Cyber-Events with Motives and Actors

The classification of cyber events, as delineated by contemporary literature, enables the discernment of distinct categories based on the actors involved and their respective motivations. This systematic approach facilitates the identification of cyber events into the following categories:

• Disruptive Events: Disruption events are defined as those that deliberately seek to interrupt or hinder the functioning of various systems or services. These events are often initiated by hacktivists, terrorists, and similar actors, with the primary objective being to either influence public opinion or to instill fear [33,34]. Beyond the mere disruption of services, the objectives of these actors frequently entail the extensive damage of existing services and functions, as well as the reputation of their targets [35].
• Exploitative Events: Exploitative events are those that primarily stem from cybercriminals seeking financial gain through theft or ransom [36,37]. Given the sophisticated tactics employed to achieve their objectives, it is imperative to implement continuous updates to cybersecurity protocols across all industry sectors [38,39].
• Mixed Events: The proliferation of cyber-events, encompassing both disruptive and exploitative elements, such as ransomware, necessitates the establishment of a distinct category that incorporates the existing classifications [40,41]. It is evident that the occurrence of such events can lead to the implementation of service disruptions and the exploitation of economic resources.

2.5. Methodology

According to the previously articulated framework, the present research study is designed to investigate the presence or absence of any potential relationships between the following:

• The actors and the motives.
• The event types and the motives.

Research Questions:

RQ1: Is there a correlation between the type of actor and the type of motive?

RQ2: Is there a correlation between the event type and the motive?

The University of Maryland's Cyber Events database [42] is regarded as an appropriate dataset for this investigation, as it can contribute to the study of our research questions. The database under consideration contains more than 14,000 cyberattack incidents, spanning the period from 2014 to 2024. Among the variables examined, three were identified as the most pertinent to the research interests under investigation. In the context of this study, the following variables warrant particular consideration:

Actor Type (actor_type):

• Criminal
• Nation-State
• Terrorist
• Hacktivist
• Hobbyist

Event Type (event_type)

• Disruptive
• Exploitive
• Mixed

Motive (motive):

• Protest
• Sabotage
• Espionage
• Financial

The initial records of the set exceeded 14,000. For the variables actor, actor_type, industry, motive, event_type, event_subtype, country, and actor_country, the respective values with the indication "undetermined" or with a similar reference were excluded. The database was formed with 2,728 records. This decision is made consciously in an effort to mitigate the ambiguity inherent in the data and to optimally address the research questions at hand.

3. Results

In light of the aforementioned considerations, the ensuing findings are hereby presented:

RQ1: Is there a correlation between the type of actor and the type of motive?

The null hypothesis (H0) and the alternative hypothesis (H1) of the chi-square independence test are formulated as follows for the pair of variables (actor_type, motive):

• H0: The null hypothesis posits that "Actor Type is independent of Motive."
• H1: The alternative hypothesis posits that "Actor Type is not independent of Motive."

Our first research question was examined using the chi-square test. The categorical variables employed in this study included actor type and event type. Both are nominal variables and include the categories presented above. The following contingency table enumerates the observations that fall into each combination.

The chi-square test yielded a statistic of χ² = 4664.967 with 12 degrees of freedom (df = 12), p < 0.001. This finding suggests the presence of a statistically significant correlation between the variables under study.

All the test criteria were met specifically, the following conditions were satisfied:

• The expected cell frequencies all met the required conditions (80% of the cells are greater than or equal to 5).
• There are more than two categories of categorical variables.
• The sample size is large.

RQ2: Is there a correlation between the event type and the motive?

The null hypothesis (H0) and the alternative hypothesis (H1) of the chi-square independence test are formulated as follows for the pair of variables (event_type, motive):

• H0: The null hypothesis posits that "Event Type is independent of Motive."
• H1: The alternative hypothesis posits that "Event Type is not independent of Motive."

Our second research question was examined using the chi-square test. The categorical variables employed in this study included event type and motive. Both are nominal variables and include the categories presented above. The following contingency table enumerates the observations that fall into each combination.

The chi-square test yielded a statistic of χ² = 2040.599 with 8 degrees of freedom (df = 8), p < 0.001. This finding suggests the presence of a statistically significant correlation between the variables under study.

All the test criteria were met; specifically, the following conditions were satisfied:

• The expected cell frequencies all met the required conditions (80% of the cells are greater than or equal to 5).
• There are more than two categories of categorical variables.
• The sample size is large.

4. Discussion

This research contributes to a more nuanced understanding of cyber actors, their motivations, and the cyber attacks they carry out. A multifactorial approach to the analysis of cyber-security incidents is deemed necessary, as cyber-threats evolve simultaneously with various technologies and changing socio-political realities. The confirmation of statistically significant correlations through chi-square tests, with regard to actor types and motives and event types and motives, once again highlights the necessity of employing integrated analytical frameworks. These frameworks are capable of enhancing prediction and response to cyber threats.

The results of the study indicate that the various actors involved in cybercrime, including nation-state actors and hacktivists, typically operate in accordance with specific motives. For instance, cybercriminals seek financial gain through ransomware and phishing attacks. The advent of the Internet has led to a substantial increase in financial transactions, thereby creating new avenues for exploitation [43]. Moreover, the digital transition of various organizations has led to the emergence of vulnerabilities that can be exploited by perpetrators for financial gain [44].

Cyber actors operating under the auspices of a state entity are driven by espionage and sabotage objectives, seeking to compromise national security or disrupt industrial activity. Given the severity of these threats, it is imperative for respective state entities to maintain constant vigilance and to enhance national strategies against various cyber threats. The various geopolitical tensions related to cyberspace require further academic investigation in the light of improving existing policies [45,46].

Through this research, the existence of a relationship between event types and motivation is highlighted. Disruptive events are most associated with hacktivists and fear-mongering groups, whose motivations are based on socio-political causes. The present findings are consistent with the existing literature, highlighting that these actors, through cyber attacks seek to influence public opinion or cultivate a sense of fear in the targeted societies [47]. As a result, the categorization of events into disruptive, exploitative and mixed allows for easier consolidation of the consequences of these attacks.

Mixed events, such as ransomware attacks, exemplify the intricate nature of emerging cyber threats. In their occurrence, these phenomena achieve two objectives: the disruption of services and the pursuit of financial gain. Due to their inherent characteristics, they render a number of conventional approaches to cybersecurity obsolete, thereby underscoring the necessity to recalibrate various cyber strategies [48].

In the aforementioned points, it would be remiss to neglect to mention the use of artificial intelligence in the domain of cybersecurity. This development poses a challenge to existing defense mechanisms, but it also facilitates the enhancement of cyber protection. A significant component of the research should entail the evaluation of defense strategies through the utilization of artificial intelligence, with the objective of intercepting emerging cyber threats [49,50]. This is particularly salient in the context of de facto actors leveraging artificial intelligence to engineer novel forms of cyberattacks.

The utilization of artificial intelligence in the analysis of cyber actors' motivations and behaviors has the potential to enhance the efficacy of personalized training programs for various organizations and communities. This approach can contribute to the cultivation of a robust cybersecurity culture, as well as the proactive identification and mitigation of potential cyber threats [51,52].

Given the dynamic nature of cyber threats, further exploration of the relationships identified in this study is necessary. In the near future, it would be advisable for research to concentrate on exploring other datasets and/or utilize poetic methods to further enrich the findings presented. A regional and/or broader focus on specific areas has the potential to illuminate the motivations and tactics influenced by these individual characteristics.

In order to enhance the protection of cyberspace, it is imperative to facilitate the exchange of information among the various stakeholders, particularly those responsible for formulating cybersecurity policies. It is imperative that there be as much cooperation between the public and private sectors as possible.

5. Conclusions

This study contributes to our understanding of the intricate relationship between the motivations of cyber actors and the typology of cyber events. Utilizing a comprehensive dataset from the University of Maryland Cyber Events Database, which spans the period from 2014 to 2024, and employing rigorous chi-squared analyses, the study uncovers statistically significant associations between both actor types and their corresponding motivations, as well as between event types and their inherent motivations. These findings underscore the necessity for multifaceted analytical frameworks that can capture the inherent dynamism and complexity of today's cyber threat landscape.

The results indicate that a diverse array of cyber actors—ranging from financially motivated cybercriminals to ideologically motivated hacktivists and state-sponsored entities—demonstrate distinct motivational profiles that directly influence the nature of cyber events they perpetrate. A critical aspect of understanding the operational impact of cyber events is the classification of these events into distinct categories, namely disruptive, exploitative, and mixed types. This classification provides a nuanced perspective, allowing for a more comprehensive analysis of the operational consequences of these incidents. For instance, the occurrence of a ransomware attack, a type of blended event, results in the disruption of services and the exploitation of economic vulnerabilities, thereby challenging the efficacy of traditional cybersecurity defenses.

Despite the contributions of this research, several limitations must be acknowledged. The study's reliance on secondary data and the exclusion of ambiguous or indeterminate cases may introduce selection bias and limit the generalizability of the findings. Consequently, future research endeavors would benefit from the incorporation of additional and more diverse data sources, longitudinal analyses, and the exploration of regional variations in cyber operations. Furthermore, the accelerating integration of artificial intelligence into both offensive and defensive cyber strategies signifies an emerging frontier that merits further scholarly exploration.

In summary, the present study establishes a critical foundation for future research endeavors aimed at elucidating the intricate interplay between the motivations of cyber actors and the typology of events. The statistically significant correlations identified in this study provide compelling evidence for the necessity of enhanced inter-sectoral collaboration—spanning the public, private, and academic domains—and the development of more resilient, adaptive cybersecurity frameworks. In the contemporary context of a constantly evolving threat landscape, characterized by increasing interconnectedness, such integrative efforts are imperative for the protection of digital infrastructures.