Who the attackers are

It is rarely personal

Most people imagine a single hooded figure targeting them by name. The reality is more ordinary and, oddly, more reassuring: the great majority of attacks are not aimed at you in particular. They are wide nets, cast to catch whoever is careless that day.

Knowing who casts those nets, and why, helps you judge what is actually likely, which is the first step in the Impact × Likelihood thinking from the previous lesson.

The main groups

• Cybercriminals. By far the most common. Their motive is money, through ransomware, phishing, and fraud. They favour easy, repeatable targets, which is exactly why everyday habits stop most of them.
• Nation-state actors. Well resourced groups working for a government, after intelligence or disruption. They are patient and targeted, but most people and small organisations are simply not their focus.
• Hacktivists. Driven by a cause rather than profit. They want attention, often through defacing a site or leaking data to make a point.
• Insiders. Someone with legitimate access: an employee, a contractor, a partner. Most insider incidents are not malicious at all, just a mistake, a missent file, or a reused password.
• Cyberterrorists. Rare, aiming to cause fear or damage to critical services. Important to name, but not the everyday threat.

What this means for you

Two things follow from the list.

First, because ordinary cybercrime is the common case, ordinary defences matter most. The habits that frustrate a mass phishing campaign, checking the sender and never rushing, are the same ones this course keeps returning to.

Second, verifying anything unusual through a separate, trusted channel works no matter who is behind it. You do not need to identify the attacker to shut the door.