Objective 2.1: Compare and contrast common threat actors and motivations
Security+ SY0-701 practice question
Days after a regional energy company announces a new pipeline project, its public website is knocked offline by a DDoS attack and then defaced with a statement opposing the project. A group claims responsibility on social media and says the attacks will continue until the project is cancelled. No payment has been demanded. Which threat actor is MOST likely responsible?
- Organized crime
Organized crime is motivated by financial gain. Its attacks usually involve ransom, extortion, fraud, or stolen data to sell, and no payment has been demanded here.
- Nation-state
Nation-state actors are well-funded and usually pursue espionage, disruption, or strategic advantage while avoiding attribution. Publicly claiming a defacement over a single pipeline project does not fit that profile.
- Insider threat
An insider threat is someone with authorized access, such as an employee or contractor. Nothing suggests internal access was used; both attacks targeted public-facing systems, and the group identifies itself publicly.
- Hacktivist(Correct)
Correct. The motive is opposition to the project, the methods (DDoS and defacement) are designed to draw attention, and the group publicly claims responsibility with a cause-based demand.
Explanation
Hacktivists attack to advance a political, social, or philosophical cause. Their typical signs are public, attention-seeking attacks such as DDoS and website defacement, open claims of responsibility, and demands tied to their cause rather than to money. Match the actor to the motivation shown in the scenario.