In the first part of our little blog series on the basics of malware, we’ve been dealing with the terminology of viruses, worms, etc. We discovered that the types of cyberattacks have changed considerably over the years. Until a few years ago, relatively simple spam messages and viruses were widely distributed according to the minimax principle (minimum effort at maximum range). Today, attacks are more sophisticated and unique. This is because defense mechanisms have adapted and the detection of waves of mass spam and viruses has been significantly improved. But before this multi-part series explores how malware can be analyzed and fended off, let’s shed light on who’s behind all these attacks.

The stereotype of a hacker looks something like this: A pale, hoodie-wearing, single man sits in a dark basement while eating pizza and drinking cola. From here, he is hacking code into a computer and attacks his targets. The reality of it is much more complex.

Nowadays, cyber-attackers are acting like small businesses – they consist of teams whose members specialize in subtasks and who professionally distribute their “goods”. After all, this industry has become a highly lucrative field of activity and cybercrime revenues are said to be even higher than in worldwide drug trafficking.

More than just nerds sitting in basements

To security professionals’ dismay, there are a large number of varying cybercrime groups. To complete the list thematically, we therefore also have to include the field of cyberwar. The goals of this group of people are often not monetary, but ideological.

The following list shows some groups that most cybercriminals can be divided into:

Professional criminals

This group includes all those who pursue purely economic goals with their cyber-attacks. Their aim is to generate the highest possible amount of money – in whatever form. In addition to banking trojans and spyware, they also use ransomware attacks or crypto mining malware. The sale of stolen data and information should also be mentioned: Selling lists of emails or other personal information, botnets and other content can be highly profitable. Even the sale of malware itself falls into this category: attacks are offered as a service, so that even technically less experienced or less-equipped people can launch attacks. This could be in form of a new ransomware, but also in form of a simple DDoS attack on companies, organizations and government agencies.

State actors

These are actors that can be attributed to national governments. One of their main goals is to improve the situation for their own country, be it through hacker attacks or through sabotage, classic espionage or the infiltration of opponents. Although these activities are not openly communicated by individual countries, they are still an open secret. As a result, individual countries repeatedly blame each other for these attacks – currently the American FBI and the British National Cyber Security Center (NCSC) accuse Russia of being responsible for a large-scale cyberattack in which hackers have infiltrated network infrastructures on a large scale. By the way, the two authorities are using the cyber kill chain as an explanation.

To combat crime and terrorism, authorities are actively using certain programs to spy on target persons and obtain information relevant to investigations. The Federal Trojan, which is allegedly already in use, is such an example. Officially, the state organs are subject to the legislative and judiciary, but in reality, this control has gaps.

Some state institutions even gather their own knowledge about security holes without allowing them to be closed so that they may be able to exploit them for themselves. The problem is that if these so-called zero-day exploits fall into the wrong hands they can then be misused – as it happened in the ransomware attack WannaCry, in which an exploit that was probably lost by the NSA, was used by North Korean hacker groups.

Activists, political groups

This group of cyber criminals, also known as “hacktivists”, conducts cyberattacks based on their ideological views. Victims can include private companies, politicians or state organs. They try to enforce their political, social or other ideas through their attacks. In addition to classic hacking, DDoS attacks are used as well.

Hacktivists include the groups Anonymous, WikiLeaks and LulzSec.

Private companies

The private sector is not immune to the activities of cybercrime. Generalized as industrial espionage, the goal of this group of attackers is to spy on their competitors, gain information, and use it for their own benefit.

Vandal / “jesters”

These attackers do not set strategic goals for their cyber-attacks – they are more concerned with satisfying their curiosity, trying out new ideas, and gaining recognition for their achievements. It might also be the pure pleasure of destruction that drives this group of people.

Security researchers

There are also people who are actively looking for vulnerabilities in IT infrastructures to increase the security of IT systems. These experts can be found in public institutions such as universities and public authorities, but also in private companies in so-called “security labs”. The difficulty sometimes lies in cybercriminals being able to misuse and exploit these published findings for their own purposes.

Money is the main driver

The main motivation behind the attacks is highly interesting: According to a recent survey by telecommunications provider Verizon, 76% of all security breaches last year were financial in nature, followed by espionage activities, “fun motives” and personal aversions. Another very interesting statistic from the Verizon study: 28% of all data breaches were carried out by internal staff.

The next part of our series will explore how malware analysis works and how to develop defense strategies based on these findings.

Further information: