[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.1.b
AP Cybersecurity · Securing Spaces
Identifying Types of Adversaries
Ask what they want and what access they started with — the rest follows.
key ideaName the type by asking what they want and what access they start with.
The categories
These five are not skill levels. They are motivation profiles, and motivation is what predicts the target, the payload, and how long the adversary stays. Two of them can be low-skill and still do enormous damage.
Only the insider begins with legitimate access, which is why they are treated as a distinct category rather than a skill level. Everyone else has to get in first.| Type | Motivation | Distinguishing feature | Typical action |
|---|
| script kiddie | greed, recognition | uses others' tools without understanding them | opportunistic defacement, off-the-shelf malware |
| hacktivist | social, political, personal cause | believes the goal justifies illegal methods | defacement, leaks, disruption of a specific target |
| insider | greed, revenge | legitimate credentials and access | data theft, sabotage, quiet exfiltration |
| transnational criminal organization | financial gain | organized, resourced, persistent | ransomware, stealing IP for illegal markets |
| cyberterrorist | politics, beliefs | seeks disruption at community or national scale | attacks on power, water, civil infrastructure |
The third column is the one to memorize. Motivation alone does not separate these types — a hacktivist and a cyberterrorist may share beliefs and differ entirely in scale and intent.
Script kiddieA low-skilled adversary running tools built by others without understanding how they work.
HacktivistMotivated by a social, political or personal cause, and willing to break the law for it.
InsiderAlready holds legitimate credentials and access — and may be recruited by an outside group.
CyberterroristAims to disrupt a community, region or nation, often through civil infrastructure.
Transnational criminal organizationOperates for financial gain at scale — ransomware and stolen intellectual property.
| Question | If yes |
|---|
| Did they already have credentials? | insider — regardless of skill |
| Is the goal money at scale? | transnational criminal organization |
| Is the goal publicity for a cause? | hacktivist |
| Is the goal disrupting civil infrastructure? | cyberterrorist |
| Was it an off-the-shelf tool used without understanding? | script kiddie |
Work down the list. The first ‘yes’ usually settles it, and the insider question comes first because it changes which controls could ever have applied.
Telling them apart
the deciding features
- Insider is defined by access, not by skill or motive.
- Script kiddie is defined by borrowed tooling — greed or recognition, no depth.
- Hacktivist and cyberterrorist share ideology; they differ in scale and intent to harm.
- Criminal organizations are the ones that behave like businesses: ransomware, resale markets, repeat operations.
Worked examples
EX 1
Access changes the answer
A departing employee copies the customer database to a personal drive on their last day and sells it. No tools, no vulnerabilities. Classify them.
1
Ask about access
They had legitimate credentials the whole time.
2
Apply the first question
That makes them an insider, whatever else is true.
3
Identify the motivation
Greed — the CED lists greed and revenge for insiders.
4
Note what failed
No perimeter control applies. The gaps were offboarding and data-loss monitoring.
5
State the lesson
Insiders bypass the entire external defense stack, which is why they are their own category.
EX 2
Cause versus catastrophe
Group A defaces a mining company’s website with protest slogans. Group B attempts to disable a regional water treatment plant. Both cite the same environmental cause. Classify each.
1
Classify group A
Hacktivist — illegal disruption aimed at a specific organization to publicize a cause.
2
Classify group B
Cyberterrorist — targeting civil infrastructure to disrupt a whole community.
3
State what separates them
Not belief, but scale and the intent to endanger a population.
4
Note the practical difference
Group A threatens reputation; group B threatens public safety.
5
Note the response difference
Group B triggers national infrastructure protection rather than ordinary incident response.
EX 3
Business-like adversaries
An organization is encrypted by ransomware, receives a negotiation portal, a support chat, and a deadline. Classify the adversary.
1
Read the motivation
Payment is demanded — financial gain.
2
Read the operation
A portal and support staff imply an organization, not an individual.
3
Classify
A transnational criminal organization.
4
Predict the second lever
Expect stolen data as well as encryption — IP resale is the other revenue line.
5
Note the implication for defense
Backups alone are insufficient once exfiltration is part of the model.
Watch out
“Script kiddie” describes tooling, not damage
Borrowed ransomware still encrypts everything. The label means the attack was preventable by patching, not that it was harmless.
Insider is about access, not intent
A careless insider and a malicious one both bypass the perimeter. What defines the category is legitimate credentials.
Hacktivist and cyberterrorist are not interchangeable
Both are ideological. The cyberterrorist aims at community, regional or national disruption — infrastructure rather than reputation.
Insiders can be recruited
The CED notes insiders may be recruited by malicious third parties. An external group can obtain insider access without any of its members being employees.