Cyber Threat Actors and the Losses They Cause

If we rank cyber threat actors, each with a different mindset, financial resources and organisational network, together with their motivations, from the lowest threat level to the highest, we can make the following classification:

Thrill Seekers (Script Kiddies) – The threat actors in this group mostly consist of people who carry out small-scale cyber attacks for fun rather than out of a motive of financial gain. People who try to break into other people’s computer systems with information obtained from easily accessible internet forums, and who enjoy doing so, are mostly included in this group. This group of actors, which can also be driven by the desire for fame, may sometimes aim to make a name for themselves by detecting and reporting organisations’ security vulnerabilities.

Insider Threats – These are people who have had or are having some friction with management at the institutions where they work and who have access to the institution’s network or critical information. These people, who may also act as intermediaries for actors outside the institution for personal gain, are called internal cyber threat actors.

In 2015, one of the lead engineers of Waymo, Google’s self-driving car project, left the company to launch his own self-driving vehicle start-up, Otto. Before leaving, however, he had downloaded 14,000 files containing various trade secrets, including diagrams and drawings related to simulations, radar technology, source code, PDFs marked confidential and videos of test drives, directly from Google’s servers to his laptop. Google executives noticed the breach after Otto was bought by Uber a few months later. In the end, as a result of this incident caused by a former Google employee, Waymo was given Uber shares worth 245 million dollars, and the former employee pleaded guilty.

Hacktivists – Threat actors who carry out cyber attacks for propaganda purposes with ideological motivation can be included in this group. The term is derived from the combination of the words hacker and activist. Hacktivists are the group into which we can place people who carry out cyber attacks to publicise ideologies they believe to be right and beneficial by drawing public attention.

Aaron Swartz, known for his actions defending freedom of access to information and open access and for the removal of censorship, was an American computer programmer, IT specialist, writer and activist. In 2008 Swartz downloaded to his computer about 20 million pages of documents held in the database of the American federal courts and sold for a fee, and in 2011 nearly 4 million articles from the online system JSTOR (Journal Storage), set up to archive academic journals, making them public, and for these reasons 13 charges of “information piracy” and “illegal downloading” were brought against him. Swartz, one of the founders of Reddit, one of the world’s leading social sharing sites, took his own life at home in January 2013, while the case, in which he faced 35 years in prison and a fine of 1 million dollars, was pending.

Cybercriminals – In general, we can include in this group those who carry out cyber attacks for financial gain. Today such attacks commonly involve spreading the malware called ransomware into the target computer network through social engineering and phishing or remote access methods, then encrypting all systems and files and ending with the attackers’ ransom demand, and they can cause very high financial losses.

Examples of Cyber Attacks Aimed at Financial Gain

• The Melissa virus, created in 1999 by the American computer programmer David Lee Smith, spread by email and overloaded computer systems, cutting off access to the networks of many companies, including Microsoft. Melissa left behind 80 million dollars of damage. The creator of the virus, David Lee Smith, was sentenced to 20 months in prison and a 5,000-dollar fine.
• In 2015 a cyber attack was carried out on an electricity distribution grid in Ukraine’s Ivano-Frankivsk region. People in this region, home to about 225,000 people, were left without electricity for hours. The energy companies stated that the attack had been carried out using the BlackEnergy virus.
• Eighteen years after the Melissa virus, Windows systems, this time the target of the ransomware attack called WannaCry, caused a major crisis in 2017, halting access on about 200,000 computers in more than 150 countries. The global cost of the attack totalled 100 million dollars, it was reported.
• One of the biggest password thefts in the history of cyber attacks took place in recent months. A 100 GB TXT file made up of 8.4 billion stolen passwords, 6 to 20 characters long and stored in clear text, was shared on a hacker forum. All this was dubbed ‘RockYou2021’. In 2009 the RockYou site had also been hacked and the data of more than 32 million people stolen.
• In 2000, Michael Calce, then 15, known by the nickname Mafiaboy, simultaneously launched DDoS (Distributed Denial of Service) attacks on Yahoo!, Fifa.com, Amazon.com, Dell, Inc., E*TRADE, eBay and CNN, crashing internet traffic in the full sense. After this attack, whose total damage was estimated at 1.2 billion dollars, Michael Calce was detained and, because of his age, given eight months of supervised probation and banned from using the internet.