Understanding Cyber Criminals: Classes, Skill Levels, Resourcing, and Typical Targets

In today’s interconnected digital landscape, cyber threats are becoming increasingly sophisticated and diverse. Cyber criminals operate in various forms, each with distinct motivations, skill levels, resources, and targets. As a leading cybersecurity consulting firm, Aegis Cybersecurity specialises in helping organisations navigate these threats through comprehensive audits, advisory services, and governance strategies. In this blog post, we’ll explore the different classes of cyber criminals, their characteristics, and how they typically operate.

Script Kiddies

Skill Level: Low
Resourcing: Minimal
Typical Targets: Small businesses, individuals, poorly secured systems

Script kiddies are novice hackers who use pre-written scripts or tools developed by more skilled hackers. Lacking deep technical knowledge, they rely on these tools to conduct attacks. Their motivations often include gaining notoriety among peers or simply causing disruption for fun. While their skill level is low, script kiddies can still cause significant damage, particularly to poorly secured systems.

Typical Attacks:

Defacement: Altering the content of a website to display their own messages.
Denial of Service (DoS): Overloading a server to make a website or service unavailable.

Defensive Measures:

Regularly update software and systems to patch vulnerabilities.
Implement strong password policies and multi-factor authentication.
Conduct regular security audits to identify and rectify weaknesses.

Hacktivists

Skill Level: Varies (from low to high)
Resourcing: Community support, crowdfunding
Typical Targets: Government agencies, corporations, political entities

Hacktivists are individuals or groups driven by ideological or political motives. Their attacks aim to promote a cause or draw attention to specific issues. They can range from amateur hackers to highly skilled professionals. Hacktivists often operate within loosely organised groups and may receive support from like-minded communities or through crowdfunding.

Typical Attacks:

Data Leaks: Exposing sensitive information to embarrass or undermine their targets.
Website Defacement: Modifying websites to display propaganda.
Distributed Denial of Service (DDoS): Coordinating large-scale attacks to disrupt services.

Defensive Measures:

Monitor for signs of activism that could indicate a potential threat.
Employ robust encryption to protect sensitive data.
Develop a crisis communication plan to address potential reputational damage.

Cyber Crime Gangs

Skill Level: High
Resourcing: Well-funded, often through proceeds of previous crimes
Typical Targets: Large scale small business “spray attacks”, financial institutions, large corporations, high-net-worth individuals

Organised cyber criminal gangs are highly skilled and well-resourced groups operating with the primary motive of financial gain. These groups are structured similarly to traditional criminal organisations, with specialised roles such as developers, hackers, and money mules who transfer stolen funds. Their operations are often highly sophisticated, involving advanced techniques and tools.

Typical Attacks:

Ransomware: Encrypting a victim’s data and demanding payment for the decryption key.
Bank Fraud: Using phishing and other methods to gain access to financial accounts.
Carding: Stealing and selling credit card information.

Defensive Measures:

Implement advanced threat detection and response systems.
Regularly back up data and develop a comprehensive disaster recovery plan.
Train employees to recognise and report phishing attempts.

State-Sponsored Hackers

Skill Level: Extremely high
Resourcing: Virtually unlimited, backed by nation-states
Typical Targets: Other governments, critical infrastructure, defence contractors, high-profile corporations

State-sponsored hackers are among the most skilled and well-resourced cyber criminals. Backed by nation-states, their attacks are often politically or economically motivated and can be part of larger geopolitical strategies. These hackers typically target government agencies, critical infrastructure, and key industries to gather intelligence, disrupt operations, or gain strategic advantages.

Typical Attacks:

Espionage: Stealing sensitive government or corporate information.
Infrastructure Sabotage: Disrupting essential services such as power grids or communication networks.
Advanced Persistent Threats (APTs): Long-term, targeted attacks designed to remain undetected while extracting valuable data.

Defensive Measures:

Implement multi-layered security strategies, including network segmentation.
Regularly update and patch systems to mitigate vulnerabilities.
Collaborate with national cybersecurity agencies for intelligence and support.

Insider Threats

Skill Level: Varies
Resourcing: Access to internal systems and information
Typical Targets: The organisation they work for

Insider threats come from individuals within an organisation who misuse their access to data and systems for malicious purposes. This can include disgruntled employees, contractors, or business partners. Their motivations can range from financial gain to revenge or espionage. Insiders often have legitimate access to sensitive information, making their actions particularly damaging and difficult to detect.

Typical Attacks:

Data Theft: Stealing sensitive information such as intellectual property or customer data.
Sabotage: Deliberately damaging systems or data.
Espionage: Providing confidential information to competitors or foreign entities.

Defensive Measures:

Implement strict access controls and regularly review access permissions.
Monitor user activity for unusual or suspicious behaviour.
Foster a positive workplace culture to reduce the risk of disgruntled employees.

Conclusion

Understanding the different classes of cyber criminals, their skill levels, resources, and typical targets is crucial for developing effective cybersecurity strategies. As cyber threats continue to evolve, it’s essential for organisations to stay informed and proactive in their defence efforts. At Aegis Cybersecurity, we specialise in providing comprehensive cybersecurity audit, advisory, and governance services to help our clients navigate the complex threat landscape and safeguard their operations.

To learn more about how Aegis Cybersecurity can help protect your organisation from cyber threats, contact us today. Together, we can build a more secure digital future.

Understanding Cyber Criminals: Classes, Skill Levels, Resourcing, and Typical Targets