Security+ 801 Countdown, T-32: Threat Actors Rewritten With Terrorists, Competitors, and Accidents

A threat actor is the person or group behind a security event: the one who clicks, types, pays, or gives the order, as distinct from the malware, the phishing message, or the exposed port that the actor uses to reach a target. A motivation is the reason the actor acts, and it is a separate fact from the actor’s identity, because the same person can act for money one week and out of spite the next. The distinction matters outside the exam room: a defender who misnames the actor chooses the wrong containment, and one who misreads the motivation predicts the wrong next move.

SY0-801 objective 2.2, “Describe common threat actors and motivations,” is an expanded treatment of the topic, with eight actors, twelve motivations, and three attributes (CompTIA 2025). The eight actors are Unskilled attacker, Hacktivist, State-sponsored, Crime syndicate/organized crime, Insider, Terrorist, Competitor, and Accidental/unintentional. The twelve motivations are Espionage, Ethical, Revenge, Financial, Extortion, Fear/chaos, Ideological, Political, Influence, Intellectual property, Notoriety, and General curiosity. The three attributes used to characterize any actor are Internal/external, Resources/funding, and Level of sophistication/capability.

The actor that deserves the closest reading is Accidental/unintentional, the only one defined by the absence of intent: a scenario can describe real damage with no motivation behind it at all. The rest of the objective is a classification exercise, and the method that holds up under pressure is to treat the label, the motivation, and the attributes as three separate decisions, made in that order.

Three decisions: label, motivation, and attributes

The label answers who acted. Four of the eight actors are defined by what the actor is. A State-sponsored actor is directed or funded by a government. A Crime syndicate/organized crime actor is a group that attacks as a business. A Competitor is a rival organization in the victim’s own market. An Insider is someone who holds, or held, trusted access to the victim’s systems or facilities. Three more are defined by what the actor wants or how it operates: a Hacktivist attacks in service of a cause, a Terrorist seeks to put fear into a population, and an Unskilled attacker runs tools other people built without the ability to adapt them. The eighth, Accidental/unintentional, is defined by the absence of a want at all, and it gets its own section below.

The motivation answers why, and the twelve options sort into five families that are easier to hold than a flat list. Money: Financial is the broad case (card theft for resale, crypto heists), and Extortion is the coercive case (pay, or we encrypt or leak). Information: Espionage collects secrets, Intellectual property targets designs, code, and trade secrets, and Influence shapes opinions or decisions rather than taking anything. Cause: Ideological is a belief about how the world should work (protesting a company’s environmental record), and Political targets a government, its policy, or an election. Self: Notoriety needs an audience (posting, claiming credit), General curiosity is private exploration, and Ethical covers authorized testing and coordinated disclosure. Harm: Fear/chaos targets a population, and Revenge targets a specific organization or person over a grievance. The families are a study aid, not CompTIA’s grouping; the objective lists the twelve flat.

The attributes describe the actor once it is labeled. Internal/external is position relative to the trust boundary, not the network path. Resources/funding is the money, people, and time behind the actor. Level of sophistication/capability is whether the actor builds and adapts its tooling or only runs it. The attributes are kept separate from the label because they vary inside it: a state-backed group can be clumsy and a small criminal crew can be excellent, and the cases later in this post show both.

The eight labels line up closely with taxonomies practitioners already use. NIST SP 800-30 Rev. 1 has a Competitor subtype and an ACCIDENTAL source type, and the VERIS enumerations include Competitor, Terrorist, Organized crime, and “State-sponsored or affiliated group” (NIST 2012; VERIS Community n.d.b). CompTIA publishes no mapping to either, but a reader who knows one of them will recognize most of 2.2 on sight.

Accidental actors: harm with no intent

NIST SP 800-30 Rev. 1, Table D-2, sorts threat sources into four types: ADVERSARIAL, ACCIDENTAL, STRUCTURAL, and ENVIRONMENTAL. ACCIDENTAL means “Erroneous actions taken by individuals in the course of executing their everyday responsibilities,” with two subtypes, User and Privileged User/Administrator (NIST 2012). Adversarial sources are characterized by Capability, Intent, and Targeting; accidental sources by Range of effects alone. Basically, NIST scores an accident only on potential damage, because there is no intent to score, and that is exactly the logic of an actor with no motivation. Do not stretch the label: equipment failure (STRUCTURAL) and natural disasters (ENVIRONMENTAL) have no equivalent on the 2.2 actor list.

The sources disagree on where accidents belong. CISA files them under insider threat, which covers “malicious, complacent, or unintentional acts,” and its accidental example is mistyping an email address and sending a sensitive document to a competitor (CISA n.d.). SY0-801 lists Insider and Accidental/unintentional as separate actors, so on the exam the deciding fact is whether the act was a mistake or deliberate. VERIS, the incident schema behind Verizon’s Data Breach Investigations Report, adds a useful rule: Error actions carry motive NA, and an insider whose misconfiguration only contributed to another actor’s breach is not counted as an actor at all (VERIS Community n.d.a). If an attacker exploits a mistake, the attacker is the actor and the mistake is a vulnerability (misconfiguration, covered at T-29).

For scale, the 2026 DBIR reports internal actors in 44 percent of Public Administration breaches, with an unusually high rate of Miscellaneous Errors, especially Misdelivery. Its headline figure, a human element in 62 percent of breaches, is broader than accidents, so do not quote it as an error rate (Verizon 2026).

Same person, same data, opposite intent

VERIS makes the distinction mechanical. These two illustrative records (not real incidents) use only VERIS 1.4 field names and enumeration values. First, the accident:

{
  "schema_version": "1.4.0",
  "incident_id": "3f2c9a1e-7b4d-4e2a-9c61-0d8e5a7b1c22",
  "security_incident": "Confirmed",
  "summary": "Payroll clerk attached the wrong spreadsheet to an email to a benefits vendor.",
  "timeline": {"incident": {"year": 2026, "month": 10}},
  "actor": {"internal": {"variety": ["Finance"], "motive": ["NA"]}},
  "action": {"error": {"variety": ["Misdelivery"], "vector": ["Carelessness"]}},
  "asset": {"assets": [{"variety": "S - Mail"}], "cloud": ["External Cloud Asset(s)"]},
  "attribute": {"confidentiality": {"data_disclosure": "Yes", "data": [{"variety": "Personal", "amount": 412}], "data_victim": ["Employee"]}},
  "discovery_method": {"internal": {"variety": ["Reported by employee"]}}
}

The second record is identical except for four fields:

{
  "summary": "Payroll clerk who was denied a promotion emailed the same spreadsheet to a personal account.",
  "actor": {"internal": {"variety": ["Finance"], "motive": ["Grudge"]}},
  "action": {"misuse": {"variety": ["Data mishandling"], "vector": ["LAN access"]}},
  "discovery_method": {"internal": {"variety": ["Data loss prevention"]}}
}

Same person, same 412 employee records, same mail server. Motive NA with an error action is Accidental/unintentional; motive Grudge with a misuse action is Insider with Revenge. Misdelivery means sending the wrong information or sending to the wrong recipient. Nothing about the damage tells you which actor you have; only the intent does, and intent is read from the action and from the surrounding facts (a denied promotion, a personal account as the destination, a DLP alert rather than a self-report).

Mapping actors to motivations

Once the label is settled, the motivation usually follows; the table gives the pairings that recur in advisories and incident data. They are typical, not rules, and are not a CompTIA mapping.

SY0-801 actor	Typical motivations	Anchor
State-sponsored	Espionage, Influence, Political; sometimes Financial	North Korean crypto heists and financial crimes net at least $1 billion a year (ODNI 2026)
Crime syndicate/organized crime	Financial, Extortion	Double extortion: encrypt and threaten to leak (CISA 2023b)
Hacktivist	Ideological, Political, Notoriety	Pro-Russia groups “primarily seeking notoriety” (CISA 2025)
Terrorist	Fear/chaos, Ideological	Terrorist shift to information operations for propaganda (ODNI 2026)
Competitor	Intellectual property, Espionage	Adversarial organization subtype (NIST 2012)
Unskilled attacker	Notoriety, General curiosity	VERIS motive “Fun, curiosity, or pride”
Insider	Revenge, Financial	Intentional insiders often want to “get even” (CISA n.d.)
Accidental/unintentional	None	VERIS motive NA; NIST Range of effects only

Ethical has no fixed actor; it fits authorized testing and coordinated disclosure. When a scenario resists the table, I use this order (my interpretation, not CompTIA’s):

1. Was the damaging act itself a mistake (wrong recipient, wrong setting, wrong file)? If so, the actor is Accidental/unintentional and no motivation applies. Deliberate access with no wish to harm, such as curiosity-driven probing or authorized testing, is not accidental; it carries a motivation (General curiosity, Ethical).
2. Who directs or funds the actor? A government means State-sponsored, whatever persona it uses.
3. Did the person hold trusted access when acting? Then Insider.
4. Otherwise classify by goal: money or coercion, cause, fear in a population, or business advantage. A lone actor running other people’s tools for bragging rights or curiosity is the Unskilled attacker.
5. Use the attributes last, to describe the actor and break ties. Sophistication names an actor only in the Unskilled attacker case, and only after steps 2 to 4 found no sponsor, organization, or cause.

Step 4 maps, in order, to Crime syndicate/organized crime, Hacktivist, Terrorist, and Competitor; its last sentence covers the Unskilled attacker. Step 3 has one known edge case, the former employee, and the sources split on it: CISA defines an insider as anyone who “has or had” authorized access, while VERIS codes a former employee with no remaining access as External (CISA n.d.; VERIS Community n.d.a). If a scenario hinges on it, look for still-valid credentials (an inference).

Blurred lines: personas, proxies, and profit

The hardest scenarios describe an actor whose persona and sponsor differ, or whose stated motive and real one do.

CARR presented itself as a group of pro-Russia hacktivists. CISA assesses that GRU unit 74455 likely supported its creation in early 2022 and likely funded its DDoS tools through at least September 2024, calling it “an unattributable platform” for activity “beneath the level of an APT” (CISA 2025). According to an indictment announced December 9, 2025, the GRU “founded, funded, and directed” it; that is an allegation, and trial outcomes are unverified (U.S. Department of Justice 2025). In 2.2 terms: State-sponsored, motivated by Political and Notoriety, with low sophistication despite state resources, which is why the attributes are separate from the label.

CyberAv3ngers defaced internet-exposed Unitronics PLCs, likely through default or missing passwords, compromising at least 75 US devices, at least 34 in the water sector, from November 2023 to January 2024. CISA and partner agencies call it “an Iranian IRGC-affiliated cyber persona” and note that the US and Canada designate the IRGC a foreign terrorist organization (CISA 2023a). Treasury sanctioned six officials of the IRGC Cyber-Electronic Command on February 2, 2024 under counterterrorism authority E.O. 13224, while calling the command a government organization and noting the operation “did not disrupt any critical services” (U.S. Department of the Treasury 2024). The terrorist designation makes Terrorist tempting, but the better 2.2 reading (an interpretation) is State-sponsored, because a government organization directs it; the motivation is Political, with Fear/chaos secondary.

Lapsus$ is the reverse trap. The Cyber Safety Review Board describes a “loosely organized,” extortion-focused group that included juveniles and was not a nation-state actor; it claimed profit as its only motive, though notoriety, amusement, and ideology were also plausible (Cyber Safety Review Board 2023). Simple techniques do not make it an Unskilled attacker, because step 4 finds a goal (money by coercion) before step 5 ever looks at sophistication. The closest 2.2 label (an interpretation) is Crime syndicate/organized crime with Extortion, Notoriety, and Financial, although the CSRB itself contrasts the loosely organized group with “well-resourced cybercrime syndicates”; the objective has no separate label for a loose criminal crew. States can also chase money: ODNI reports that North Korea runs espionage and cybercrime and places IT workers with falsified credentials, which is a state actor gaining insider access (ODNI 2026).

What you need to know for SY0-801

• Eight actors: Unskilled attacker, Hacktivist, State-sponsored, Crime syndicate/organized crime, Insider, Terrorist, Competitor, and Accidental/unintentional.
• Twelve motivations: Espionage, Ethical, Revenge, Financial, Extortion, Fear/chaos, Ideological, Political, Influence, Intellectual property, Notoriety, and General curiosity.
• Three attributes: Internal/external, Resources/funding, and Level of sophistication/capability; they describe an actor and never replace the label.
• “Nation-state” is 701-era vocabulary; SY0-801 says State-sponsored, and an APT scenario usually resolves to it (APT itself is named in 2.3 as a source, covered at T-31).
• Shadow IT is no longer an actor answer; an employee’s unapproved SaaS tool is a 2.4 exposure (T-29).
• An error (misdelivery, misconfiguration) means Accidental/unintentional; deliberate access without malice does not. If an attacker exploits that mistake, the attacker is the actor and the mistake is a vulnerability.
• Extortion is coercion (pay, or we encrypt or leak); Financial is broader, e.g., card theft for resale or crypto heists.
• Espionage collects secrets; Intellectual property targets designs, code, and trade secrets and pairs with Competitor; Influence shapes opinions or decisions.
• Ideological is a cause (protesting a company’s environmental record); Political targets a government, its policy, or an election.
• Notoriety needs an audience (posting, claiming credit); General curiosity is private exploration.
• Fear/chaos targets a population; Revenge targets a specific organization or person over a grievance.
• The VERIS motive “Fear” means acting under fear or duress; it is not CompTIA’s Fear/chaos.
• A persona’s claims never decide the label; funding and direction do.

Check yourself

These are my own practice questions, written for this post.

1. A help desk technician bulk-edits group membership and mistakenly adds 300 contractors to a finance share. An audit finds the error two days later; logs show no access by anyone outside the company. Using SY0-801 2.2 terms, which actor and motivation best fit the technician?

• A. Insider; Revenge.
• B. Accidental/unintentional; no motivation applies.
• C. Insider; Financial.
• D. Unskilled attacker; General curiosity.

Answer: B. The technician’s change was a mistake, not a deliberate act against the organization, which is the line between Insider and Accidental/unintentional. Trusted access alone does not make someone an Insider actor on 801.

2. A Telegram channel of self-described patriotic volunteers claims it changed setpoints on water-plant HMIs. A later government advisory assesses that a foreign military intelligence unit created the group and funded its tools, and notes the group’s techniques were unsophisticated. Which actor label fits best?

• A. Hacktivist.
• B. Terrorist.
• C. State-sponsored.
• D. Unskilled attacker.

Answer: C. Funding and direction by a government decide the label, whatever persona the group presents. Low sophistication is an attribute describing the actor, not a reason to call it an Unskilled attacker.

3. A rival manufacturer pays a contractor at a robotics firm to copy CAD files for an unreleased gripper and uses them to shorten its own design cycle. Which actor and motivation best describe the manufacturer?

• A. Competitor; Intellectual property.
• B. State-sponsored; Espionage.
• C. Crime syndicate/organized crime; Extortion.
• D. Insider; Revenge.

Answer: A. A business rival stealing designs for economic advantage is the new Competitor actor with the new Intellectual property motivation. The contractor is an insider motivated by money, but the question asks about the organization that commissioned the theft.

This is T-32 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-31: Threat Vectors Rebuilt for RCS, QR Codes, and Fake CAPTCHAs. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CISA. 2023a. “IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities.” Cybersecurity Advisory AA23-335A, last revised December 18, 2024.

CISA. 2023b. #StopRansomware Guide. Joint Ransomware Task Force, October 2023.

CISA. 2025. “Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure.” Cybersecurity Advisory AA25-343A, last revised December 18, 2025.

CISA. n.d. “Defining Insider Threats.” Accessed October 12, 2026.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Cyber Safety Review Board. 2023. Review of the Attacks Associated with Lapsus$ and Related Threat Groups. Department of Homeland Security.

NIST. 2012. Guide for Conducting Risk Assessments. Special Publication 800-30 Rev. 1. Joint Task Force Transformation Initiative.

ODNI. 2026. Annual Threat Assessment of the U.S. Intelligence Community. Office of the Director of National Intelligence, March 2026.

U.S. Department of Justice. 2025. “Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups.” Press Release 25-1158, December 9, 2025.

U.S. Department of the Treasury. 2024. “Treasury Sanctions Actors Responsible for Malicious Cyber Activities on Critical Infrastructure.” Press release JY2072, February 2, 2024.

VERIS Community. n.d.a. “Actors.” VERIS Framework. Accessed October 12, 2026.

VERIS Community. n.d.b. “verisc-labels.json.” VERIS Community Schema 1.4.1, vz-risk/VERIS repository on GitHub. Accessed October 12, 2026.

Verizon. 2026. 2026 Data Breach Investigations Report: Executive Summary.