# Cyber Threat Actors for the Factory of the Future
## 3 Classifying Cyber Threat Actors (CTAs)
### Cyber Criminals  
Cyber criminals infiltrate networks using any available and exploitable vulnerability. They have two objectives, to extract value (money, valuable items or valuable data) and to avoid legal consequences while doing it. One should keep in mind that a large portion of financial damage caused by cyber criminals is not direct, especially in industrial networks. Many schemes (e.g., ad fraud, loyalty program fraud) inflict mainly secondary (indirect) costs to their victim organization [29].  
Some cyber crime groups seem to be state-sponsored and act for nation-state threat actors [30], so clear differentiation between cyber criminals and state actors may be impossible. Cyber criminals can also work for other third parties, even other cyber criminals, as a service (cyber crime as a service--CCAaS) [31].  
Cyber criminal activity directed at organizations can be divided into three broad categories:  
* Mass scams and automated hacking: these activities aim to monetize successful hacking using automated tools and mass scams to infect large amount of accounts and computers. They use crypto trojans for blackmailing and stealing easily sellable data (e.g., social security numbers, credit card numbers, passwords and bitcoins). They seek to get value with minimum possible human effort. Special mention should be given to cryptojackers, who infect systems and then use  
Figure 1: Identified threat actors combined into the eight categories discussed in this paper.  
those resources for mining crypto currencies. This gives the owners of the tools financial value without the knowledge of the owner of the system.
* Criminal infrastructure providers: these actors use automated hacking tools to infect as many systems as possible, and to consequently use those systems in a criminal infrastructure (e.g., botnets). They may then sell the utilization of this infrastructure to third parties for distributed denial of service (DDoS) attacks, spamming, bullet-proof hosting etc., or exploit it for their own campaigns. In these cases, an infected system may perform normally without any noticeable problems, until the system is placed on a public blacklist for malicious activity.
* Big game hunters: these cyber criminals use considerable effort to attack single high-value targets, especially high-value financial transaction systems (e.g., SWIFT hacks). These types of attack may apply custom designed malware, or conduct attacks through supply chain partners. The criminals invest considerable effort into studying the related technologies and network architectures, carefully engineering the attack and hiding their actions. High-value targets in an organization are also targeted by email and phone frauds, utilizing social engineering skills to enhance the wider attack [25; 28].  
Cyber criminals are very creative, they may both come up with novel attacks and resurface long-forgotten scams with a fresh perspective to make criminal gains. This is important to keep in mind, especially when discussing emerging technologies such as artificial intelligence (AI) or the ecosystem of the FoF.  
Cyber criminals are the primary source of incidents in the wild [5]. It is important to note, however, that cyber crimes range widely from online tax fraud to romance scams [29]. Not all kinds of cyber crimes are relevant to the majority of organizations and an organization needs to apply proper risk-based cyber security management processes to identify the relevant threats. Moreover, e.g., a tax fraud may not be directed at the organization but an insider committing such a crime could still impact it. Twenty of the 22 organisations identified cyber criminals as a CTA (Table 1).