# Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools
## 2 Background
### (Unethical) Hacking Landscape and Motivations  
Cyberattacks, intrusion techniques, social engineering, and information manipulation are increasingly becoming more sophisticated, targeting individuals and organisations. The objective of each attack, regardless of its nature, is to circumvent the three primary principles of security: _confidentiality_, _integrity_, and _availability_[13]. There is a wide range of motivations for cyberattacks, and many factors interplay. According to [14; 15; 16; 17], the motivations for these attacks can be grouped into:  
* _Economic Gain_: Cybercriminals often target individuals, businesses, or organisations to extort money through ransomware [18] or financial fraud. Financial institutions such as banks and related services can be a target, as in the case of the attack on the SWIFT international transaction system [19].  
* _Competitive Advantage and Sabotage_: Competing companies, state-sponsored actors, and individuals can steal and reveal industrial secrets and intellectual properties to gain a competitive edge and compromise the data integrity and accessibility in businesses. While the WannaCry ransomware was used primarily to extort money from the victims, the attack on the UK National Health Service (NHS) could have also been conducted to demonstrate the business complacency and lack of digital transformation [18].
* _Personal Revenge_: Cyberattacks driven by personal revenge are often perpetrated by disgruntled insiders or individuals with a vendetta against specific targets. These attacks leverage insider knowledge or access to inflict damage, disrupt operations, or steal sensitive data.
* _Political_: The attack is carried out as groups of hackers engaged in politics, sponsored-stated hacking teams aiming at damaging specific targets. This includes governmental institutions, political parties, social society organisations and other public subjects. Examples are the alleged interference in the US presidential elections by Russian state-sponsored cyber actors in 2016 [20], and the _Operation Socialist_ in 2010-2013 against Belgacom attributed to the UK's GCHQ [21], a case of an attack perpetrated by a NATO member state against another one.  
The activities described above broadly fall into the category of cybercrime and involve hacking, data theft, identity theft, financial fraud, and malware distribution. However, when cyberattacks are carried out by state-sponsored actors against other nations or entities, they are often called cyber warfare. The distinction can be blurred in some cases, as the direct involvement of government organisations can have surprising ramifications and side effects.  
The _EternalBlue_ exploit [22] was developed by the United States National Security Agency (NSA) targeting a vulnerability in Microsoft's Windows operating system, specifically in the Server Message Block (SMB) protocol. The NSA utilised the exploit for years without reporting the vulnerability to Microsoft. However, it became widely known when a hacking group called the Shadow Brokers leaked the exploit in April 2017. The most notorious incident involving EternalBlue was the aforementioned WannaCry attack in May 2017. The exploit allowed the rapid spread of malware across networks, affecting hundreds of thousands of computers in over 150 countries and causing hundreds of millions of USD of damage worldwide.  
This demonstrates the potential for unintended consequences and collateral damage as malicious actors can weaponise an offensive security tool developed by a government agency for large-scale cybercrime. This case also highlights the importance of responsible handling and disclosure of vulnerabilities by any entity, including government intelligence agencies.