A threat actor or advanced persistent threat usually seeks monetary gain. They do this by retrieving data that they can sell to a third party or by directly exploiting a victim through a ransomware attack. Insider threats may be following the lead of other cybercriminals by selling information to competitors.