Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Adversaries and Their Motivations (Part 1)

Summary: Unit 42's first blog in a series on adversaries and their motivations argues that intelligence-driven Computer Network Defense treats incidents as phased progressions rather than singular events, and that tracking an actor's interactions with a network in the aggregate supports both current detection and an evidence-based approach to future threats. The post says Unit 42 recognizes six top-level malicious actor motivations, that these are not mutually exclusive and can be worn like hats across one or more campaigns, and that attribution can be built gradually at varying levels of granularity rather than starting with identifying individuals.

What you should know: The post frames a direct trade-off for leadership: completeness of investigation against time to closure, with organizational attention traditionally on the what, when, where and how while the who and why are sometimes overlooked. It also notes that more advanced adversaries may practice misdirection, suggesting one motivation while operating on another.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related