# Threat Actors, Motivations, and Objectives

> Categorise threat actors, reason about their motivations and objectives, and assess capability, intent and opportunity.

Canonical: https://codelivly.com/rooms/cti-threat-actors-and-motivations
Last updated: 2026-10-28

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Defenders cannot prioritise without knowing who might act against them and why. This module teaches the main threat actor categories, how motivation shapes objectives and behaviour, how to assess a threat as a combination of capability, intent and opportunity, and how the cybercrime ecosystem and vendor naming conventions complicate the picture.

**Prerequisites.** Modules 1 and 2 of this path (intelligence levels, requirements).

**Measurable outcomes.** After this module you can:
- Describe six threat actor categories with their typical motivations, capabilities and targets.
- Infer likely motivation and objective from described activity, and state which evidence supports the inference.
- Rate an actor's capability and intent against an organisation using a defined rubric, and explain how opportunity changes the threat.
- Explain the roles in the ransomware-as-a-service ecosystem and why one actor can have several vendor names.

**Practical completion objective.** In the lab you profile four fictional threat actors from eight synthetic reports, rate their motivation, capability and intent towards a fictional energy company, and write a short comparative profile.

## Lessons

1. Threat Actor Categories (15 min)
2. Motivations and Objectives (15 min)
3. Capability, Intent and Opportunity (20 min)
4. The Cybercrime Ecosystem and Actor Naming (15 min)
5. Lab: Profile Fictional Threat Actors (50 min)

## Related

- [Learning path: Cyber Threat Intelligence Foundations](https://codelivly.com/learning-paths/cti-foundations)
- [All rooms](https://codelivly.com/rooms)