Who is behind cyberattacks? Types of hackers and their motivations

In the digital world, threats are not abstract: they have names, faces (though often hidden) and concrete motivations. The cyberattacks we see in the news every day do not happen by chance; behind them are actors with very specific goals. Understanding who they are, how they operate and why they do it is the first step to protecting any organisation, especially small and medium-sized businesses which, whether they believe it or not, are increasingly in the crosshairs.

In fact, a Verizon report revealed that more than 40% of cyberattacks affect small businesses, which often lack the resources and knowledge to defend themselves properly. Most of these attacks are not personally targeted but automated, looking for common weak spots: outdated systems, weak passwords or a lack of basic protection measures.

But who is really behind these attacks? Are all "hackers" criminals? What are they after? These questions no longer interest only technical professionals; they are increasingly a concern for CEOs, finance managers, administrative staff and anyone who is part of a company's ecosystem.

The hacker myth and the reality behind the screen

When we hear the word hacker, we tend to picture a hooded figure in front of several green screens. But reality is more complex and, in many cases, more worrying. The term "hacker" originally referred to people with exceptional skills to understand and modify computer systems. Today, however, it has largely become associated with crime, although not always fairly.

There are different types of hackers, and their classification is not only technical but also ethical. For example, "white hat" hackers work professionally to protect systems. They are the people who, within companies like ours — Ciberseguridad 720 — carry out penetration tests, vulnerability assessments and audits to anticipate and block potential threats. We work under methodological frameworks such as NIST, ISO/IEC 27001 or OWASP, and always with the client's consent.

At the opposite end are the "black hats", true cybercriminals seeking financial or political gain or simply to cause harm. Many are behind attacks such as ransomware, credential theft, sabotage of critical infrastructure or the sale of personal data on the darknet. In between we find the so-called "grey hats", who operate in a blurry zone: they may identify vulnerabilities without permission and report them (or not), sometimes seeking a reward and sometimes simply notoriety.

Beyond this classification, we must also mention groups such as hacktivists, driven by political or social ideals, and APT (Advanced Persistent Threat) groups, which are usually linked to governments or large criminal structures and whose main objectives are espionage, sabotage or obtaining strategic information.

One of the best-known examples is APT28 (Fancy Bear), allegedly linked to the Russian government and named by multiple Western intelligence agencies in cyberattacks on military and political institutions and the media, including interference in electoral processes. Source: Council on Foreign Relations – APT28.

Why do they attack SMEs?

There is a dangerous myth: believing that cybercriminals only attack large corporations. The reality is exactly the opposite. SMEs are frequent targets for a simple reason: they are easier to attack. In many cases they do not have properly configured firewalls, do not update their systems regularly, use weak passwords or have no clear internal cybersecurity policies.

Moreover, as the ENISA Threat Landscape 2023 (European Union Agency for Cybersecurity) points out, supply chains and third parties (such as smaller partners or suppliers) have become gateways into larger systems. In other words: an SME can be used as a "Trojan horse" to reach higher-value targets.

Motivations: the engine behind every attack

The motivations behind attacks vary. In many cases money is the main driver. Ransomware, for example, has grown exponentially because it is profitable: a cybercriminal encrypts a company's data and demands a ransom in cryptocurrency to restore access. At other times the motivation is industrial espionage, digital activism or even the simple pursuit of recognition in underground communities.

Knowing these motivations helps anticipate risks. A company that handles sensitive health data, for example, may be targeted because of the value of that data on illegal markets. A company involved in public tenders may be targeted by groups interested in its bids. A technology supplier may be used as a bridge to compromise its clients.

How to protect yourself?

There are no magic solutions, but there are concrete steps. The key is to combine technology, processes and awareness. Using strong passwords, enabling two-factor authentication (2FA), keeping offline backups and training staff are basic but powerful measures.

It is also essential to carry out regular audits to understand the real state of a company's digital security. At Ciberseguridad 720, we help organisations see their systems from an attacker's perspective, identify blind spots and build defences tailored to their reality. In 2025 alone we have assessed more than 25 SMEs in sectors such as healthcare, technology, industry and services, identifying more than 250 exploitable vulnerabilities capable of compromising sensitive data, disrupting business continuity or opening the door to targeted cyberattacks. Our approach does not depend on expensive licences or closed solutions: we rely on open-source tools, automated processes and close support that combines training, awareness and ongoing mentoring to empower our clients on their path to digital resilience.