After initial access, privilege escalation, and lateral movement, an adversary transitions to their true goal—called Actions on Objectives.
This phase reflects the "why" behind an operation. It’s when an attacker acts on the intended mission objectives, which vary based on motivation, funding, and opportunity.
🧭 Goals and Motivations
Cyberattacks serve a wide spectrum of purposes. Below are the most common strategic objectives grouped by intent:
🏦 1. Financial Gain
| Method | Example Use Cases |
|---|
| 💰 Direct Theft | Wire fraud, draining wallets, siphoning bank accounts |
| 💸 Ransomware | Encrypting data and demanding payment for recovery |
| 🛍️ Fraud | Selling stolen credit card or PII data |
| 🧮 Cryptojacking | Covert crypto mining on compromised systems |
🕵️ 2. Espionage
| Method | Example Use Cases |
|---|
| 🏢 Corporate Espionage | Stealing proprietary source code, M&A docs |
| 🛰️ State-Sponsored Ops | Surveillance of foreign agencies or adversaries |
| ⚙️ Industrial Espionage | Compromising ICS/SCADA for economic advantage |
⚡ 3. Disruption
| Method | Impact |
|---|
| 🌐 DDoS Attacks | Taking down websites or services |
| ⚠️ Critical Infra Hits | Disrupting power, transit, or healthcare |
| 🧨 Data Corruption | Causing operational failure |
🧾 4. Data Theft
| Data Targeted | Use |
|---|
| 👤 Personal Info (PII) | Identity theft, doxxing, resale |
| 🔐 Credentials | Enable lateral movement, resale |
| 🧾 Corporate Records | Competitive intelligence, leaks |
✊ 5. Political or Ideological Goals
| Tactic | Objective |
|---|
| 🖼️ Website Defacement | Making a public statement |
| 🗣️ Info Warfare | Disinformation, propaganda, election meddling |
| 🔓 Whistleblowing | Leaking corporate/government misdeeds |
💥 6. Destruction or Manipulation
| Goal | Example |
|---|
| 💣 Data Wiping | Malware like NotPetya targeting disks |
| 🧪 Data Tampering | Altering financial or sensor data |
🛠️ 7. Infrastructure Access
| Mechanism | Purpose |
|---|
| 🪝 Backdoor Creation | Persistent access for later operations |
| ↔️ Pivoting | Move deeper into the environment |
| 🤖 Botnet Enlistment | Future DDoS, spam, or proxy use |
🧼 8. Reputation Damage
| Method | Impact |
|---|
| 🖍️ Defacement | Undermines public trust |
| 🪓 Leaks | Embarrassment, PR crises |
| 🎭 Social Eng | Manipulating internal stakeholders |
🪖 9. Military or National Security
| Goal | Description |
|---|
| 🔥 Cyber Warfare | Cripple enemy systems |
| 🛰️ Surveillance | Monitor adversaries |
| 💀 Capability Disruption | Disable defense, comms, logistics |
🧪 10. Capability Testing
| Purpose | Examples |
|---|
| 🔧 PoC Exploits | Showcasing 0-day effectiveness |
| 🧑💻 Recruitment | Impressing threat actors |
| 🎮 Cyber Range Games | Practicing in the real world |
🔐 11. Extortion & Coercion
| Mechanism | Application |
|---|
| 🧨 Blackmail | With leaked photos, chats, emails, or data |
| 🤝 Coercion | Forcing execs or officials into compliance |
🗳️ 12. Influence Operations
| Tactic | Target |
|---|
| 🐦 Social Media Hacks | Controlling narrative or speech |
| 🗳️ Election Interference | Tampering, discrediting institutions |
🧠 The Takeaway
Understanding Actions on Objectives helps defenders:
- Prioritize post-compromise detection
- Monitor exfil and data manipulation patterns
- Tag alerts with intent (espionage vs disruption)
🔄 Initial access is just the door. The real damage happens during Actions on Objectives.