APT vs Cybercrime vs Hacktivists: Which Controls and Intel Matter for Each

Security teams are told to defend against "nation states, ransomware gangs and hacktivists" as if they were one threat, and end up spreading budget evenly across all three or chasing whichever made the news last week. The three actor classes want different things, so they choose targets differently, move at different speeds and are stopped by different controls. Motivation is the most useful lens for prioritisation because it predicts behaviour even when the specific group is unknown. This guide compares state-linked advanced persistent threats (APTs), financially motivated cybercrime and hacktivists by motive, targeting, tradecraft and dwell time, then maps each to the controls and intelligence sources that matter most. It is written for security leaders, threat intelligence analysts and architects building a threat-informed control plan. It deliberately avoids group profiles; for those, see the Threat Actor Groups Guide.

Key takeaways

• Motive predicts behaviour. Espionage and pre-positioning reward stealth and patience; crime rewards speed and scale; hacktivism rewards visibility. Each drives a different control priority.
• Cybercrime is the base case for almost everyone. Mandiant reports that 55% of the threat groups it tracked in 2024 were financially motivated, against 8% motivated by espionage, so ransomware and extortion resilience comes first unless you hold assets a state wants.
• The basics overlap more than the actors do. Patching internet-facing systems, phishing-resistant MFA and centralised logging appear in both government ransomware guidance and state-actor advisories.
• Dwell time decides where detection effort goes. Ransomware compresses to days, so prevention and fast containment matter; state actors can stay for years, so hunting and log retention matter.
• The lines blur. States run financially motivated operations, criminals sell access to anyone, and hacktivist personas can front for state activity. Classify by observed behaviour and plan for the overlap.

The short answer

If you must rank, rank by likelihood times impact for your organisation, not by sophistication. For most organisations that means: cybercrime first (likely, and highly damaging through encryption and extortion), hacktivism second where you are publicly visible or politically exposed (likely in bursts, usually disruptive rather than destructive), and state-linked APTs first only if you operate critical infrastructure, defence, government, telecoms, research or a supply chain that serves them. Then build the shared foundation once, because it covers a large share of all three.

Side-by-side comparison

State-linked APTs: threat model and controls

Threat model: state-linked groups select targets because of what they hold or what they could later disrupt. The joint CISA, NSA and FBI advisory on Volt Typhoon (AA24-038A) assesses with high confidence that the group was pre-positioning on IT networks to enable disruption of operational technology during a crisis or conflict, that its activity was not consistent with ordinary espionage, and that some victims had hosted its footholds for at least five years.

Architecture in words: the typical path runs from an unpatched edge appliance or VPN, through valid accounts and built-in administration tools, to credential stores such as domain controllers, with selective log clearing along the way. Little custom malware means few signatures to match.

Failure modes for defenders: logs not retained long enough to reconstruct a multi-year intrusion; edge devices outside EDR coverage; detection built around malware rather than behaviour; and end-of-life equipment left in place.

Controls that matter most:

• Edge device hygiene: patch internet-facing systems with known exploited vulnerabilities first and plan replacement of end-of-life appliances, as AA24-038A recommends. See the Edge Device Security Guide.
• Phishing-resistant MFA on remote and administrative access.
• Centralised, long-retention logging of authentication, administrative and security events, with the ability to search a year or more back.
• Behavioural hunting for living-off-the-land activity; see the Living off the Land Guide.
• Segmentation between IT and OT so a domain compromise does not reach control systems.

Cybercrime: threat model and controls

Threat model: criminal groups choose targets by exposure and ability to pay, and increasingly specialise: access brokers, ransomware operators and affiliates trade services with each other (see the Cybercrime Ecosystem Guide). Verizon's 2026 Data Breach Investigations Report says 48% of breaches involved ransomware and that software vulnerabilities, at 31%, have overtaken stolen passwords as the top entry point. Mandiant's M-Trends 2025 puts the 2024 global median dwell time at 11 days, falling to 5 days where the adversary itself notified the victim, which is typically a ransomware demand.

Architecture in words: initial access through a vulnerable or exposed service, stolen credentials or precursor malware, then fast escalation to domain administrator, discovery and deletion of reachable backups, data exfiltration and encryption. The #StopRansomware Guide from CISA, MS-ISAC, NSA and FBI notes that many actors pair encryption with data theft and that some extort without encrypting at all.

Failure modes for defenders: backups reachable from the domain; remote services exposed with single-factor authentication; alerts that wait until morning; and no tested rebuild process.

Controls that matter most:

• Offline, encrypted, tested backups, plus offline golden images and infrastructure templates, as the #StopRansomware Guide advises.
• Closing exposed services such as RDP and enforcing MFA on VPNs.
• Credential protection: phishing-resistant MFA, separate admin accounts, least privilege. See the Phishing-Resistant MFA Guide.
• Execution control and EDR with 24x7 containment, because the window is days.
• Third-party access limits, especially for managed service providers.

The Ransomware Prevention Guide turns these into a rollout plan.

Hacktivists: threat model and controls

Threat model: hacktivists pick targets for symbolism and timing, often in waves after a political event. ENISA's Threat Landscape 2025, covering July 2024 to June 2025, reports that EU public administrations are increasingly targeted by hacktivists who primarily use DDoS. A fact sheet from CISA, FBI, NSA, the UK NCSC and other agencies describes pro-Russia hacktivists manipulating small-scale OT in water, dams, energy and food and agriculture, mostly with unsophisticated techniques causing nuisance effects, but with potential for physical harm where OT is insecure or misconfigured.

Architecture in words: no foothold is needed for DDoS; for intrusions, attackers search for exposed interfaces with weak or default credentials, act, and publicise. Claims are often louder than the actual impact, which makes rapid, factual communication part of the defence.

Failure modes for defenders: no DDoS protection agreed with the provider in advance; OT interfaces reachable from the internet; and communications teams caught out by public claims they cannot quickly verify.

Controls that matter most:

• DDoS readiness for volumetric, protocol and application-layer attacks, the three types described in the CISA, FBI and MS-ISAC DDoS guide. See the DDoS Protection Guide.
• Removing internet exposure of OT and management interfaces and changing default credentials. See the Pro-Russia Hacktivists Targeting OT Guide.
• Web application hardening and defacement monitoring for public sites.
• A claims-response process that lets you confirm or refute a leak or intrusion claim within hours.

The Hacktivism Guide covers campaigns and detection in depth.

Which controls matter for each class

Read the table by row, not column: anything rated critical for two or more classes belongs in the shared foundation.

Intelligence feeds by actor class

Different motives need different intelligence. Buying one generic indicator feed serves none of them well.

See the Threat Intelligence Guide for collection and processing, and the CISA KEV Catalogue Guide for using exploited-vulnerability data.

Where the lines blur

• States that steal money: MITRE ATT&CK describes APT38 (G0082) as a North Korean state-sponsored group specialising in financial cyber operations, attributed by CISA to the Reconnaissance General Bureau. Its targeting looks criminal, its persistence and resourcing look like an APT.
• Criminal access sold to anyone: an access broker's listing can be bought by a ransomware affiliate or a state-linked buyer. The intrusion begins criminal and may not stay that way. See the Initial Access Brokers Guide.
• Shared tooling: ENISA describes the 2025 landscape as "diverse yet convergent", with groups reusing tools and techniques and collaborating.
• Personas: hacktivist branding can be used to claim activity whose true sponsor is a state. Treat attribution claims made by actors themselves as unverified until a government or reporting vendor publishes primary research.

The practical rule: classify an incident by what the actor does on your network (stealthy persistence, fast monetisation or public disruption) and respond to that behaviour, rather than waiting for attribution.

A prioritisation method

1. Profile yourself: sector, critical infrastructure status, government and defence supply chain links, public and political visibility, and ability to pay.
2. Score each class for likelihood and impact on a simple 1 to 5 scale, using sector advisories and your own incident history.
3. Build the shared foundation first: every control rated critical for two or more classes in the table above.
4. Add class-specific controls in score order: backups and containment for crime, long-retention logging and hunting for APTs, DDoS and claims response for hacktivists.
5. Align intelligence spend to the top-scoring class.
6. Test against each class: a ransomware tabletop, an APT hunt exercise using a government advisory, and a DDoS test with your provider.
7. Re-score at least annually and after major geopolitical events, which can raise hacktivist and state interest quickly.

Worked scenario: a regional water utility

A regional water utility with 600 staff scores itself: APT likelihood 3 and impact 5 (critical infrastructure, matching the sectors in AA24-038A); cybercrime likelihood 4 and impact 5 (billing and operations outage); hacktivist likelihood 4 and impact 3 (the CISA fact sheet names water among targeted sectors).

• Shared foundation: remove internet exposure of OT interfaces, enforce phishing-resistant MFA on remote access, and patch edge devices against KEV entries within days.
• Cybercrime layer: offline backups for billing and SCADA historian data, tested rebuilds, and an MDR service for 24x7 containment.
• APT layer: extend log retention to cover authentication and VPN events for at least a year and run quarterly hunts using government advisories as hypotheses.
• Hacktivist layer: DDoS protection for the customer portal, a pre-agreed statement template, and an OT engineer on call to verify any claimed manipulation within hours.

The utility ends up spending most of its budget on controls that serve all three classes, with modest additions per class, which is the usual result of doing this analysis honestly.

Where identity fits

Valid accounts are a common thread. State actors re-dump domain credentials to keep access, according to AA24-038A; criminals buy and reuse stolen credentials; hacktivists exploit default passwords. Machine and service accounts deserve particular attention because they rarely have MFA and are often excluded from monitoring. See the Threat-Informed Defence Guide for mapping actor behaviour to identity controls.

Detection and measurement

• APT signals: unusual use of built-in administration tools, authentication from edge devices at odd hours, log clearing, new persistence on domain controllers.
• Cybercrime signals: backup deletion or modification, mass privilege changes, large outbound transfers, credential appearing in broker or leak listings.
• Hacktivist signals: traffic surges, defacement monitoring alerts, public claims naming you.

Metrics:

1. Time to patch KEV-listed vulnerabilities on internet-facing systems.
2. Percentage of remote and administrative access protected by phishing-resistant MFA.
3. Log retention in days for authentication and edge device logs, against the target.
4. Time from detection to containment for high-severity endpoint alerts.
5. Last successful backup restore test date for critical systems.
6. Time to confirm or refute a public intrusion claim.

Framework mapping

Common failure patterns

• Prioritising by headlines: buying APT-focused tooling while backups sit on the domain is the commonest misallocation.
• Treating hacktivism as harmless: nuisance DDoS is the usual case, but exposed OT turns nuisance into physical risk.
• Waiting for attribution before acting: respond to behaviour; attribution can follow weeks later.
• Short log retention: 30 or 90 days of logs cannot reconstruct an intrusion that began years ago.
• One generic intel feed: indicator lists without tradecraft context feed blocklists but not hunts or patch priority.

Practitioner checklist

• Score APT, cybercrime and hacktivist likelihood and impact for your organisation and record the rationale.
• Fund the shared foundation first: edge patching, phishing-resistant MFA, logging, segmentation.
• Keep offline, tested backups and an offline rebuild kit.
• Set log retention to support multi-year investigations for authentication and edge devices.
• Agree DDoS protection and a runbook with your providers before you need it.
• Remove internet exposure of OT and management interfaces.
• Map intelligence sources to each actor class and drop feeds nobody uses.
• Write a claims-response procedure with communications and legal.
• Re-score after major geopolitical events.

Standards and references

• CISA, NSA, FBI: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• CISA: #StopRansomware Guide
• CISA: Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity
• CISA, FBI, MS-ISAC: Understanding and Responding to Distributed Denial-of-Service Attacks
• ENISA: Threat Landscape 2025
• MITRE ATT&CK: APT38 (G0082)
• Google Cloud (Mandiant): M-Trends 2025
• Verizon: Data Breach Investigations Report

Related NHI Mgmt Group resources: Threat Actor Groups Guide, Hacktivism Guide, Cybercrime Ecosystem Guide, Ransomware Groups Guide, Nation State Cyber Activity Statistics.