Two intrusions can start with the same phishing email, the same stolen password and the same remote access tool and still end in completely different ways. One ends with a ransom note an hour later. The other never ends visibly at all, because the intruder wants to read three executives' email for the next year and is careful not to be seen.
The difference is motivation. On the CompTIA Security+ SY0-801 exam, motivations sit under objective 2.2 alongside the actor types from the previous lesson. The objective lists twelve: financial, influence, intellectual property, notoriety, espionage, fear and chaos, extortion, general curiosity, revenge, ideological, political and ethical. This lesson groups them by what the attacker wants and shows how a scenario reveals which one is at work.
Motivation explains why a target was chosen and what comes next
A motivation is the reason an actor attacks. It is the intent half of a threat; the capability half, made up of an actor's access, resources and skill, is the next lesson.
Defenders care about motive because it predicts behavior. An attacker after money wants to cash in quickly, so expect encryption, a demand or fraudulent transfers within days. An attacker after secrets wants to stay unseen, so expect careful movement, small data transfers and attempts to keep access for months. An attacker after attention will make sure everyone knows, through a defaced page or a post claiming credit.
Motive also tells you which assets attract which attackers. A company with valuable designs draws intellectual property theft. A bank draws financial attacks. An organization in a controversial industry draws hacktivists. Threat modeling starts by asking who would want what you have, and why.
Two cautions apply. First, motives combine: a fired employee can want revenge and money at once, and a state operation can mix espionage with influence. Second, motive and actor type don't map one to one. Financial gain drives crime syndicates, but also some insiders, unskilled attackers and even a few nation-states. Exam questions often ask about the actor and the motive separately, so you may need to answer both from the same scenario.
Financial gain and extortion drive most attacks
Money is the most common motive by a wide margin. Industry breach studies, such as Verizon's annual Data Breach Investigations Report, consistently find financial gain behind the large majority of breaches. Attackers turn access into money in many ways: ransomware, selling stolen card numbers, credentials or health records, business email compromise that redirects wire transfers, banking trojans, cryptojacking that uses a victim's servers to mine cryptocurrency, and selling access to a compromised network to another group.
Extortion is a narrower motive: forcing the victim to pay or act by threatening harm. The attacker holds something hostage, such as encrypted files, stolen data they threaten to publish, a website they will keep flooding with DDoS traffic (ransom DDoS), or the victim's reputation with customers and regulators. In 2023 one ransomware group even filed a complaint with the U.S. Securities and Exchange Commission accusing a victim of failing to disclose the breach the group had caused. Mass sextortion emails are extortion too, usually with nothing behind the threat:
Subject: Your password is Summer2019!
I recorded you through your webcam and copied your contact list.
Send $1,450 in Bitcoin to the wallet below within 48 hours,
or the video goes to everyone you know.
The password is real, taken from an old breach, to make an empty threat look credible.
The difference matters on the exam. Financial gain is the end goal; extortion is a method built on a threat and a demand. A scenario with an "or else" in it, such as pay or we publish, pay or the attack continues, is extortion. Card numbers quietly skimmed and sold on a forum are financial without extortion. And extortion isn't always about money; an insider who threatens to leak files unless reinstated is extorting too.