Organized Crime Threat Actors Explained for the Security+ Exam

Organized crime is the threat actor most businesses will actually meet. Motivated purely by money, well resourced, professionally run, and responsible for the majority of financially damaging incidents.

The attributes

Attribute	Organized crime
Motivation	Financial gain, exclusively
Sophistication	High — often buys or develops zero-days
Resources	Substantial; operates as a business
Internal or external	External, sometimes recruiting insiders
Target selection	Opportunistic at scale, or targeted by ability to pay

The word to hold onto is business. These groups have specialised roles, recruitment, quality assurance and customer support for victims paying ransoms. Treating them as disciplined commercial organisations predicts their behaviour better than treating them as hackers.

How they make money

Ransomware. The dominant model. Encrypt the data, demand payment for the key.

Double extortion. The refinement that broke the backup defence. Data is exfiltrated before encryption, so paying is demanded both to decrypt and to prevent publication. Good backups no longer remove the leverage, which is why the exam stresses that backups alone are not a complete ransomware answer.

Triple extortion adds pressure on the victim's customers or partners, or a denial of service attack alongside.

Business email compromise. Often more lucrative than ransomware and far less technical — compromise or spoof an executive account and redirect a legitimate payment.

Banking trojans and credential theft, sold or used directly.

Data theft for resale — card data, credentials, personal information sold on criminal markets.

Cryptojacking, using stolen compute to mine cryptocurrency.

The as-a-service economy

A structural point CompTIA now tests. Criminal capability is sold as a service, which decouples skill from capability.

Ransomware-as-a-service provides the malware, infrastructure and payment handling to affiliates who carry out intrusions and split the proceeds.

Initial access brokers specialise in getting in and sell that access to whoever wants it.

Malware-as-a-service, bulletproof hosting, and exploit kits complete the supply chain.

The consequence: an attacker with modest technical skill can deploy sophisticated ransomware. Do not assume a sophisticated attack means a sophisticated attacker — that inference is exactly what the exam wants you to avoid.

Distinguishing them from the others

Versus nation-state. Both are well resourced and capable. Crime wants money and will take it from anyone who can pay; a state wants intelligence or strategic effect and selects targets accordingly. Crime is noisy once the ransom note appears; a state prefers to remain undetected for years. The overlap case: some states tolerate or direct criminal groups, and some criminal groups take state work.

Versus hacktivist. Both may steal data. Crime sells or ransoms it; hacktivists publish it for a cause. Crime never wants publicity for its own sake.

Versus competitor. Both financially motivated, but a competitor wants advantage over you and must stay hidden, whereas crime wants payment from you and eventually announces itself.

Versus unskilled attacker. Resources and persistence. Crime funds development and will spend weeks inside a network; the unskilled attacker runs a tool and moves on.

How they get in

Unremarkable, and that is the point. Phishing with a malicious attachment or link. Exposed RDP and VPN appliances with weak or reused credentials. Unpatched internet-facing vulnerabilities. Supply chain compromise through a managed service provider, which yields many victims at once.

Once inside: credential dumping, lateral movement, privilege escalation to domain administrator, disabling backups and security tooling, exfiltration, and only then encryption. That sequence is worth knowing, because every stage before encryption is an opportunity to detect.

Defending against them

Because the entry routes are ordinary, the defences are too. Multifactor authentication everywhere, especially on remote access. Patch internet-facing systems promptly. Segment the network so one compromised host does not reach everything. Offline or immutable backups that a domain administrator cannot delete. Monitor for the pre-encryption stages — mass file access, backup deletion, security tooling being disabled. And have a tested incident response plan, including the decision about whether to pay, made before it is needed rather than at three in the morning.

What to remember

Organized crime is externally motivated purely by financial gain, highly resourced and organised like a business. Double extortion means backups alone do not remove the leverage. The as-a-service economy separates attacker skill from attack sophistication. Detection opportunity lies in the stages before encryption.

Related reading: Competitor threat actors · Hacktivist threat actors · Geographic dispersion of backups