A defense contractor finds intruders who used custom-built implants and several fallback command channels, stayed undetected for 18 months, and copied only weapons research data. There was no ransom demand and nothing was sold or leaked publicly. Which actor and motivation are most likely?
Select an answer to reveal the explanation.
Short Explanation
Ask yourself who has the money and patience to sit quietly in a network for a year and a half and only take research files. That's a nation-state doing what spies have always done -- gathering secrets, not cashing in. No ransom and no bragging is your big clue.
Full Explanation
Attribution in a threat assessment relies on matching observed attributes to typical actor profiles. Custom implants and multiple fallback command channels indicate high sophistication and significant resources. An 18-month dwell time shows patience and a long-term objective. Selective theft of weapons research, with no ransom and no publication, points to intelligence gathering. Together these traits fit a state-sponsored actor motivated by espionage. A hacktivist group is driven by ideology or politics and typically seeks visibility through defacement, leaks or disruption; quietly holding stolen data serves none of those aims. A crime syndicate seeks money through ransom, extortion or resale of data, and the absence of any monetization over 18 months contradicts that motive. An unskilled attacker relies on public tools, lacks the capability to build custom implants, and seeks notoriety, which would require publicity the intruders avoided. Exam caveat: real attribution is uncertain and actors sometimes imitate each other, but exam questions expect the profile that best matches the stated attributes. Operational check: preserve evidence, engage the appropriate government or sector reporting channels required for defense contractors, and hunt for the identified implants and command infrastructure across the environment.