Motivation taxonomy

Use a small number of consistent motivation labels across group pages and, when clearly relevant, people pages:

• Access monetization, compromise is turned into resale, extortion, or direct use for further compromise
• Credential theft, primary goal is to obtain secrets and tokens
• Blast-radius expansion, the group’s goal is to turn one foothold into many victims
• Espionage, long-term, targeted access for intelligence collection
• Disruption / sabotage, intent is to break operations or damage trust

Guidance

• If multiple motivations are visible, prefer the primary operational objective first.
• If attribution is weak, say “likely” or “appears to be.”
• Do not invent a human identity unless a public source clearly names one.