Rational choices in cyberspace: Quantitative insights into targeting and attack behavior among cyber offenders

This study empirically tests whether incident-level indicators distinguish the distinct features (i.e., signatures) of state-sponsored and non-state-sponsored cyber actors using the European Repository of Cyber Incidents (EuRepoC; 2000–2024). Drawing on environmental criminology and Rational Choice Theory, we estimate multivariate logistic regression models to assess whether actor type is systematically associated with observable incident characteristics, including disruptive tactics, strategic activity, and targeting patterns. Across models, non-state actors were significantly more likely to employ high-visibility, immediate-impact tactics (e.g., ransomware) and to confirm responsibility for attacks. Whereas, state-sponsored actors were more consistently associated with lower-visibility, strategic activity (e.g., data theft) and a reduced in likelihood of operational disruption. In theory-guided models, expectations regarding disruption-avoidance and strategic-orientation were supported, whereas the expectation that state actors preferentially target state or political systems was not supported. This suggests that actor differentiation may hinge on more visibility and operational trade-offs than on direct target-category preference. These findings provide empirically grounded, incident-level “signatures” that can support early-stage attribution triage and inform actor-differentiated prevention and response strategies.