(De-)Constructing Attacker Categorisations: A Typology Iteration for the Case of Digital Banking

In this extended and updated paper, the experimental construction of a new attacker typology grounded in real-life data is proposed, using grounded theory analysis and over 300 publicly available documents containing details of digital banking related cybercrime and involved attackers. Seven attacker profiles forming the typology specific to the case of digital banking are presented. An initial light-touch evaluation approach based on peer review feedback and basic heuristics is suggested. A short excursus on circumplex models is added to address this visualisation tool used across past categorisation efforts.