Information theft, data loss/manipulation, identity theft, and disruption of service.

Once a threat actor is inside a network, the damage falls into four broad categories. They are worth distinguishing because each targets a different asset — confidentiality, integrity, identity, or availability — and so calls for a different defence:

1. Information Theft - Breaking in to steal confidential information (attacks confidentiality). Example: copying a company's research data to sell to a competitor.
2. Data Loss and Manipulation - Destroying or altering data records (attacks integrity). Example: a virus reformatting a hard drive, or quietly changing prices in a billing system.
3. Identity Theft - Stealing personal information to impersonate someone, then using that identity to obtain documents or credit illegally.
4. Disruption of Service - Preventing legitimate users from reaching services they are entitled to (attacks availability) — the goal of denial-of-service attacks.

Go deeper:

• Computer security — Wikipedia — surveys the full threat landscape (malware, DoS, MITM, social engineering) and the assets each one targets.

An intruder who gains network access by modifying software or exploiting software vulnerabilities.

A threat actor is an intruder who gains access to a network by modifying software or exploiting software vulnerabilities.

They can gain access through:

• Software vulnerabilities
• Hardware attacks
• Guessing usernames and passwords

Go deeper:

• Computer security — Wikipedia — the "attackers and motives" coverage shows the kinds of actor (criminal, insider, state) behind these intrusion methods.