A threat actor tries to infiltrate a web application with the goal of stealing data, modifying data, or other malicious act for personal gain. This term is used in threat modeling to help discover those who may have reason to launch attacks against an application.