Sure, the final business goal is selling access to the resources gained by the attack, but ultimately the attacking IS aligned with/directly enables that goal. Defense in cyber security is almost always at odds with the goals of defender's business. Or put another way, if there were no Attackers, no one would spend any money on cyber security defense. But if there were no Defenders, someone would still be paying for cyber security attacks.