As our daily life depends more and more on Internet technology, it also becomes increasingly susceptible to new types of cyber threats. These threats often take a form of innovative malicious behavior and commonly emerge in a pace that exceeds the capability of security experts to develop timely solutions to counter such threats. In this context it becomes particularly important to develop a good understanding of the complete cycle of malicious behavior including its evolution and the factors contributing to its spread so that these types of threats are addressed in proactive manner. In this paper we describe and define the new type of recently emerged threat - the ideologically-motivated “snowball” attack. We develop a conceptual model for explaining the evolution of ideologically motivated attacks and discuss a set of methods that can be used to detect and respond to this type of threat at all stages of its development. Finally, we use the recent case of ideologically motivated attack - the attack on Estonia’s cyber infrastructure to evaluate our conceptual model.