The usual suspects
This a grouped adversary, which includes state-sponsored and corporate and other such hackers, the usual suspects, because search engines are a big part of reconnaissance for structured hacks. To distinguish between black hats and black hat SEO may seem arbitrary. Some of the techniques used in Black Hat SEO can and are also being used to drive user traffic to malicious sites for the purposes of distributing malware.
The difference is in the purpose between the two. Black hat SEO is aimed at the search engine for profit purposes, while the usual suspects aim at the searchers.
Mostly search engine poisoning and Man in the Middle attacks to either gain information for planning further attacks or to plant malware.