Rainbow worrier

 You're basically right on white, grey, and black.

The confusing part is that white, grey, and black are the really well-established categories. Once you get into red, blue, green, yellow, purple, etc., the terminology gets a lot less standardized, and some of them genuinely have multiple definitions.

So roughly:

WHITE HAT = ethical hacker. Works with authorization to find vulnerabilities and reports them so they can be fixed.

GREY HAT = operates somewhere between white and black. May hack without permission or technically break the law, but generally isn't doing it with malicious intent. The classic example would be someone who finds a vulnerability without authorization and then discloses it. They might report it responsibly, publish it, ask for payment, or otherwise operate outside the normal rules. That's why grey covers a pretty wide spectrum.

BLACK HAT = malicious hacker. Theft, fraud, extortion, destruction, espionage, ransomware, personal gain, etc.

RED HAT = generally a vigilante hacker who goes after black hats. They may use aggressive or even illegal methods to disrupt them, destroy their infrastructure, or shut them down. There are some alternate uses of the term, but that's the common hacker-hat definition.

BLUE HAT = genuinely ambiguous. One definition is an outside security researcher or tester brought in to find vulnerabilities, particularly before release. That usage is heavily associated with Microsoft's BlueHat program, although Microsoft itself has said "BlueHat hacker" isn't actually a formal category. In other circles, blue hat means a revenge-motivated or vengeful hacker.

GREEN HAT = a beginner or aspiring hacker who is actively learning the craft.

YELLOW HAT = another poorly standardized one. It's often used in expanded taxonomies for hackers who focus on social media accounts, social engineering, scams, psychological manipulation, and other human-focused attacks. Other sources use yellow hat for authorized ethical security testing, basically overlapping with white hat, so this one definitely depends on who's using the term.

PURPLE HAT = also pretty fuzzy. You'll see it used for someone who attacks their own systems in a controlled environment to learn and improve their skills, and sometimes for someone who combines offensive and defensive security skills. That second definition probably gets some of its meaning from purple team terminology.

And then RED TEAM, BLUE TEAM, and PURPLE TEAM are a separate naming system from the hats.

RED TEAM = offensive security. Authorized people emulate real attackers and try to penetrate or exploit an organization's systems to find vulnerabilities and see what gets detected.

BLUE TEAM = defensive security. They're protecting the systems, detecting attacks, investigating them, responding to them, and hardening the environment.

PURPLE TEAM = collaboration between red and blue. Instead of red attacking and simply handing over a report afterward, offensive and defensive people work together and share findings, detection gaps, and techniques so the defenses improve as they go.

So someone can be a red team hacker or blue team hacker without being a red hat or blue hat hacker. Those are two different naming systems.

And worth saying outright, the further you get beyond white, grey, and black, the more you're dealing with informal hacker taxonomy rather than standardized industry terminology. 

You'll see red hat, blue hat, green hat, yellow hat, purple hat, etc. constantly in articles and hacker classification lists, but working security people are much more likely to describe themselves as pentesters, red teamers, security researchers, bug bounty hunters, threat actors, incident responders, and so on.

So white, grey, and black are pretty solid. Red and green have fairly recognizable informal meanings. Blue, yellow, and purple are where things start getting fuzzy because there really isn't one universally agreed-upon rainbow of hacker hats.

Hope this helps :)

A past we've been passed out of.  Farewell the social hack!