2 Threats, Vulnerabilities, and Attacks

How an attack chain works

Cybersecurity incidents often follow a chain: a threat actor uses an attack vector to reach an attack surface, then exploits a vulnerability to achieve an objective. For example, a criminal might send a phishing email to an employee, who opens a malicious attachment; the resulting malware exploits the employee’s access to steal data. Identifying each part of the chain helps show what is targeted and where defenses can interrupt an attack.

Threat actors and motives

Threat actors may be internal or external and differ in resources, expertise, access, and intent. Common types include:

• Nation-state: Well-resourced operations may pursue espionage, strategic advantage, disruption, or conflict.

• Organized crime: Financial gain may come through fraud, theft, extortion, or ransomware.

• Hacktivist: Political or social beliefs may motivate actions such as defacing sites, leaking information, or disrupting services.

• Insider threat: An employee, contractor, or partner may misuse authorized access deliberately or through carelessness.

• Unskilled attacker: May use readily available tools or instructions, often opportunistically.

• Shadow IT: Unapproved systems or services can create risk by bypassing security oversight. Shadow IT describes an organizational exposure, not necessarily a malicious actor.

Motives can include financial gain, espionage, data theft, blackmail, revenge, ideology, disruption, or personal challenge. An actor may have more than one motive, and observed activity does not always reveal intent.

Attack surfaces and vectors

An attack surface is the set of points where an attacker could enter a system, cause an effect, or extract data. An attack vector is the route or method used to reach a target. Common attack surfaces include:

• Internet-facing services and open ports

• Wireless and wired networks, and Bluetooth

• Endpoints, cloud services, applications, and identities

• Physical access points and removable media

• Third-party connections, including vendors, suppliers, and managed service providers

Weak or default credentials, vulnerable or unsupported software, and poorly configured systems increase exposure. Supply-chain paths can also provide access to a target.

For example, a remote-access service exposed to the internet is part of an organization’s attack surface. If it uses a default password, that weakness may let an attacker enter through the service. Reducing unnecessary exposure, replacing default credentials, patching, and limiting access shrink the opportunities available to attackers.

Social engineering

Social engineering manipulates people into revealing information, granting access, or taking an unsafe action. Attackers may exploit urgency, authority, fear, curiosity, or a desire to help.

Common forms include:

• Phishing uses deceptive electronic messages or sites. Spear phishing targets a specific person or organization, while whaling targets a high-profile person. Smishing uses text messages; vishing uses voice calls.

• Business email compromise (BEC) impersonates or compromises a trusted business account to induce actions such as sending money or sensitive information.

• Pretexting invents a plausible scenario or identity to win a victim’s trust. Impersonation poses as a trusted person or organization.

• Baiting offers something appealing, such as a supposedly useful file or device, to provoke an unsafe action. Tailgating follows an authorized person into a restricted physical area.

• A watering-hole attack compromises a site that a target group is likely to visit. Typosquatting uses a look-alike domain or common misspelling to misdirect visitors.

• Misinformation is false information shared without necessarily intending harm; disinformation is deliberately deceptive information. Either may help manipulate people or undermine trust.

Familiar branding or tone does not prove that a message is genuine. Verify unusual requests through a separate, known contact method, and avoid opening unexpected links, attachments, or files.

Malware behaviors

Malware is software intended to perform unauthorized or harmful actions. These categories describe common behaviors, and a single malware family may combine several of them.

• Virus: Attaches to a file or program and spreads when the infected host is run.

• Worm: Self-replicates and spreads between systems, often across networks, without needing to attach to another file.

• Trojan: Masquerades as legitimate or useful software to persuade a victim to install or run it; it does not necessarily self-replicate.

• Ransomware: Denies access to data or systems, commonly by encrypting files, and demands payment. Paying does not guarantee recovery or deletion of stolen data.

• Spyware: Secretly monitors activity or collects information. A keylogger records keystrokes and may capture credentials.

• Rootkit: Hides malicious activity and may help maintain privileged access. A backdoor provides a concealed way to access a system.

• Bot malware: Lets an attacker control an infected device. Groups of controlled devices form a botnet, which may be used for tasks such as distributed denial-of-service attacks.

• Logic bomb: Triggers a malicious action when a specified condition or time is reached.

• Fileless malware: Operates largely through legitimate system tools or memory rather than relying on a conventional malware file on disk.

Vulnerabilities and exposure

A vulnerability is a weakness in a system, its procedures, controls, or implementation that could be exploited or triggered. A zero-day vulnerability is exploited before an effective fix is available to the affected organization; it may be unknown to the vendor or simply unpatched. A vulnerability is not itself an attack: an attacker must be able to reach and exploit it.

Common weaknesses include missing security updates, unsupported software, insecure defaults, excessive permissions, weak authentication, exposed services, and configuration errors.

Common attack techniques

Attack techniques exploit weaknesses in different ways. Recognizing how each technique applies its method helps distinguish one attack from another.

• Credential attacks: Brute force tries many passwords against an account. Password spraying tries a small number of common passwords against many accounts. Credential stuffing reuses credentials stolen from other services. These techniques differ in how guesses are applied.

• Injection: An application handles untrusted input as a command or query. SQL injection can alter a database query; input validation and parameterized queries help prevent it. Cross-site scripting (XSS) injects attacker-controlled script into content viewed by other users.

• Buffer overflow: Excess data exceeds the space reserved in memory and may disrupt a program or, in some cases, enable unintended code execution.

• Race condition / TOCTOU: The system’s state changes between a check and the related action, allowing an attacker to exploit the gap.

• Privilege escalation and lateral movement: Privilege escalation gains permissions beyond those initially held. Lateral movement uses an initial foothold to reach other systems or accounts.

• Denial of service (DoS): Overwhelms or disrupts a service. Distributed DoS (DDoS) uses many systems or sources to increase the attack’s scale.

• Adversary-in-the-middle (AiTM): An attacker positions themselves between communicating parties to observe or alter traffic. A replay attack captures valid data or an authentication exchange and retransmits it later.

• Poisoning and spoofing: An attacker falsifies or manipulates information, such as name-resolution data, or impersonates a trusted source to misdirect users or systems.

• Supply-chain compromise: An attacker targets a supplier, software component, service provider, or update path to affect downstream customers.

Putting the concepts together

Consider an employee who receives a convincing invoice email linking to a look-alike sign-in page. The employee enters a password, which the attacker uses to access the organization’s cloud service. The actor may be financially motivated; the vector is phishing; the human and identity systems are attack surfaces; and the deception and exposed credentials are weaknesses the attacker exploits.

This example shows why security requires more than patching software: identity protections, user verification habits, system configuration, and monitoring also matter. In a scenario, identify the actor and likely motive, distinguish the attack surface from the vector, recognize the weakness or technique, and connect the attack to its likely impact.