3 Attacks and Adversary Techniques

Threat actors and targets

A Threat actor is a person or group capable of causing harm. Common categories include cybercriminals, who often seek money through fraud, data theft, extortion, or ransomware; nation-state groups, which may pursue intelligence, strategic advantage, or disruption; and hacktivists, who commonly seek publicity or political and social influence.

Insiders, including employees and contractors, may act maliciously or expose systems accidentally. Opportunistic attackers use widely available tools against many exposed systems rather than choosing each victim individually. These categories describe broad patterns, not certain identities or motives: an attacker may have several objectives, and different actors may use similar methods.

Targets include individuals, businesses, government agencies, suppliers, and critical infrastructure. Attackers may select a target because it holds valuable data, can pay, provides access to another organization, or has exposed systems that are easier to compromise.

Attack patterns and stages

An intrusion often develops through several stages, but real attacks may skip, repeat, or reorder them. MITRE ATT&CK organizes observed adversary behavior by tactics, meaning the goal of an action, and techniques, meaning how an actor pursues that goal. It is a knowledge base for describing behavior, not a fixed sequence every attack follows.

A common attack pattern is:

1. Reconnaissance: Identify people, systems, software, or exposed services that may be useful.

2. Initial access: Enter through phishing, stolen credentials, an exploited internet-facing service, or a compromised supplier.

3. Execution and persistence: Run commands or malware and attempt to retain access.

4. Credential access and discovery: Obtain account credentials and learn what systems, users, and data are available.

5. Lateral movement and collection: Move to other systems and gather information.

6. Command and control, exfiltration, or impact: Communicate with compromised systems, steal data, encrypt or destroy it, or interrupt operations.

Common attack techniques

Phishing and social engineering use messages or calls to trick people into revealing credentials, approving a login, opening a harmful attachment, or transferring money. Targeted phishing is tailored to a specific person or organization.

Credential attacks use stolen, reused, or guessed passwords to take over accounts. Warning signs may include unusual sign-ins, repeated failed logins, unexpected multifactor authentication (MFA) prompts, or logins from unfamiliar locations.

Malware and ransomware may steal information, spy, disrupt systems, or encrypt data for extortion; ransomware incidents may also involve data theft. Exploitation of vulnerabilities takes advantage of a flaw or unsafe configuration in software, a device, or a service. Internet-facing, unpatched systems can be especially exposed.

Denial-of-service attacks overwhelm a service with large volumes of traffic or requests, reducing availability. A Supply-chain compromise abuses a supplier, software update, or trusted service to reach downstream organizations. Insider misuse occurs when a trusted user intentionally or accidentally accesses, discloses, or changes information in an unsafe way.

Vulnerabilities and risk

A Vulnerability is a weakness that could be used to harm a system. Examples include unpatched software, weak or reused passwords, excessive account permissions, exposed remote services, insecure configurations, and inadequate network separation. An Exploit is a method or code that takes advantage of a vulnerability.

A weakness does not guarantee compromise. Risk also depends on whether an attacker can reach the weakness, whether a suitable exploit exists, and what access or impact successful exploitation would provide.

Prioritize vulnerability fixes using factors such as exposure, business importance, available mitigations, and evidence of active exploitation. CISA’s Known Exploited Vulnerabilities (KEV) Catalog identifies vulnerabilities known to have been exploited and can help organizations prioritize remediation.

Indicators and defensive evidence

An Indicator of compromise (IoC) is a technical artifact or observable that suggests an attack may be underway or may already have occurred. Examples include a known malicious file hash or domain, an unexpected new administrator account, unusual outbound traffic, suspicious authentication events, or files changing rapidly across many systems.

A single indicator is not always proof of an intrusion. Benign activity can look unusual, and attackers may change infrastructure or tools. Assess indicators in context and correlate evidence across identity, endpoint, email, network, and cloud logs. A behavior pattern—such as a suspicious sign-in followed by privilege changes, discovery activity, and unusual data transfer—may be more informative than one isolated artifact. Preserve relevant logs and records so investigators can reconstruct the sequence and scope of events.

For example, an employee reports a convincing fake document-sharing email. Email records show a suspicious link, and identity logs then show a successful sign-in from an unfamiliar device, followed by access to shared files and an unusual download. Together, these observations suggest a possible phishing-led account compromise. Responders would verify the activity, secure the account, investigate affected systems and data, and preserve evidence.

Mitigation and response

Effective defense combines measures that reduce the chance of entry, limit an attacker’s movement, improve detection, and support recovery:

• Patch supported software promptly, especially exposed systems and vulnerabilities known to be exploited. Remove or isolate unsupported services when feasible.

• Use unique passwords and phishing-resistant multifactor authentication where available, particularly for email, remote access, and privileged accounts. Phishing-resistant MFA is a strong protection against phishing-based account theft.

• Limit administrative privileges, review accounts regularly, and remove access that is no longer needed.

• Filter suspicious email and web traffic. Train users to report unexpected requests and verify sensitive actions through a separate trusted channel.

• Segment networks and restrict unnecessary connections so a compromise is less likely to spread.

• Collect and protect security logs. Monitor unusual sign-ins, privilege changes, endpoint behavior, and data transfers.

• Maintain offline, encrypted backups and test restoration. Ransomware may target accessible backups.

• Prepare an Incident response plan. During a suspected incident, assess and contain the activity, preserve evidence, communicate through established channels, remove the cause, and recover systems from trusted sources. Incident response should be integrated into broader cybersecurity risk management.

Threat actors differ in capability and objectives, but many attacks follow recognizable patterns: find a target, gain access, expand control, and pursue theft, disruption, or financial gain. Vulnerabilities provide opportunities, while indicators and behavior patterns provide defensive evidence. Organizations reduce risk by prioritizing exposed and actively exploited weaknesses, protecting identities, limiting access, monitoring systems, maintaining tested backups, and preparing to respond.