Types of Cyber Attacks and Threats

A small number of attack types account for the large majority of incidents that organizations actually experience. The exotic techniques get the coverage, and these are what shows up in the incident data published each year by sources such as the Verizon Data Breach Investigations Report and Mandiant's M-Trends:

• Phishing and social engineering: tricking a person into giving up credentials, approving access, or running something. One of the two most common initial access routes, alongside stolen credentials.
• Credential attacks: using stolen, guessed, reused, or purchased credentials to log in as a legitimate user. Includes password spraying, credential stuffing, and use of credentials bought from access brokers.
• Ransomware: encrypting or stealing data and demanding payment. Almost always the end of an intrusion rather than the beginning of one.
• Malware: software installed to steal, spy, persist, or destroy, delivered by email, web, removable media, or a compromised software supply chain.
• Exploitation of internet-facing systems: attacking an unpatched or misconfigured service that is directly reachable, such as a VPN appliance, a file transfer product, or a web application. The MOVEit Transfer campaign is the best-known recent example of the file transfer case.
• Business email compromise: manipulating a legitimate email account or conversation to redirect a payment. Frequently involves no malware at all.
• Insider activity: misuse by someone who already has access, whether deliberate or accidental.
• Denial of service: overwhelming a system so it can't serve legitimate users.

The pattern worth noticing is how many of these involve valid credentials rather than technical exploitation, and the consequence is that a large share of the controls a security program buys are watching for a break-in that never happens, while the actual entry event looks identical to an employee signing in from a hotel. An attacker who logs in doesn't trigger the controls built to catch an attacker who breaks in. That is the central reason identity telemetry has become as important as endpoint telemetry.

Malware is software written to do something harmful to a system or its user, such as stealing data, granting remote access, encrypting files, or using resources without permission, and the categories overlap heavily, since a single piece of modern malware commonly does several of these things.

• Ransomware: encrypts data, steals it, or both, and demands payment.
• Infostealers: harvest credentials, session cookies, and browser data. Extremely common, and the front end of a large share of later intrusions.
• Remote access trojans: give an attacker interactive control of a host.
• Loaders and droppers: exist only to install the next thing, and are often the first stage of an infection chain.
• Rootkits and bootkits: hide the presence of other malware by subverting the operating system or the boot process.
• Worms: spread by themselves across a network without needing a person to do anything.
• Spyware and keyloggers: monitor and record activity.
• Cryptominers: consume computing resources to mine cryptocurrency. Often treated as low severity, and worth investigating because the access used to install it could have been used for anything.

A note on the categories. They describe function, not delivery, and function changes at runtime. Treating a malware classification from an antivirus verdict as the full story about an incident is a common triage mistake, since what the sample was called matters far less than how it got there and what it did afterwards.

Ransomware is an attack that makes an organization's data unusable or exposes it, and demands payment to reverse or prevent that, and most current operations use 'double extortion', meaning data is stolen first and then encrypted, so paying to decrypt does not resolve the exposure.

The encryption is the last step, and by the time it happens the attacker has usually been present for a while. A typical sequence:

• Initial access: stolen credentials, a phishing email, or an exploited internet-facing service.
• Establish persistence and escalate: ensure continued access, then obtain higher privileges, most often by harvesting credentials from memory or from a poorly protected service account.
• Move laterally and find what matters: locate file shares, databases, backup infrastructure, and the domain controller.
• Disable defenses and backups: turn off or evade endpoint protection, delete shadow copies, and reach the backup system. This step is why backup isolation is so consequential.
• Exfiltrate: copy the valuable data out, which is what makes the extortion work even against organizations that can restore cleanly.
• Encrypt: deploy the payload broadly, usually outside business hours.

The operationally important point is that everything before the final step is detectable, and often for days. Ransomware feels sudden to the victim because the visible event is the last one in a long sequence. The stages that precede it are where a security operations function actually has a chance.

Phishing is an attack that uses a message, most often email, to trick a recipient into revealing credentials, approving access, or running something harmful, it works on people rather than on software; that is why it survives every generation of technical control.

The main variants need different defenses:

• Bulk phishing: untargeted, high-volume, low effort — mostly stopped by email filtering.
• Spear phishing: targeted at a specific person using details about them or their role. Much harder to filter because the volume is low and the content is plausible.
• Whaling: spear phishing aimed at executives and other high-authority targets.
• Smishing and vishing: the same techniques delivered by text message and by voice call. Voice-based social engineering against help desks has become a notable route to account takeover.
• Multi-factor fatigue and consent phishing: rather than stealing a password, the attacker pushes repeated approval prompts until one is accepted, or persuades the user to authorize a malicious application.

"We have multi-factor authentication" is a weaker statement than it used to be. Phishing has adapted to target the second factor and the approval flow rather than the password, so the relevant question is which form of multi-factor authentication is in use, not whether it exists. Bulk volume is what an email security gateway such as Proofpoint removes; what survives that filter is the part a security team has to work by hand.

Social engineering is the manipulation of people into taking an action that helps an attacker. Phishing is one technique within social engineering, specifically the one delivered by message. All phishing is social engineering, and a good deal of social engineering is not phishing.

Techniques that are social engineering but not phishing:

• Pretexting: inventing a scenario that justifies the request, such as calling a help desk as an employee locked out before a meeting.
• Baiting: leaving something the target will want to use, physically or digitally.
• Tailgating: following an authorized person through a controlled door.
• Quid pro quo: offering something useful, such as fake technical support, in exchange for access or credentials.
• Impersonation in real time: on a phone call or a video call, increasingly aided by synthetic audio and video.

The distinction matters operationally because the defenses differ. Phishing is partly a technical problem with a technical control layer, meaning filtering, link rewriting, and authentication checks, and non-message social engineering has almost no technical control layer at all, and the defenses are procedural: identity verification steps at the help desk, callback rules for payment changes, and clear authority for staff to refuse an urgent-sounding request.

An insider threat is the risk that someone with legitimate access uses it in a way that causes harm. The category covers three quite different situations that get lumped together — and should not be.

• The malicious insider: deliberately steals, sabotages, or leaks. Rare, and the hardest to detect because the activity looks authorized by definition.
• The negligent insider: causes harm without intending to, such as by misconfiguring a storage bucket, emailing a file to the wrong recipient, or bypassing a control to get work done. By volume, the large majority of insider incidents.
• The compromised insider: an outside attacker operating with a legitimate user's credentials. Technically an external attack, and indistinguishable from a genuine insider in the telemetry until you investigate.

That third category is the one that connects insider threat to everyday security operations, and most detection logic aimed at insider behavior, such as unusual data access, access at unusual hours, or access to systems outside a role's normal pattern, fires equally on a compromised account.

Insider threat programs are as much a governance and human resources problem as a technical one, and monitoring employees carries legal and cultural constraints that vary considerably by jurisdiction.

A supply chain attack compromises an organization indirectly, by attacking something it depends on and trusts. The dependency can be software, hardware, or a service provider, and the shared characteristic is that the compromise arrives through a channel the victim has deliberately allowed.

The main forms:

• Software supply chain: a legitimate product or update is modified to include attacker code, so the compromise arrives signed and through the normal update path. The SolarWinds Orion compromise is the reference case.
• Open source dependency: a package a build pipeline depends on is compromised, typosquatted, or taken over by a new maintainer. Log4Shell showed how far a single widely-embedded component reaches.
• Service provider compromise: a managed service provider, cloud vendor, or contractor with access to your environment is breached, and their access becomes the attacker's access.
• Hardware and firmware: components are modified before delivery. Rare and consequential.

These attacks are difficult to defend against with conventional controls because the trust is intentional — you allowed the channel on purpose. The controls that do help are mostly about limiting the blast radius rather than preventing entry, such as restricting what third-party access can reach, segmenting the environment, monitoring vendor accounts as closely as privileged internal ones, and knowing what software you actually run.

They are three distinct things and the sequence matters. A threat is who or what might cause harm. A vulnerability is the weakness they could use. A risk is the combination of the two together with the consequence if it happens.

Two consequences follow from keeping them separate. First, you cannot reduce a threat, you can only reduce your exposure to it, so a program aimed at eliminating threats is aimed at the wrong thing, and second, a vulnerability with no reachable threat and no meaningful impact is not a risk, which is what makes ranking by severity score alone such an unreliable way to prioritize remediation work.