Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the compa …

Crypto-wallet drainer … y signing transactions that move crypto assets. Draining a wallet is the process in which the user, believing they are doing something legitimate, signs a trans …

Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update me …

Botnet Attacks … tnet is used for DDoS, sending spam, phishing campaigns, password spraying, cryptocurrency mining, malware distribution and other work that needs quantity. The …

DNS Amplification … r uses open DNS resolvers to multiply the traffic aimed at a victim. The attacker sends relatively small DNS queries but forges the victim's address as the sour …

Deepfake Attack A deepfake attack uses an artificially generated voice, image or video so that somebody can pose as a real person. In cyber attacks this usually means the director's voice on a call, a colleague's face in a video meeting, or a recording that feels real enough for the victim to accept the request.

Denial of Service / DoS DoS is a denial-of-service attack that tries to bring a service down or slow it so far that legitimate users can no longer use it. Unlike DDoS it need not come from a large network of compromised devices. Sometimes one source and a well-chosen vulnerability are enough.

Dependency Confusion … y. It is enough to slip into an unchecked build chain.

Distributed Denial of Service / DDoS … in web requests until the server is blocked. The aim is not data theft but choking the service into unavailability.

Model theft / extraction Model theft and extraction means an attacker obtains a model an organization trained, bought or adapted to its own needs. That can be direct theft of the files, …

Physical Access Attack … nters the premises without a card of their own — tailgating.

Prompt injection … tent they are processing. When a model reads an email, a document, a page, a ticket or a message, the attacker can put text into that content which reads like a …

Ransom DDoS Ransom DDoS joins an attack on availability to extortion. The attackers threaten to bring the service down, or first run a short demonstration attack, and then …

Resource Exhaustion … , threads, the database or processing queues. The aim is not necessarily to send enormous traffic but to make the system spend what it has.

Service Abuse … unction can be automated, overloaded, or turned against the service and its users.

Typosquatting … r recognizing a name. The attacker registers a domain, an account or a software package that resembles a legitimate name, counting on a user, a developer or a s …

API Abuse … nical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.

Accidental Data Leak … he consequences can look the same. Data becomes available to the wrong people through human error, bad configuration, wrong sharing, a public repository, open c …

Account Takeover Account takeover is the moment the attacker gains full control of an account — not only access, but the ability to change the password, the recovery mail addres …

BGP Hijacking The consequence can be loss of availability, interception of traffic, or its diversion through a network that should never have been on that path. Sometimes it …

Backdoor … rst break-in, to secure a way back even when the main entrance is closed. Sometimes it is left behind by employees or service providers, deliberately or by acci …

Brute-force attack … ord after password until one takes. It succeeds against short, weak and common passwords, and against systems that put no limit on failed attempts. It is not cl …

Cloud storage exposure … rol is not protection but a copy of the incident waiting to be found.

Contractor Abuse … oyees they are often outside the same regime of training, oversight, HR process and discipline. When the contract ends, the account sometimes stays open.

Credential stuffing … it tries known ones. With username and password pairs from databases leaked across the internet, the attacker tries the most-used services such as Facebook and …

Cross-Site Request Forgery … t an action the user never intended. A change of mail address, password, account settings, an order or a transfer of funds can be set off from another page, thr …

Cryptominer … nes are higher than expected. The vendor did not raise prices and you changed nothing.

DNS Poisoning … er or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the browser and DNS takes them to the wrong web …

Evil Twin … use people expect open networks in hotels, cafés, airports and conference halls.

Fileless malware … n on scheduled tasks and the Windows registry — again with no conspicuous file. A restart clears it from memory, but persistence techniques bring it back.

Infostealer … or malicious advertising. It does not linger; the aim is not to settle in but to grab and vanish, often within seconds. Stolen session tokens are the real prize …

Insecure Deserialization … e libraries. Once the attacker finds a suitable chain of objects, the application itself does the work it should never have done.

Insider Threat … ust towards people but protection of the system against a situation going badly.

Kerberoasting Kerberoasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets …

Keylogger Software keylogger installed via an infected email attachment

Loader / Dropper … suspicious invoice does not install ransomware straight away; it starts a small loader that pulls down the tools needed for the next stages of the attack.

Malvertising A paid search advert leads to a fake site for popular software, where a Trojan is downloaded instead of the legitimate installer.

Pass-the-Hash … -the-hash abuses exactly that: if the attacker obtains a user's hash, they can log in with it without ever learning the real password.

Password spraying … sight, it never trips the thresholds that watch failed attempts. The attack shows up only in the wider picture — login attempts with the same password across m …

Phishing The defense works on two levels. Technical: mail filtering, link checking, two-factor authentication that makes a stolen password unusable. Human: through train …

Pretexting … ry. The attacker does not simply send a link and wait for a click; they build a scenario in which what they are doing looks normal. They present themselves as a …

Privilege Escalation … vertical escalation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of ri …

Privilege Misuse … own favor, and technical staff can reach private mail, records or systems outside the scope of their work. The system often sees a valid account and a permitted …

QR phishing - Quishing … rd because it hides the destination well. In an email or a document there is no ordinary link for a filter to read, and the user often carries on working on the …

Ransomware … data and threatens to publish them if nothing is paid — double extortion. Some ransomware groups sell their whole operation to affiliates as a package (ransomwa …

Remote Code Execution … is no longer merely a user on the outside; they gain a way to influence what the server executes.

Remote access trojan - RAT … it the attacker can take your data, but can also wait for the right moment to move deeper into the network. Because it works interactively, it is more dangerous …

Rootkit … moval is much harder. It is found by comparison against a trusted reference, by checking the integrity of the boot process, and by system behavior that does not …

SCADA/OT Attack In attacks like these the aim is not always theft. It can be a halt in production, a change of parameters, damage to equipment, pressure on the operators, or sa …

SIM Swapping … ed card. They usually come armed with personal details from leaked databases and phishing. The moment the number moves to their card, the real phone loses signa …

SMS phishing - Smishing … ed, a transaction looks suspicious, a package is waiting on a small charge. Everything is reduced to a few words and one link.

SQL Injection … something the designer never had in mind, and certainly never intended.

SSRF … ernal services which from the outside ought to remain invisible.

Session Hijacking … h it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. Tha …

Shared Account Abuse … access. The problem is attribution. It cannot be said with any confidence who logged in, who changed the setting, who exported the data, or who passed the passw …

Spear Phishing An email that refers to a real, recent internal meeting, with the minutes attached — and the attachment carrying malware.

Spyware … a trace. That is why they are a favored weapon against journalists, activists and political opponents, but the same mechanism shows up in corporate espionage a …

Third-Party Compromise … rations, API keys, access to data, or the job of maintaining systems. If they are less well protected than the organization they reach into, they become the eas …

Token Theft … equest, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — witho …

Trojan The surest defense against Trojans is a boring one: software comes only from the official source, and mail attachments are not opened without thinking. A crack …

USB Drop Attack … f the network protection. The attacker sends no email and jumps no company firewall; they rely on the victim carrying it in themselves, behind every technical b …

Virus It travels on USB sticks, mail attachments, shared folders and pirated software. Through the nineties and the early two-thousands it was the dominant form of ma …

Watering Hole Attack … ndustrial teams, lawyers, journalists or supply chains. The user is not clicking a suspicious email; they are visiting a familiar site. That is exactly why the …

Whaling Whaling is targeted phishing aimed at senior management, owners, directors and people who can approve large decisions. The target is not chosen by chance. The a …

Wiper … recovery was never part of the plan, because the aim is damage, not money.

Worm … work is enough to bring the whole network down. Against a worm, segmentation is the best defense.

Zero-Day Exploitation … overnment institutions, large companies, supply chains, journalists, activists, financial systems or infrastructure. When they do appear in mass use, the window …

voice phishing - Vishing … g is phishing over the telephone. Instead of an email and a link, the attacker uses a voice, a phone number and the pressure of the moment. They present themsel …