Botnet Attacks … ised devices the attacker controls remotely. That network can hold computers, servers, routers, cameras, NAS devices, phones and IoT equipment. The owner of the …

DNS Amplification DNS amplification is a reflected DDoS attack in which the attacker uses open DNS resolvers to multiply the traffic aimed at a victim. The attacker sends relatively small DNS queries but forges the victim's address as the source.

DNS Poisoning A local network uses a compromised DNS server that redirects popular domains to false addresses.

Distributed Denial of Service / DDoS The attack can hit network capacity, the transport layer, or the application itself. Sometimes a huge volume of traffic is sent to congest the link, sometimes c …

Worm To spread it uses what connects computers: the network, shared resources, unpatched vulnerabilities. It can carry extra cargo — ransomware, a backdoor, a remote …

Account Takeover … hanges the recovery address and phone on a social network, the owner rarely gets the account back, if at all. What usually follows is a new account and building …

BGP Hijacking … terception of traffic, or its diversion through a network that should never have been on that path. Sometimes it is a provider's mistake, sometimes a deliberate …

Backdoor … ose — permanent access to the victim's machine or network, regardless of patching, changed credentials or a reinstalled system.

Cloud IAM misconfiguration … ermission to read data, spin up resources, change networks, assume roles and delete backups.

Contractor Abuse … he external associate becomes a blind spot in the network of trust.

Denial of Service / DoS … use it. Unlike DDoS it need not come from a large network of compromised devices. Sometimes one source and a well-chosen vulnerability are enough.

Evil Twin A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network …

Infostealer … ms: account takeover, a break-in to the corporate network, ransomware. A large share of breaches begins with credentials some stealer gathered months earlier.

IoT Device Compromise … controllers and all the equipment connected to a network that does not behave like a classic computer. The problem is that these devices are often forgotten th …

Kerberoasting … eroasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets as …

Malvertising Malvertising uses ad networks as a delivery channel for attacks. The user does not have to be on a dubious site; a malicious advert can appear on a legitimate p …

Pass-the-Hash … y can try logging in to the other machines on the network. Wherever the same account exists, Windows accepts the login as legitimate. That way an attacker can c …

Password spraying … e hit is enough for the attacker to be inside the network.

Path Traversal A vulnerable VPN or network device allows files holding sessions or credentials to be read through path manipulation.

Privilege Escalation … o widen their rights in order to move through the network. Escalation is rarely the first stage — it comes after entry through, say, an ordinary user account or …

Remote access trojan - RAT … wait for the right moment to move deeper into the network. Because it works interactively, it is more dangerous than malware programmed in advance for a fixed s …

Resource Exhaustion … tem cannot work without: processor, memory, disk, network connections, threads, the database or processing queues. The aim is not necessarily to send enormous t …

Rootkit … kernel rootkit hides the attacker's processes and network connections, so the administrator looks at a clean system while the malware operates beneath the secur …

SCADA/OT Attack … esigned for reliable operation, not for a hostile network. When IT and OT networks are joined for monitoring, remote access or efficiency, the attack surface gr …

SIM Swapping A phone suddenly shows no network where there should be one — a possible sign that a number transfer is already in progress.

SSRF … addresses is rarely enough. Better an allowlist, network separation, and the rule that an application may call only what it genuinely needs.

Session Hijacking … cepts a session cookie on an unprotected wireless network and carries on using the victim's account without logging in once.

Spear Phishing … g — it is their cheapest way into a well-defended network.

Third-Party Compromise … er and uses its account to reach a large client's network.

USB Drop Attack … ot gone away, because it steps around part of the network protection. The attacker sends no email and jumps no company firewall; they rely on the victim carryin …

Virus … document moves from file to file across a company network, multiplying each time somebody opens an infected document.

Watering Hole Attack … licious script only for users coming from certain networks.

Wiper … lities it can bring down hundreds or thousands of networks within hours. Unlike ransomware it offers no ransom; recovery was never part of the plan, because the …

Zero-Day Exploitation A vulnerability in a network device is exploited before the vendor publishes a patch.