IoT Device Compromise IoT device compromise hits cameras, routers, sensors, smart televisions, locks, controllers and all the equipment connected to a network that does not behave li …

Remote access trojan - RAT A RAT gives the attacker remote control of your machine. Once inside they can browse files, switch on the camera and microphone, record what you type and run co …

SCADA/OT Attack An attack on SCADA and OT systems targets industrial processes, not only data. These are the systems that run manufacturing, energy, water, transport, buildings …

Botnet Attacks A botnet is a set of compromised devices the attacker controls remotely. That network can hold computers, servers, routers, cameras, NAS devices, phones and IoT …

Remote Code Execution Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewher …

Rootkit A rootkit is hard to see, and that is its most important property. It can settle beneath the operating system and beneath the layer where antivirus software can …

Backdoor Blocking the initial way in is not the end of the fight. Until you establish which backdoor was opened during the attack, the job is not finished.

Insider Threat … or a partner. The trouble is that the access was not necessarily unauthorized to begin with.

MFA Fatigue … confirms by pressing an Approve button. It does not work where numbers have to be typed from the login screen, nor where hardware keys are in use.

Wiper A wiper does not exist to steal or to extort — a wiper destroys data. It erases and overwrites, breaks file systems, and combined with worms and zero-day vulner …

API Abuse … ogramming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is of …

Accidental Data Leak An accidental data leak is not an attack in the classic sense, but the consequences can look the same. Data becomes available to the wrong people through human …

Account Takeover … the attacker gains full control of an account — not only access, but the ability to change the password, the recovery mail address, the phone number and the se …

Authentication Bypass … hentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a fla …

BGP Hijacking … raffic is diverted by wrong routing. BGP is the protocol by which autonomous systems on the internet tell each other which path leads to particular IP ranges. I …

Brute-force attack … tems that put no limit on failed attempts. It is not clever — it is only fast, and it can run for days.

Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the compa …

Cloud IAM misconfiguration … ights than it needs. In the cloud an identity is not merely a login. An identity is permission to read data, spin up resources, change networks, assume roles an …

Cloud storage exposure … mistakes constantly, so exposure rarely stays unnoticed.

Contractor Abuse … often granted legitimately, but afterwards it is not monitored, not narrowed and not withdrawn in time.

Credential stuffing Credential stuffing does not go after unknown passwords; it tries known ones. With username and password pairs from databases leaked across the internet, the at …

Cross-Site Request Forgery … the user is already logged in. The attacker does not need to know the password. It is enough to lead the user down the wrong path.

Cross-Site Scripting … xecuted in the user's browser. The attacker does not have to break into the web server. It is enough for their code to end up in a page the victim opens as thou …

Crypto-wallet drainer Here a password is usually not stolen and no encryption is broken. The victim signs an action they do not understand. Once the transaction executes on the chain …

Cryptominer … ping into your water and power while you suspect nothing until the bills arrive.

DNS Amplification … resolvers then send their answers to the victim, not to the attacker. If the answer is much larger than the query, the attacker gains amplification: a little of …

DNS Poisoning … a certificate warning in an attack like this is not something to click past.

Deepfake Attack This is not merely a technical curiosity. Deepfakes strengthen classic social engineering because they give the attacker what used to be largely out of reach: a …

Denial of Service / DoS … users can no longer use it. Unlike DDoS it need not come from a large network of compromised devices. Sometimes one source and a well-chosen vulnerability are …

Dependency Confusion … ization's internal package, or with the name of another public and valid package, counting on the fetching tool choosing their version over the real one.

Distributed Denial of Service / DDoS … requests until the server is blocked. The aim is not data theft but choking the service into unavailability.

Evil Twin … rly well, because people expect open networks in hotels, cafés, airports and conference halls.

Fileless malware … ayload through legitimate tools, its activity is not easy to tell apart from normal work.

Infostealer … s, attachments or malicious advertising. It does not linger; the aim is not to settle in but to grab and vanish, often within seconds. Stolen session tokens are …

Insecure Deserialization … ough it were safe. At that point the attacker is not sending mere data but a specially prepared structure that can change the flow of execution.

Kerberoasting … y (AD). User logins are handled by the Kerberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — servi …

Keylogger … ords, payment card numbers, private messages, and other sensitive information. The attacker periodically retrieves the log or it is automatically sent to a remo …

Loader / Dropper … ted vulnerability. Because they are small and do nothing suspicious at first, they slip past protection more easily. Once settled they fetch what they were sent …

Malvertising … as a delivery channel for attacks. The user does not have to be on a dubious site; a malicious advert can appear on a legitimate portal too, because ad space of …

Model theft / extraction … rect theft resembles ordinary data theft: badly protected storage, a repository, a developer's laptop or a cloud bucket. Extraction is different. The attacker s …

Pass-the-Hash So that it does not keep the password in readable form, Windows remembers its cryptographic fingerprint — the hash. With older Windows authentication (NTLM), th …

Password spraying … tried against hundreds of accounts before anyone notices anything.

Path Traversal The problem is not only the `../` characters. Paths can be encoded, normalized and bypassed in several ways if the application has no clearly bounded permission …

Phishing The strength of phishing is not in the technique but in the psychology. The message creates pressure — your account is suspended, the parcel could not be delive …

Physical Access Attack … ice into a port or carry a laptop away, digital protection no longer helps.

Pretexting … neering with a prepared story. The attacker does not simply send a link and wait for a click; they build a scenario in which what they are doing looks normal. T …

Privilege Escalation … tor, and horizontal, moving from one account to another user's resources at the same level of rights.

Privilege Misuse … ge escalation, the attacker or insider here does not have to acquire new authority. The trouble is that the existing authority is enough to do damage.

Prompt injection A chatbot connected to a database receives a request to ignore its previous rules and print another user's data.

QR phishing - Quishing … en carries on working on the phone, outside the protections that exist on the computer. A QR code feels like a fast and modern way in, so it is less often taken …

Ransom DDoS … money for the attack to stop or for a larger one not to happen.

Ransomware … ies of the data and threatens to publish them if nothing is paid — double extortion. Some ransomware groups sell their whole operation to affiliates as a packag …

Resource Exhaustion Resource exhaustion targets what a system cannot work without: processor, memory, disk, network connections, threads, the database or processing queues. The aim …

SIM Swapping SIM swapping does not attack the phone but the phone number. The attacker persuades, or bribes, a mobile operator to move the number to a new SIM card, citing a …

SMS phishing - Smishing … e offers a simple reason to click: the parcel cannot be delivered, the account is blocked, a transaction looks suspicious, a package is waiting on a small charg …

SQL Injection … search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.

SSRF … hoosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outsi …

Service Abuse … a system in an unforeseen way. The attacker does not have to find a classic vulnerability. It is enough to work out how a normal function can be automated, over …

Session Hijacking … es and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an id …

Shadow IT … or approval of the IT team. Employees usually do not bring them in to cause a problem but to get the work done faster: a file needs sharing, a team needs a chat …

Shared Account Abuse … which for accountability is the same as knowing nothing.

Spear Phishing … successful than the mass kind. The message does not smell of fraud: it refers to a real project, a real name, a real deadline. The attacker knows they do not h …

Spyware … through the microphone and camera. The point is not damage to the device but a record of the person, which can later be turned to any number of uses.

Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update me …

Third-Party Compromise … -party compromise happens when the attacker does not go at an organization directly but at a supplier, a partner, a service provider or an external associate wh …

Token Theft … omatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker pre …

Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked app …

Typosquatting … ack because it uses speed and routine. People do not read every letter of a domain, and build systems do not consider a package's intent. One wrong character ca …

USB Drop Attack … ves a USB stick or device where an employee will notice it: a car park, a corridor, a reception desk, a meeting room, a bag of promotional material.

Virus A virus embeds itself in other executable files and runs together with them. It starts when the user launches the application or opens the infected file, and of …

Watering Hole Attack A watering hole attack does not chase the victim directly. The attacker first finds a site the target group visits regularly, then compromises that site or the …

Whaling … e who can approve large decisions. The target is not chosen by chance. The attacker knows who they are after and why that person is worth more than an ordinary …

Worm … carry extra cargo — ransomware, a backdoor, a remote access tool — so what begins on one machine soon floods the whole network. It can do damage with no cargo …

Zero-Day Exploitation … y for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be …

voice phishing - Vishing … ails or lead the victim into doing something they otherwise would not.