Cloud IAM misconfiguration Cloud IAM misconfiguration means a user, a service account, an application or a role holds more rights than it needs. In the cloud an identity is not merely a l …

Remote access trojan - RAT A RAT gives the attacker remote control of your machine. Once inside they can browse files, switch on the camera and microphone, record what you type and run co …

Accidental Data Leak … the wrong people through human error, bad configuration, wrong sharing, a public repository, open cloud storage, or mail sent to the wrong address.

Authentication Bypass … uence can be access to a user account, to administration, to internal data, or to a function that changes the state of the system. Authentication therefore has …

Cloud storage exposure … e becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database ex …

Shadow IT Shadow IT is often a symptom rather than merely a breach. If the official tools do not do the job, employees find their own. But the consequence stays the same: …

Shared Account Abuse The whole IT team uses the same administrator account to manage the servers.

Spyware … pponents, but the same mechanism shows up in corporate espionage and in domestic abuse.

Watering Hole Attack A watering hole attack does not chase the victim directly. The attacker first finds a site the target group visits regularly, then compromises that site or the content loaded through it. The victim then comes to the place of the attack on their own, doing what they normally do.

API Abuse … e users, the orders, the payments and the administration.

Account Takeover … ally follows is a new account and building from scratch, which is particularly painful for business accounts.

BGP Hijacking … mes it is a provider's mistake, sometimes a deliberate attack. The user usually does not see that the path changed, only that the service does not work or that …

Backdoor … t behind by employees or service providers, deliberately or by accident. Sometimes it surfaces as a software or hardware vulnerability. It always serves the sam …

Botnet Attacks A network of compromised cameras and routers generates large DDoS traffic at a public service.

Brute-force attack … tool hits a live login, where account lockout and rate limits slow it down. Offline, the attacker works on their own hardware against a stolen database of passw …

Contractor Abuse The risk is not only deliberate theft. A private laptop with no protection is enough, or keeping data for the next project, or sharing an account inside the sup …

Cross-Site Request Forgery The user is logged into an administrative panel and then opens another page that automatically sends a request to change a setting.

Cryptominer A cryptominer steals capacity rather than data — which is why it goes unnoticed for longer.

DNS Amplification … ternet with no need to is not merely a bad configuration but part of somebody else's problem.

Deepfake Attack A deepfake attack uses an artificially generated voice, image or video so that somebody can pose as a real person. In cyber attacks this usually means the direc …

Denial of Service / DoS … aw in the application, the protocol or the configuration. A small number of specially shaped requests can consume a great deal of memory, hold connections open, …

Dependency Confusion … public repository, and becomes a target for registration on a public package registry.

Distributed Denial of Service / DDoS … s capacity arranged in advance, scrubbing, a CDN, rate limiting and a clear line to the provider.

Fileless malware … oftware has a harder time finding it. While it operates it lives in memory and works with tools the system already has — PowerShell, scripts, built-in commands. …

Infostealer … roblems: account takeover, a break-in to the corporate network, ransomware. A large share of breaches begins with credentials some stealer gathered months earli …

Insider Threat … can be an employee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized …

Kerberoasting … tack starts from any user account at all. Administrator rights are not needed. The attacker requests a ticket for a service account, carries it to their own mac …

MFA Fatigue … rove/Deny with a confirmation that requires a generated number to be entered. Safer still is a phishing-resistant factor (FIDO2, passkeys, hardware keys). Along …

Model theft / extraction … ct theft of the files, the weights and the configuration, but also controlled extraction through an API, where the model is queried enough times to build an app …

Pass-the-Hash To get the hash the attacker needs administrator or SYSTEM rights and a tool such as Mimikatz. Once they have it, they can try logging in to the other machines …

Path Traversal … a file path, the attacker can try to read configurations, passwords, source code and system files.

Pretexting … mass phishing, pretexting requires thorough preparation. The attacker uses publicly available information, LinkedIn, the company website, job adverts, old emai …

Privilege Escalation … calation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of rights.

Privilege Misuse An administrator can read data they should not read, a finance user can start a transaction in their own favor, and technical staff can reach private mail, reco …

Prompt injection … he attack is no longer a game with text but an operational incident.

Ransom DDoS … ing the service down, or first run a short demonstration attack, and then ask for money for the attack to stop or for a larger one not to happen.

Ransomware … rtion. Some ransomware groups sell their whole operation to affiliates as a package (ransomware as a service), so attacks are now run by people with no particul …

Remote Code Execution It is reached through configuration mistakes, vulnerable libraries, insecure deserialization, file upload, document parsers, memory handling or wrongly exposed …

Resource Exhaustion … arch, a badly written regular expression, the generation of a huge report, the writing of enormous log entries, or connections that stay open too long. The serv …

Rootkit … important property. It can settle beneath the operating system and beneath the layer where antivirus software can look: sometimes in drivers or in the kernel, …

SCADA/OT Attack … ice life. Much of it was designed for reliable operation, not for a hostile network. When IT and OT networks are joined for monitoring, remote access or efficie …

SIM Swapping … r. The attacker persuades, or bribes, a mobile operator to move the number to a new SIM card, citing a lost phone or a damaged card. They usually come armed wit …

SMS phishing - Smishing … r a parcel is often the bait. The amount is deliberately low so that card details are entered more readily.

SSRF … a function that fetches an image from a URL, generates a link preview or checks a remote resource. If the application accepts a user-supplied address without s …

Service Abuse … es. That is why quotas, reputation, anomalies and rate limiting matter more than the syntax of the request.

Session Hijacking … has already passed authentication and carry on operating the service in your name.

Spear Phishing … y and authority in a message are a sign to verify rather than to comply.

Supply Chain Attack … s, the attacker uses a supplier's access, an integration or an administrative channel. Either way, trust becomes the channel of attack.

Third-Party Compromise … ies often hold VPN access, support accounts, integrations, API keys, access to data, or the job of maintaining systems. If they are less well protected than the …

Typosquatting Defensive registration of similar domains helps but does not cover every variant. Monitoring is not optional.

Virus … ning processes and applications. That is what separates it from a worm: a virus needs a host and a user, while a worm spreads on its own.

Whaling … n set a large payment in motion, open access to strategic documents, compromise negotiations, or serve as the entrance to the rest of the organization. The high …

Wiper Without a sound backup in a separate location, a wiper ends the business. The 3-2-1 backup rule is the difference here between recovery and total loss. With a w …

voice phishing - Vishing … tle urgency is added, a person easily starts cooperating with the attacker, thinking they are solving a sudden problem.