Brute-force attack A brute-force attack breaks into an account by trying to log in over and over: automated tools work through password after password until one takes. It succeeds …

Resource Exhaustion Resource exhaustion targets what a system cannot work without: processor, memory, disk, network connections, threads, the database or processing queues. The aim …

BGP Hijacking The consequence can be loss of availability, interception of traffic, or its diversion through a network that should never have been on that path. Sometimes it …

Cryptominer … It has no interest in our data, only in our resources and how much of them there is.

Evil Twin A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.

Insecure Deserialization … pplication accepts an object from an untrusted source and handles it as though it were safe. At that point the attacker is not sending mere data but a specially …

Service Abuse … accounts in bulk and consumes the platform's resources.

Botnet Attacks … ng messages from compromised devices, changing sources to make blocking harder.

Cloud IAM misconfiguration … identity is permission to read data, spin up resources, change networks, assume roles and delete backups.

Contractor Abuse An external developer copies the project's source code and uses it later on another engagement.

Credential stuffing … ating perfectly ordinary users, so blocking by source address helps little. It only takes a small share of people reusing a password for the attack to pay. The …

DNS Amplification … queries but forges the victim's address as the source.

DNS Poisoning … That way they can steer users to a fake page, intercept communication, or distribute malware from somewhere that resembles the legitimate source.

Denial of Service / DoS … network of compromised devices. Sometimes one source and a well-chosen vulnerability are enough.

Dependency Confusion … build system has no clearly configured package source, no namespace check, no locked versions and no integrity check, it can pull the malicious package by itsel …

Distributed Denial of Service / DDoS DDoS is not always a technical show of force. It can be a method of extortion, political pressure, disruption of a competitor, or a smokescreen while something …

Password spraying Password spraying is brute force turned around. Instead of trying many passwords on one account, the attacker tries common passwords across many accounts. That …

Path Traversal … ker can try to read configurations, passwords, source code and system files.

Phishing … eates pressure — your account is suspended, the parcel could not be delivered, the invoice is overdue — so a person reacts before they have time to think. Mass …

Privilege Escalation … l, moving from one account to another user's resources at the same level of rights.

Ransom DDoS … tied to revenue, trust or public pressure: e-commerce, finance, online services, gaming, media, government services. The threat often arrives at the moment when …

Remote Code Execution RCE rarely stays an isolated technical event. After the first execution come a web shell, further tools, data theft, lateral movement and an attempt to keep the …

SIM Swapping … the attacker's card, the mail reset codes are intercepted, the account is taken.

SMS phishing - Smishing … he message offers a simple reason to click: the parcel cannot be delivered, the account is blocked, a transaction looks suspicious, a package is waiting on a sm …

SSRF … generates a link preview or checks a remote resource. If the application accepts a user-supplied address without strict control, the attacker can force the ser …

Session Hijacking … st common is theft of the session cookie — by intercepting traffic on an unprotected connection, through a flaw on the site that allows the cookie to be read, o …

Shadow IT … that ended up in a private cloud, and cannot enforce rules over a tool that is not part of the system.

Supply Chain Attack … their own environment, because it comes from a source they trust.

Token Theft … oment the service issues it. The third way is intercepting the traffic between you and the service you are reaching. Once it is taken, the attacker no longer ne …

Trojan … r taken from somewhere other than the official source does everything it should — while in the background it has brought along a keylogger that records every ke …

Watering Hole Attack … tion, a forum, an industry association, or a resource used by one specific group of people.

Worm … what connects computers: the network, shared resources, unpatched vulnerabilities. It can carry extra cargo — ransomware, a backdoor, a remote access tool — so …