Blended attack

A blended attack is one in which the attacker uses several methods and vectors together, in a coordinated way, to compromise a system or a network.

The point of combining them is to get past defences that were each designed to stop one thing. A control that reliably blocks one technique may be irrelevant to the next one in the sequence, and the attacker is counting on exactly that.

The combination can mix technical exploitation with human manipulation, and occasionally with physical access, aimed at a specific outcome: stealing data, interrupting a service or undermining the integrity of a system.

Defending against them is harder for a structural reason: it demands that technology, process and people all hold, and the attacker only needs the weakest of the three.

What characterises it

More than one vector. Software exploitation, social engineering, malware and evasion techniques used together rather than in isolation.

Coordination. The order and the timing are chosen. One action creates the conditions for the next, and sometimes one is there only to occupy the people who would otherwise be watching.

Diversified threat. Digital activity combined with physical or social tactics, in either order: physical access used to plant a foothold, or a digital compromise used to make physical access easier.

Persistence and adaptation. These attacks try to establish a foothold that survives, and to adjust as defences respond. That is what separates them from a single opportunistic attempt.

A worked example

An organisation is the target.

The attackers begin with a phishing campaign and obtain the credentials of an employee with useful access.

With those credentials they reach the internal network. Once inside, they deploy malware on several systems and use evasion to stay out of the alerting.

At the same time they launch a denial of service attack against the public facing servers, which interrupts the online service and, just as importantly, occupies the operations team.

Under cover of that confusion they attempt physical access to the premises, looking for critical systems and for storage devices that can be removed.

What the example illustrates is not the exotic nature of any single step. It is that each step is ordinary, and the combination is what defeats a defence organised in separate compartments.

Where the term sits today

Blended attack is an older term, and it is worth saying how it maps onto how intrusions get described now.

Today the same reality is usually written as a chain: initial access, execution, persistence, privilege escalation, lateral movement and impact, which is the vocabulary of the kill chain and of MITRE ATT&CK. Almost every real intrusion is blended in the original sense, because almost none of them consist of a single technique.

The idea the term still carries, and the reason it is worth keeping, is the argument for defence in depth: a control that stops one vector does not stop the attack, it stops one step of it. What decides the outcome is whether any of the remaining steps is noticed, which is a question about detection rather than about prevention.

The corollary is uncomfortable and worth stating: an organisation can pass every individual control test and still be compromised by a sequence in which each step is individually unremarkable.