Threats & adversaries
Who attacks and with what: malware families from trojans to wipers, botnets and backdoors, zero-days and privilege escalation, plus APTs, hacktivists and scams.
Active attack
An active attack is one where the adversary acts on the system: writing, modifying, executing or interrupting. It stands against the passive attack, which only observes. The distinction is not academic: it changes how each one is detected, because an active attack leaves a trace and a passive one leaves almost none.
Advanced persistent threat (APT)
In threat intelligence, an advanced persistent threat is a well-resourced attacker that targets a specific entity and maintains access over long periods to meet an objective. The defining words are targeted and persistent: the adversary chose you, and is prepared to stay, which changes what defence has to achieve.
Adversary-in-the-middle (AiTM)
In phishing, an adversary-in-the-middle attack places a reverse proxy between the victim and the real site, relaying the whole login in real time and keeping the session cookie the site issues at the end. The victim authenticates successfully, second factor included, and the attacker walks away with the resulting session.
Adware
Adware is unwanted software whose purpose is to push advertising onto a device, usually arriving alongside something the user did mean to install.
Backdoor
In offensive and defensive security, a backdoor is covert access to a system that bypasses its normal authentication. It may be planted by an attacker after compromise, shipped inside a dependency or a build system, or left in place by a vendor. What defines it is the bypass, not how long it survives.
Blended attack
A blended attack is one where the attacker coordinates several methods and vectors at once, technical, human and sometimes physical, so that defences designed to stop any one of them are not enough.
Botnet
A botnet is a network of computing devices that have been compromised and are controlled remotely by a single operator.
Brute force
In credential attacks, brute force is trying values until one works. Exhaustive search is the textbook definition and almost nobody does it: real attacks use wordlists, mutation rules and leaked material, so the practical question is never the size of the keyspace but how fast a guess can be tested.
Computer virus
In security, a computer virus is malicious code that reproduces by inserting a copy of itself into another program, document or boot sector, so it needs a host and needs something or someone to run it. It is one category of malware rather than a synonym for it, because most of today’s attacks do not spread that way.
Credential stuffing
Credential stuffing is an attack in which someone replays username and password pairs stolen from other services against your login, betting that people reuse passwords. Nothing is guessed and nothing is cracked: every attempt uses a credential that was correct somewhere else, which is why the success rate is low and the volume enormous.
Cryptojacking
Cryptojacking is the unauthorised use of someone else’s computing resources to mine cryptocurrency. In cloud environments it is usually the visible symptom of a compromised credential rather than the objective itself, which makes an unexplained rise in compute spend a cheap and reliable intrusion sensor.
Data leak
A data leak is an incident in which confidential, sensitive or protected information is exposed, disclosed or made reachable to people who were not authorised to see it.
Deepfake
In social engineering, a deepfake is synthetic audio, video or imagery generated to impersonate a specific real person convincingly. For security purposes the important case is not the fabricated video: it is cloned voice on a telephone call, because that is the channel most organisations still treat as proof of identity.
Defacement
Defacement is the unauthorised modification of a website’s content, usually its home page, to carry a message, damage a reputation or simply demonstrate that the site could be broken into.
Dropper and downloader
A dropper and a downloader are the two ways malware gets delivered onto a machine: the dropper carries the payload inside itself and writes it to disk, while the downloader carries nothing and fetches it from a server the moment it runs. Neither of them is the damage, both are the road it arrives on.
Executable file
An executable file contains instructions a computer can run. That is what makes software possible, and it is also why an attachment that runs on a double click has been a delivery route for malware for thirty years.
Exploit
In offensive security, an exploit is the code or technique that turns a vulnerability into actual unauthorised access or impact. The vulnerability is the defect; the exploit is the demonstration that the defect can be used. The distance between the two is what decides how urgently anybody should care.
Hacktivist
A hacktivist is a person or group who uses technical skills to push a political, social or ideological cause, from publishing documents to knocking a website offline.
Heartbleed
Heartbleed is a critical vulnerability in OpenSSL, disclosed in April 2014, that let an attacker read chunks of a server’s memory straight off the wire.
Hoax
A hoax is a false message that travels by email, chat or social media and whose only goal is that you keep passing it on: a fake virus alert, a chain message, an invented security warning. There is nothing technical inside it, which is why no filter stops it. It spreads because checking it costs more than forwarding it.
Infostealer
In criminal operations, an infostealer is malware built for one job: harvest credentials, session cookies, browser data and files from a machine, send them to the operator and leave. It is the origin of a large share of the corporate access sold today, and the reason a stolen session matters more than a stolen password.
Initial access broker
In the criminal economy, an initial access broker is a specialist who compromises organisations and sells that access to somebody else rather than using it. They are the reason an intrusion can begin with no exploitation at all: the buyer logs in with access that was obtained weeks earlier by a different party.
Insider threat
In risk terms, an insider threat is the risk that somebody with legitimate access uses it against the organisation, whether deliberately, carelessly, or because their account has been taken over by an outsider. The third case is the most common, and it is why the category cannot be separated from ordinary access control.
Lateral movement
In a network intrusion, lateral movement is how an attacker travels from the machine they first compromised to the systems that hold what they came for, usually by reusing valid credentials rather than by exploiting anything. It is the longest phase of most real intrusions and the one defenders have the best chance of interrupting.
Living off the land (LOLBins)
In intrusion tradecraft, living off the land means conducting an operation using software that is already present and trusted on the target: signed system utilities, administrative tools and scripting engines. The binaries used this way are called LOLBins, and the technique exists because trusted tools are not what security controls are looking for.
Logic bomb
A logic bomb is malicious code that sits inert inside a system until a condition is met: a date, a program running, a piece of data appearing or disappearing. What sets it apart from other malware is not what it does when it fires, but that the attacker chooses when, and that months can pass between the intrusion and the damage.
Password spraying
In credential attacks, password spraying tries a small number of likely passwords against a very large number of accounts, instead of many passwords against one account. It is designed to stay below lockout thresholds, and it is the technique that most reliably produces a first foothold in a cloud tenant.
Persistence
In intrusion operations, persistence is the set of mechanisms an attacker plants so their access survives reboots, credential changes and clean-up. It is the difference between an intrusion that ends when a machine is restarted and one that has to be hunted, and it is what a red team exercise is meant to test the response to.
Privilege escalation
In an intrusion, privilege escalation is the step where an attacker turns limited access into more: from an ordinary user to administrator on a machine, or from a normal account to control of a directory or a cloud tenant. It usually comes from a misconfiguration or an over-granted permission rather than from an exploit.
Ransomware
Ransomware is an extortion operation against an organisation, not simply a type of malware: intruders take the data first, then usually encrypt it, and charge for both silence and recovery. Some crews now skip the encryption altogether and extort on the threat of publication alone, which is why the old definition no longer fits.
Ransomware-as-a-service (RaaS)
In the criminal economy, ransomware-as-a-service (RaaS) is the model in which one group builds and maintains the encryption software, the leak site and the negotiation infrastructure, and other people, the affiliates, carry out the intrusions in exchange for a share of the payment. It is why two incidents under the same name can look nothing alike.
Replay attack
In a replay attack the attacker captures valid data in transit and sends it again, unchanged, so the receiving system accepts it a second time. No decryption required: the message was legitimate the first time.
Rootkit
In malware analysis, a rootkit is malware that subverts the operating system so the system under-reports the attacker’s presence, hiding processes, files, connections and accounts from the tools that trust it for their answers. The deception happens inside the system being queried, which is why the tools running on it report a clean machine.
Security breach
A security breach is an event, or a chain of them, that lets somebody unauthorised compromise the integrity, confidentiality or availability of data, systems or networks. What defines it is not the entry point but how long it goes unnoticed.
Software supply chain attack
In threat terms, a software supply chain attack compromises something an organisation already trusts and installs, rather than attacking the organisation directly. The malicious code arrives signed, through the update mechanism, and reaches every customer of the compromised component at once.
Targeted attack
A targeted attack is one aimed at a specific organisation, person or piece of infrastructure, planned around what that target actually looks like rather than fired indiscriminately at whoever happens to be reachable.
Threat
A threat is any event, action, person or entity with the capability to compromise the security of a system, a network, an application or data. It is one of the three terms in the sentence that defines risk, and the three are routinely confused.
Trojan horse
A trojan horse is malware disguised as legitimate or useful software, so that the user installs it themselves and hands over the access the attacker wanted.
Wiper
A wiper is malware whose purpose is destruction rather than profit: it overwrites files, partition tables or firmware so the data cannot be recovered. Several notable families have presented themselves as ransomware, complete with a ransom note, when no decryption key ever existed.
Worm
A worm is malware that spreads across networks on its own, without anybody having to open anything. That is the whole distinction from a virus, and it is what makes a worm a problem measured in minutes rather than in weeks.