Threats, Adversaries and Attack Lifecycle

Introduction

Cybersecurity begins with understanding what must be defended, who may attack it, why attacks occur, and how attacks develop over time. Technical controls such as firewalls, encryption and access management are important, but they are most effective when security professionals understand the behaviour and objectives of adversaries.

A cyberattack is not usually a single event. It is a sequence of activities that may begin with reconnaissance, proceed through delivery and exploitation, and end with data theft, disruption or extortion. Defenders can interrupt this sequence at many points. This chapter introduces threat actors, motives, malware, social engineering, credential attacks, common attack vectors, the Cyber Kill Chain and the MITRE ATT&CK framework.

The objective is not to memorise names of attacks. It is to develop a practical way of analysing risk and recognising how apparently minor events—such as a convincing email or a reused password—can become part of a larger compromise.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish assets, vulnerabilities, threats, risks and threat events.
2. Identify major categories of threat actors and explain their motives.
3. Describe malware families and common infection methods.
4. Explain social engineering and credential-based attacks.
5. Identify common attack vectors and basic defensive controls.
6. Interpret the stages of the Cyber Kill Chain.
7. Use MITRE ATT&CK terminology at an introductory level.
8. Analyse an attack scenario and recommend appropriate preventive and detective measures.
9. Explain legal, ethical and governance responsibilities in threat analysis.

1. Foundations of Threat and Risk

An asset is something valuable to an organisation, including data, systems, applications, facilities, services, reputation and human safety. A vulnerability is a weakness that could be exploited. A threat is a potential cause of harm, while a threat actor is an individual or group capable of carrying out a harmful action. A threat event is an occurrence that may damage an asset. Risk is the possibility that a threat will exploit a vulnerability and produce an adverse consequence.

A useful introductory model is:

Likelihood describes how probable or plausible an adverse event is; impact describes the magnitude of its consequences. This is a simplified risk model rather than a precise law. In professional risk assessments, likelihood and impact may be expressed using qualitative scales, monetary estimates or more complex models. The model is useful because it reminds analysts that a highly damaging event may deserve attention even when it is less probable, and a frequent event may be important even when each occurrence has modest impact.

Threat analysis should therefore ask four questions:

• What is valuable?
• What could go wrong?
• Who could cause it, deliberately or accidentally?
• Which controls would reduce likelihood, impact or both?

A vulnerability is not automatically a breach. For example, an unpatched server may be vulnerable, but exploitation also requires an attacker to discover the system, reach it, possess or obtain a suitable exploit, and achieve a meaningful objective.

Threat, Vulnerability and Risk: An Example

Suppose a company exposes a remote-access service to the internet. The service uses a weak password policy and has no multi-factor authentication. The exposed service is an asset; weak authentication is a vulnerability; an organised criminal group is a possible threat actor; unauthorised access is the threat event; and the resulting risk may include data theft and operational disruption.

Controls could include patching, multi-factor authentication, network restriction, account lockout, central logging and monitoring. No single control is perfect. Defence in depth is necessary because an attacker who bypasses one control may still be stopped by another.

2. Threat Actors and Their Motives

Threat actors differ in capability, resources, access, persistence and motivation. Categories may overlap: an employee can become a criminal insider, and a state-sponsored group may use criminal infrastructure.

Capability and Intent

Intent answers the question, “What does the actor want?” Capability asks, “What can the actor do?” Opportunity asks, “What access or weakness is available?” Risk increases when a capable actor with strong intent encounters an accessible vulnerability.

A sophisticated actor does not always use sophisticated techniques. If a reused password permits access, there may be no reason to deploy advanced malware. Conversely, a low-capability attacker may cause serious harm by using an unpatched vulnerability against a critical system.

Insider Threats

Insiders may be malicious, careless or compromised. A malicious insider deliberately abuses authorised access. A negligent insider may mishandle information, misconfigure a cloud service or fall for phishing. A compromised insider account is controlled by an external attacker but appears legitimate.

Effective controls include least privilege, separation of duties, access reviews, strong authentication, monitoring, secure offboarding and a workplace culture in which suspicious activity can be reported safely. Monitoring must be proportionate and lawful; security does not eliminate privacy rights.

3. Malware and Malicious Code

Malware is software designed to perform unauthorised, harmful or deceptive actions. Malware categories describe behaviour, but categories can overlap.

• Virus: Malicious code that attaches to a host file or program and normally requires execution of the host to spread.
• Worm: Malware that can self-propagate across systems or networks, often by exploiting vulnerabilities.
• Trojan: Malicious software disguised as legitimate software or delivered through deception. A Trojan does not need to self-replicate.
• Ransomware: Malware that prevents access to systems or data, commonly through encryption, and demands payment. Modern campaigns may also steal data and threaten publication.
• Spyware: Software that secretly collects information, such as credentials, browsing data or keystrokes.
• Remote access trojan: Malware that gives an attacker remote control or interactive access.
• Rootkit: Tools designed to hide malicious processes, files or system activity and maintain privileged access.
• Botnet malware: Software that enrols devices into a remotely controlled network used for activities such as distributed denial-of-service attacks or spam.
• Wiper: Malware designed primarily to destroy or render data and systems unusable.
• Fileless or memory-resident malware: Malicious activity that relies heavily on legitimate tools or system memory rather than a conventional executable file. The term does not mean that no artefacts exist.

Malware Delivery and Execution

Malware may arrive through malicious attachments, compromised websites, drive-by downloads, software supply chains, removable media, exposed services or legitimate credentials. A user may execute a malicious document, or an attacker may exploit a vulnerable service without user interaction.

Defensive measures include secure configuration, patch management, application allow-listing, endpoint detection and response, email filtering, network segmentation, backups and user education. Backups must be protected from unauthorised modification; otherwise ransomware may encrypt both production data and backup copies.

4. Social Engineering

Social engineering manipulates people into revealing information, performing an action or granting access. It exploits trust, urgency, authority, fear, curiosity and helpfulness rather than relying solely on technical vulnerabilities.

Phishing uses fraudulent electronic messages or websites. Spear phishing targets a particular individual or organisation. Whaling targets senior executives or high-value personnel. Business email compromise uses impersonation or account takeover to induce payments, disclose information or alter transactions. Smishing uses text messages, while vishing uses voice calls. Pretexting creates a fabricated scenario to obtain cooperation. Baiting offers something attractive, such as a free file or device. Tailgating occurs when an unauthorised person follows an authorised person into a restricted area.

Deepfakes and synthetic voice can make impersonation more convincing. However, the underlying defence remains procedural and technical: verify unusual requests through an independent channel, avoid relying solely on caller identity or email display names, require dual approval for sensitive transactions, and use phishing-resistant authentication where feasible.

Recognising a Suspicious Message

Warning signs include:

• unexpected urgency or secrecy;
• requests for passwords, payment or confidential data;
• mismatched domains or misleading links;
• unusual writing, branding or attachments;
• a request to bypass normal approval procedures;
• claims that a security control must be disabled.

No single warning sign proves that a message is malicious. Attackers may use correct grammar and genuine-looking infrastructure. Verification is more reliable than appearance.

5. Credential Attacks

Credentials include passwords, passphrases, cryptographic keys, tokens, certificates and biometric factors. Credential attacks are common because a valid login may allow an attacker to blend into normal activity.

• Brute force: Systematically tries many possible passwords.
• Password spraying: Tries a small number of common passwords against many accounts, reducing the chance of account lockout for any one account.
• Credential stuffing: Uses username-password pairs stolen from another service, exploiting password reuse.
• Phishing: Tricks users into submitting credentials to an attacker-controlled service.
• Keylogging: Captures keystrokes through malware or hardware.
• Credential dumping: Extracts credentials or authentication material from systems.
• Pass-the-hash: Uses a captured password hash or equivalent authentication material without recovering the plaintext password.
• Token theft: Abuses session cookies, refresh tokens or other authentication artefacts.

Passwords should be long and unique. Organisations should use password managers, multi-factor authentication, rate limiting, breached-password screening and secure password storage. Passwords should not be stored in plaintext. Proper password storage uses a deliberately slow, memory-hard password-hashing scheme with a unique salt for each password. Encryption and hashing are different: encryption is designed to be reversible with a key, whereas a cryptographic hash is designed to be computationally difficult to reverse.

Multi-factor authentication combines different factor types: something known, something possessed or something inherent. A second factor does not make phishing impossible, because attackers may proxy a login or steal a session. Phishing-resistant methods, such as hardware security keys using modern public-key protocols, provide stronger protection than codes typed into a website.

6. Common Attack Vectors

An attack vector is a path or method by which an attacker reaches a target or achieves an objective.

Internet-Facing Services

Remote-access gateways, web applications, mail servers, virtual private networks and cloud management interfaces are frequently scanned. Common weaknesses include unpatched software, weak authentication, insecure defaults, exposed administrative interfaces and excessive permissions.

Web Applications

Web attacks may involve injection, broken access control, cross-site scripting, insecure file upload, server-side request forgery and poor session management. Input validation, output encoding, secure frameworks, access-control checks, code review and security testing reduce exposure.

Email and Collaboration Platforms

Email remains a major delivery mechanism for phishing, malware and fraudulent requests. Collaboration systems may also be abused through malicious links, guest accounts and stolen session tokens.

Supply Chains

An organisation may be compromised through a supplier, software update, managed service provider or open-source dependency. Supply-chain security requires vendor assessment, dependency management, code-signing validation, segmentation and monitoring of third-party access.

Cloud and Identity Systems

Misconfigured storage, excessive permissions, long-lived credentials and insecure application programming interfaces can expose cloud resources. Cloud security is a shared responsibility: the provider secures parts of the underlying service, while the customer remains responsible for configuration, identities and data according to the service model.

Removable Media and Physical Access

USB devices, stolen laptops, unlocked workstations and unauthorised building access can bypass logical controls. Encryption, device control, secure disposal, physical security and screen-lock policies are relevant countermeasures.

7. The Cyber Kill Chain

The Cyber Kill Chain, associated with Lockheed Martin, describes seven broad stages of a targeted intrusion:

1. Reconnaissance: The attacker researches the target, personnel, technology and exposed services.
2. Weaponisation: The attacker prepares a malicious payload, such as a document containing exploit code. This stage may occur away from the target environment.
3. Delivery: The payload reaches the target through email, a website, removable media or another channel.
4. Exploitation: A vulnerability or human action causes malicious code or activity to execute.
5. Installation: Malware or another persistence mechanism is established.
6. Command and control: The compromised system communicates with attacker-controlled infrastructure.
7. Actions on objectives: The attacker performs the intended activity, such as theft, disruption, espionage or extortion.

The model is valuable because it encourages defenders to disrupt attacks before the final objective. For example, email filtering may block delivery, patching may prevent exploitation, endpoint controls may detect installation, and network monitoring may identify command-and-control traffic.

The model has limitations. Real attacks are not always linear. Attackers may move laterally, repeat stages, begin with stolen credentials, or use legitimate cloud services instead of installing malware. The model can also encourage a narrow focus on perimeter intrusion. It should therefore be used as a communication aid, not as a complete representation of every attack.

8. MITRE ATT&CK

MITRE ATT&CK is a knowledge base describing adversary tactics, techniques and procedures. It is based on observed behaviours and is used for threat-informed defence, detection engineering, incident response and security assessment.

A tactic represents an adversary goal, such as Initial Access, Persistence, Privilege Escalation, Defence Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration or Impact. A technique describes how the goal may be achieved—for example, phishing, valid accounts, scheduled task/job, or exploitation of a public-facing application. A sub-technique provides more detail. A procedure describes how a particular threat actor has used a technique in practice.

ATT&CK is not the same as the Cyber Kill Chain. The Kill Chain is a high-level sequence of stages. ATT&CK provides a more granular behavioural vocabulary and recognises that tactics and techniques may recur in different orders.

Security teams can map observed events to ATT&CK techniques. For example, repeated failed logins followed by a successful login from an unusual country may relate to credential attacks and valid-account use. PowerShell or another administration utility used by an unexpected process may indicate execution or defence evasion, although legitimate administration must also be considered.

ATT&CK mapping does not prove maliciousness. It supports structured analysis, but context, evidence and confidence are essential. Analysts should avoid treating every administrative command as an attack merely because it resembles a documented technique.

9. Applied Case: A Ransomware Incident

Background

The following is a fictional illustrative case. A medium-sized logistics company operates a cloud email platform, an internal file server and a warehouse management system. Employees use remote access, and several administrators share emergency accounts.

Problem

An accounts employee receives an email appearing to come from a supplier. The message asks the employee to review an invoice through a linked website. The employee enters credentials. The attacker uses the credentials to access email, creates a hidden forwarding rule and searches messages for administrator information. A second employee approves a fraudulent request to reset a remote-access account. The attacker enters the corporate network, obtains elevated privileges and deploys ransomware to file servers. Some backups are also encrypted.

Analysis

The attack includes several stages:

• Initial access: spear phishing and stolen credentials;
• Persistence: a mailbox forwarding rule and continued account access;
• Credential access: collection of administrator information;
• Discovery: searching email and identifying file servers;
• Privilege escalation: obtaining higher-level access;
• Lateral movement: moving from user systems to servers;
• Impact: encrypting operational data and disrupting logistics.

In Kill Chain terms, phishing represents delivery, credential submission enables exploitation of human trust, account access supports installation or persistence, and encryption represents actions on objectives. In ATT&CK terms, analysts might investigate phishing, valid accounts, email collection, account manipulation, remote services and data encrypted for impact. Exact mapping would depend on the evidence.

Response and Improvement

The organisation isolates affected systems, disables compromised accounts, preserves logs, contacts its incident-response team and restores from verified backups. It does not assume that paying a ransom will restore systems or prevent data publication. Legal, regulatory, insurance and law-enforcement advice is obtained where appropriate.

Long-term improvements include phishing-resistant multi-factor authentication, elimination of shared administrator accounts, privileged access management, email-rule monitoring, network segmentation, endpoint detection, immutable or offline backups, tested recovery procedures and exercises involving finance and operations staff.

Learning Points

The incident was not caused by one failure. It resulted from the interaction of social engineering, weak identity governance, excessive privilege, insufficient monitoring and inadequate backup protection. Effective security is therefore a system of technical, procedural and human controls.

10. Detection, Prevention and Professional Practice

A mature defence uses preventive, detective, corrective and recovery controls. Preventive controls reduce the chance of compromise; detective controls identify suspicious activity; corrective controls contain and remove threats; recovery controls restore services and improve resilience.

Useful practices include:

• maintain an accurate asset and software inventory;
• prioritise patching of internet-facing and exploited vulnerabilities;
• apply least privilege and separate administrative accounts;
• require multi-factor authentication, especially for remote and privileged access;
• centralise logs and synchronise system time;
• monitor authentication, privilege changes, forwarding rules and unusual data transfers;
• segment critical systems and restrict east-west traffic;
• maintain tested, protected backups;
• conduct vulnerability assessments and authorised penetration tests;
• provide realistic security awareness training;
• rehearse incident response and business continuity plans.

Security monitoring should be risk-based. Large volumes of alerts are not useful if analysts cannot investigate them. Detection rules should have a clear purpose, relevant context and a documented response. Metrics may include time to detect, time to contain, patch age, MFA coverage, backup restoration success and the proportion of high-risk findings remediated.

11. Ethical, Legal and Governance Considerations

Threat analysis must be authorised, proportionate and respectful of privacy. Scanning systems without permission may be unlawful, even if the intention is defensive. Penetration testing requires written scope, rules of engagement, communication procedures and protection of collected evidence.

Organisations should define responsibility for risk acceptance, incident reporting, data protection and continuity. Personal data collected during investigations must be handled securely and retained only as necessary. Evidence should be preserved with appropriate integrity controls and access restrictions.

Defenders should distinguish indicators from conclusions. An unusual login is an indicator, not automatic proof of compromise. Analysts should document assumptions, confidence levels, alternative explanations and decisions. This discipline reduces false accusations and improves the quality of incident response.

12. Contemporary Developments and Limitations

Cloud services, remote work, software dependencies and identity-based access have expanded the attack surface. Attackers increasingly use legitimate tools, stolen tokens and trusted services, making simple malware signatures less sufficient. Artificial intelligence can help attackers create convincing messages and can help defenders classify alerts, summarise evidence and identify anomalies. AI outputs require human validation because they may be inaccurate, biased or based on incomplete data.

No framework captures every aspect of cybersecurity. The Kill Chain may oversimplify complex campaigns; ATT&CK may encourage checklist behaviour; risk ratings can create false precision; and awareness training alone cannot compensate for weak technical controls. Frameworks should support judgement, not replace it.

Chapter Summary

Threats arise when adversaries, vulnerabilities and opportunities combine to create potential harm. Threat actors include criminals, nation-states, insiders, hacktivists, opportunists and other groups, each with different capabilities and motives. Malware includes viruses, worms, Trojans, ransomware, spyware, rootkits, botnet software and destructive wipers. Social engineering manipulates people, while credential attacks exploit weak, reused or stolen authentication material.

Common attack vectors include exposed services, web applications, email, cloud identities, supply chains, removable media and physical access. The Cyber Kill Chain provides seven broad stages for considering where an attack can be interrupted. MITRE ATT&CK provides a detailed vocabulary of adversary tactics, techniques and procedures. The two frameworks are complementary but neither should be treated as a complete description of all attacks.

Effective cybersecurity combines least privilege, strong authentication, patching, segmentation, monitoring, protected backups, incident response and trained personnel. Ethical and lawful practice requires authorisation, proportionality, privacy protection, evidence handling and careful interpretation of indicators. The most important professional lesson is that major incidents usually result from several connected weaknesses rather than one isolated mistake.

Key Terms

Asset: Something valuable that requires protection.

Attack vector: A path or method used to reach a target or conduct an attack.

Credential stuffing: Use of stolen username-password pairs against other services.

Cyber Kill Chain: A seven-stage model describing broad phases of a targeted cyberattack.

Exploit: Code, technique or action that takes advantage of a vulnerability.

Insider threat: Risk caused by a person with authorised access, whether malicious, negligent or compromised.

Malware: Software intended to perform unauthorised, harmful or deceptive actions.

MITRE ATT&CK: A knowledge base of adversary tactics, techniques and procedures.

Multi-factor authentication: Authentication using two or more different factor types.

Password spraying: Trying a few common passwords across many accounts.

Phishing: Deceptive communication intended to obtain information or induce an action.

Ransomware: Malware that denies access to data or systems, commonly for extortion.

Risk: The possibility of harm arising from threats exploiting weaknesses.

Social engineering: Manipulation of people to disclose information or perform an action.

Threat actor: An individual or group capable of causing harm.

Threat event: An occurrence that may adversely affect an asset.

Trojan: Malicious software disguised as legitimate software or content.

Vulnerability: A weakness that can be exploited.

Worm: Malware capable of self-propagation across systems or networks.

Review Questions

5 Short Answer Questions

1. What is the difference between a threat, a vulnerability and a risk?
2. How does credential stuffing differ from password spraying?
3. Define social engineering and give two examples.
4. What is the purpose of the Cyber Kill Chain?
5. Distinguish an ATT&CK tactic from an ATT&CK technique.

5 Long Answer Questions

1. Compare the motives, capabilities and typical methods of cybercriminals, nation-state groups and insiders.
2. Explain the principal malware categories and discuss suitable controls for reducing malware risk.
3. Describe how phishing can develop into a ransomware incident.
4. Explain the seven Cyber Kill Chain stages and identify one defensive control for each stage.
5. Discuss the strengths and limitations of using MITRE ATT&CK in a security operations team.

3 Analytical / Application Questions

1. A company detects a successful login from an unusual country, followed by the creation of an email forwarding rule. Analyse possible explanations, identify evidence to collect and recommend immediate actions.
2. A university allows remote access using passwords only. Develop a prioritised improvement plan addressing identity, endpoint, network, monitoring and recovery controls.
3. Analyse the fictional ransomware case in this chapter and identify three preventive, three detective and three recovery controls that could have reduced its impact.

Multiple Choice Questions with Answers

Question 1

Which statement best describes credential stuffing?

A. Trying every possible password against one account

B. Using stolen username-password pairs against other services

C. Sending many common passwords to one account only

D. Stealing a password hash from system memory

Correct Answer: B. Using stolen username-password pairs against other services

Question 2

Which threat actor is most directly associated with espionage and strategic advantage?

A. Nation-state group

B. Script user

C. Accidental insider

D. Online fraud victim

Correct Answer: A. Nation-state group

Question 3

What is the primary characteristic of a worm?

A. It disguises itself as legitimate software

B. It encrypts files for extortion

C. It can self-propagate across systems or networks

D. It only records keystrokes

Correct Answer: C. It can self-propagate across systems or networks

Question 4

Which activity belongs most directly to the reconnaissance stage of the Cyber Kill Chain?

A. Encrypting a victim’s files

B. Researching exposed services and personnel

C. Installing persistence on a workstation

D. Transferring stolen data to an external server

Correct Answer: B. Researching exposed services and personnel

Question 5

Which option is an example of spear phishing?

A. A random scan of internet addresses

B. A targeted fraudulent email written for a particular employee

C. A system automatically applying a security patch

D. A backup being stored offline

Correct Answer: B. A targeted fraudulent email written for a particular employee

Question 6

What does the principle of least privilege require?

A. Every user receives administrator access

B. Users receive only the access needed for their duties

C. All accounts use the same password

D. Access is granted permanently to avoid interruptions

Correct Answer: B. Users receive only the access needed for their duties

Question 7

In MITRE ATT&CK, a tactic primarily describes:

A. An adversary’s broad goal

B. A specific software vulnerability identifier

C. A company’s asset inventory

D. A password-storage algorithm

Correct Answer: A. An adversary’s broad goal

Question 8

Which control most directly reduces the risk of password reuse?

A. A password manager generating unique passwords

B. Disabling system time synchronisation

C. Increasing the number of shared accounts

D. Allowing unrestricted administrator access

Correct Answer: A. A password manager generating unique passwords

Question 9

Why are protected and tested backups important during ransomware incidents?

A. They guarantee that no phishing email will arrive

B. They can support restoration after data is encrypted or systems are disrupted

C. They eliminate the need for access controls

D. They prevent all forms of malware execution

Correct Answer: B. They can support restoration after data is encrypted or systems are disrupted

Question 10

An attacker uses a stolen session cookie to access a web application. This is best understood as:

A. Token theft

B. Baiting

C. Tailgating

D. Software patching

Correct Answer: A. Token theft