Certificate in Cybersecurity
Cybersecurity Fundamentals
•
Certificate
Threats, Adversaries and Attack Methods
Introduction
Cybersecurity begins with understanding what must be defended, who may attack it, and how attacks progress from intention to impact. A threat is a potential cause of harm; a vulnerability is a weakness that can be exploited; and risk is the possibility that a threat will exploit a vulnerability and produce an undesirable consequence. These concepts are related but not interchangeable. A vulnerability may exist without being exploited, while a threat may exist without having a practical opportunity to cause harm.
Modern attacks are rarely isolated technical events. They commonly combine malicious software, stolen credentials, social manipulation, exploitation of vulnerabilities, legitimate administration tools, and abuse of trusted suppliers. Effective cybersecurity therefore requires both technical knowledge and an understanding of human, organizational and geopolitical context.
This chapter introduces major adversary categories and attack methods. It uses the Cyber Kill Chain and MITRE ATT&CK as complementary frameworks for describing how attacks operate. The purpose is not to teach offensive exploitation, but to help learners recognize attack patterns, interpret indicators, and select appropriate defensive actions.
Learning Objectives
By the end of this chapter, you should be able to:
distinguish major adversary categories, including cybercriminals, nation-states, insiders, hacktivists and automated threats;
explain the relationship among threats, vulnerabilities, exploits, controls and risk;
describe malware, phishing, credential attacks, social engineering, denial-of-service and supply-chain attacks;
apply an attack-lifecycle perspective to a security incident;
explain the purpose and limitations of the Cyber Kill Chain;
use MITRE ATT&CK terminology to describe adversary tactics and techniques;
identify practical preventive, detective and responsive controls.
Threats, Vulnerabilities and Adversaries
A threat is any circumstance or actor capable of causing harm to an information asset. Threats may be intentional, accidental or environmental. Examples include a criminal group deploying ransomware, an employee sending confidential data to the wrong recipient, and a flood disabling a data centre.
An adversary is a person, group or system that intentionally seeks to compromise confidentiality, integrity or availability. An attack is an attempt to achieve that compromise. An exploit is the method, code or action that takes advantage of a vulnerability. A payload is the result delivered by an exploit, such as a command shell, credential-stealing program or ransomware component.
The traditional security objectives are often summarized as the CIA triad:
Confidentiality: information is not disclosed to unauthorized parties.
Integrity: information and systems remain accurate, complete and unaltered without authorization.
Availability: authorized users can access systems and information when required.
An attack may affect one or more objectives. Credential theft primarily threatens confidentiality and account integrity. Ransomware threatens availability and may also threaten confidentiality when data is exfiltrated. Distributed denial-of-service attacks mainly target availability.
Risk is commonly described conceptually as a combination of likelihood and impact. This is a decision-making model rather than a precise universal equation. An organization may use a qualitative matrix, such as low, medium and high, or a quantitative method supported by evidence. Risk assessments should state their assumptions because likelihood estimates are uncertain and impacts may include financial, legal, operational and reputational consequences.
Major Adversary Categories
Cybercriminals
Cybercriminals seek financial benefit. They include individual offenders, fraud networks, ransomware groups, access brokers and operators of criminal services. Their methods include phishing, business email compromise, payment fraud, credential resale, malware distribution and extortion. Criminal ecosystems increasingly divide work: one group may obtain access, another may sell it, and a third may deploy ransomware.
Nation-state and state-sponsored actors
Nation-state actors pursue political, military, intelligence or economic objectives. They may conduct espionage, influence operations, intellectual-property theft or disruption of critical infrastructure. State-sponsored groups often have substantial resources, patience and specialized capabilities. Their activity may remain undetected for long periods and may use legitimate tools to blend into normal administration.
Attribution is difficult. Similar tools may be copied by different groups, false flags may be used, and public evidence is incomplete. Defenders should therefore prioritize observed behavior and protective action rather than relying solely on an alleged identity.
Insiders
An insider is a person with authorized access who causes harm, either deliberately or accidentally. A malicious insider may steal data for money or revenge. A negligent insider may mishandle information, reuse passwords or approve a fraudulent request. Compromised insiders are legitimate users whose accounts or devices have been taken over by an external attacker.
Insider risk cannot be solved by distrust alone. Least privilege, separation of duties, access reviews, strong authentication, data-loss prevention, logging and a healthy reporting culture are more effective than indiscriminate surveillance.
Hacktivists
Hacktivists use cyber operations to promote political or social causes. They may deface websites, leak information, conduct denial-of-service attacks or publicize alleged wrongdoing. Their capabilities vary considerably. Public visibility and symbolism may be more important to them than long-term covert access.
Automated and opportunistic threats
Automated threats include worms, botnets, scanners, credential-stuffing systems and exploit campaigns. They can scan large address ranges, test exposed services and attack vulnerable systems without human decision-making at each step. Automation increases speed and scale, which makes basic hygiene—patching, secure configuration, multi-factor authentication and removal of exposed services—especially important.
Discovery: learning about hosts, accounts, applications, shares and security controls.
Lateral movement: moving from one system or account to another.
Collection and exfiltration: gathering and transferring information.
Impact: disrupting, altering, destroying or encrypting systems and data.
Real attacks do not always follow a straight line. An attacker may return to reconnaissance after gaining access, skip stages, repeat stages, or conduct several activities in parallel. Defenders should use the lifecycle to identify opportunities for prevention and detection, not to assume that every incident has a fixed sequence.
Figure: A simplified attack lifecycle. Actual incidents may loop, branch or omit stages.
The Cyber Kill Chain
The Cyber Kill Chain, developed by Lockheed Martin, presents seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. It was designed to help defenders disrupt an intrusion at multiple points.
Reconnaissance: selecting and researching a target.
Weaponization: combining an exploit with a malicious payload.
Delivery: transmitting the weapon through email, a website, removable media or another channel.
Exploitation: triggering a vulnerability or persuading a user to act.
Installation: placing malware or another mechanism on the target.
Command and control: establishing communication with attacker infrastructure.
Actions on objectives: stealing data, conducting espionage, disrupting service or causing other impact.
The model encourages layered defense. A malicious email can be blocked during delivery, an exploit can be prevented by patching, installation can be stopped by endpoint controls, command-and-control traffic can be detected, and actions on objectives can be limited through segmentation and access control.
The model has limitations. It is relatively linear, emphasizes malware-oriented intrusions, and may not represent cloud abuse, identity attacks or attacks that use valid credentials without installing software. It should therefore be combined with contemporary behavioral models.
MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on observed behavior. In the Enterprise matrix, tactics describe the adversary’s goal or reason for acting, while techniques describe how that goal may be achieved. Examples include Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact.
A technique might include phishing, exploitation of a public-facing application, valid accounts, scheduled task or job, process discovery, remote services, data from local systems, or data encrypted for impact. Sub-techniques provide additional detail.
ATT&CK is not a compliance checklist and does not predict every attack. It is useful for threat-informed defense: mapping detections to behaviors, identifying visibility gaps, organizing threat intelligence, and testing whether security controls detect relevant techniques. A technique should not be treated as proof of a particular adversary; different actors can use the same technique.
The Cyber Kill Chain and ATT&CK serve different purposes. The Kill Chain gives a concise campaign-level sequence. ATT&CK provides a broader behavioral vocabulary and supports detailed mapping of activity. For example, a phishing email can be described as delivery in the Kill Chain and mapped to an ATT&CK initial-access technique, while the subsequent use of a stolen account can be mapped to valid accounts.
Principal Attack Methods
Malware
Malware is software intentionally designed to perform unauthorized or harmful actions. Important categories include:
Virus: code that attaches to another file or program and commonly requires execution of the host.
Worm: malware that can self-propagate across systems or networks.
Trojan: software that appears legitimate but performs hidden malicious actions.
Ransomware: malware that blocks access to systems or data, commonly through encryption, and demands payment.
Spyware: software that covertly gathers information.
Remote-access trojan: malware that provides unauthorized remote control.
Rootkit: tools designed to hide malicious activity or maintain privileged access.
Bot or botnet malware: software that turns a device into a remotely controlled participant in coordinated activity.
Malware may arrive through attachments, drive-by downloads, malicious advertisements, removable media, exploited vulnerabilities or software updates. Defenses include application control, endpoint detection and response, patching, email filtering, least privilege, network segmentation, tested backups and user awareness. Backups should be isolated sufficiently that an attacker cannot encrypt or delete both production data and recovery copies.
Phishing and related influence attacks
Phishing uses deceptive communications to obtain information, deliver malware or persuade a victim to perform an action. Spear phishing is targeted at a particular person or organization. Whaling targets senior personnel. Smishing uses text messages, while vishing uses voice or telephone communication. Business email compromise often uses impersonation and urgency to redirect payments or obtain sensitive information.
Warning signs include unexpected requests, urgency, secrecy, mismatched domains, unusual payment instructions, suspicious links, requests for authentication codes and appeals to authority. However, grammar and spelling are no longer reliable indicators because messages can be professionally written and generated or translated automatically.
Controls include phishing-resistant multi-factor authentication, email authentication technologies, out-of-band verification of payment changes, safe link handling, reporting mechanisms, secure defaults and training based on realistic scenarios. Security awareness should not blame victims; organizational processes must make fraudulent actions difficult and reversible.
Credential attacks
Credential attacks target passwords, tokens, authentication cookies or other secrets. Common methods include:
Brute force: trying many possible passwords.
Password spraying: trying a small number of common passwords against many accounts.
Credential stuffing: using usernames and passwords exposed in another breach.
Phishing: persuading users to disclose credentials or approve a fraudulent sign-in.
Pass-the-hash or token abuse: using an authentication artifact without recovering the original password.
Keylogging: recording user keystrokes.
Password managers, unique passwords, rate limiting, breached-password screening, adaptive authentication and multi-factor authentication reduce risk. Multi-factor authentication is particularly valuable, but not all factors are equally resistant to phishing. Hardware security keys and passkeys provide stronger resistance than codes that can be relayed or socially engineered.
Social engineering
Social engineering exploits human judgment rather than a software defect. Pretexting creates a false scenario; impersonation relies on a trusted identity; baiting offers an attractive object or file; quid pro quo promises a benefit; and tailgating gains physical access by following an authorized person.
Effective defenses combine training with process controls. Examples include two-person approval for high-value transfers, call-back verification using known contact details, visitor controls, clear escalation routes and a culture in which employees may pause suspicious requests without penalty.
Denial-of-service
A denial-of-service attack attempts to prevent legitimate use of a service. A distributed denial-of-service attack uses many sources, often a botnet, to generate traffic or requests. Attacks may consume bandwidth, overwhelm connection tables, exhaust application resources or target a computationally expensive function.
Defenses include capacity planning, rate limiting, content delivery and scrubbing services, resilient architecture, upstream provider coordination, web application firewalls and incident communication plans. A mitigation that blocks all traffic may preserve availability but damage business operations; response must therefore distinguish legitimate surges from malicious traffic.
Supply-chain attacks
A supply-chain attack compromises a supplier, software dependency, managed service provider, build system or update mechanism so that downstream customers receive malicious or altered functionality. The trusted relationship is the attack path.
Risk reduction includes supplier due diligence, contractual security requirements, software bills of materials where appropriate, signed and verified updates, reproducible or controlled builds, dependency review, network segmentation, least privilege for suppliers, monitoring of administrative activity and an exit or continuity plan. No supplier assurance process eliminates risk; organizations must also monitor what trusted software and partners actually do.
Applied Case: Illustrative Ransomware Incident
Background
A regional manufacturing company uses a cloud email platform, a remote-access service and an external IT provider. Employees receive routine invoices by email. Backups exist, but some are reachable through the same administrative credentials used for production systems.
Problem
An accounts employee receives a convincing message that appears to come from a supplier. The employee signs in to a counterfeit portal. Attackers use the captured credentials, bypass weak second-factor protection, and access a remote service. They discover file servers, disable some security tools, copy selected business documents and encrypt production data.
Analysis
The incident contains several linked behaviors:
phishing and credential theft during initial access;
valid-account use to enter a remote service;
discovery of hosts and shared folders;
privilege escalation through excessive permissions;
lateral movement to file servers;
collection and exfiltration of sensitive documents;
impact through data encryption.
In Kill Chain terms, delivery occurred through email, exploitation was primarily user interaction and credential abuse, installation was limited or replaced by use of legitimate access, command and control occurred through remote infrastructure, and the final objective was extortion and disruption. In ATT&CK terms, the activity can be mapped to phishing, valid accounts, remote services, account discovery, network-service discovery, data from local systems and data encrypted for impact.
Approach and solution
The company isolates affected systems, disables compromised accounts, preserves logs, contacts its incident-response provider, verifies the integrity of backups and communicates with employees and regulators as required. It does not immediately destroy compromised systems because forensic evidence may be needed. Recovery occurs in priority order: identity services, essential production systems, then lower-priority collaboration resources.
After containment, the organization deploys phishing-resistant authentication for administrators, separates backup administration, reduces privileges, restricts remote access, improves email reporting, monitors unusual file access and rehearses recovery. Supplier access is reviewed and contractual notification requirements are clarified.
Outcome and learning points
The company restores critical operations without paying the ransom, although production is interrupted and investigation costs are significant. The case demonstrates that a single deceptive message can become a major incident when identity controls, segmentation, monitoring and backup isolation are weak. It also shows why prevention, detection, response and recovery must operate as a system.
Defensive and Governance Implications
A mature defense uses layered controls:
Preventive controls: secure configuration, patching, MFA, least privilege, segmentation and staff procedures.
Logging should support investigation without collecting unnecessary personal information. Monitoring must comply with applicable privacy, employment and data-protection requirements. Organizations should define retention periods, access restrictions and legitimate purposes for security data.
Artificial intelligence can help summarize alerts, identify unusual behavior, classify messages and accelerate analysis. It can also help attackers create convincing phishing content, discover targets and automate adaptation. AI output requires human validation, protected data handling and controls against prompt injection, model misuse and fabricated conclusions. Automation should not silently disable accounts, delete evidence or make high-impact decisions without suitable authorization.
Ethically, defenders should minimize harm, respect proportionality and avoid retaliatory attacks. Incident response should preserve evidence, protect affected individuals, communicate accurately and coordinate with law enforcement where appropriate. Paying an extortion demand may not restore systems, can encourage further crime and may create legal or sanctions concerns; the decision requires qualified legal, executive and incident-response advice.
Challenges and Limitations
Attack frameworks simplify reality. The same observable behavior may have benign or malicious explanations. A PowerShell command, remote login or database query is not inherently malicious. Detection therefore requires context, identity, timing, authorization and expected behavior.
Attribution remains uncertain, especially when attackers rent infrastructure, use public tools or imitate other groups. Organizations should avoid overconfidence and focus on reducing exposure and impact.
Controls also involve trade-offs. Strict authentication may frustrate users; extensive logging may create privacy and storage burdens; aggressive blocking may interrupt legitimate work. Security decisions should be risk-based, tested and reviewed as systems and threats change.
Best-Practice Checklist
Maintain an accurate inventory of assets, identities, suppliers and exposed services.
Patch internet-facing and high-risk systems promptly using risk-based prioritization.
Require strong, preferably phishing-resistant, MFA for privileged and remote access.
Use unique passwords and screen credentials against known breach data.
Apply least privilege and regularly review dormant accounts and supplier access.
Segment critical systems and protect backup administration separately.
Centralize relevant logs and map important detections to adversary behaviors.
Test phishing reporting, incident response and restoration from backups.
Verify payment and account-change requests through trusted channels.
Treat software and service suppliers as part of the organizational attack surface.
Chapter Summary
Cyber threats arise from diverse actors, including financially motivated criminals, nation-state groups, insiders, hacktivists and automated systems. Their objectives and resources differ, but many attacks exploit the same weaknesses: excessive access, unpatched systems, weak authentication, poor segmentation and misplaced trust.
Malware, phishing, credential attacks, social engineering, denial-of-service and supply-chain attacks should be understood as connected methods within an attack lifecycle. The Cyber Kill Chain provides a high-level sequence for disrupting campaigns, while MITRE ATT&CK offers a detailed behavioral vocabulary for describing tactics and techniques. Neither framework is a complete prediction of every incident.
Effective cybersecurity combines prevention, detection, response and recovery. Strong identity controls, least privilege, secure configuration, resilient backups, supplier oversight, monitoring and practiced incident response reduce both the likelihood and consequences of compromise. Ethical and lawful practice requires proportional monitoring, careful evidence handling, accurate communication and avoidance of retaliatory action.
Key Terms
Threat: A circumstance or actor capable of causing harm.
Vulnerability: A weakness that may be exploited.
Exploit: A method or code that takes advantage of a vulnerability.
Adversary: An actor that intentionally seeks unauthorized access or impact.
Payload: The malicious or unauthorized function delivered by an attack.
Confidentiality: Protection against unauthorized disclosure.
Integrity: Protection against unauthorized alteration.
Availability: Reliable access for authorized users.
Malware: Software designed to perform unauthorized or harmful actions.
Phishing: Deceptive communication intended to obtain information or cause an action.
Credential stuffing: Use of breached credentials against other services.
Social engineering: Manipulation of people to obtain access or information.
Botnet: A group of compromised devices controlled for coordinated activity.
Denial-of-service: An attempt to prevent legitimate service use.
Supply-chain attack: Compromise through a trusted supplier, dependency or update path.
Cyber Kill Chain: A seven-stage model for describing intrusion campaigns.
MITRE ATT&CK: A knowledge base of observed adversary tactics and techniques.
Lateral movement: Movement from one system or account to another after access.
Persistence: Maintaining access over time.
Least privilege: Giving subjects only the access necessary for authorized tasks.
Review Questions
Short Answer Questions
Distinguish a threat, vulnerability and exploit.
Identify three characteristics of nation-state activity.
What is credential stuffing, and how does it differ from brute force?
State two limitations of the Cyber Kill Chain.
Why are isolated and tested backups important in ransomware defense?
Long Answer Questions
Compare cybercriminals, insiders and hacktivists in terms of motivation, methods and defensive priorities.
Explain the seven stages of the Cyber Kill Chain and show how layered controls can disrupt an intrusion.
Explain how MITRE ATT&CK complements, but does not replace, the Cyber Kill Chain.
Discuss the technical and organizational controls that reduce phishing and social-engineering risk.
Describe the security and governance challenges created by supply-chain dependencies.
Analytical / Application Questions
An employee reports a suspicious login notification followed by an urgent request to change a supplier’s bank details. Analyze the likely attack methods and propose immediate and long-term controls.
A company has strong endpoint protection but allows administrators to use shared accounts and stores backups on the production network. Evaluate the likely attack paths and prioritize improvements.
A public website experiences a sudden traffic surge during a controversial event. Develop a reasoned process for distinguishing legitimate demand from denial-of-service activity and selecting a proportionate response.
Multiple Choice Questions with Answers
Question 1
Which adversary category is primarily motivated by financial gain?
A. Cybercriminals
B. Hacktivists
C. Nation-state actors
D. Accidental insiders
Correct Answer: A. Cybercriminals
Question 2
Which attack method uses previously breached username-and-password pairs against another service?
A. Password spraying
B. Credential stuffing
C. Tailgating
D. Data encryption
Correct Answer: B. Credential stuffing
Question 3
What is the main purpose of the Cyber Kill Chain?
A. To calculate the monetary value of an incident
B. To provide a sequence for understanding and disrupting intrusions
C. To replace all vulnerability-scanning tools
D. To identify the legal jurisdiction of an attacker
Correct Answer: B. To provide a sequence for understanding and disrupting intrusions
Question 4
Which MITRE ATT&CK tactic describes learning about hosts, accounts and networks after access?
A. Discovery
B. Impact
C. Exfiltration
D. Initial Access
Correct Answer: A. Discovery
Question 5
Which control provides the strongest general resistance to phishing-based theft of authentication codes?
A. A longer single-factor password
B. A hardware security key or passkey
C. A public username
D. A shared administrator account
Correct Answer: B. A hardware security key or passkey
Question 6
What distinguishes a worm from a typical virus?
A. A worm can self-propagate across systems or networks
B. A worm is always harmless
C. A worm only affects printed documents
D. A worm cannot execute code
Correct Answer: A. A worm can self-propagate across systems or networks
Question 7
A distributed denial-of-service attack primarily attempts to compromise which CIA objective?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Correct Answer: C. Availability
Question 8
Which situation is an example of a supply-chain attack?
A. An employee forgets a password
B. A compromised software update delivers malicious code to customers
C. A user locks an account after failed logins
D. A firewall blocks an unauthorized port
Correct Answer: B. A compromised software update delivers malicious code to customers
Question 9
Why is least privilege valuable during an intrusion?
A. It guarantees that phishing cannot occur
B. It limits what a compromised account can access or change
C. It eliminates the need for backups
D. It makes all software automatically trustworthy
Correct Answer: B. It limits what a compromised account can access or change
Question 10
In the illustrative ransomware case, which combination best describes the attack progression?
A. Phishing, valid-account use, discovery, lateral movement and encryption
B. Physical theft, weather damage and hardware replacement
C. DDoS, website defacement and public protest only
D. Password creation, software licensing and routine patching
Correct Answer: A. Phishing, valid-account use, discovery, lateral movement and encryption