Threat Landscape, Adversaries and Attack Models

Introduction

Cybersecurity is not merely the protection of computers from viruses. It is the systematic management of hostile activity directed against people, information, applications, devices, networks, cloud services and organisations. A threat landscape describes the changing collection of threats, vulnerabilities, adversaries, technologies and environmental conditions that influence cyber risk. Understanding this landscape enables security professionals to move from reactive incident handling to informed prevention, detection and response.

Modern attacks are frequently multi-stage. An adversary may research an organisation, obtain credentials through phishing, enter through a remote service, escalate privileges, move laterally, steal data and then deploy ransomware. Different actors may perform different stages, and legitimate administrative tools may be used to conceal malicious activity. Consequently, classifying an attack only by its visible malware is inadequate. Analysts must also examine the actor’s motive, capability, opportunity, behaviour and position within an attack lifecycle.

This chapter introduces major threat categories and explains three complementary analytical approaches: the attack lifecycle, the Cyber Kill Chain and MITRE ATT&CK. These frameworks are not competing descriptions of reality. They operate at different levels of abstraction and should be used together.

Learning objectives

By the end of this chapter, students should be able to:

• classify malware, ransomware, phishing, social engineering, insider threats, supply-chain attacks, denial-of-service and advanced persistent threats;
• distinguish adversaries by motive, capability, resources and behaviour;
• explain the stages of a generic attack lifecycle;
• apply the Cyber Kill Chain to analyse and disrupt an intrusion;
• use MITRE ATT&CK terminology to map adversary tactics and techniques;
• evaluate the limitations and ethical implications of threat models; and
• recommend practical controls for prevention, detection, response and recovery.

1. The contemporary threat landscape

A threat is a potential cause of harm. A vulnerability is a weakness that can be exploited. A threat actor is an individual or group capable of exploiting a vulnerability, while risk combines the likelihood of an adverse event with its potential impact. These concepts should not be treated as synonyms. A vulnerability can exist without being exploited; an attempted attack can fail; and a serious incident can occur even when no software vulnerability is involved, such as when an employee discloses confidential information by mistake.

The threat landscape is shaped by several trends:

1. Digital dependency. Organisations rely on identity providers, cloud platforms, managed service providers, software repositories, mobile devices and interconnected operational technology.
2. Crime-as-a-service. Criminal groups can rent botnets, phishing infrastructure, stolen credentials and ransomware affiliates, reducing the expertise required to attack.
3. Identity-centred attacks. Password theft, session-token theft, consent abuse and social engineering frequently bypass traditional network boundaries.
4. Convergence of physical and cyber risk. A compromised account may enable access to buildings, industrial processes or safety systems.
5. Automation and artificial intelligence. Automation allows defenders to correlate events at scale, but also helps attackers generate convincing messages, discover exposed systems and adapt campaigns. AI output must therefore be treated as untrusted and verified.
6. Third-party concentration. A single technology provider can connect thousands of customers, creating systemic supply-chain exposure.

Security analysis begins with a clear asset and trust-boundary picture. Important questions include: What must be protected? Who is allowed to access it? Which suppliers can change it? Which identities have administrative authority? Which services are exposed to the internet? What evidence would demonstrate compromise?

2. Major categories of cyber threat

2.1 Malware

Malware is software intentionally designed to compromise confidentiality, integrity or availability. A single sample may have several functions, so categories overlap.

• Virus: malicious code that attaches to a host file and generally requires execution of that host to replicate.
• Worm: self-propagating malware that spreads across systems or networks, often by exploiting vulnerabilities or weak credentials.
• Trojan: software that appears legitimate but performs hidden malicious actions. Unlike a worm, it does not necessarily self-propagate.
• RAT (remote access trojan): malware that provides an attacker with covert remote control.
• Spyware and infostealers: tools that collect credentials, browser data, keystrokes or other information.
• Rootkit: mechanisms designed to conceal malicious processes, files or persistence, often at a privileged level.
• Botnet malware: code that enrols devices into an attacker-controlled network used for spam, fraud, scanning or denial-of-service.
• Wiper: destructive malware intended to erase or corrupt data and systems rather than obtain continuing access.

The distinction between malware families and behaviours is important. A file may be classified as a trojan by its delivery method but exhibit ransomware behaviour by encrypting data. Detection should therefore examine execution, persistence, privilege use, communication and impact rather than rely only on a name assigned by a vendor.

2.2 Ransomware

Ransomware denies access to systems or data, usually by encryption, and demands payment. Contemporary operations often use double extortion: the attacker both encrypts data and threatens public disclosure. Some groups add data theft, harassment, distributed denial-of-service or attacks on backup systems.

A ransomware intrusion commonly includes initial access, privilege escalation, lateral movement, data collection, backup disruption, encryption and extortion. Not every incident uses malware: attackers may use legitimate remote administration tools and manually execute encryption. Important controls include phishing-resistant multifactor authentication, least privilege, network segmentation, tested offline or immutable backups, endpoint detection, rapid patching and rehearsed recovery procedures.

Payment is a business and ethical decision, not a technical remedy. It does not guarantee decryption, confidentiality or future safety and may create legal, sanctions or public-interest concerns. Organisations should involve legal, executive, law-enforcement, insurance and incident-response stakeholders.

2.3 Phishing and social engineering

Phishing uses deceptive electronic communication to induce a victim to click, disclose information, approve access or transfer money. Forms include:

• spear phishing, directed at a named person or organisation;
• whaling, directed at senior executives;
• business email compromise, often involving payment or invoice fraud;
• smishing through text messages; and
• vishing through voice calls or synthetic audio.

Social engineering is broader than phishing. It exploits human trust, authority, urgency, fear, curiosity or helpfulness. Examples include impersonating technical support, following an employee through a secure door, persuading a help desk to reset an account, or placing a malicious USB device where it will be found.

Effective defence combines technology and organisational design. Email authentication, safe-link analysis and attachment sandboxing are useful, but they cannot solve every problem. Strong identity proofing, independent payment verification, clear reporting channels, realistic awareness training and a culture that does not punish early reporting are equally important. Training should measure behaviour and reporting quality rather than simply test memory.

2.4 Insider threats

An insider is a person with authorised access, such as an employee, contractor, partner or administrator. An insider threat may be:

• malicious, involving intentional theft, sabotage or fraud;
• negligent, involving unsafe behaviour such as misdirected email or insecure storage; or
• compromised, where an attacker controls a legitimate insider account or device.

Insider-risk programmes must balance security with privacy, employment law and proportionality. Useful measures include role-based access, separation of duties, joiner–mover–leaver processes, privileged-access management, data-loss prevention and carefully governed behavioural indicators. Monitoring should be purpose-limited, transparent where required and reviewed for bias. A suspicious event is not proof of malicious intent.

2.5 Supply-chain attacks

A supply-chain attack compromises a supplier, dependency, update mechanism, development pipeline or service provider in order to reach downstream victims. The affected component may be software, hardware, firmware, data, a managed service or a human process.

Examples include malicious code inserted into a software build, a compromised package repository, stolen signing keys, a vulnerable managed service, counterfeit hardware or a supplier’s exposed credentials. Supply-chain risk is difficult because trust is transitive: an organisation may trust its supplier, while the supplier trusts several other dependencies.

Controls include supplier due diligence, contractual security requirements, software bills of materials, signed and reproducible builds where feasible, dependency pinning and scanning, privileged vendor access, segmentation, independent verification of updates, vulnerability disclosure processes and an inventory of critical dependencies. No single certification proves that a supplier is safe; assurance must be continuous and risk-based.

2.6 Denial-of-service

A denial-of-service (DoS) attack attempts to reduce or eliminate availability. A distributed denial-of-service (DDoS) attack uses many sources, commonly a botnet or abused infrastructure. Attacks may exhaust bandwidth, connection tables, application threads, CPU, memory or a costly backend function. Application-layer attacks can be effective even when network bandwidth is not saturated.

Defence depends on the resource being exhausted. Measures include rate limiting, caching, autoscaling with safeguards, resilient architecture, upstream filtering, content-delivery networks, anycast distribution, service isolation and an incident runbook. Availability planning must consider legitimate traffic surges as well as malicious traffic. A control that blocks too broadly can itself create an availability failure.

2.7 Advanced persistent threats

An advanced persistent threat (APT) is a sustained campaign in which an adversary with significant capability seeks durable access to a selected target. “Advanced” does not mean that every tool is novel; an APT may use ordinary credentials and administration utilities. “Persistent” refers to the campaign’s determination and maintenance of access, not necessarily continuous connection.

APT analysis focuses on objectives, infrastructure, victimology, operational security, persistence mechanisms and repeated behaviour. Nation-state intelligence collection, strategic disruption and long-term espionage are common motives, although labels should be evidence-based. Defenders should avoid assuming that attribution is certain merely because a tool or technique resembles a known group.

3. Adversaries: motive, capability and behaviour

Threat actors are best understood through multiple dimensions rather than stereotypes. Common categories include:

Useful analytical questions are:

• Motive: What outcome would benefit the actor—money, intelligence, disruption, reputation or personal satisfaction?
• Capability: Does the actor possess exploit knowledge, infrastructure, funding, access and operational skill?
• Intent: Is the activity deliberate, opportunistic or accidental?
• Opportunity: What exposed systems, identities, suppliers or human relationships are available?
• Risk tolerance: Will the actor accept noisy activity, or does it require stealth?
• Behaviour: Does the actor reuse infrastructure, favour particular credentials, operate at certain times or repeatedly target a sector?

Attribution is an analytic judgement with uncertainty. Technical indicators can be copied, infrastructure can be rented and false flags can be planted. A responsible report distinguishes observed facts, assessed inferences and confidence levels.

4. Attack lifecycle analysis

An attack lifecycle represents an intrusion as a sequence of activities. A practical lifecycle is:

1. Reconnaissance: identifying people, domains, technologies, suppliers and exposed services.
2. Preparation and weaponisation: obtaining credentials, developing or selecting malware, registering infrastructure or preparing a malicious document.
3. Initial access: phishing, exploitation of a public-facing application, valid accounts, removable media or supply-chain compromise.
4. Execution: running code or commands in the target environment.
5. Persistence: maintaining access through accounts, scheduled tasks, services, web shells, tokens or other mechanisms.
6. Privilege escalation and defence evasion: obtaining greater rights and reducing the chance of detection.
7. Discovery and lateral movement: learning about hosts, accounts and shares, then reaching additional systems.
8. Collection and command and control: gathering data and communicating with attacker infrastructure.
9. Actions on objectives: theft, fraud, espionage, extortion, destruction or disruption.
10. Response and recovery: detection, containment, eradication, restoration and lessons learned.

The lifecycle is not always linear. Attackers can revisit stages, defenders can interrupt them, and multiple intrusions may overlap. Its practical value is that it encourages layered controls. For example, a phishing-resistant authenticator may prevent initial access, endpoint telemetry may detect execution, segmentation may limit lateral movement, and immutable backups may reduce the impact of encryption.

5. The Cyber Kill Chain

Lockheed Martin’s Cyber Kill Chain describes seven phases:

1. reconnaissance;
2. weaponisation;
3. delivery;
4. exploitation;
5. installation;
6. command and control; and
7. actions on objectives.

The model is useful for communicating an intrusion and identifying points of disruption. If a malicious document is blocked at delivery, exploitation does not occur. If a compromised endpoint cannot communicate with command-and-control infrastructure, installation may have limited value.

However, the model has limitations. It was developed primarily for intrusion campaigns and can underrepresent credential abuse, cloud-native attacks, insider activity, living-off-the-land techniques and repeated identity attacks. Some phases occur outside the defender’s visibility, and modern campaigns may begin with valid access rather than weaponisation. The Kill Chain should therefore be used as a high-level narrative, not as a complete taxonomy.

6. MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on observed behaviour. Tactics describe the adversary’s goal or “why”; techniques describe “how” that goal is pursued. Sub-techniques provide additional detail. Enterprise ATT&CK covers environments such as Windows, Linux, macOS, cloud and identity systems, while other matrices address mobile and operational technology.

Examples of tactics include Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. A technique might involve phishing, valid accounts, scheduled task/job, remote services, credential dumping or data encrypted for impact.

ATT&CK supports:

• mapping observed behaviours from an incident;
• designing detection rules and threat-hunting hypotheses;
• measuring coverage across tactics and techniques;
• building adversary emulation exercises; and
• communicating between analysts, engineers and managers.

A coverage matrix is not a security score by itself. Detecting a technique is not equivalent to preventing it, and a tool claiming coverage may generate weak or unactionable alerts. Teams should record the data source, analytic logic, expected fidelity, response action and testing evidence for each detection.

Integrating the models

The lifecycle explains progression, the Kill Chain provides a concise disruption narrative, and ATT&CK provides behavioural detail. An analyst might write: “The actor gained initial access through spear phishing, executed a user-launched file, established persistence through a scheduled task, used valid accounts for lateral movement and encrypted shared data.” The first description maps naturally to lifecycle and Kill Chain stages; the individual behaviours can be mapped to ATT&CK techniques and detections.

7. Applied case: illustrative healthcare ransomware incident

Background

This fictional scenario concerns Northbridge Health, a regional healthcare provider. Its environment includes a cloud identity service, electronic health records, diagnostic devices, a billing platform and a managed security provider. Remote access is available to staff and selected vendors.

Problem

A finance employee receives a convincing invoice email and enters credentials into a fraudulent cloud sign-in page. The account lacks phishing-resistant multifactor authentication. Two days later, an attacker uses the credentials to access remote services, discovers an inadequately protected service account and moves into a file server. Backups are reachable from the production network. The attacker copies patient and billing data, disables selected backup jobs and deploys ransomware overnight.

Analysis

The actor’s motive is financially driven extortion. The campaign is not necessarily an APT: it is targeted and multi-stage, but its persistence and capability must be established from evidence rather than assumed.

Approach and solution

The response team first isolates affected systems while preserving forensic evidence. It disables compromised identities, revokes sessions, blocks known malicious infrastructure and verifies that containment does not interrupt critical clinical functions. Legal and privacy teams assess notification duties, while clinical leadership prioritises patient safety.

Recovery proceeds from clean, offline or immutable backups after the organisation establishes a trusted identity and endpoint baseline. All privileged credentials are rotated, remote access is reduced, service accounts are redesigned, and vendor access is time-limited. The organisation then implements phishing-resistant MFA, network segmentation, centralised logging, tested restoration procedures and exercises involving clinical operations.

Outcome and learning points

The incident demonstrates that a single phishing event became severe because of weak identity assurance, excessive privilege, exposed remote services and connected backups. Malware prevention alone would not have been sufficient. The most important lessons are to protect identity, limit blast radius, monitor behaviour, preserve recovery independence and treat cybersecurity as a safety and governance responsibility in healthcare.

8. Defensive practice and governance

A mature threat-management programme aligns controls with business impact. Priority practices include:

• maintain inventories of assets, identities, software and suppliers;
• apply secure configuration and risk-based vulnerability management;
• require strong, preferably phishing-resistant, authentication for sensitive access;
• use least privilege, separation of duties and privileged-access management;
• segment networks and cloud accounts according to trust and impact;
• collect high-quality identity, endpoint, network and cloud telemetry;
• test detections and incident-response playbooks through exercises;
• protect backups from ordinary administrative compromise;
• establish supplier-security requirements and incident-notification processes; and
• measure restoration capability, not merely prevention activity.

Governance requires clearly assigned ownership, risk acceptance by accountable leaders, evidence-based assurance and regular review. Regulatory obligations vary by jurisdiction and sector, but commonly include privacy protection, breach notification, records management, critical-infrastructure resilience and third-party oversight. Organisations should seek legal advice rather than treating a technical framework as a substitute for law.

Ethically, defenders must minimise unnecessary collection of personal data, avoid discriminatory profiling, protect whistle-blowers and use testing authority responsibly. Threat intelligence should not become uncontrolled surveillance, and offensive security exercises require explicit scope, authorisation and safeguards.

9. Limitations and contemporary developments

Threat models simplify complex events. A framework can create false confidence if analysts force evidence into categories, ignore unsuccessful attacks or count controls without testing them. ATT&CK entries and threat reports also reflect available observations, which may overrepresent well-resourced or publicly studied actors. Cloud services, identity tokens, APIs, software dependencies and operational technology require context-specific analysis.

Artificial intelligence increases the scale and quality of both phishing and defensive triage. It can help summarise logs, generate detection hypotheses and identify unusual relationships, but it may hallucinate facts, reproduce bias or expose sensitive information. Human validation, data governance, access controls and auditability remain essential.

The strongest programmes therefore combine models with evidence: tested controls, reliable telemetry, realistic exercises, secure architecture and learning after incidents. The purpose of classification is not to assign a fashionable label; it is to choose an effective intervention.

Chapter Summary

The threat landscape includes technical, human, organisational and supply-chain sources of risk. Malware, ransomware, phishing, social engineering, insider threats, supply-chain attacks, denial-of-service and APT campaigns differ in mechanism and objective, but frequently overlap in a single intrusion. Adversaries should be assessed through motive, capability, opportunity, intent and behaviour, while attribution should express uncertainty.

The attack lifecycle offers a broad sequence from reconnaissance to impact and recovery. The Cyber Kill Chain gives a concise seven-phase disruption model. MITRE ATT&CK adds detailed, behaviour-based tactics and techniques for detection, hunting and adversary emulation. Used together, these models support layered prevention, detection, containment and recovery. Their limitations require context, evidence and continuous validation. Effective threat management also depends on governance, privacy, legal compliance, supplier assurance, ethical monitoring and resilient recovery.

Key Terms

Threat: A potential cause of harm to an asset or organisation.

Vulnerability: A weakness that can be exploited.

Threat actor: An individual or group capable of conducting harmful cyber activity.

Malware: Software intentionally designed to compromise confidentiality, integrity or availability.

Ransomware: Malware or an operation that denies access to data or systems for extortion.

Phishing: Deceptive communication intended to induce a harmful action or disclosure.

Social engineering: Manipulation of human behaviour to obtain access, information or action.

Insider threat: Harm caused by a malicious, negligent or compromised authorised user.

Supply-chain attack: Compromise of a supplier, dependency or service to reach downstream victims.

Denial-of-service: An attempt to reduce or eliminate service availability.

Advanced persistent threat: A sustained, capable campaign seeking access to a selected target.

Attack lifecycle: A model describing stages of an intrusion and response.

Cyber Kill Chain: A seven-phase model of cyber intrusion activity.

MITRE ATT&CK: A knowledge base of adversary tactics and techniques.

Tactic: An adversary’s strategic objective or reason for an action.

Technique: The method used to achieve an adversary objective.

Lateral movement: Activity used to move from one compromised system or account to another.

Persistence: Methods used to maintain access after an initial compromise.

Defence evasion: Actions intended to avoid detection or security controls.

Blast radius: The scope of systems, data or operations affected by a compromise.

Review Questions

Short Answer Questions

1. Distinguish a vulnerability from a threat and a threat actor.
2. What is the difference between phishing and social engineering?
3. Why are offline or immutable backups important against ransomware?
4. Define a tactic and a technique in MITRE ATT&CK.
5. State two limitations of the Cyber Kill Chain.

Long Answer Questions

1. Compare malware, ransomware and wipers, explaining how their purposes may overlap.
2. Analyse how motive, capability, opportunity and behaviour assist adversary assessment.
3. Explain the stages of a generic attack lifecycle and identify a defensive control for each stage.
4. Compare the lifecycle model, Cyber Kill Chain and MITRE ATT&CK in terms of purpose and level of detail.
5. Discuss the governance, privacy and ethical issues involved in insider-risk monitoring.

Analytical / Application Questions

1. A supplier update introduces suspicious code into an organisation’s network. Classify the threat, map its likely lifecycle stages and recommend five controls.
2. An employee approves an unexpected multifactor-authentication prompt, after which unusual cloud logins occur. Analyse the likely attack path and propose containment, investigation and recovery actions.
3. A company has strong malware detection but shared administrator accounts, flat networking and backups connected to production. Evaluate its ransomware resilience and prioritise improvements.

Multiple Choice Questions with Answers

Question 1

Which characteristic most clearly distinguishes a worm from a traditional virus?

A. A worm is always encrypted.

B. A worm can self-propagate across systems or networks.

C. A worm can only affect mobile devices.

D. A worm requires a host file to execute.

Correct Answer: B. A worm can self-propagate across systems or networks.

Question 2

What is the principal purpose of double extortion in a ransomware operation?

A. To encrypt the attacker’s own backups.

B. To use two unrelated malware families at once.

C. To combine data encryption with threats to disclose stolen data.

D. To attack two organisations in different countries.

Correct Answer: C. To combine data encryption with threats to disclose stolen data.

Question 3

Which example is social engineering but not necessarily phishing?

A. An attacker exploits an unpatched web server.

B. A worm scans network addresses automatically.

C. A person impersonates technical support to persuade a help desk to reset an account.

D. A firewall blocks an unauthorised port.

Correct Answer: C. A person impersonates technical support to persuade a help desk to reset an account.

Question 4

In the Cyber Kill Chain, which phase follows delivery?

A. Exploitation

B. Reconnaissance

C. Actions on objectives

D. Command and control

Correct Answer: A. Exploitation

Question 5

In MITRE ATT&CK, a tactic primarily describes:

A. The adversary’s strategic objective or reason for an action.

B. The brand name of malware used in an incident.

C. The legal penalty for a cybercrime.

D. The exact IP address of an attacker.

Correct Answer: A. The adversary’s strategic objective or reason for an action.

Question 6

Which control most directly reduces the risk of stolen passwords being used for account takeover?

A. Phishing-resistant multifactor authentication

B. Increasing monitor brightness

C. Removing all system logs

D. Using a single shared administrator account

Correct Answer: A. Phishing-resistant multifactor authentication

Question 7

Why can a supply-chain attack have a large downstream impact?

A. Suppliers are never monitored by customers.

B. Trust and software or service dependencies can connect one compromise to many customers.

C. Supply-chain attacks only affect physical warehouses.

D. They cannot be detected after delivery.

Correct Answer: B. Trust and software or service dependencies can connect one compromise to many customers.

Question 8

Which statement about attribution is most accurate?

A. A reused tool proves the identity of the attacker.

B. Attribution is always certain when malware has a distinctive name.

C. Attribution should distinguish observed facts from inferences and express confidence.

D. Attribution is unnecessary in every incident.

Correct Answer: C. Attribution should distinguish observed facts from inferences and express confidence.

Question 9

Which design choice best limits ransomware blast radius?

A. Flat networking with shared administrator credentials

B. Network segmentation and least privilege

C. Backups permanently writable from production systems

D. Disabling endpoint telemetry

Correct Answer: B. Network segmentation and least privilege

Question 10

An attacker steals credentials, discovers file shares, moves to another server and encrypts data. Which activity is the clearest example of lateral movement?

A. Stealing the initial credentials

B. Discovering the organisation’s public website

C. Moving from one compromised host to another server

D. Threatening to publish stolen data

Correct Answer: C. Moving from one compromised host to another server