Threats, Attacks and Adversary Methods

Introduction

Internet and network security begins with understanding how systems are threatened and how attacks are conducted. A vulnerability is a weakness; a threat is a potential cause of harm; and an attack is an intentional action that exploits a weakness. Security professionals must therefore study not only malicious software, but also people, processes, technologies, and relationships that create opportunities for compromise.

Modern attacks rarely depend on a single technique. An adversary may discover an exposed service, obtain a password through phishing, use malware to establish persistence, move through a network, and steal data over an encrypted channel. Effective defence requires a structured view of this sequence. This chapter introduces threat actors, attack surfaces, common attack methods, the attack lifecycle, and the MITRE ATT&CK framework.

Learning Objectives

By the end of this chapter, students should be able to:

• distinguish assets, vulnerabilities, threats, risks, exploits, and attacks;
• classify threat actors and explain their motivations;
• identify major attack surfaces in contemporary networks;
• describe malware, phishing, spoofing, sniffing, scanning, denial-of-service, session, man-in-the-middle, and advanced persistent threat techniques;
• apply a simple attack-lifecycle model to an incident;
• explain how MITRE ATT&CK represents adversary tactics and techniques;
• recommend practical controls for prevention, detection, response, and recovery; and
• evaluate ethical, legal, and governance issues associated with offensive security activity.

1. The Security Threat Landscape

1.1 Fundamental concepts

An asset is something valuable that an organisation seeks to protect, such as data, applications, credentials, hardware, services, reputation, or safety. A vulnerability is a weakness that could be exploited. A threat actor is an individual or group capable of causing harm. A threat is the possibility that a threat actor or event will exploit a vulnerability. An exploit is a method, code, or procedure used to take advantage of a vulnerability.

Risk combines likelihood and impact. In a simple qualitative model, risk rises when an adverse event is more likely or its consequences are more severe. Organisations commonly assess risk using categories such as low, medium, high, and critical rather than pretending that uncertain estimates are precise measurements.

The objectives of information security are often expressed through the CIA triad:

• Confidentiality: information is accessible only to authorised parties.
• Integrity: information remains accurate, complete, and protected from unauthorised alteration.
• Availability: systems and information are accessible when needed.

Attacks may target one or several of these properties. Ransomware can reduce availability and threaten confidentiality through data theft. A forged transaction primarily attacks integrity. Credential theft threatens confidentiality and may provide a route to all three objectives.

1.2 Threat actors

Threat actors differ in capability, resources, motivation, persistence, and legal status. Common categories include:

The distinction between actor categories is not absolute. A criminal group may use techniques associated with state operations, while a state may contract criminal specialists. Attribution is difficult because attackers can use compromised infrastructure, false identities, copied tools, and deliberate deception.

1.3 Attack surface

The attack surface is the collection of reachable points through which an attacker might influence, access, or disrupt an organisation. It includes:

• internet-facing servers, VPN gateways, firewalls, and cloud services;
• web applications, APIs, mobile applications, and databases;
• endpoints, removable media, and employee devices;
• wireless networks, Bluetooth, and Internet of Things devices;
• identities, passwords, tokens, and privileged accounts;
• suppliers, managed service providers, and software dependencies;
• people who can be deceived, coerced, or persuaded; and
• physical facilities, ports, cables, and unattended equipment.

Attack-surface management requires maintaining an accurate inventory, removing unnecessary exposure, applying secure configurations, patching weaknesses, and monitoring changes. A forgotten development server or an abandoned cloud account can be as important as a major production system.

2. Common Attack Methods

2.1 Malware

Malware is software designed to perform unauthorised or harmful actions. Important forms include:

• Virus: code that attaches to a host file and spreads when the host is executed.
• Worm: self-propagating malware that spreads across systems or networks.
• Trojan: malicious software disguised as legitimate software or content.
• Ransomware: malware that blocks access to data or systems, commonly by encryption, and demands payment.
• Spyware: software that secretly collects information.
• Keylogger: a program or device that records keystrokes.
• Rootkit: tools designed to conceal malicious activity and maintain privileged access.
• Botnet malware: software that enrolls devices into a remotely controlled network.
• Fileless malware: malicious activity that relies heavily on memory, scripts, or legitimate administrative tools rather than a conventional executable file.

Malware commonly follows a chain: delivery, execution, persistence, privilege escalation, command and control, action on objectives, and possible evasion. Defences include application control, endpoint detection and response, patching, least privilege, backups, email filtering, network segmentation, and user education. No single antivirus product detects every threat, particularly when attackers use legitimate tools or previously unknown malware.

2.2 Phishing and social engineering

Phishing uses deceptive messages or websites to persuade a victim to reveal information, open a malicious file, approve a login, or transfer money. Variants include:

• Spear phishing: targeted messages based on information about a particular person or organisation.
• Whaling: spear phishing directed at senior executives or high-value individuals.
• Smishing: phishing through SMS or messaging applications.
• Vishing: phishing through voice calls.
• Business email compromise: impersonation or compromise of an email account to influence payments or sensitive decisions.

Social engineering exploits trust, urgency, authority, fear, curiosity, and routine. Technical controls include multifactor authentication, secure email gateways, domain authentication mechanisms, attachment sandboxing, browser protection, and payment-verification procedures. Human awareness training is useful, but it should be supported by system design that makes unsafe actions difficult.

2.3 Spoofing and impersonation

Spoofing occurs when an attacker falsifies an identity or source. Examples include:

• email-address and domain spoofing;
• IP-address spoofing;
• DNS spoofing or manipulation of name resolution;
• ARP spoofing on a local network;
• caller-ID spoofing; and
• fake websites, certificates, or login portals.

Spoofing is often a supporting technique rather than the final objective. For example, a forged email may deliver malware, while ARP spoofing may support traffic interception. Defences include authenticated protocols, certificate validation, DNS security controls, network segmentation, switch protections, and verification through a trusted communication channel.

2.4 Sniffing and traffic interception

Sniffing is the capture and examination of network traffic. On a switched network, an attacker may need a compromised device, a monitoring point, a misconfigured switch, or a local interception technique. Unencrypted protocols can expose credentials, messages, cookies, and business data.

Encryption reduces the value of captured traffic but does not eliminate all risk. Metadata, traffic timing, endpoints, and volumes may remain visible. Secure practice includes current versions of TLS, encrypted administration protocols such as SSH, protected wireless networks, certificate validation, network monitoring, and avoidance of sensitive data in unencrypted protocols.

2.5 Scanning and reconnaissance

Reconnaissance gathers information about a target. Passive reconnaissance uses public sources, while active reconnaissance interacts directly with systems. Scanning may identify live hosts, open ports, software versions, web directories, certificates, or vulnerable services.

Scanning is not automatically malicious: administrators and authorised testers scan systems for inventory and weaknesses. However, unauthorised scanning may violate policy or law and can precede exploitation. Defenders should maintain an external asset inventory, monitor unusual probing, restrict unnecessary services, use secure configurations, and avoid exposing version information unnecessarily.

2.6 Denial-of-service attacks

A denial-of-service (DoS) attack attempts to reduce or eliminate availability. A distributed denial-of-service (DDoS) attack uses many sources, often compromised devices or amplification services. Attacks may exhaust bandwidth, connection tables, CPU, memory, application threads, or database capacity.

Mitigation depends on the layer and scale of the attack. Measures include rate limiting, caching, resilient architecture, filtering, upstream provider assistance, content-delivery networks, load balancing, autoscaling with cost controls, and rehearsed incident procedures. A mitigation service cannot correct an application that is inherently inefficient or vulnerable to a cheap request-exhaustion attack.

2.7 Session attacks

A session is a period during which a user remains authenticated. A session attack attempts to obtain, predict, fix, or misuse a session identifier. Session hijacking occurs when an attacker obtains a valid token. Session fixation occurs when a victim is induced to authenticate using a session identifier known to the attacker.

Controls include secure random session identifiers, HTTPS throughout the session, Secure and HttpOnly cookie attributes, appropriate SameSite settings, session rotation after authentication or privilege changes, short idle and absolute timeouts, logout invalidation, and reauthentication for sensitive actions. Tokens should not be placed in URLs, logs, or unprotected client storage without careful design.

2.8 Man-in-the-middle attacks

A man-in-the-middle (MITM) attack places an adversary between two communicating parties. The attacker may read, alter, delay, or selectively forward messages. Examples include a malicious wireless access point, compromised router, DNS manipulation, or a fraudulent certificate.

End-to-end authenticated encryption is the principal defence. Users and systems must validate certificates and avoid silently accepting warnings. Mutual authentication, secure key management, protected DNS, network segmentation, and monitoring for unexpected routing or certificate changes provide additional protection.

2.9 Advanced persistent threats

An advanced persistent threat (APT) is a sustained campaign in which an adversary uses multiple techniques to maintain access and pursue strategic objectives. “Advanced” does not necessarily mean that every tool is technically sophisticated; it may refer to the actor’s planning, resources, adaptability, and operational discipline. “Persistent” means that the campaign seeks continued access or repeated opportunities.

APT activity may involve initial access through phishing, exploitation of a public-facing application, stolen credentials, or a supplier. The attacker then establishes persistence, escalates privileges, discovers the environment, moves laterally, collects information, and exfiltrates it. Effective defence requires layered controls, threat-informed detection, identity protection, segmentation, rapid patching, and incident response that assumes the possibility of additional compromised accounts or hosts.

3. The Attack Lifecycle

A lifecycle model helps defenders understand an intrusion as a sequence rather than an isolated event. One useful model contains the following stages:

1. Reconnaissance: identify people, systems, technologies, and weaknesses.
2. Weaponisation: prepare malicious files, infrastructure, credentials, or exploit chains.
3. Delivery: send or expose the attack through email, web traffic, removable media, supply chains, or direct network access.
4. Exploitation: trigger a vulnerability or persuade a user to execute an action.
5. Installation: establish malware, accounts, scheduled tasks, services, or other persistence.
6. Command and control: communicate with infrastructure controlled by the adversary.
7. Actions on objectives: steal data, commit fraud, disrupt operations, conduct espionage, or destroy resources.
8. Covering or evasion: delete evidence, alter logs, disguise traffic, or use legitimate tools.

The stages are not always linear. An attacker may repeat reconnaissance after gaining access, or perform several actions concurrently. Defenders can interrupt the lifecycle at every stage. Asset management reduces reconnaissance opportunities; multifactor authentication limits credential abuse; endpoint controls detect installation; egress monitoring identifies command and control; and tested backups support recovery from destructive actions.

4. MITRE ATT&CK

MITRE ATT&CK is a publicly available knowledge base describing adversary behaviour. It organises behaviour into tactics, techniques, and, where relevant, sub-techniques.

• Tactics describe the adversary’s objective, such as Initial Access, Execution, Persistence, Privilege Escalation, Defence Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.
• Techniques describe how an objective may be achieved, such as phishing, valid accounts, scheduled task/job, or remote services.
• Sub-techniques provide more specific descriptions within a technique.
• Procedures are concrete examples of how a group or malware family has used a technique.

ATT&CK is not a complete incident-response procedure and does not itself prove that an organisation is compromised. It is a common vocabulary for threat intelligence, detection engineering, purple teaming, security assessment, and reporting. A security team can map observed events to ATT&CK techniques, identify missing telemetry, and assess whether controls cover important behaviours.

For example, a suspicious email attachment may map to spear phishing under Initial Access; script execution may map to Command and Scripting Interpreter under Execution; credential dumping may map to Credential Access; and copying files to an external service may map to Exfiltration. Analysts should avoid over-mapping: a technique should be recorded only when evidence supports it.

5. Applied Case: Illustrative Health-Clinic Ransomware Incident

Background

The fictional Riverside Health Clinic operates a patient-management application, email system, file server, and remote-access gateway. Staff work partly from home. The clinic has backups, but backup administration uses ordinary user accounts.

Problem

A finance employee receives a convincing message appearing to come from a supplier. The employee opens an attachment and enters credentials into a counterfeit login page. The attacker uses the credentials to access remote services, discovers shared folders, and deploys ransomware during a weekend maintenance period. Some files are encrypted and a copy of patient records is threatened with publication.

Analysis

The incident includes spear phishing, credential theft, valid-account use, remote access, discovery, lateral movement, collection, exfiltration, and impact. The attacker’s success was not caused by one missing product. Contributing weaknesses included inadequate multifactor authentication, excessive privileges, insufficient network segmentation, limited monitoring of unusual logins, and backup accounts that could be reached from ordinary systems.

Approach and solution

The clinic isolates affected systems, disables compromised accounts, preserves logs and forensic images, and contacts its incident-response provider and relevant authorities. It verifies the integrity of backups before restoration. After containment, it enables phishing-resistant multifactor authentication for remote access, separates clinical, administrative, and backup networks, removes unnecessary privileges, deploys endpoint detection, filters executable attachments, and conducts targeted awareness training. It also establishes a process for verifying changes to supplier payment details.

Outcome and learning points

Operations are restored from clean backups, although reporting and patient communication require careful management. The case demonstrates that prevention, detection, response, and recovery must work together. It also illustrates that an incident should be analysed as a chain of behaviours rather than as “a virus problem.”

6. Defensive and Professional Practice

Security controls should be selected according to risk and evidence. Important practices include accurate asset and identity inventories, secure configuration baselines, timely vulnerability management, least privilege, multifactor authentication, segmentation, encryption, centralised logging, tested backups, and incident-response exercises.

Detection must account for normal behaviour. Useful signals include impossible-travel logins, unusual administrative activity, new persistence mechanisms, abnormal data transfers, repeated authentication failures, and unexpected use of scripting tools. Automated analytics and artificial intelligence can help prioritise alerts and identify patterns, but they can produce false positives, inherit biased data, and be manipulated by adversaries. Human validation, explainable procedures, and protected training data remain important.

Ethical, legal, and governance considerations

Security testing must be authorised, scoped, documented, and conducted with safeguards for availability and privacy. Unauthorised scanning, credential use, interception, or malware deployment may breach criminal, civil, telecommunications, privacy, or computer misuse laws. Organisations should follow applicable data-protection and breach-notification requirements, preserve evidence appropriately, and avoid paying extortion demands without legal, regulatory, and risk review.

Responsible vulnerability disclosure gives affected parties sufficient information and time to remediate while avoiding unnecessary exposure. Professionals must protect confidential information encountered during testing and distinguish defensive research from unauthorised intrusion.

7. Challenges and Limitations

No framework captures every attack, and no control guarantees security. Cloud services and supply chains can obscure ownership and responsibility. Encryption can protect legitimate users while also concealing malicious traffic. Multifactor authentication reduces many credential attacks but may be bypassed through session theft, consent abuse, or social engineering. Logs may be incomplete or altered. Attribution remains uncertain, and attackers continuously adapt.

Consequently, security should be treated as a risk-management and resilience discipline. Organisations should assume that some preventive controls will fail, then design detection, containment, recovery, and learning processes that limit harm.

Chapter Summary

Threats arise when actors can exploit weaknesses in valuable assets. The attack surface includes technology, identities, people, suppliers, and physical environments. Malware, phishing, spoofing, sniffing, scanning, denial-of-service, session attacks, MITM attacks, and APT campaigns use different mechanisms but often combine across an intrusion.

The attack lifecycle provides a way to locate opportunities for prevention and detection from reconnaissance through actions on objectives. MITRE ATT&CK supplies a shared language for describing adversary tactics and techniques, supporting threat-informed defence and incident analysis. Effective security combines technical controls, governance, trained personnel, ethical practice, and tested response and recovery.

Key Terms

Asset: Something valuable that requires protection.

Attack surface: All reachable points that may be used to influence, access, or disrupt a system.

Exploit: A method or code that takes advantage of a vulnerability.

Malware: Software designed to perform unauthorised or harmful actions.

Phishing: Deceptive communication intended to manipulate a victim or steal information.

Spoofing: Falsifying an identity, source, or destination.

Sniffing: Capturing and examining network traffic.

Scanning: Probing systems to identify hosts, ports, services, or weaknesses.

Denial of service: An attempt to reduce or prevent legitimate availability.

Session hijacking: Unauthorised use of a valid authenticated session.

Session fixation: Causing a victim to authenticate using an attacker-known session identifier.

Man-in-the-middle attack: Interception and possible alteration of communication between parties.

Threat actor: A person or group capable of causing security harm.

Vulnerability: A weakness that may be exploited.

Advanced persistent threat: A sustained, organised campaign pursuing strategic objectives.

Tactic: An adversary objective in MITRE ATT&CK.

Technique: A method used to achieve an ATT&CK tactic.

Lateral movement: Movement from one compromised system or account to others.

Persistence: Methods used to maintain access after initial compromise.

Exfiltration: Unauthorised removal of data from an environment.

Review Questions

Short Answer Questions

1. Distinguish a threat, vulnerability, exploit, and attack.
2. What are the three objectives of the CIA triad?
3. Explain the difference between phishing, spear phishing, and whaling.
4. What is the purpose of network scanning?
5. Define a man-in-the-middle attack.

Long Answer Questions

1. Describe five categories of threat actor and compare their motivations and capabilities.
2. Explain how ransomware may progress through an attack lifecycle.
3. Discuss technical and procedural controls for protecting authenticated sessions.
4. Explain the role of MITRE ATT&CK in detection engineering and incident response.
5. Discuss why layered defence is necessary against advanced persistent threats.

Analytical / Application Questions

1. A company observes repeated failed logins followed by a successful login from an unfamiliar country, creation of a new administrator account, and large outbound transfers. Map these observations to likely attack-lifecycle stages and recommend immediate actions.
2. A university’s public web server is scanned repeatedly, but no exploitation is observed. Explain how the university should assess the activity, what evidence it should collect, and which preventive controls it should review.
3. Design a concise security-improvement plan for the health-clinic case. Prioritise three controls and justify the order using likely attack paths and business impact.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from an exploit?

A. A vulnerability is a weakness; an exploit is a method used to take advantage of it.

B. A vulnerability is always malware; an exploit is always a password.

C. A vulnerability is an attacker; an exploit is the victim.

D. A vulnerability affects availability only; an exploit affects confidentiality only.

Correct Answer: A. A vulnerability is a weakness; an exploit is a method used to take advantage of it.

Question 2

Which attack attempts to use a victim’s authenticated session without obtaining the password?

A. DNS reconnaissance

B. Session hijacking

C. Data destruction

D. Port scanning

Correct Answer: B. Session hijacking

Question 3

Which MITRE ATT&CK element describes an adversary’s objective, such as Persistence or Lateral Movement?

A. Procedure

B. Indicator

C. Tactic

D. Vulnerability

Correct Answer: C. Tactic

Question 4

A message targeted at a particular finance manager and designed to steal credentials is best classified as:

A. Spear phishing

B. Network sniffing

C. DDoS

D. Wardriving

Correct Answer: A. Spear phishing

Question 5

What is the primary security benefit of end-to-end authenticated encryption against a MITM attack?

A. It guarantees that systems cannot be scanned.

B. It helps ensure confidentiality and verifies communicating parties.

C. It prevents all denial-of-service attacks.

D. It removes the need for access control.

Correct Answer: B. It helps ensure confidentiality and verifies communicating parties.

Question 6

Which activity is most closely associated with reconnaissance?

A. Identifying exposed services and software versions

B. Encrypting files for extortion

C. Restoring systems from backups

D. Rotating a session token after login

Correct Answer: A. Identifying exposed services and software versions

Question 7

Which control most directly limits the impact of a compromised ordinary user account?

A. Least privilege and network segmentation

B. Publishing software versions

C. Disabling all system logs

D. Using shared administrator accounts

Correct Answer: A. Least privilege and network segmentation

Question 8

An attacker uses many compromised devices to overwhelm an organisation’s internet connection. This is primarily a:

A. DDoS attack

B. Session fixation attack

C. Credential-dumping attack

D. Supply-chain audit

Correct Answer: A. DDoS attack

Question 9

Why is an APT described as persistent?

A. It uses only permanent hardware implants.

B. It seeks continued access or repeated opportunities to achieve strategic objectives.

C. It can never be detected.

D. It affects only government networks.

Correct Answer: B. It seeks continued access or repeated opportunities to achieve strategic objectives.

Question 10

Which practice is most appropriate before conducting an authorised penetration test?

A. Begin scanning without informing anyone

B. Obtain written authorisation and define scope and safeguards

C. Use real destructive malware to test backups

D. Publish discovered credentials immediately

Correct Answer: B. Obtain written authorisation and define scope and safeguards