Threat Actors, Malware and Attack Techniques

Introduction

Network security is concerned not only with devices, protocols and controls, but also with the people and organisations that attempt to misuse them. A network may be attacked to steal information, disrupt services, obtain money, influence public opinion, conduct espionage or demonstrate technical ability. Effective security therefore requires an understanding of both who conducts attacks and how attacks are performed.

This chapter examines major threat actors, common malware types and attack techniques encountered in computer networks. It focuses on the conceptual and practical knowledge required by network technicians and security support personnel. The aim is not to teach unauthorised intrusion, but to help professionals recognise attack patterns, reduce exposure, preserve evidence and select appropriate defensive controls.

Learning Objectives

By the end of this chapter, the learner should be able to:

• distinguish among cybercriminal, insider, state-sponsored and hacktivist threats;
• explain the purpose and behaviour of common malware categories;
• identify phishing, spoofing, sniffing, scanning, password attacks, denial-of-service, session hijacking and man-in-the-middle attacks;
• relate attacks to confidentiality, integrity and availability;
• recognise indicators of compromise and select suitable preventive and detective controls;
• analyse a realistic network-security incident and recommend a proportionate response;
• discuss ethical, legal and governance responsibilities in handling cyber threats.

1. The Threat Landscape

A threat is a potential cause of harm. A vulnerability is a weakness that can be exploited. An attack is an intentional attempt to exploit a vulnerability, while risk is the possibility that a threat will exploit a vulnerability and cause a harmful impact. Risk is influenced by likelihood, consequence, exposure and the effectiveness of existing controls.

A useful security model is the CIA triad:

• Confidentiality: information is accessible only to authorised people or systems.
• Integrity: information and systems remain accurate, complete and trustworthy.
• Availability: authorised users can access systems and information when required.

One attack may affect all three properties. For example, ransomware can deny availability by encrypting files, threaten confidentiality through data theft and damage integrity by altering systems or records.

1.1 Attack surfaces and attack vectors

The attack surface is the collection of points through which an attacker might gain access or influence a system. It includes internet-facing servers, wireless networks, endpoints, cloud services, applications, user accounts, removable media and third-party connections.

An attack vector is the route or method used to reach a target. Examples include a malicious email attachment, a stolen password, an unpatched web server, a rogue wireless access point or a compromised supplier.

Security professionals often analyse an incident as a sequence rather than as one isolated event. A simplified sequence is:

Figure: A simplified attack progression showing that defensive controls are useful at every stage.

2. Major Threat Actors

Threat actors differ in motivation, resources, access and tolerance for risk. These categories overlap; an individual may act for financial gain while using tools developed by a state-sponsored group, and an insider may be recruited by a criminal organisation.

2.1 Cybercriminals

Cybercriminals conduct illegal activity primarily for financial benefit. Their activities include credential theft, payment-card fraud, ransomware, business email compromise, extortion and the sale of stolen data. Some operate independently, while others participate in organised groups using a criminal service economy. For example, malware, stolen credentials and infrastructure may be rented to less-skilled criminals.

Cybercriminals commonly prefer scalable attacks. A mass phishing campaign can target thousands of users at low cost. Ransomware operators may first steal sensitive data and then threaten publication if payment is not made. The use of cryptocurrency can complicate, but does not eliminate, financial tracing.

Defensive priorities include multi-factor authentication (MFA), secure backups, endpoint protection, email filtering, payment-verification procedures, least privilege and rapid patching.

2.2 Insiders

An insider is a person with legitimate organisational access who uses that access in a harmful or unauthorised way. Insiders may be:

• malicious, acting deliberately for revenge, profit or ideology;
• negligent, exposing information through carelessness or poor practice;
• compromised, where an attacker controls the insider’s account or device.

Insider risk is difficult because normal access can resemble legitimate work. Warning signs may include unusual downloads, access outside a person’s role, repeated policy violations, unexplained use of removable media or attempts to bypass monitoring. These indicators are not proof of wrongdoing and must be handled fairly.

Controls include role-based access control, separation of duties, privileged-access management, logging, data-loss prevention, staff training and carefully governed joiner–mover–leaver processes. Monitoring must be proportionate and consistent with employment, privacy and data-protection law.

2.3 State-sponsored actors

State-sponsored or state-aligned groups may conduct espionage, intellectual-property theft, military preparation, political influence or disruption of critical infrastructure. They may possess substantial funding, specialist personnel, custom tools and patience. Their campaigns can remain undetected for long periods and may target government, defence, telecommunications, energy, transport, health and research organisations.

A state actor may exploit a trusted supplier, compromise a widely used software component or use previously unknown vulnerabilities. Defenders should therefore apply defence in depth: asset inventories, network segmentation, identity protection, vulnerability management, secure configuration, centralised logging and tested recovery plans.

Attribution is technically and politically difficult. Similar tools may be copied, infrastructure may be deliberately misleading and evidence may be incomplete. Organisations should focus first on containment and protection rather than making premature public attribution claims.

2.4 Hacktivists

Hacktivists use cyber operations to promote political, social or ideological causes. Typical actions include website defacement, distributed denial-of-service, data leaks and public exposure of organisations viewed as hostile to their cause. Their capabilities range from simple public tools to more organised operations.

Although motivation may be ideological rather than financial, the effects can be serious. A defaced website can damage public trust, while a data leak can expose individuals to identity theft. Organisations should protect public-facing services, maintain communication plans, monitor reputational channels and ensure that public statements are accurate and non-inflammatory.

2.5 Other relevant actors

Other categories include script kiddies, who use existing tools with limited understanding; insiders’ accidental actions, such as sending a file to the wrong recipient; competitors conducting industrial espionage; and botnet operators, who control collections of compromised devices. Threat intelligence should consider capability, opportunity, motivation and likely target rather than relying only on labels.

3. Malware

Malware is software designed to perform unauthorised or harmful actions. It may steal information, provide remote control, damage data, evade detection or use a system to attack others. Malware can arrive through email, downloads, compromised websites, removable media, supply chains or exploited services.

A virus normally requires a host file or user action, whereas a worm is designed to spread independently. A Trojan is defined by deception rather than by its method of propagation. These distinctions are useful, but modern malware may combine several characteristics.

3.1 Malware lifecycle and indicators

A typical malware operation involves delivery, execution, persistence, command and control, and objectives. Indicators may include unexpected processes, disabled security software, unusual outbound connections, new administrator accounts, encrypted files, changed browser settings, repeated authentication failures and unexplained system slowdowns.

Detection may be signature-based, identifying known code patterns; heuristic, identifying suspicious characteristics; or behavioural, identifying actions that are abnormal in context. No method is perfect. Signatures can miss new variants, while behavioural systems can produce false positives. Effective security combines endpoint detection and response, network monitoring, vulnerability management and human investigation.

4. Social Engineering and Phishing

Social engineering manipulates people rather than directly attacking technology. It exploits trust, urgency, authority, fear, curiosity or helpfulness.

Phishing uses deceptive electronic communication to persuade a target to reveal information, open content, transfer money or visit a malicious site. Variants include:

• spear phishing, directed at a particular person or organisation;
• whaling, targeting senior executives or high-value individuals;
• smishing, delivered by text message;
• vishing, delivered by voice communication;
• business email compromise, in which an attacker impersonates an executive, supplier or employee to influence a payment or disclosure.

Common warning signs are unexpected urgency, mismatched domains, requests to bypass normal procedures, unfamiliar attachments, unusual payment instructions and links whose displayed text does not match the destination. However, grammar and spelling are no longer reliable indicators because attackers can produce polished messages.

Controls include phishing-resistant MFA where feasible, email authentication and filtering, secure payment approval, user reporting mechanisms, browser protection, staff exercises and verification through an independent communication channel. Training should develop safe behaviour rather than blame victims.

5. Spoofing and Impersonation

Spoofing occurs when an attacker falsifies an identity, address or source so that communication appears trustworthy. Examples include:

• email-address or domain spoofing;
• IP-address spoofing;
• caller-ID spoofing;
• DNS or website spoofing;
• MAC-address spoofing;
• biometric or document impersonation.

Spoofing is often a component of another attack, such as phishing or man-in-the-middle activity. Technical controls may include SPF, DKIM and DMARC for email-domain protection, DNS security mechanisms, certificate validation, ingress and egress filtering, secure network configuration and strong identity verification.

No single email-authentication mechanism proves that a message is safe. A correctly authenticated account may itself be compromised. Users and organisations should therefore evaluate the request, context and consequences as well as the apparent sender.

6. Sniffing and Traffic Analysis

Sniffing is the capture and examination of network traffic. In a properly configured switched network, a normal endpoint generally sees traffic addressed to it, broadcast traffic and selected control traffic. Attackers may nevertheless capture traffic through an open wireless network, a compromised device, a misconfigured switch, a monitoring-port abuse or an interception position.

Passive sniffing observes traffic without altering it. Active sniffing attempts to influence traffic flows, for example by manipulating local network resolution or switching behaviour. Unencrypted protocols can expose credentials, session tokens, messages and metadata. Even encrypted traffic may reveal timing, volume and communicating endpoints.

Defensive measures include modern wireless encryption, secure transport protocols such as TLS, virtual private networks where appropriate, network segmentation, switch security, certificate validation and avoidance of legacy clear-text protocols. Encryption protects content but does not automatically conceal all traffic patterns or guarantee endpoint trust.

7. Scanning and Reconnaissance

Reconnaissance gathers information about a target. Scanning is the systematic examination of hosts, ports, services, versions or weaknesses. Administrators use authorised scanning to inventory assets and identify vulnerabilities; attackers use similar activity to select targets.

Types include host discovery, port scanning, service identification, vulnerability scanning, web-application discovery and passive collection from public sources. Scanning can generate alerts through repeated connection attempts, unusual source addresses, sequential port access or requests for uncommon services.

A professional scanning programme must have written authorisation, defined scope, timing, safety limits and a process for reporting results. Unauthorised scanning may violate policy or law even when no system is damaged. Defenders should maintain an accurate asset inventory, close unnecessary services, patch exposed systems, use firewalls and investigate unexpected scanning patterns.

8. Password and Credential Attacks

Passwords are targeted because they are often reused, predictable or exposed through phishing and breaches. Common attacks include:

• brute force, systematically trying combinations;
• dictionary attack, trying likely words and phrases;
• password spraying, trying a small number of common passwords against many accounts;
• credential stuffing, using username–password pairs stolen from another service;
• offline cracking, testing guesses against a stolen password database;
• keylogging and phishing, capturing credentials during use.

Password storage must use a slow, salted, adaptive password-hashing function rather than reversible encryption or plain text. A salt is a unique random value stored with each password hash; it prevents identical passwords from producing identical stored values and defeats many precomputed tables. Password managers, long unique passphrases, MFA, login throttling, breached-password screening and monitoring for unusual logins reduce risk.

MFA improves security because an attacker needs more than a password. It is not equally strong in every form: possession codes can be intercepted or socially engineered, while phishing-resistant methods provide stronger protection.

9. Denial-of-Service Attacks

A denial-of-service (DoS) attack attempts to make a service unavailable. A distributed denial-of-service (DDoS) attack uses many sources, often compromised devices in a botnet. Attacks may consume bandwidth, exhaust connection tables, overload CPU or memory, or trigger expensive application operations.

Defensive design includes capacity planning, rate limiting, traffic filtering, content delivery and scrubbing services, redundant architecture, caching, autoscaling where appropriate, resilient DNS and a tested incident response plan. Application-layer attacks may resemble legitimate requests, so volume alone is not a complete detection criterion.

Availability controls must be balanced against legitimate access. Overly aggressive filtering can block customers, emergency services or remote staff. Organisations should define service priorities and communicate with upstream providers before a crisis occurs.

10. Session Hijacking

A session represents an authenticated interaction between a client and a service. A session hijacking attack occurs when an attacker obtains or takes over a valid session identifier, allowing access without directly knowing the password.

Session identifiers may be exposed through unencrypted traffic, malware, cross-site scripting, insecure storage, predictable token generation or compromised endpoints. Consequences include unauthorised account actions, data theft and transaction manipulation.

Defensive practices include TLS throughout the session, secure and HttpOnly cookies, appropriate SameSite settings, session rotation after authentication or privilege changes, short inactivity timeouts, explicit logout invalidation, reauthentication for sensitive actions and careful protection against cross-site scripting. Tokens should be random, sufficiently long, narrowly scoped and protected from unnecessary exposure.

11. Man-in-the-Middle Attacks

In a man-in-the-middle (MITM) attack, an attacker places themselves between two communicating parties and may read, alter or relay traffic. Examples include a malicious wireless access point, a compromised router, DNS manipulation or fraudulent certificates.

A related attack is man-in-the-browser, in which malware alters transactions inside a user’s browser. MITM attacks are especially dangerous because each party may believe communication is direct and trustworthy.

TLS reduces risk when certificates are correctly validated and endpoints are secure. Users should avoid connecting to unknown wireless networks for sensitive activity, verify warnings rather than bypassing them, use secure DNS and VPN technologies where justified, and authenticate devices and services. Organisations should use network access control, certificate monitoring, wireless protections and segmentation.

12. Applied Case: Ransomware Following Credential Theft

The following is an illustrative case, not a report of a particular organisation.

Background

A medium-sized college operates an identity server, file servers, learning systems and remote-access services. It uses password authentication for many staff accounts, has incomplete asset records and performs backups to a network location that is continuously reachable.

Problem

Several employees receive convincing messages appearing to come from a cloud-service provider. One employee enters credentials into a fraudulent sign-in page. Within two days, an attacker uses the account to access remote services, creates a privileged account, copies sensitive files and deploys ransomware across shared storage. Teaching and administration systems become unavailable.

Analysis

The incident combines phishing, credential theft, account misuse, privilege escalation, lateral movement, data exfiltration and ransomware. The initial weakness was not merely user error. Contributing conditions included insufficient MFA, excessive privileges, limited detection of unusual logins, weak network segmentation and continuously accessible backups.

The CIA impact is significant. Availability is directly affected by encryption, confidentiality is threatened by copied files and integrity is affected by altered systems and records. The college must preserve evidence while restoring essential services.

Approach and solution

The response team should first activate the incident plan, isolate affected systems and disable compromised accounts. It should preserve logs, memory or disk evidence where feasible, record decisions and notify appropriate leadership, legal advisers, regulators and law-enforcement bodies according to applicable requirements. It should determine whether data was exfiltrated, not assume that restoring files ends the incident.

Recovery should use clean, verified systems and offline or otherwise protected backups. Credentials and privileged secrets should be reset, vulnerable remote services reviewed, and restored systems monitored carefully. Longer-term improvements include phishing-resistant MFA, least privilege, privileged-access management, segmentation, endpoint detection, tested immutable or offline backups, email controls and repeated exercises.

Outcome and learning points

The college restores priority services from clean backups and confirms that compromised accounts are disabled. The investigation identifies the initial phishing message and finds that the attacker’s unusual login location was logged but not alerted. The main lesson is that layered controls are necessary: awareness may reduce phishing, but MFA, monitoring, segmentation and recoverable backups limit the consequences when a user is deceived.

13. Ethical, Legal and Governance Responsibilities

Security work must be authorised, proportionate and accountable. Penetration testing, scanning and monitoring require written permission, clear boundaries and protection of collected data. Professionals must not access systems merely because they can, disclose vulnerabilities irresponsibly or retain personal information unnecessarily.

Organisations should establish acceptable-use policies, incident-reporting procedures, data-classification rules, access reviews, retention schedules and supplier-security requirements. Depending on jurisdiction and sector, privacy, computer-misuse, breach-notification, intellectual-property and critical-infrastructure laws may apply. Legal obligations vary, so technical staff should consult authorised management and legal specialists rather than making assumptions.

Evidence must be handled carefully. Logs should have reliable time sources, controlled access and documented retention. Investigators should maintain chain of custody when evidence may support disciplinary or legal proceedings. Security decisions should also consider accessibility, fairness and the risk that automated monitoring may incorrectly label legitimate users.

14. Contemporary Developments and Best Practice

Attackers increasingly combine human deception with automation, cloud services, stolen identity tokens and supply-chain compromise. Generative AI can help attackers produce convincing messages at scale, but it can also support defensive analysis, detection engineering and user training. AI-generated alerts and content require human review because models can produce false positives, false negatives or fabricated explanations. Sensitive data should not be entered into unapproved tools.

A practical baseline for network-security personnel is:

1. maintain an accurate inventory of devices, services, accounts and data;
2. patch systems according to risk and remove unsupported software;
3. enforce least privilege and MFA, especially for administrators and remote access;
4. segment networks and restrict unnecessary east–west traffic;
5. protect email, DNS, endpoints and wireless infrastructure;
6. centralise logs and establish meaningful alerts;
7. maintain protected, tested backups and recovery priorities;
8. train users and provide easy, non-punitive reporting channels;
9. rehearse incident response, communication and evidence preservation;
10. review suppliers, cloud configurations and security controls continuously.

No control eliminates all risk. The professional goal is to reduce the probability of compromise, limit the attacker’s movement, detect activity quickly, preserve trustworthy evidence and restore safe operations.

Chapter Summary

Threat actors include financially motivated cybercriminals, malicious or compromised insiders, state-sponsored groups and ideologically motivated hacktivists. Their capabilities and objectives differ, so effective defence begins with understanding likely motivation, access and target.

Malware includes viruses, worms, Trojans, ransomware, spyware, rootkits, bot malware and fileless threats. Phishing and other forms of social engineering exploit human trust, while spoofing disguises identity or origin. Sniffing captures traffic, scanning discovers systems and services, password attacks target weak or reused credentials, and DoS attacks target availability. Session hijacking abuses valid session tokens, while MITM attacks place an attacker between communicating parties.

Defence requires layered controls: secure configuration, patching, MFA, least privilege, encryption, segmentation, monitoring, user education, protected backups and tested incident response. Technical controls must operate within ethical, legal and governance requirements. Security professionals should focus on resilience and evidence-based response rather than relying on a single product or assuming that any one threat category fully explains an incident.

Key Terms

Attack surface: The collection of points through which a system may be attacked.

Attack vector: The route or method used to conduct an attack.

Botnet: A collection of compromised devices controlled by an attacker.

Confidentiality: Protection of information from unauthorised access.

Credential stuffing: Using credentials stolen from one service to access another.

Denial-of-service: An attempt to make a service unavailable.

Exploit: Code, technique or action that takes advantage of a vulnerability.

Hacktivist: An actor using cyber activity to promote an ideological or political cause.

Insider threat: Harm caused by a person with legitimate organisational access.

Malware: Software designed to perform unauthorised or harmful actions.

Man-in-the-middle: An attack in which communication is intercepted or relayed by an attacker.

Multi-factor authentication: Authentication requiring two or more different factor types.

Phishing: Deceptive communication intended to obtain information or induce an unsafe action.

Ransomware: Malware that blocks access to data or systems, commonly demanding payment.

Reconnaissance: Collection of information about a potential target.

Session hijacking: Taking control of an authenticated session.

Sniffing: Capturing and examining network traffic.

Spoofing: Falsifying an identity, address or source.

Threat actor: A person or group capable of causing a security incident.

Vulnerability: A weakness that can be exploited.

Review Questions

Short Answer Questions

1. Define threat, vulnerability and attack, and explain how they are related.
2. State the three elements of the CIA triad.
3. Distinguish between a virus, a worm and a Trojan.
4. What is credential stuffing, and why does password reuse increase its effectiveness?
5. Give two controls that reduce the risk of session hijacking.

Long Answer Questions

1. Compare cybercriminal, insider, state-sponsored and hacktivist threats in terms of motivation, capability and likely targets.
2. Explain how phishing, spoofing and social engineering may be combined in a business email compromise attack.
3. Describe the principal malware categories and discuss why signature-based detection alone is insufficient.
4. Explain how network segmentation, MFA, monitoring and protected backups contribute to ransomware resilience.
5. Discuss the ethical and legal responsibilities associated with authorised scanning and incident investigation.

Analytical / Application Questions

1. A company observes repeated logins from unfamiliar locations, large downloads from a finance account and a new administrator account. Analyse the likely attack sequence and recommend immediate containment actions.
2. A public website remains online during a DDoS attack, but customers report that the login service is extremely slow. Explain why availability may still be impaired and propose layered controls.
3. A staff member connects to a free wireless network and receives a certificate warning while accessing a banking application. Evaluate the risk and state the correct professional response.

Multiple Choice Questions with Answers

Question 1

Which threat actor is primarily motivated by financial gain through activities such as ransomware and credential theft?

A. Cybercriminal

B. Hacktivist

C. Security auditor

D. Accidental insider

Correct Answer: A. Cybercriminal

Question 2

Which malware type is designed to spread independently across networks?

A. Trojan

B. Worm

C. Spyware

D. Keylogger

Correct Answer: B. Worm

Question 3

An attacker sends a message that appears to come from a senior manager and requests an urgent payment. Which technique is most directly involved?

A. Business email compromise

B. Port scanning

C. Passive sniffing

D. File compression

Correct Answer: A. Business email compromise

Question 4

What is the main purpose of a salt in password storage?

A. To make passwords reversible

B. To ensure identical passwords have identical hashes

C. To make precomputed password tables less useful

D. To replace multi-factor authentication

Correct Answer: C. To make precomputed password tables less useful

Question 5

Which attack attempts to make a service unavailable by overwhelming resources or processing capacity?

A. Denial-of-service

B. Session rotation

C. Data classification

D. Certificate validation

Correct Answer: A. Denial-of-service

Question 6

What best describes session hijacking?

A. Discovering open network ports

B. Taking control of a valid authenticated session

C. Encrypting a backup for recovery

D. Filtering unwanted email

Correct Answer: B. Taking control of a valid authenticated session

Question 7

Which control most directly reduces the risk that a stolen password alone can be used to access an account?

A. Multi-factor authentication

B. Website defacement

C. IP spoofing

D. Traffic sniffing

Correct Answer: A. Multi-factor authentication

Question 8

Why is a man-in-the-middle attack dangerous?

A. It guarantees that traffic is deleted

B. It may allow communication to be read or altered while appearing normal

C. It only affects systems with no network connection

D. It prevents all forms of authentication

Correct Answer: B. It may allow communication to be read or altered while appearing normal

Question 9

Which practice is most appropriate before conducting an organisational vulnerability scan?

A. Obtain written authorisation and define the scope

B. Scan every internet address without notice

C. Disable all logging

D. Publish discovered weaknesses immediately

Correct Answer: A. Obtain written authorisation and define the scope

Question 10

Which backup characteristic is especially important for limiting ransomware impact?

A. Continuous write access from all user accounts

B. Protection from alteration or deletion by compromised systems

C. Storage only on the infected workstation

D. Use of the same administrator password everywhere

Correct Answer: B. Protection from alteration or deletion by compromised systems