Adversaries use a wide range of techniques to compromise systems. Malware, or malicious software, comes in many forms. Viruses attach to programs and spread when executed, while worms self-replicate across networks without user interaction. Trojan horses disguise themselves as legitimate software, ransomware encrypts data and demands payment for decryption, and spyware secretly monitors user activity and exfiltrates information. Adware displays unwanted advertisements, rootkits hide themselves and provide persistent privileged access, and keyloggers record keystrokes to capture passwords or sensitive data. More advanced families include fileless malware, which operates in memory without writing files to disk, botnets of compromised devices controlled remotely by an attacker, and logic bombs triggered by specific conditions. Droppers and payloads play supporting roles, with droppers designed to install other malware and payloads carrying the actual malicious code.
Beyond malware, attackers exploit weaknesses in software and human behavior. A zero-day vulnerability is one that is unknown to the vendor with no patch available, making it especially dangerous. Backdoors are hidden methods of bypassing normal authentication, and supply chain attacks compromise a trusted vendor in order to reach its customers. Attackers also rely heavily on social engineering, the art of manipulating people into divulging information or performing actions. Phishing is the broad category of fraudulent attempts to obtain sensitive information by impersonating trusted entities, and it has many variants: spear phishing targets specific individuals or organizations, whaling targets executives, smishing uses SMS messages, vishing uses voice calls, and pretexting constructs fabricated scenarios to elicit information. Other techniques include baiting by leaving infected media such as USB sticks for victims to find, tailgating by following an authorized person into a restricted area, and shoulder surfing by observing screens or keystrokes.
Network-level and application-level attacks add further pressure on defenders. Denial-of-service attacks overwhelm a service to make it unavailable, and distributed denial-of-service attacks amplify this by originating from many sources at once. Man-in-the-middle attacks intercept communications between two parties to eavesdrop or alter data, while replay attacks capture valid transmissions and resend them. Web applications face threats such as SQL injection, which inserts malicious SQL into queries; cross-site scripting (XSS), which injects client-side scripts into pages viewed by other users; cross-site request forgery (CSRF), which tricks a logged-in browser into performing unintended actions; clickjacking, which hides interface elements behind decoys; and session hijacking or fixation, which steals or forces session identifiers. Memory corruption bugs like buffer overflows and privilege escalation exploits allow attackers to gain higher-level permissions than originally granted. Passwords face brute force attempts that try every combination, dictionary attacks that try likely candidates, credential stuffing that reuses stolen credentials from one breach against other sites, password spraying that tries common passwords across many accounts, and rainbow table attacks that use precomputed hash tables. Adding random salt to passwords before hashing is the standard defense against rainbow tables.
More sophisticated adversaries conduct reconnaissance using open source intelligence (OSINT) and tools like Nmap for port scanning, then escalate through lateral movement inside a network. Advanced persistent threats (APTs), often nation-state actors, maintain long-term access and exfiltrate data over command-and-control channels. Other tactics include watering hole attacks that compromise sites a target frequents, typosquatting that registers lookalike domains, and spoofing at various protocol layers such as DNS spoofing, ARP spoofing, and BGP hijacking to redirect traffic. To hide their communications and tooling, attackers may use the Tor network, the dark web, cryptocurrency for payments, and steganography to embed data inside innocuous files like images.