Threats and Attackers — Cybersecurity Fundamentals

Who the Attackers Are

Behind every threat is an actor with different motivations, capabilities, and resources. Understanding who might attack you is not an academic exercise: it determines which defenses to prioritize. You do not prepare the same way against a teenager testing downloaded tools as against a professional criminal group that makes a living from extortion.

At the most sophisticated end are nation-state actors, government-backed groups that conduct espionage, sabotage of critical infrastructure, and intellectual property theft with patience and almost unlimited funding. These are the so-called APTs (Advanced Persistent Threats): "persistent" because they can remain inside a network for months or years without being detected, moving stealthily. The Stuxnet worm, which sabotaged Iranian nuclear centrifuges around 2010, is the classic example of an operation with state-level resources.

Organized cybercriminals operate with business logic: they seek financial gain through fraud, data theft, or extortion. They have industrialized crime to the point of offering "crime as a service," complete with technical support, control panels, and even affiliate programs. There are also hacktivists, motivated by political or social causes, and amateurs known as script kiddies, who use other people's tools without fully understanding them — dangerous nonetheless, because automated tools do not require the person launching them to be an expert.

We must not forget insider threats: disgruntled or careless employees, or those whose credentials have been compromised. They are especially dangerous because the attacker already has legitimate access, which lets them bypass many perimeter defenses. A common, quiet case is the employee who, upon resigning, takes the customer database "just in case."

| Actor | Main motivation | Resources | Example target | |---|---|---|---| | Nation-state (APT) | Espionage, geopolitical sabotage | Very high, near-unlimited | Critical infrastructure, governments, defense | | Organized cybercrime | Money (fraud, extortion) | High and professionalized | Companies of any size, hospitals | | Hacktivists | Political or social causes | Medium | Brands and bodies with public visibility | | Script kiddies | Fun, reputation | Low (other people's tools) | Any easy, exposed target | | Insider threat | Revenge, money, carelessness | Pre-existing legitimate access | The organization itself |

Malware: Software with Malicious Intent

The term malware (malicious software) covers any program designed to damage, spy on, or take control of a system. Knowing its families helps you interpret security alerts and understand how each threat spreads.

Viruses attach to legitimate files and spread when executed; they need a human to open something.
Worms replicate across the network without human intervention, exploiting vulnerabilities. The WannaCry ransomware (2017) behaved like a worm: using a Windows flaw for which a patch already existed, it infected more than 200,000 machines in 150 countries within days, including hospitals in the British health system that had to cancel surgeries.
Trojans disguise themselves as useful software —a supposed installer, a "crack" for a paid program— to trick the user and open a back door.
Spyware secretly collects information from the victim; keyloggers record every keystroke to steal credentials; rootkits hide deep within the operating system to go unnoticed.
Botnets turn thousands of infected machines into a remotely controlled network, used to send spam, mine cryptocurrency, or launch massive denial-of-service attacks.

A worrying modern pattern is fileless malware, which runs directly in memory using the system's own legitimate tools (such as PowerShell), leaving no file on disk for a traditional antivirus to scan. That is why defense evolved from the simple antivirus toward behavioral analysis, which we will cover in the endpoints lesson.

Defending against malware combines technical solutions —antivirus, EDR, application allowlisting— with good practices: not running files from unknown sources, keeping software updated, and being wary of unexpected attachments. When you download an installer from an official site that publishes its hash, verifying that it matches confirms the file was not tampered with:

# Windows: compute the SHA-256 hash of a downloaded file
Get-FileHash installer.exe -Algorithm SHA256

# Linux / macOS: same computation
sha256sum installer.exe      # Linux
shasum -a 256 installer.dmg  # macOS

If the value you get does not match the one the vendor publishes, do not run the file.

Social engineering is the art of manipulating people into revealing information or performing actions that compromise security. Instead of attacking technology, it attacks the human being, who is often the weakest link. It exploits predictable emotions and biases: urgency ("your account will be suspended in 24 hours"), fear ("we detected an unauthorized login"), authority (a message that appears to come from the manager), curiosity ("look at these photos"), and the desire to help.

Phishing is its most common form: fraudulent emails, messages, or websites that impersonate legitimate entities to steal credentials or data. Its variants differ by channel and target:

| Variant | How it works | Who it targets | |---|---|---| | Mass phishing | Generic emails sent to thousands of people | Anyone who bites | | Spear-phishing | Personalized message with real data about the victim | A specific person | | Whaling | Spear-phishing aimed at top leadership | CEO, CFO, directors | | Smishing | Phishing over SMS or messaging | Mobile users | | Vishing | Phishing over a voice phone call | Support and finance staff | | BEC | Impersonating an executive to order payments | The finance department |

An illustrative case of the power of vishing: in 2020, attackers phoned employees of a large social network posing as internal support, obtained credentials, and ended up controlling the accounts of public figures. There was no sophisticated technical exploit: there was a convincing conversation. Business Email Compromise (BEC), for its part, is one of the costliest frauds in the world: an email that appears to come from the director asks "urgently and confidentially" to transfer funds to a new supplier — and accounting pays without verifying.

The best defense is awareness combined with process. When a message asks for a sensitive action, apply this reflex:

Verify the real sender, not the displayed name: hover over the address and over the links to see the true destination before clicking.
Distrust pressure to act quickly: artificial urgency is the scammer's number-one tool.
Confirm through an alternative channel: if "your bank" or "your boss" asks for something unusual, call a number you already knew, not the one in the message.
Never enter credentials after arriving from an unsolicited link: reach the site by typing the address yourself.

Ransomware: the Threat That Hijacks Data

Ransomware is a type of malware that encrypts the victim's files and demands a payment (ransom), usually in cryptocurrency, in exchange for the decryption key. It has become one of the most devastating threats to companies, hospitals, and governments because of its ability to paralyze entire operations. In 2021, a ransomware attack against a fuel pipeline operator in the United States (Colonial Pipeline) forced a temporary shutdown of fuel supply to much of the East Coast — a reminder that an IT incident can have immediate physical consequences.

Modern tactics make the problem worse with double extortion: in addition to encrypting the data, attackers exfiltrate it and threaten to publish it if payment is not made. So having backups is no longer enough to refuse to pay, because the leak of sensitive data remains a threat. Some groups add a triple extortion, also pressuring the affected customers or patients.

The Ransomware-as-a-Service (RaaS) model lets criminals without technical skills rent ready-to-use platforms in exchange for a share of the ransom, which has multiplied the number of attacks. A typical incident follows this sequence: initial access (via phishing or an exposed RDP) → credential theft → lateral movement across the network → data exfiltration → simultaneous encryption of every machine, almost always in the small hours or over a long weekend to maximize damage before anyone reacts.

Effective protection rests on complementary pillars: frequent, tested backups isolated from the network (the 3-2-1 rule, which we will see in endpoints); rapid patching of vulnerabilities; MFA to close off initial access; and segmentation so that a compromised machine does not infect the whole organization. Paying the ransom never guarantees recovering the data and, moreover, funds future attacks — which is why security agencies advise against it.

Anatomy of an Attack

Understanding that attacks follow phases helps you defend against each one. An attacker rarely gets in and steals everything in a single step; they walk through a chain of stages, and each stage is an opportunity to detect and stop them. Models such as the Cyber Kill Chain or the MITRE ATT&CK framework describe and catalog these stages and the concrete techniques observed in real incidents.

| Phase | What the attacker does | Defensive opportunity | |---|---|---| | Reconnaissance | Gathers information about the target | Reduce public information, monitor scans | | Initial access | Gets in via phishing, credential, or vulnerability | MFA, email filtering, patching | | Execution and persistence | Runs code and ensures they can return | EDR, behavioral analysis | | Lateral movement | Hops from one machine to another across the network | Segmentation, least privilege | | Exfiltration and impact | Steals data, encrypts, or sabotages | Data egress monitoring, backups |

The strategic lesson is clear: since any control can fail, do not rely on stopping the attacker at a single point. If phishing gets past the email barrier, MFA can still block the login; if the login happens, segmentation limits the movement; if they still advance, backups allow recovery. This is defense in depth, the principle we will bring together at the end of the course.

Common Mistakes

Believing technology is enough: the most expensive antivirus does not stop an employee from handing over their password over the phone to a convincing scammer. Awareness is part of the defense, not an extra.
Thinking phishing is easy to spot: emails with spelling mistakes and generic greetings barely exist anymore; modern spear-phishing uses real data and sounds legitimate.
Ignoring insider threats: concentrating all defense on the perimeter leaves the organization blind to whoever is already inside.
Assuming "we are too small to be attacked": ransomware and phishing are massive and automated; they do not pick victims by size, but by ease.
Paying the ransom as a first option: without backups or a prior plan, many companies pay and still do not recover everything — and end up marked as targets willing to pay.

Key Takeaways

Behind every threat is a different actor (nation-state, cybercrime, hacktivists, insiders); knowing who might attack you guides which defenses to prioritize.
Malware has many families (viruses, worms, trojans, spyware, ransomware, botnets); cases like WannaCry show how an unpatched vulnerability turns into disaster.
Phishing and social engineering attack the person, not the machine, exploiting urgency, fear, and authority; verifying through an alternative channel neutralizes most of these frauds.
Ransomware with double extortion and the RaaS model is one of today's greatest threats; it is countered with isolated backups, patching, MFA, and segmentation — not by paying.
Attacks follow phases (Cyber Kill Chain, MITRE ATT&CK); each phase is an opportunity to detect and stop, and that is the foundation of defense in depth.

With this threat landscape in mind, the next lessons focus on concrete controls: robust authentication, cryptography, and protection of the devices we use every day.