Behaviors. Adversaries. Damage.
A working reference to the language of compromise: what attackers do, who they are, and the damage they leave behind. The techniques, the actors, the campaigns, and the artifacts an analyst will name out loud during triage.
Adversary traversal across an environment after initial access. Each hop expands the blast radius and adds new entities for Subject to map. In real intrusions the movement is rarely linear and often piggybacks on legitimate authentication.
The climb from standard user to admin to SYSTEM to domain admin. Triage often catches the first hop; mature SOCs catch the second. Catching the climb in progress is the difference between a contained incident and a full domain compromise.
Why removing the malware is rarely enough. Mature adversaries plant multiple anchors (registry Run keys, scheduled tasks, services, WMI event subscriptions) so reboots, password resets, and even partial cleanups leave at least one foothold intact. Defenders need to enumerate every place persistence might hide before they can call a host clean.
Untrusted input concatenated straight into a SQL query. The classic payload ’ OR ‘1’=‘1’ — turns the query into a tautology and returns every row. The same characters get parsed as syntax instead of data.
The patch counter sits at zero. The vendor has not shipped a fix; possibly does not yet know the bug exists. Exploits in the wild outpace mitigation. The window between disclosure and patch is when zero-days do the most damage, and the most expensive ones never publicly disclose at all.
Windows User Account Control should prompt before elevation. Bypass techniques (abusing auto-elevating binaries like fodhelper.exe, eventvwr.exe, or registry hijacks) skip the prompt entirely. The dialog never fires and the privilege escalation succeeds silently.
A sophisticated, well-resourced adversary, often state-sponsored, that gains and maintains prolonged, covert unauthorized access to a network while avoiding detection. The term names the actor; the campaign it runs is APT activity.
Source: NIST glossaryA persistence technique that abuses Windows Component Object Model (COM) registry entries to hijack the execution flow of legitimate applications.
Source: ATT&CK T1546.015A system under attacker control, often used for lateral movement, staging malware, or maintaining persistence within a network.
ATT&CK tactic: hiding and concealing actions so they appear as normal behavior, through obfuscation, masquerading, process injection, and indicator removal. With Defense Impairment, one of the two successors to the Defense Evasion tactic retired in ATT&CK v19 (April 2026).
Source: ATT&CK TA0005ATT&CK tactic: breaking security mechanisms, pipelines, and tooling so defenders cannot see or trust what is happening — disabling security tools, modifying firewalls, tampering with logging and trust controls. With Stealth, one of the two successors to the Defense Evasion tactic retired in ATT&CK v19 (April 2026).
Source: ATT&CK TA0112An attack that breaks out of a restricted environment (container, VM, or sandbox) to reach the underlying host. The container variant is ATT&CK T1611, Escape to Host.
Source: ATT&CK T1611The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools.
Source: ATT&CK TA0002The first step of a breach, where attackers gain a foothold in the environment through phishing, exploits, credential abuse, or exposed services.
Source: ATT&CK TA0001Risk of harm originating from a person with authorized access, typically through negligence, mistake, or policy violation rather than deliberate intent. Distinct from insider threat, which is deliberate.
A trusted internal user who intentionally abuses their access to cause harm, steal data, or assist external attackers.
Source: CISAThe removal of OS-level security restrictions, particularly on iOS devices, to allow unauthorized control, often used maliciously.
An attacker’s method of traversing a network to escalate access, find sensitive data, or reach higher-value targets.
Source: ATT&CK TA0008A technique that exploits flaws in system logic or workflows, rather than code, to bypass controls or cause disruption.
Software designed to disrupt, damage, or gain unauthorized access to systems. Encompasses ransomware, trojans, worms, viruses, spyware, wipers, rootkits, and the other malware families catalogued below.
The delivery and installation of malicious software, tools, or scripts intended to perform an attacker’s objectives.
Tactics that maintain access across reboots, updates, or password changes. Multiple anchors, Run keys, scheduled tasks, services, WMI event subs.
Source: ATT&CK TA0003The phase where the attacker explores the environment, escalates access, exfiltrates data, or sets up long-term control.
The sequential use of multiple smaller privilege escalations or credential compromises to progressively gain more powerful access.
The act of increasing privileges on a system. Standard user → admin → SYSTEM → domain admin.
Source: ATT&CK TA0004Running commands or malicious code on a target system from a remote location, often via exploits or administrative tools.
The pre-attack phase where attackers gather intelligence, enumerate exposed services, and identify vulnerabilities before launching an intrusion.
Source: ATT&CK TA0043Code injection where malicious SQL is inserted into input fields to manipulate backend databases.
Source: OWASPA two-phase delivery process where a lightweight stager downloads and executes a more complex secondary payload.
The unauthorized modification of system configurations, binaries, or behaviors to support attacker goals or disrupt operations.
An access-governance term: multiple individually benign roles or permissions that together create excessive, dangerous access (the classic separation-of-duties conflict). A condition attackers hunt for and access reviews exist to catch.
Circumventing Windows User Account Control prompts to gain elevated privileges without user approval.
Source: ATT&CK T1548.002A previously unknown vulnerability with no patch, exploited before the vendor can respond.
Source: NIST glossaryNamed groups and individuals known for malicious cyber activity. Their tradecraft, motivations, and historical campaigns shape modern triage.
One group, many names: every vendor names actors from its own telemetry, so the same cluster carries a Mandiant APT number (APT29), a CrowdStrike animal (Cozy Bear), a Microsoft weather family (Midnight Blizzard), and a Proofpoint TA number. The subtitles below cross-reference common aliases; treat each name as one vendor’s view of overlapping activity, not a precise identity.
Vocabulary for: Uncover
Chinese state-sponsored group associated with global IP theft. Their Cloud Hopper campaign targeted managed service providers (MSPs) to compromise downstream customers. Focus: healthcare, defense, aerospace, tech. Uses RedLeaves, custom loaders, spear-phishing, credential theft, and cloud-service abuse aligned with China’s economic and military goals.
Source: ATT&CK G0045Linked to Russia’s GRU and known for aggressive operations. Credential harvesting, malware deployment, destructive attacks against political and military targets. Tied to the 2016 DNC breach and many NATO-related campaigns. Leverages zero-days and weaponized Office documents. Noisier and more direct than APT29; a primary actor in Russian hybrid warfare.
Source: ATT&CK G0007Sophisticated espionage group associated with Russia’s SVR. Stealth and long-term access. Targets governments, think tanks, healthcare, vaccine researchers. One of the groups behind SolarWinds (UNC2452). Custom malware, living-off-the-land, well-crafted spear-phishing. Operations often go undetected for months. As Midnight Blizzard (Microsoft’s name), breached Microsoft’s own corporate email in 2023-2024 by password-spraying a legacy test tenant.
Source: ATT&CK G0016Iranian government-linked group targeting aerospace, energy, and critical infrastructure. Mixes espionage with destructive operations including Shamoon wiper variants. Phishing campaigns tied to fake aviation job postings. Represents Iran’s evolving cyber capability and willingness to engage in hybrid warfare.
Source: ATT&CK G0064Iranian group conducting espionage against academics, human rights activists, and government entities. Phishing, fake social personas, credential harvesting. Known for impersonating journalists and think tanks. Supports Iran’s strategic interests in surveillance and foreign intelligence collection. Active for over a decade.
Source: ATT&CK G0059Russian-speaking extortion group (TA505-adjacent) that industrialized mass exploitation of file-transfer software: Accellion FTA (2021), GoAnywhere (2023), and MOVEit Transfer (2023), which alone touched 2,700+ organizations. Skips encryption in favor of pure data-theft extortion at scale. A defining example of one zero-day monetized across thousands of victims simultaneously.
Source: CISA AA23-158ARussian cybercrime group behind the Dridex banking trojan and BitPaymer / WastedLocker ransomware. Hundreds of millions stolen from global financial institutions. U.S. Treasury has sanctioned the group and its alleged leader Maksim Yakubets. Has continued operations under new malware names to evade sanctions and tracking.
Source: ATT&CK G0119Well-organized cybercrime group conducting large-scale intrusions against banks, POS systems, and hospitality. Financially motivated but operationally on par with nation-state actors. Developed Carbanak and Bateleur malware families. Uses phishing, backdoors, supply-chain compromise. Has rebranded after arrests, including via fronts like Combi Security.
Source: ATT&CK G0046Suspected Chinese state-sponsored group, widely known for exploiting Microsoft Exchange zero-days in 2021. Web-shell deployment and widespread data theft from education, law firms, NGOs, and defense contractors. Uses a mix of custom malware and commercial tools, including C2 over compromised Exchange servers.
Source: ATT&CK G0125Loosely organized group known for extortion, data leaks, and high-profile breaches. Access via SIM-swapping, credential theft, and insider recruitment rather than malware. Thrives on media attention and public-facing leaks. Members believed to be primarily teenagers, with arrests in the UK. Disruption over stealth.
Source: ATT&CK G1004Umbrella term for several North Korean operations under the Reconnaissance General Bureau. Espionage, sabotage, and financially motivated attacks: Sony Pictures, WannaCry, bank and crypto-exchange theft. Blends APT tradecraft with cybercrime to fund the regime. Strategic patience plus opportunistic targeting.
Source: ATT&CK G0032The most prolific ransomware-as-a-service operation of the 2020s, responsible for thousands of victims across every sector. Ran a professionalized affiliate program with a slick leak site, bug bounties, and payment discipline. Disrupted by Operation Cronos (2024), which seized infrastructure and unmasked its leader, but affiliates and the playbook persist under new brands.
Source: CISA AA23-165ADestructive GRU unit behind the 2015 / 2016 Ukraine power grid attacks (BlackEnergy, Industroyer) and the global NotPetya wiper. Tools include VPNFilter, KillDisk, Cyclops Blink. Specializes in ICS/OT disruption, hybrid warfare, and psychological operations. Aligned with Russian military objectives.
Source: ATT&CK G0034Native-English-speaking group (UNC3944 / Octo Tempest) behind the 2023 MGM and Caesars intrusions. The defining identity-attack playbook: help-desk social engineering, SIM swapping, MFA fatigue, AiTM phishing kits, then abuse of the victim’s own IdP and cloud tooling. Overlaps with the loose “The Com” ecosystem; later partnered with RaaS operations for encryption. The actor profile most relevant to SSO-era triage.
Source: ATT&CK G1015Collective term for Nigerian actors conducting Business Email Compromise fraud. Less technically advanced than APTs but highly profitable. Phishing, credential theft, social engineering to divert funds from corporate communications. Many actors operate openly on social media. Hundreds of arrests, but the group continues to evolve.
Source: ATT&CK G0083Prolific cybercriminal group distributing banking trojans, ransomware, and RATs globally. Frequent massive phishing waves delivering Dridex, FlawedAmmyy, Locky. Often acts as an initial-access broker for other groups. Frequently shifts tactics, payloads, and infrastructure. Exemplifies the malware-as-a-service model.
Source: ATT&CK G0092Long-running Russian cyber-espionage group linked to the FSB. Targets governments, embassies, militaries. Custom implants like Snake, Carbon, Kazuar. Hijacks infrastructure from other malware families to obfuscate attribution. Watering holes, poisoned updates, compromised email systems. Tradecraft emphasizes longevity and covertness.
Source: ATT&CK G0010Mandiant designation for the threat group behind the SolarWinds supply-chain compromise, later linked to APT29. Introduced the SUNBURST backdoor into Orion updates, affecting U.S. government agencies and Fortune 500 companies. Stealthy lateral movement and privilege escalation. Undetected for months. A landmark case for software trust chains.
Source: ATT&CK G0016 (APT29)Chinese state-sponsored group that pre-positions inside U.S. critical infrastructure (energy, water, communications, transportation) for potential disruptive action rather than day-to-day espionage. Defining tradecraft is living off the land: built-in tools, valid accounts, and hands-on-keyboard operation with almost no malware, which defeats IOC-driven detection. Disclosed May 2023 by Microsoft and CISA; the campaign itself is covered under notable campaigns below.
Source: ATT&CK G1017Russia-based cybercriminal group behind Ryuk, Conti, and TrickBot. Financially motivated; hundreds of millions extorted from hospitals, municipalities, corporations. Operates within a larger ecosystem of IABs and malware developers. Fast lateral movement, data theft, double extortion. Often preceded by TrickBot or BazarLoader infections.
Source: ATT&CK G0102High-impact, widely analyzed intrusions and operations that shaped modern security thinking.
Vocabulary for: Uncover
The watershed cyber-physical weapon. Stuxnet altered centrifuge speeds at Iran’s Natanz facility while feeding operators normal readings on the SCADA HMIs. The gap between what the equipment was doing and what the monitors reported is the breakthrough that turned malware into a tool of kinetic effect.
WannaCry used the EternalBlue exploit (MS17-010) to propagate through SMB to any unpatched host it could reach. From patient zero, it spread autonomously by scanning local subnets and random IPs, infecting roughly 200,000 systems across 150 countries within 24 hours of the May 12, 2017 outbreak. By the time most SOCs had triaged the first alert, the second wave of hosts was already encrypting. That speed is what “wormable” means in practice: the malware does its own lateral movement; defenders don’t get the usual reaction window.
Political consulting firm that improperly harvested data from 87 million Facebook users via a quiz app; the scandal broke in 2018. Psychological profiling and micro-targeted ads aimed at influencing votes, most prominently the 2016 U.S. election (the UK ICO’s investigation later concluded its role in Brexit had been overstated). Not a traditional cyberattack, but exposed serious flaws in data privacy and third-party app oversight. Triggered global debate about surveillance capitalism and election interference; GDPR enforcement followed.
Widespread espionage campaign by China’s APT10 targeting MSPs globally. Compromising MSPs gave attackers stealthy access to customer networks across aerospace, finance, manufacturing, and healthcare. Credential theft, custom malware, and RATs. Victims often unaware due to the trusted MSP position. A textbook example of supply-chain compromise for espionage.
Source: CISA TA17-117AMay 2021 ransomware incident attributed to DarkSide that hit the IT systems of one of the largest fuel pipeline operators in the U.S. The company preemptively shut down operations, causing East Coast shortages. Initial access via a compromised VPN password. $4.4M ransom paid; partly recovered by the U.S. government. Spurred new cybersecurity mandates for pipeline operators.
Source: CISA AA21-131A2017 breach exposing PII (SSNs, birth dates, addresses) for 147 million Americans. Caused by failure to patch Apache Struts (CVE-2017-5638). Attackers operated undetected for roughly 76 days. Handling and disclosure drew widespread criticism. Resulted in a historic $700M settlement and regulatory reforms focused on data protection.
Source: US FTCCVE-2021-44228, a critical RCE in Apache Log4j. Attacker-controlled input is interpolated into a log message that triggers a JNDI lookup, which loads and executes a remote class. Disclosed December 2021, exploited globally within hours. Affected vast swaths of Java applications. Renewed calls for software bill-of-materials and open-source security funding. Reset assumptions about transitive-dependency risk.
Source: CISA AA21-356AEarly 2021 chain of zero-day exploits in Microsoft Exchange Server. Tens of thousands of orgs affected globally, government, academic, business. Web shells deployed for data theft, persistence, and lateral movement. Out-of-band patches issued. Raised concerns about on-premises Exchange security and patch management.
Source: CISA AA21-062ADestructive cyberattack masquerading as ransomware, attributed to Russia’s GRU Sandworm. Spread via a compromised update to Ukrainian accounting software (MeDoc), then jumped globally. Irreversibly wiped disks despite the ransom note. Maersk, Merck, FedEx among the victims. Billions in damages and a defining case study in supply-chain abuse.
Source: CISA (2017)2009–2010 China-attributed intrusions targeting Google, Adobe, and dozens of others. Zero-day in Internet Explorer used to deploy backdoors and steal source code and IP. Google’s public disclosure was a turning point in public discussion of state-sponsored industrial espionage and APTs.
Source: Google (2010)2019 supply-chain compromise of the ASUS software update utility. Compromised updates were signed and shipped from ASUS’s own servers, reaching hundreds of thousands. Payload activated only on specific targets, suggesting selective espionage. Stolen certificates plus supply-chain trust. Linked to nation-state-capable APT activity.
Source: Kaspersky Securelist2015 breach compromising SF-86 background investigation records (and fingerprints) for 21+ million U.S. federal personnel. Attributed to Chinese state-sponsored actors. A goldmine for counterintelligence. Major reforms in U.S. government cybersecurity practices and incident response readiness followed.
Source: US GAO2014 destructive attack attributed to North Korea’s Lazarus Group, reportedly in retaliation for The Interview. Wiper malware, leaked unreleased films, and exposed executive communications. Blended political retaliation, information warfare, and corporate sabotage. First high-profile nation-state attack on a private company over content.
Source: FBI (2014)Late-2020 supply-chain compromise of SolarWinds Orion. Trojanized update gave APT29 / UNC2452 backdoor access to thousands of customers including U.S. government agencies and Fortune 500 firms. Stealthy command-and-control, lateral movement, and data exfiltration over months. Reshaped trust assumptions around software vendors.
Source: CISA AA20-352ALandmark cyberweapon widely attributed to a joint U.S.-Israeli operation (never officially acknowledged) to disrupt Iran’s nuclear enrichment. Multiple zero-days and PLC-specific payloads targeted Siemens controllers at Natanz. Altered centrifuge speeds while reporting normal readings. First malware known to cause real-world industrial damage. Inspired subsequent ICS-targeting malware.
Source: CISA ICSA-10-272-012013 breach compromising payment data for 40 million customers and PII for 70 million more. Initial access via a compromised HVAC contractor; lateral movement to POS systems; malware on registers captured card data. A landmark for third-party risk management and network segmentation. Hundreds of millions in costs and executive resignations.
2015 and 2016 attacks marking the first known successful cyberattacks to cause power outages. Attributed to Russia’s Sandworm. Spear-phishing plus BlackEnergy to gain SCADA access; operators locked out as breakers were opened manually. 2016 used Industroyer / CrashOverride targeting grid-specific protocols. Defining examples of cyber warfare against civilian infrastructure.
Source: CISA IR-ALERT-H-16-056-01May 2017 ransomware outbreak using EternalBlue (NSA SMB exploit leaked by Shadow Brokers). Wormed across networks, encrypting files in 150+ countries; the UK NHS was hit hard. Microsoft had released the patch beforehand, but many systems were unpatched. Attributed to North Korea’s Lazarus Group. A wake-up call on patch hygiene.
Source: CISA (2017)July 2023 intrusion in which a China-aligned actor forged Azure AD access tokens using a stolen Microsoft consumer-MSA signing key, reading emails of ~25 organizations including U.S. State Department and Commerce officials via Outlook Web Access. The key should not have signed enterprise tokens; a validation gap let it. Reshaped how the industry talks about identity-provider key custody, token-binding, and the blast radius of a single signing key.
Source: Microsoft (2023)May–June 2023 zero-day SQL-injection in Progress Software’s MOVEit Transfer (CVE-2023-34362), exploited at scale by the Cl0p ransomware group. Thousands of organizations affected via the file-transfer vendor’s customer base, U.S. federal agencies, state DMVs, Fortune 500 firms. A defining case for third-party-software risk and for ransomware groups shifting from encryption to pure data-extortion.
Source: CISA AA23-158AOctober 2023 intrusion of Okta’s customer support case-management system. Attackers used a service-account credential found in a Google account session to access HAR files customers had uploaded for troubleshooting, HAR files that contained valid session cookies. Drove home that “support” surfaces handle production credentials and need the same identity-provider rigor as the products themselves.
Source: Okta SecurityMarch 2024. A multi-year social-engineering campaign by a fictitious maintainer (“Jia Tan”) inserted a stealthy backdoor (CVE-2024-3094) into the xz/liblzma compression library that would have given remote SSH code execution on Linux systems linked against the affected build. Caught by chance by a Microsoft engineer noticing a 500ms slowdown. A defining open-source supply-chain case and the catalyst for renewed maintainer-trust scrutiny.
Source: CISA (2024)April–June 2024. A threat group later tracked as UNC5537 used credentials harvested from infostealer logs to access Snowflake customer environments that had no MFA configured. Victims included Ticketmaster, Santander, AT&T, LendingTree. Not a Snowflake CVE, a customer-side identity hygiene failure at scale. Drove the industry-wide push for MFA-mandatory cloud SaaS access.
Source: Mandiant / GoogleTwo long-running China-linked campaigns against U.S. critical infrastructure. Volt Typhoon, disclosed May 2023 by Microsoft and CISA, pre-positioned in energy, water, communications, and transportation networks using living-off-the-land techniques for stealthy persistence. Salt Typhoon, disclosed in late 2024, compromised major U.S. telecom carriers’ lawful-intercept systems with potential access to call metadata and the federal wiretap apparatus. Together they reframed the boundary between espionage and prepositioning for disruptive action.
Source: CISA AA24-038AMalware that encrypts a victim’s files or systems and demands payment (usually in cryptocurrency) for the decryption key. Modern ransomware operators add data theft and public-leak extortion. In telemetry, the encryption sweep shows as rapid sequential file writes across the filesystem.
Many infected machines (bots) coordinating to a central controller. The rhythm of regular check-ins is what defenders look for. DDoS, credential stuffing, spam, and proxy abuse all ride on this primitive. Modern botnets span PCs, servers, routers, and IoT.
The destructive cousin of ransomware. There is no decryption key, no negotiation, no recovery; wiper overwrites data structures so the disk cannot be restored. NotPetya, Shamoon, and WhisperGate all wore the ransom-note costume while quietly destroying the underlying data.
Malware that displays unwanted advertisements, often bundled with legitimate software. Advanced adware can harvest data or serve as a delivery mechanism for more serious malware.
Malicious code that provides unauthorized access to a compromised system, bypassing normal authentication. Often installed post-exploitation to maintain persistent remote control.
Malware designed to steal banking credentials and financial information by intercepting login sessions, injecting fake forms, or logging keystrokes. Often targets online banking and payment systems.
Lightweight malware designed solely to download and execute a more substantial payload, often a banking trojan or ransomware. Examples include Emotet, ZLoader, Smoke Loader.
Highly persistent malware that infects the bootloader or Master Boot Record to gain control before the OS loads. Difficult to detect or remove since they operate beneath the operating system.
A network of infected machines (bots) controlled by a central attacker, used for DDoS, spam, credential stuffing, and more.
Source: NIST glossaryMalware that simulates user clicks on advertisements to generate fraudulent revenue. Often run on compromised systems in large volumes to exploit pay-per-click ad platforms.
Tooling that uses encryption or obfuscation to hide malicious code and evade antivirus. Not malicious on their own but commonly paired with trojans, RATs, or ransomware.
Malware that operates in memory without writing files to disk, harder to detect with traditional AV. Often leverages legitimate system tools like PowerShell or WMI for execution.
Software that harvests sensitive data from victims: passwords, cookies, browser history, autofill. Commonly used in initial-access phases of broader attack campaigns.
Designed to infect Internet of Things devices like routers, cameras, smart appliances. Often used in botnets (e.g., Mirai) due to weak authentication and outdated firmware.
Malicious code triggered by specific conditions, such as a date or user action. Can remain dormant until activated, then execute destructive or stealthy functions.
Malware targeting mobile devices, often distributed via malicious apps or phishing links. Includes SMS stealers, fake banking apps, mobile RATs.
Malware that encrypts a victim’s files and demands payment for the key. Modern ransomware often includes data theft and extortion.
Source: CISA StopRansomwareMalware that masquerades as legitimate software and, once installed, gives the operator interactive remote control of the host. The trojan delivery is load-bearing: the user runs it willingly. Common capabilities include keylogging, screen capture, file transfer, and webcam access.
Malware that hides its presence by subverting the OS or using kernel-level access. Often combined with other malware to maintain stealth and persistence.
Source: NIST glossarySoftware that tricks users into believing their device is infected, pressuring them to buy fake antivirus tools. Often a social-engineering precursor to real malware.
Malware that secretly monitors user activity: keystrokes, screen captures, camera or microphone access. Used for surveillance, espionage, or credential theft.
Source: NIST glossaryMalware designed to irreversibly delete data and destroy system functionality. NotPetya, Shamoon, WhisperGate.
Named tools and campaign malware tied to specific actors or operations.
Vocabulary for: Uncover
Sophisticated ransomware-as-a-service operation, one of the first to use Rust, making detection and analysis harder. Highly customizable Windows / Linux payloads, double-extortion with leak-site shaming. Successor to BlackMatter in the DarkSide lineage; ties to REvil are affiliate overlap, not direct succession. Aggressive targeting of critical infrastructure and high-profile enterprises.
Source: CISA AA23-353ALegitimate post-exploitation tool widely abused for C2, lateral movement, and credential harvesting. Beaconing, fileless injection, encrypted comms. Pirated and cracked versions used by APTs, ransomware gangs, and commodity malware. Frequently paired with TrickBot or BazarLoader to coordinate ransomware deployment.
Source: ATT&CK S0154One of the most prolific ransomware groups before disbanding in 2022. Centralized structure, professional affiliate model, human-operated intrusions. Used Cobalt Strike and TrickBot for movement. Internal chat-log leaks in 2022 exposed structure, operations, and finances. Many former members moved to BlackCat or Royal.
Source: ATT&CK S0575Banking Trojan evolved into a modular platform for credential theft, lateral movement, and ransomware delivery. Spread via Word macros; injects into browsers to harvest banking credentials. Used to deploy Locky and BitPaymer. Associated with Evil Corp. Still under active development despite arrests.
Source: ATT&CK S0384Banking trojan turned modular loader botnet; for years the dominant initial-access delivery vehicle, dropping TrickBot, QakBot, and ultimately ransomware. Spread via thread-hijacked phishing with macro documents. Taken down by law enforcement in January 2021, resurfaced later that year, and its playbook still defines the loader-botnet ecosystem.
Source: ATT&CK S0367Open-source post-exploitation framework with Python-based agents (EmPyre is the macOS/Linux branch; Empire is the PowerShell/Windows branch). Originally a red-team tool, adopted by various actors. Encrypted C2, evasion techniques, in-memory execution. Less common in the wild than Cobalt Strike, but its presence in a compromise should be treated as a high-risk indicator. Not a backdoor.
Source: ATT&CK S0363Banking Trojan turned loader frequently used to drop Cobalt Strike, TrickBot, or ransomware. Spread through malicious documents and phishing. Modular: credential theft, web injection, lateral movement. Persistence via scheduled tasks and registry keys. A key player in post-intrusion ransomware operations.
Source: ATT&CK S0483The dominant malware-as-a-service infostealer of the mid-2020s, inheriting RedLine’s and Raccoon’s market. Harvests browser credentials, cookies, session tokens, and crypto wallets; the resulting logs are sold in bulk and seed downstream intrusions, including the 2024 Snowflake customer breaches. Distributed via malvertising, cracked software, and fake-CAPTCHA ClickFix lures. A May 2025 international takedown seized much of its infrastructure, though rebuilds followed.
Source: CISA AA25-141BPioneer of double extortion, encryption plus data theft to pressure victims. RaaS model with public leak blog. Exploited RDP, phishing, and known vulnerabilities; used Cobalt Strike and Mimikatz internally. Announced retirement in late 2020, but affiliates continued under the Egregor banner (the code-sharing Sekhmet family had operated in parallel).
Source: ATT&CK S0449The canonical credential-theft tool: reads LSASS memory to extract plaintext passwords, NTLM hashes, and Kerberos tickets, and implements pass-the-hash, pass-the-ticket, golden and silver tickets. Written by Benjamin Delpy as a proof of concept; now embedded in nearly every intrusion toolchain and re-implemented inside countless loaders and C2 frameworks. EDR watches lsass access patterns specifically because of it.
Source: ATT&CK S0002Multifunctional banking Trojan and malware dropper that evolved into a full-featured loader. Email-thread hijacking for phishing. Persistence, network discovery, credential harvesting, encrypted C2. Cornerstone of many enterprise compromises. Coordinated international disruption in 2023, but variants may persist.
Source: ATT&CK S0650Infostealer sold on underground forums. Harvests credentials, browser data, cryptocurrency wallets, and system information. Distributed via cracked software, malvertising, phishing, and fake installers. JSON-over-HTTP/S C2. Customizable and affordable; popular among low-skill actors and initial-access brokers. Infrastructure seized in the international Operation Magnus takedown (October 2024).
Source: MalpediaHigh-impact ransomware operated by Wizard Spider, typically delivered via TrickBot or BazarLoader. AES/RSA file encryption. Targets hospitals, municipalities, critical infrastructure. Fast encryption, kills backup and recovery processes. Operators are believed to overlap heavily with the subsequent Conti operation, which is generally treated as the successor brand.
Source: ATT&CK S0446Destructive wiper associated with Iranian state-sponsored actors. Infamous for the 2012 attack on Saudi Aramco that wiped roughly 30,000 machines; returned in 2016-2017 (“Shamoon 2”) against other Saudi organizations, including the General Authority of Civil Aviation. Overwrites MBR with provocative imagery, renders devices inoperable. Spreads via stolen credentials and admin shares. Primary goal is destruction, not financial gain.
Source: ATT&CK S0140Began as a banking Trojan, evolved into a modular enterprise-scale framework. Credential theft, recon, ransomware delivery. Often followed Emotet, provided a foothold for Ryuk or Conti. Decentralized infrastructure, encrypted comms, plugins for SMB spread and AD enumeration. A coordinated takedown in October 2020 only dented it; the operators wound the botnet down by 2022 as work shifted into Conti.
Source: ATT&CK S0266Widely distributed infostealer harvesting credentials, browser data, cookies, cryptocurrency wallets, and more. Delivered via phishing, malvertising, fake installers. HTTP POST C2 with encrypted exfiltration. Customizable and available as malware-as-a-service. Often bundled with or mistaken for RedLine / Raccoon.
Source: MalpediaDestructive malware attributed to Russian actors, deployed against Ukraine in 2022. Masquerades as ransomware but irreversibly corrupts the MBR and deletes system files. Two-stage: first corrupts the bootloader, second drops a wiper. No recovery mechanism, disruption, not finance. Echoed NotPetya tactics.
Source: ATT&CK S0689OpenSSL heartbeat extension flaw that lets a remote attacker read up to 64KB of memory per request: keys, passwords, session tokens, anything in the server’s heap. The attack leaves no obvious log traces, which is why the post-disclosure cleanup required mass key rotation across the internet.
One line of user input becomes remote code execution. The JNDI lookup inside $${jndi:ldap://...} tricks Log4j into contacting attacker-controlled infrastructure, which returns a payload that the JVM then executes. Four steps in sequence: an attacker submits a string, Log4j resolves it, LDAP serves a malicious class, the JVM runs it.
Critical RDP vulnerability allowing remote code execution without authentication. Affects older Windows. “Wormable”, could self-propagate like WannaCry. Microsoft issued an emergency patch. Highlighted the danger of exposing RDP directly to the internet.
Source: NVD CVE-2019-0708Linux kernel privilege escalation via a race condition in the copy-on-write handling of memory mappings. An unprivileged process with read access to a file can race the COW path to write the underlying page, modifying files it should only be able to read, including system binaries owned by root. Widely used in rootkits and Linux malware. Impacted a wide range of distributions and Android.
Source: NVD CVE-2016-5195NSA SMBv1 exploit leaked by Shadow Brokers in 2017. Buffer overflow allows unauthenticated remote code execution. Instrumental in WannaCry and NotPetya. Spurred deprecation of SMBv1 and stronger patching practices.
Source: NVD CVE-2017-0144Vulnerability in the Microsoft Support Diagnostic Tool (MSDT) triggered via crafted Word documents. Executes code through the ms-msdt protocol handler without macros when the document is opened; the RTF variant fires from the Explorer preview pane with no click at all. Stealthier than VBA-based attacks. Used in phishing campaigns before fully addressed.
Source: NVD CVE-2022-30190OpenSSL flaw allowing attackers to read up to 64KB of server memory per request, keys, passwords, session tokens. Affected an estimated ~17% of TLS-enabled web servers at peak.
Source: NVD CVE-2014-0160Critical RCE in Apache Log4j. A logged string containing ${jndi:ldap://…} triggers a JNDI lookup; the attacker hosts a class on the referenced server that the JVM then fetches and runs.
Three chained Exchange vulnerabilities (CVE-2021-34473, -34523, -31207) allowing unauthenticated SYSTEM-level RCE. AutoDiscover and PowerShell endpoint abuse. Mass exploitation after Black Hat 2021 demo, web shells and ransomware staging.
Source: NVD CVE-2021-34473GNU Bash flaw allowing arbitrary command execution via environment variables. Especially dangerous through CGI scripts. Affected web servers, routers, IoT. Exploits appeared within hours of disclosure. Drove broad review of UNIX-based software.
Source: NVD CVE-2014-6271Hardware vulnerabilities affecting modern microprocessors. Exploit speculative execution to leak memory across trust boundaries. Affect Intel, AMD, ARM chips. Required firmware and software mitigations. Paradigm shift in how hardware-level trust boundaries are viewed.
Source: meltdownattack.comNetlogon protocol flaw (CVE-2020-1472) allowing an unauthenticated attacker on the network to gain domain admin by exploiting a weakness in the AES-CFB8 implementation to bypass Netlogon authentication, then resetting the domain controller’s machine-account password to a known value and pivoting to domain admin. Actively exploited soon after disclosure.
Source: NVD CVE-2020-1472One common password, many accounts. The inverse of brute force on a single account, designed to avoid lockouts and stay under detection thresholds. A seasonal candidate such as Spring2024! tried once against every user in a directory will get a few hits and almost never trip a lockout, exactly the pattern that should appear in identity-provider logs when a spray is underway.
The opposite of password spraying: one account, many passwords. The attacker cycles through common candidates, password, 123456, qwerty, letmein, against one locked target. Lockout policies and rate limits exist to defeat this; weak detection lets it grind silently for hours.
The attacker never needs the plaintext password. The NTLM hash from host A authenticates against host B because the protocol treats the hash as the credential. Silent, irreversible until the password is rotated, and the backbone of many lateral-movement campaigns.
LSASS memory holds the credentials of every active session. Tools like Mimikatz read it directly and extract hashes, tickets, and (sometimes) plaintext. EDR catches Mimikatz-style reads by detecting unusual access to the lsass process.
With the krbtgt account hash, an attacker forges a Kerberos Ticket Granting Ticket that authenticates as anyone, for as long as they want. The only fix is rotating the krbtgt password twice, which is rare and disruptive.
The session cookie is the credential after login. Steal it via XSS, MITM, or malware, replay it from anywhere, and the server cannot tell. No password prompt, no MFA, just the cookie. Same SID, different person.
Discovering valid usernames or accounts by analyzing system responses during login attempts or other interactions.
Source: ATT&CK T1087Adversary gains unauthorized control of a user’s account using stolen credentials or session tokens to impersonate the user.
Usernames and passwords exposed, stolen, or leaked, enabling attackers to gain unauthorized access to systems or services.
Source: ATT&CK T1078Extracting credentials (hashes, tokens, tickets) from a compromised system’s memory or files.
Source: ATT&CK T1003Stealing login information through phishing, malware, or system exploitation.
Source: ATT&CK TA0006Forging Kerberos TGTs to grant unrestricted domain access by impersonating any user.
Source: ATT&CK T1558.001Injecting a stolen or forged hash into a system’s authentication mechanism to impersonate a user without the plaintext password.
Targeting Kerberos service tickets to extract and crack service account credentials offline; often used for lateral movement.
Source: ATT&CK T1558.003Combining Pass-the-Hash with Kerberos by using NTLM hashes to request Kerberos tickets, bypassing some defenses.
Intercepting and relaying NTLM authentication messages to access resources without knowing the user’s password.
Source: ATT&CK T1557.001Using stolen password hashes to authenticate without needing to crack or know the actual password.
Source: ATT&CK T1550.002Using brute force, dictionary attacks, or rainbow tables to recover plaintext passwords from hashes.
Source: ATT&CK T1110.002Trying a small number of common passwords against many accounts to avoid lockouts.
Source: ATT&CK T1110.003Precomputed table of hash values used to reverse cryptographic hashes, recovering plaintext passwords more efficiently.
Taking over an active session by stealing or guessing session tokens or cookies, bypassing authentication.
Similar to Golden Ticket but targets Kerberos Service Tickets (TGS), giving access to specific services within a domain.
Source: ATT&CK T1558.002Like NTLM Relay, but specifically targeting Server Message Block to relay authentication requests.
Source: ATT&CK T1557.001Creating or modifying security tokens to assume the identity and privileges of another user or process.
Source: ATT&CK T1134.001Altering or forging tokens to escalate privileges or bypass security controls within Windows.
Source: ATT&CK T1134Unauthorized acquisition of authentication tokens from memory or storage, enabling attackers to impersonate legitimate users.
Source: ATT&CK T1134.001A legitimate process is launched in a suspended state, its memory is replaced with malicious code, and execution resumes. To observers (and many EDR tools) the process still looks like the trusted binary: same name, same path, same parent. The shell stays the same while the contents are swapped.
A malicious DLL is loaded into another process’s address space. The injected code now runs with the target’s privileges and trust, inherits its network handles, and survives in the loaded-modules list of a legitimate binary. EDR catches the injection moment; static tools see only a benign process.
Why install attacker tooling when Windows already ships with everything you need? PowerShell, certutil, rundll32, wmic, mshta, bitsadmin: every one signed, trusted, allowlisted, and bundled on every host. Same binary, different intent, no new file on disk.
Input that becomes code. Whether it is SQL, JavaScript, shell, or Python eval, the pattern is the same: untrusted text concatenates with logic and the interpreter cannot tell where the data stops and the program begins. Benign input and malicious input travel the same path; the difference shows up only at runtime, in what the interpreter actually does with it.
Inserting malicious code into a vulnerable application to execute arbitrary commands or manipulate program behavior.
Source: ATT&CK T1055Using legitimate command-line shells or scripting environments (PowerShell, cmd.exe) to execute commands, often to evade detection.
Source: ATT&CK T1059Injecting code into another running process’s memory space to hide execution and bypass security controls.
Source: ATT&CK T1055Injecting a Dynamic Link Library into a target process to execute malicious code within that process’s context.
Source: ATT&CK T1055.001Abusing legitimate system tools already on the host. powershell, certutil, rundll32, wmic, mshta, bitsadmin.
Source: LOLBAS projectUsing macros embedded in Office documents or other files to execute malicious code once the file is opened.
Source: ATT&CK T1059.005Exploiting Windows transaction mechanisms to execute malicious code under the guise of a legitimate process without modifying the original executable on disk.
Source: ATT&CK T1055.013A legitimate process is created suspended, its memory replaced with malicious code, then resumed under the guise of a trusted process.
Source: ATT&CK T1055.012Altering the name or appearance of a malicious process to mimic legitimate system processes, evading detection.
Source: ATT&CK T1036Stealthier DLL injection where the DLL loads itself into memory without touching disk, helping evade antivirus detection.
Source: ATT&CK T1620Loading and executing a malicious DLL or module through a legitimate application to bypass security controls.
Source: ATT&CK T1574.001Injecting malicious code into a running thread of another process for stealthy execution.
Source: ATT&CK T1055Mechanisms adversaries use to communicate with and control compromised systems.
Vocabulary for: Uncover
Periodic check-in from an infected host to its C2 server. The cadence is the signature: regular intervals (60s, 5m, 1h) with consistent packet sizes betray a beacon even when the destination and protocol look legitimate. Modern implants add jitter, randomizing the sleep around a base interval, so hunters look for tight statistical distributions rather than exact periodicity.
The data is in the subdomain. aGVsbG8.dGhpcw.attacker.example looks like a DNS query to your firewall, but the labels are base64-encoded chunks of command-and-control traffic. Because DNS is rarely blocked or deep-inspected, the channel hides in plain sight. Long, high-entropy subdomains to the same parent zone are the canonical detection signal.
One domain. Six (or sixty, or six hundred) IPs rotating beneath it on short TTLs. Block one IP, the next resolution returns another. Defenders trying to take down the infrastructure can’t pin it long enough for a block to stick.
Instead of a hardcoded C2 domain, the malware computes a fresh list each day (or hour) from a seed. The attacker registers just one of the generated names. The malware tries them all; only the registered one resolves. Static blocklists never quite catch DGA-driven malware because the candidate names change continuously.
The beacon hides in normal-looking HTTPS traffic. To a proxy log, a C2 request is identical to any CDN or SaaS request: 200 OK, encrypted body, common-looking hostname. The beacon is indistinguishable from its neighbors at a glance, which is exactly why TLS-aware decryption and JA3/JA4 fingerprinting matter.
The SNI (and DNS lookup) point at a trusted CDN, so the firewall sees only the allowed front. Inside the encrypted request, the Host: header redirects to attacker infrastructure on the same CDN. That mismatch between outer and inner names is where the technique lives, and why most major CDNs eventually shut the door on it.
Periodic network communication from an infected host to a C2 server.
Hosting services known for ignoring abuse complaints and allowing malicious activities to operate with minimal risk of takedown.
Communication channel between an attacker and a compromised system used to send commands, receive stolen data, or control malware post-infection.
Source: ATT&CK TA0011Proprietary or disguised protocols on unexpected ports (e.g., a home-grown C2 protocol on port 8888) to evade detection that expects known service behavior.
Source: ATT&CK T1571Malware retrieves commands from content stored on legitimate platforms (Pastebin, GitHub, social media), avoiding direct connection to attacker infrastructure.
Source: ATT&CK T1102.001Abusing DNS to encapsulate and exfiltrate data or create covert C2, bypassing traditional network controls.
Source: ATT&CK T1071.004Algorithm generating many domain names on the fly, making C2 connections hard to block via static domain blacklists.
Source: ATT&CK T1568.002Using SMTP/IMAP to send or receive commands and data, hidden in attachments or content that blends with business traffic.
Source: ATT&CK T1071.003Sensitive data uploaded via HTTPS to attacker-controlled servers, helping evade content inspection.
Rapidly rotating DNS records that cycle a malicious domain through many IP addresses, hiding C2 servers behind shifting infrastructure and defeating IP-based blocking and takedowns.
Source: ATT&CK T1568.001Standard HTTP/HTTPS traffic carrying C2, blending with normal web activity.
Source: ATT&CK T1071.001Embedding commands or data in ICMP echo packets (ping) to establish covert C2 communication that traditional firewalls often miss.
Source: ATT&CK T1095Mesh-like networks where infected systems communicate with each other to share commands and updates without a centralized server.
Abuse of Slack’s APIs, webhooks, or tokens to create covert C2 by embedding commands or exfiltrated data within messages or bots.
Source: ATT&CK T1102Using Twitter, Facebook, Instagram to post encoded commands or retrieve data via posts, images, or profiles on trusted domains.
Source: ATT&CK T1102Leveraging Telegram’s bot API to issue commands or receive data, creating C2 over an encrypted, trusted messaging platform.
Source: ATT&CK T1102Leveraging Tor to anonymize attacker and malware communication, making attribution and traffic analysis significantly harder.
Source: ATT&CK T1090.003The deliberate, unauthorized transfer of data out of the network. Sensitive files leave through whatever hole the attacker can use, encrypted upload to a cloud drop, DNS tunnel, or a slow drip below the DLP threshold. The real signal is usually a small one, repeating, in a direction the network was not expecting.
An incident where an unauthorized party gains access to protected or sensitive data, often involving large-scale loss of personal or organizational information.
Deliberate and unauthorized transfer of data from a system or network to an external location.
Source: ATT&CK TA0010Data left accessible without proper controls, often due to misconfigurations like open cloud storage or unsecured APIs.
Automated or bulk collection of data via scrapers, malware, or scripts, often used for profiling, fraud, or resale.
Unintended or accidental release of sensitive data, often caused by human error, misconfigured systems, or negligence.
Stealthy exfiltration techniques such as covert DNS queries, encrypted uploads, or embedding in benign-looking traffic.
Sensitive data collected and stored locally in chunks before exfiltration, avoiding large, sudden transfers that DLP would flag.
Source: ATT&CK T1074A system or application reveals internal details, sensitive metadata, or user data, often as part of a vulnerability or misconfiguration.
Unauthorized access and removal of sensitive data by a trusted internal party with legitimate access.
Data intercepted while being transmitted across a network without proper encryption or integrity checks, vulnerable to MITM or sniffing.
Sensitive or regulated data stored in unmanaged, forgotten, or unsanctioned locations, abandoned cloud buckets, rogue spreadsheets, old backups.
Compromise or exposure of sensitive data caused by a breach, misconfiguration, or negligence on the part of an external vendor or partner.
Leakage involving documents, logs, screenshots, audio, harder to classify or monitor using traditional DLP tools.
The malware rewrites itself on each generation, different hashes, different bytes, identical behavior. Signature-based detection sees four “different” samples; behavior-based detection sees one campaign. The hash on the left cycles while the behavior box on the right stays static. This is why TTP-based hunting outperforms IOC-based for sophisticated adversaries.
Most sandboxes are not very lived-in. They have small disks, brief uptime, no mouse activity, suspicious driver names, and known artifacts. Malware that runs the checks above will sit silent in analysis, then unfurl on a real user’s host.
Attackers rewrite the MAC (modified / accessed / created) timestamps on dropped files to a date that matches everything around them. A binary that “shipped with Windows” in 2009 won’t catch the eye of an analyst scanning recent-changes lists. Same bytes, different forensic story.
Abuses Windows Application Compatibility Infrastructure (shims) to inject malicious code or maintain persistence.
Source: ATT&CK T1546.011Adds non-functional data or junk code to malware files to change their hash and avoid signature-based detection.
Source: ATT&CK T1027.001Code is deliberately scrambled, encrypted, or disguised to make analysis harder and evade static analysis engines.
Source: ATT&CK T1027Switches out C2 domains regularly to avoid blacklisting and detection.
Malicious commands hidden using encoding (Base64), string concatenation, or misleading syntax to bypass command-line monitoring.
Source: ATT&CK T1027.010Non-standard encryption schemes that wrap malicious traffic to avoid detection by DPI or SSL/TLS inspection.
Source: ATT&CK T1573Malware waits for a specific trigger (time, date, keyboard input) before executing, bypassing sandbox environments.
Source: ATT&CK T1497.003Disguises the true destination of HTTPS traffic by routing through a legitimate front-facing domain.
Source: ATT&CK T1090.004Payloads encoded (Base64, XOR) to hide true content until runtime, evading static detection.
Source: ATT&CK T1027Malware inspects its environment (VMs, debuggers) before running to avoid sandbox analysis.
Source: ATT&CK T1497Files disguised with misleading extensions (e.g., invoice.pdf.exe) to trick users and bypass basic file-type filters.
Living Off the Land Binaries: trusted, signed system executables (certutil, rundll32, mshta) weaponized so the malicious part is the argument line, not the file on disk. The evasion face of the Living Off The Land technique covered under Execution.
Source: LOLBAS projectPerforms actions gradually or in minimal increments to remain under detection thresholds.
Disguises a malicious process or file by renaming it or giving it the appearance of a trusted application.
Source: ATT&CK T1036Injects code directly into memory rather than writing to disk, avoiding file-based detection.
Source: ATT&CK T1055Spawns processes that appear to be launched by trusted executables (like explorer.exe), misleading analysts and EDR.
Encapsulates malicious traffic within legitimate protocols (HTTPS, DNS, ICMP) to bypass network detection.
Source: ATT&CK T1572Executes malicious code through trusted signed binaries (rundll32, regsvr32), exploiting inherent trust.
Changes MAC addresses to impersonate other machines or confuse device-based monitoring.
Abuses subdomains that genuinely belong to trusted services, e.g., attacker tenants like evil.azurewebsites.net or takeover of dangling DNS records, so traffic inherits the parent domain’s reputation.
Alters file timestamps to make malicious activity appear older or less suspicious.
Source: ATT&CK T1070.006Schedules or delays actions to avoid time-sensitive monitoring tools or activate only during specific conditions.
Source: ATT&CK T1497.003Alters HTTP headers to mimic trusted applications or browsers, blending into normal web traffic.
Malware detects sandboxes or VMs and refuses to execute, hiding true behavior from automated analysis.
Source: ATT&CK T1497.001Uses complex or hidden WMI commands to evade detection and gather data stealthily.
Source: ATT&CK T1047Deceptive messages that lure users into clicking, opening, or entering credentials. The bait is the email; the line is the trust the sender impersonates; the catch is initial access.
Don’t go to the targets. Wait at the website they all visit (an industry news source, a community forum, a vendor portal), implant a payload there, and infect everyone who shows up. Originally a metaphor; now a mature tradecraft used in espionage.
The vendor ships the malware for you. A signed, trusted update flows through normal channels to thousands of customers, every one of them welcoming it. SolarWinds, ShadowHammer, 3CX, M.E.Doc, different names, same shape.
The attacker is not guessing. They have leaked credentials from somewhere else. They replay them at scale against your login page. Password reuse across sites is what makes the economics work: reuse is common enough that even a per-attempt success rate well under one percent pays off across millions of attempts. Rate limits and MFA stop most of this.
Automated injection of stolen username-password pairs into login forms, relying on credential reuse.
Source: ATT&CK T1110.004Malicious code automatically downloaded and executed simply by visiting a compromised or malicious website, often without user interaction.
Source: ATT&CK T1189Malware or exploit code embedded in an email attachment that executes when the user opens the file.
Source: ATT&CK T1566.001Targets vulnerabilities in externally exposed applications (web servers, APIs) to gain unauthorized access or RCE.
Source: ATT&CK T1190Malicious advertisements on legitimate websites that redirect users to exploit kits or deliver malware.
Source: ATT&CK T1583.008Deceptive emails or messages tricking users into revealing credentials or downloading malware.
Source: ATT&CK T1566Gains access via Remote Desktop Protocol, then uses it to move laterally or reach other internal assets.
Source: ATT&CK T1021.001Manipulates people into performing actions or revealing information by exploiting trust, fear, urgency, or authority.
Source: CISATargeted phishing customized for a specific individual or organization to increase success rate.
Source: ATT&CK T1566Targets third-party software or service providers to insert malicious code or access downstream victims (e.g., SolarWinds).
Source: ATT&CK T1195Registers look-alike domains to trick users into visiting malicious sites, often to harvest credentials or deliver malware.
Malware delivered via infected USB drives that automatically executes when plugged in.
Source: ATT&CK T1091Compromises a website frequently visited by a target group, embedding malware to infect visitors.
Source: ATT&CK T1189Phone calls or voicemails impersonating authority figures or institutions to extract credentials or prompt unsafe actions.
Source: ATT&CK T1566.004Spear phishing targeting high-profile individuals like executives, often for financial fraud or data theft.
Four questions on the adversarial vocabulary. No grades; the point is retention.
Why does Pass-the-Hash work without the attacker ever cracking a password?
The NTLM hash is the credential. An attacker who reads a hash from one host's memory can authenticate to other hosts with it directly; the plaintext never enters the picture, so password strength is irrelevant. That is what makes the technique silent, the backbone of lateral-movement campaigns, and irreversible until the password (and with it the hash) is rotated.
An attacker obtains the krbtgt account hash in an Active Directory domain. What can they do, and what is the only real fix?
The krbtgt hash signs every Ticket Granting Ticket in the domain, so holding it lets the attacker mint tickets as any user, with any lifetime: the Golden Ticket. Forged tickets are self-contained, so changing user passwords does nothing. The only fix is rotating the krbtgt password twice, because a single rotation leaves the previous key valid for ticket validation. That double rotation is rare and disruptive, which is exactly why the technique is prized for persistence.
Malware using a Domain Generation Algorithm defeats static domain blocklists. How?
The malware and the attacker share the algorithm and the seed. Each day or hour the malware computes the same candidate list the attacker does, tries them all, and reaches whichever single name the attacker actually registered. Blocking yesterday's domains accomplishes nothing because tomorrow's list is already different. Detection shifts to the pattern itself: bursts of failed lookups for algorithmically random names.
What distinguishes password spraying from a classic brute-force attack?
Classic brute force hammers one account with many passwords and trips the lockout in minutes. Spraying inverts the shape: one or two plausible passwords against hundreds of accounts, then a pause, then the next password. Each account sees so few failures that lockouts never fire, which is why detection depends on looking across accounts (many usernames, one source, the same interval) rather than at any single one.