Key takeaway
Start by identifying essential services, data and dependencies. Then select access controls, patching, backups, monitoring and incident exercises for the scenarios most likely to affect them.
What is a cyber threat?
A cyber threat is a potential event or circumstance that could harm digital systems or data; an attack is an attempt to cause harm. Threats may involve financially motivated criminals, state actors that may pursue espionage or political aims, ideologically motivated hacktivists, or insiders who create risk deliberately or by mistake. The actor’s identity is often unknown in advance; build defenses around observable behavior and the services you need to protect.
Malware and ransomware
Malware includes viruses, worms, Trojans and spyware; adware displays ads and is not always malicious. Their behavior and aims vary. Ransomware can encrypt files or lock systems and may threaten to publish stolen data. Ransomware-as-a-service (RaaS) can give other criminals access to an attack operation. Initial access can come through phishing, a malicious download or an exploited vulnerability. Controls include updated endpoint protection, restricted privileges, network segmentation, email defenses and backups kept separately from the network and tested through restoration.
Phishing and social engineering
Social engineering tries to persuade someone to reveal a password, make a payment or share sensitive information. Phishing can use email, messages, calls and fake sites; spear phishing tailors an approach to a specific person. Executive impersonation and pretexting exploit trust and urgency, while baiting tempts users with an appealing file or offer. Teach staff to verify unexpected requests through another channel, use MFA and report suspicious messages easily; support that training with filtering and payment approval rules.
DDoS and service availability
A distributed denial-of-service (DDoS) attack can disrupt availability by overwhelming a server or network service with traffic. The traffic may come from a botnet of compromised devices, including IoT devices, and may serve as a distraction from other activity. For critical services, agree on traffic thresholds and provider escalation, assess DDoS mitigation, prepare customer and staff communications, and rehearse traffic filtering and failover to a backup service.
Zero-days and supply-chain exposure
A zero-day attack exploits a previously unknown hardware, firmware or software vulnerability. A known flaw with an available patch that has not yet been installed is an unpatched vulnerability, not a zero-day. Zero-day attacks may target cloud services, SaaS providers or software supply chains. Inventory assets and supplier dependencies, prioritize patches, limit integration permissions, strengthen authentication, monitor suspicious behavior and learn each supplier’s incident and update process.
Insider risk and data exposure
Insider risk can involve an employee deliberately taking data, accidentally exposing access, sending information to the wrong recipient or falling for phishing. An external attacker may also cause a data leak with a stolen account or misconfiguration. Classify sensitive information, limit access by role, record sharing and exports, close accounts when people leave and establish a clear incident reporting process. Investigate based on evidence; suspicion alone does not establish intent.
Cloud, API and IoT threats
A cloud misconfiguration can expose data; weaknesses in API authentication or access control can enable unauthorized access. APIs and container environments in cloud workloads can also be targets, so review images, permissions, secrets and network boundaries. Unpatched IoT devices or devices with default passwords may join a botnet or become an entry point to a network. Review cloud storage and API permissions regularly, protect and rotate keys, inventory and update devices, restrict IoT to the network segments it needs and include provider logs in monitoring.
Emerging and changing risks
AI can make phishing easier to automate and enable fraud using synthetic voices or video that impersonate an executive. Verify important payment and instruction requests through an independent channel and approval process even when the material looks convincing; do not rely only on signs of a deepfake. Quantum computers could pose a future risk to some current encryption methods, but that does not establish an active attack today. New technologies such as IoT and containers also bring configuration and patching responsibilities. Update data-flow records, ownership and threat models when adopting them.
Assess business impact
Assess impact beyond potential fines. Consider service downtime, data loss, recovery time, customer and supplier obligations, financial fraud and damage to trust. For each critical process, define acceptable downtime and a recovery point: the maximum tolerable data loss measured in time. Then select the required backups, alternate service and escalation level. Record the evidence, likelihood, impact, owner and next review date in the risk register.
Defense and incident readiness
Combine controls according to risk: verify identity and grant least privilege; separate critical systems; prioritize vulnerability remediation; monitor endpoints and cloud activity; encrypt data and test backup restoration. A Zero Trust approach evaluates each request in context and continually checks access. Use relevant threat intelligence with endpoint and cloud logs to prioritize alerts; if SIEM/SOAR is in use, assign an integration owner and escalation path. Document roles, evidence preservation, decision makers and recovery criteria in the incident plan, then use tabletop exercises to find gaps.
Build a security culture
Technology does not replace everyday decisions. Train employees in role-specific phishing awareness, safe data sharing and incident reporting; involve executives in risk ownership and budget decisions. Security, IT, legal, privacy and business teams should agree on communication and decision paths before an incident. Update procedures after incidents and exercises, assigning owners and dates to recurring gaps.
Malware and other attack methods
Malware is malicious code that may be running on a system or dormant until triggered; not every cyberattack installs software. Phishing can steal passwords or payment details directly. A man-in-the-middle attack intercepts or alters traffic between parties. Credential stuffing tests stolen username-and-password pairs from other services where people have reused them, while brute force repeatedly guesses credentials. DoS/DDoS targets service availability, and vulnerability exploitation targets a software flaw. An incident can combine methods, so investigate both the visible impact and the initial access path.
Credential attacks
Counter credential stuffing and brute force with unique passwords, MFA, login rate limits and monitoring for suspicious attempts.
Network and service attacks
Reduce MitM risk with encrypted connections and certificate validation. For DDoS scenarios, plan traffic thresholds, provider escalation and service recovery.
Software vulnerabilities
Inventory assets and versions, prioritize security updates, disable unused services and verify that fixes for identified vulnerabilities are applied.
Hosting, distribution and MaaS are distinct
Hosting infrastructure used for malicious sites or files, the delivery method used to reach victims and the criminal service model are separate concepts. An attacker may place a file on a compromised server, send a link through a phishing email or buy botnet access from another criminal. Malware-as-a-Service (MaaS) offers paid access to malware and its use; botnet rental, exploit delivery and access brokerage are broader criminal services. None of these facts alone makes the hosting provider complicit. Record the confirmed domain, file, delivery message and related infrastructure separately during an investigation.
Hosting infrastructure
A compromised web server may host a malicious file or page. The hosting provider, server owner and attacker may be different parties.
Delivery method
A phishing link, email attachment, fake download or exploit can deliver a file to a device. These methods do not by themselves describe a service business model.
Criminal service model
MaaS offers paid access to malware and its use; botnet rental, exploit delivery and access brokerage are other criminal services. One participant may maintain infrastructure while another uses it in a separate campaign.
Historical case: TrickBot
A joint CISA and FBI advisory revised on March 17, 2021 described TrickBot as modular, multi-stage malware. The advisory documented phishing messages, including a traffic-violation lure, data theft, lateral spread using SMB and delivery of follow-on ransomware such as Ryuk and Conti.
Initial access
The CISA/FBI advisory described spearphishing attachments and links, including a JavaScript file downloaded from a compromised server. Verify unexpected messages and attachments through another channel before opening them.
Modules and network activity
According to the advisory, modules could steal information, enumerate hosts, use SMB for lateral movement and download additional malware. Investigate logs, identity events and network connections together.
Defense and response
If infection is suspected, follow the incident response plan: coordinate safe isolation with responders, preserve relevant evidence and investigate affected accounts and systems. Apply patching, MFA, segmentation, email filtering and tested backups according to risk.
Persistent hidden access: campaign examples
State-linked campaigns can pursue espionage, supply-chain access and preparation to disrupt essential services. These dated examples help defenders compare access and persistence methods. Assess vulnerabilities and supplier access, restrict execution of unverified programs, and investigate privilege escalation and movement to other systems in the network.
Volt Typhoon · 2024
On February 7, 2024, CISA, NSA and FBI warned about Volt Typhoon maintaining access to U.S. critical infrastructure. The campaign highlighted use of existing system tools, known as living off the land.
APT41 · 2020
In September 2020, the U.S. Department of Justice announced charges associated with APT41 activity. The alleged intrusions included theft of source code and signing certificates and compromise of software suppliers.
APT10 · 2018
The FBI’s APT10 record describes December 2018 charges involving computer intrusion, wire fraud and identity theft. Include third-party accounts and connections in your environment’s access controls and monitoring.
Malware families
MITRE ATT&CK describes ShadowPad as a modular backdoor and PlugX as a remote-access tool. FortiGuard’s 2019 Zegost research documents information theft and keystroke recording. A family name alone does not identify an actor; investigate processes, accounts, networks and files together.