Overview
The technology industry, over the past few decades, has witnessed a rapid proliferation of innovations in a diverse array of fields. These technological advancements have brought about numerous benefits and conveniences, but they have also given rise to a parallel surge in cybersecurity threats, necessitating the continuous development of robust security measures. This essay dives into the various types of threats faced in the cybersecurity industry, focusing on key adversaries such as Distributed Denial of Service (DDoS) attacks, Advanced Persistent Threats (APTs), viruses, and steganographic threats. Each of these threats are explored in detail, shedding light on their methodologies and evolving characteristics. Furthermore, the essay touches on the motives behind these threats, revealing a few of the diverse and often complex motivations that drive malicious actors to compromise the integrity of technology systems. By comprehending the multifaceted nature of these threats and their underlying motives, it becomes possible to implement more effective and adaptive cybersecurity strategies, reaching to safeguard the technology industry's continued growth and innovation.
Phishing Attacks
Phishing attacks stand out as a pervasive and versatile threat, making it imperative to dive into their underlying motives and the diverse range of methods by which they are employed to deceive and compromise security. Phishing attacks are defined by the Computer Security Resource Center (CSRC) as a “technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a website, in which the perpetrator masquerades as a legitimate business or reputable person.” The next paragraph will cover some of the different Phishing attack techniques that are being utilised within the industry.
Standard Phishing attacks typically begin with a suspicious email, either looking to get a wide audience to visit a malicious link or download a malicious file. Phishing attacks are specifically designed to be sent out to many potential victims, with the goal of as many “catches” as possible, usually with only a small percentage of catches necessary for the cyber attack to be successful. However, another type of Phishing attack, a “Spear-Phishing” attack is specifically targeted at one or a small number of potential victims, typically curated with content gathered from an Open-Source Intelligence (OSINT) gathering session. Other techniques used within Phishing attacks include Whaling (Spear-Phishing attacks aimed at senior executives, masquerading as legitimate emails), Clone Phishing (legitimate email or website replication phishing), Pharming (online fraud that involves the use of malicious code to direct victims to spoofed websites), Vishing (Voice Call Phishing) and Smishing (SMS Phishing).
Three mitigation techniques for phishing attacks include email filtering, User Awareness Training and Two-Factor Authentication (2FA). Email filtering uses specialised software to automatically detect and block suspicious emails. It helps prevent phishing emails from reaching users' inboxes by analysing the content, attachments, and sender information, thereby reducing the likelihood of users falling victim to phishing attempts. In addition, through training programs, users learn to recognise phishing emails, understand social engineering techniques, and adopt best practices for verifying the legitimacy of emails. This empowers users to make informed decisions and reduces the likelihood of falling prey to phishing attempts. Lastly, Two-Factor Authentication is an additional layer of security that mitigates the impact of phishing attacks by requiring users to provide two forms of identification before accessing an account. Even if a user's credentials are compromised through phishing, the attacker would still need the second factor (e.g., a code sent to a mobile device) to gain unauthorised access. This adds an extra barrier, making it more difficult for attackers to successfully exploit compromised credentials. Other phishing attack mitigation techniques may include Email Authentication Protocols (like DMARC, SPF, and DKIM), up-to-date software and URL/mail header inspection.
Denial of Distribution of Service (DDoS) Cyber Attacks
Following Phishing attacks as one extensively used threat in the Cyber industry, another vector of attack is Denial of Distribution of Service attacks, also known as DDoS or Denial of Service attacks. These attacks use botnets or proxy servers (also known as “proxies”) to overload other systems in the hopes of crashing them. Botnets are networks of private computers infected with malicious software and controlled as a group without the owners' knowledge, and proxies are server applications that act as intermediaries between a client requesting a resource and the server providing that resource. The Kaspersky Encyclopedia defines denial of Distribution of Service (DDoS) attacks as a “Denial of Service technique that uses numerous hosts to perform [an] attack.” The next paragraph will cover some of the different Denial of Distribution of Service (DDoS) attack techniques that are being utilised within the industry.
While there are many different DDoS attack methods, some of the most commonly utilised are Volume Based Attacks, Protocol Based Attacks, Application Layer Attacks and Reflection/Amplification Attacks. Volume Based DDoS attacks aim to target a network with an overwhelming number of resources and often come in the form of UDP and ICMP flood attacks, which send a high volume of packets to saturate the target's network capacity. Protocol Based DDoS Attacks work to exploit vulnerabilities in network protocols to bring networks down and often come in the form of SYN flood attacks that exploit the TCP handshake process, or Ping of Death attacks that manipulate ICMP packets. Application Layer Attacks, also known as Layer 7 Attacks, target the software and application resources of the victim, such as CPU, memory, or application-specific limits. These attacks usually come in the form of either HTTP floods, which send a high volume of HTTP requests, and Slowloris attacks, where attackers open many connections to the target but send data very slowly, causing server resources to be tied up. Lastly, Reflection/Amplification attackers leverage intermediary servers or devices to reflect and amplify the attack traffic towards the target, often by utilising forged source IP addresses to hide their identity. Common Reflection/Amplification attacks come in the form of DNS amplification, NTP amplification, and SSDP amplification attacks, which exploit services that respond with larger volumes of data than the initial request, effectively amplifying the DDoS traffic.
Three mitigation techniques for Denial of Distribution of Service (DDoS) attacks include Content Delivery Networks (CDNs) with built-in DDoS protection, Load Balancers and Intrusion Detection and Prevention Systems (IDPSs). CDNs with built-in DDoS protection serve as a mitigation technique for DDoS attacks by distributing content across multiple servers and data centres. They can identify and filter out malicious traffic, ensuring that legitimate requests reach the target server. By absorbing and mitigating DDoS traffic closer to the source, CDNs help prevent service disruptions and maintain the availability of the targeted online services. In addition, load balancers function as a mitigation technique for DDoS attacks by distributing incoming network traffic across multiple servers, ensuring that no single server is overwhelmed. In the face of a DDoS attack, load balancers can intelligently distribute traffic, redirecting or blocking malicious requests. This helps maintain service availability and prevents a single point of failure, allowing the system to handle increased loads more effectively. Lastly, IDPSs serve as a mitigation technique for DDoS attacks by monitoring network and system activities for abnormal patterns that may indicate an ongoing attack. These systems can detect and block malicious traffic in real-time, preventing the DDoS attack from overwhelming the network or servers. IDPSs contribute to the early detection and response to DDoS incidents, enhancing the overall resilience of the network infrastructure against denial-of-service threats. Other DDoS attack mitigation techniques may include traffic scrubbing, Anycast DNS, bandwidth scaling, Border Gateway Protocol (BGP) Anycast, network and server updates/patches, simulation DDoS attacks, IP rate limiting and blacklisting, DNS redundancy and data backup and recovery tools
Remote Access Tool (RAT) Attacks
Remote Access Tools (RATs) emerge as a multifaceted cyber attack vector, with motives that encompass espionage, data theft, and system compromise, and usages that grant malicious actors covert access to target networks, often leading to devastating consequences for individuals, organisations, and critical infrastructure. Remote Access Tools (RATs) are defined by the Computer Security Resource Center (CSRC) as “programs for remote access to a computer or other device connected to the Internet or a local network. Remote administration tools can be part of a software product or come as separate utilities. RAT enables remote configuration of applications and devices.” The next paragraph will cover some of the different Remote Access Tool (RAT) attack techniques that are being utilised within the industry.
Remote Access Tool usages may vary. However, some of the most common include RAT-Based Malware Infections, RAT-Based Espionage Attacks, RAT-Based Phishing Attacks, Fileless RAT Attacks, RAT-Based Data Exfiltration and RAT-Based Denial of Distribution of Service (DDoS) Attacks. In RAT-Based Malware Infections, threat actors use RATs to install and maintain malware on a victim's system, providing attackers with unauthorised access. Malware in these attacks may include viruses, worms and/or ransomware. In RAT-Based Espionage Attacks, threat actors leverage RATs to conduct espionage by infiltrating and monitoring targeted systems and networks. In RAT-Based Phishing Attacks, RATs may be involved in phishing campaigns to infiltrate victims' systems when they click on malicious links or open email attachments. Fileless RATs are RATs that operate in a system’s memory, leaving minimal traces on the victim's system by not relying on traditional files for persistence. In RAT-Based Data Exfiltration Attacks, RATs are employed to steal and exfiltrate data from compromised systems. Lastly, in RAT-Based Denial of Distribution of Service (DDoS) Attacks, RATs can be used to infect multiple systems, with some RATs even utilised for Botnet recruitment.
Three mitigation techniques for Remote Access Tool (RAT) attacks include network segmentation, access control and Multi-Factor Authentication (MFA) systems. Network segmentation is a mitigation technique for Remote Access Tools (RAT) attacks that involves dividing a network into isolated segments. By restricting access between these segments, organisations can contain the spread of a RAT attack. If a remote access tool gains unauthorised access to one segment, network segmentation helps prevent lateral movement, limiting the impact and scope of the compromise. In addition, access control serves as a mitigation technique for RAT attacks by enforcing restrictions on user permissions and access privileges. By implementing the principle of least privilege, organisations can ensure that users, including potential attackers employing remote access tools, have only the minimum level of access necessary for their roles. This reduces the risk of unauthorised access and limits the potential damage that can be inflicted through compromised accounts. Lastly, Multi-Factor Authentication is a mitigation technique for RAT attacks that adds an additional layer of security beyond passwords. By requiring users to provide multiple forms of identification, such as a password and a temporary code sent to a mobile device, MFA systems enhance the authentication process. This makes it more challenging for attackers to gain unauthorised access using remote access tools, even if they manage to obtain login credentials through other means. Other RAT attack mitigation techniques may include logging/monitoring, Intrusion Detection and Prevention Systems (IDPS), network/operating system/software/application patching and updates, user awareness training, application whitelisting, Security Information and Event Management (SIEM) systems/behavioural analysis, security audits/vulnerability assessments, data encryption, data backup and recovery tools.
Advanced Persistent Threats (APTs)
Advanced Persistent Threats (APTs) represent a highly sophisticated and persistent cyber attack vector, driven by motives that span from nation-state espionage to corporate espionage, and usages that involve stealthy infiltration, prolonged data exfiltration, and the potential for significant, long-term damage to targeted entities. Advanced Persistent Threat (APT) attacks are defined by the Computer Security Resource Center (CSRC) as “adversar[ies] with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives which are typically to establish and extend its presence within the information technology infrastructure of organizations.” The next paragraph will break the Advanced Persistent Threat (APTs) into three respective strategies that are frequently utilised within APTs in the industry.
Firstly, APTs establish communication channels between compromised systems and their own infrastructure, which are known as Command & Control (C&C) systems. They may use various protocols and encryption methods to maintain stealth and persistence. Next, APTs may use Living Off the Land (LOL) techniques, which involve utilising legitimate tools and processes already present on the target system to carry out their malicious activities. This reduces the likelihood of detection, as the attacker doesn't introduce new or unusual software. Lastly, APTs may target one, lesser secure, organisation with the intent of leveraging it as a stepping stone to infiltrate a more high-profile target, such as a customer, partner, or supplier. This is known as “Island-Hopping” and the choice of island-hopping targets and the methods used can vary based on the ultimate objective.
Three mitigation techniques for Advanced Persistent Threat (APT) attacks include network segmentation, access control and the Least Privilege Principle. Network segmentation is a mitigation technique for Advanced Persistent Threat (APT) attacks that involves dividing the network into isolated segments, creating barriers that can impede lateral movement and limit the APT's ability to traverse the network. This helps contain and isolate potential compromises, reducing the APT's ability to move freely within the network. In addition, access control is a crucial mitigation technique for APT attacks, as it restricts user permissions and access based on predefined roles. By implementing robust access controls, organisations can minimise the risk of APTs gaining unauthorised access to sensitive systems or data, limiting their ability to escalate privileges and move laterally within the network. Lastly, the Least Privilege Principle serves as a mitigation strategy for APT attacks by ensuring that users are granted the minimum level of access necessary for their specific roles. By adhering to this principle, organisations reduce the attack surface and limit the impact of APTs, as compromised accounts will have restricted privileges, mitigating the potential for extensive system compromise. Other APT attack mitigation techniques may include User/Employee Training, Multi-Factor Authentication (MFA) systems, endpoint security solutions, firewall optimisation, Intrusion Detection and Prevention Systems (IDPSs), software/application/system patch and update management, data encryption and Security Information and Event Management (SIEM) Systems.
Virus Attacks
Computer viruses stand as one of the oldest yet enduringly effective attack vectors, driven by motives ranging from financial gain to data destruction, and with usages that can infiltrate, replicate, and disrupt both individual systems and entire networks. Virus attacks are defined by the Computer Security Resource Center (CSRC) as a “computer program that can copy itself and infect a computer without permission or knowledge of the user. A virus might corrupt or delete data on a computer, use e-mail programs to spread itself to other computers, or even erase everything on a hard disk.” The next paragraph will cover some of the different Virus attack techniques that are being utilised within the industry.
Like the other cyber threats discussed, Viruses often also come in various forms. The most common forms include File Infector Viruses, Macro Viruses, Boot Sector Viruses, Resident/Non-Resident Viruses, Polymorphic/Metamorphic Viruses and Multipartite Viruses. A File Infector Virus attaches itself to executable files. When the infected file is executed, the virus activates and spreads to other files. A notable File Infector Virus includes the CIH/Chernobyl Virus. Macro viruses are written in scripting languages embedded within document files, such as Microsoft Word or Excel documents, and are designed to exploit the macros feature in office software. A notable Macro Virus would be the Melissa Virus. Boot Sector Viruses infect the Master Boot Record (MBR) of storage devices (e.g., hard drives, USB drives) and activate when the infected device is booted. The Stone Virus is an example of a Boot Sector Virus. Resident Viruses embed themselves into the system's memory, allowing them to infect other files as they are accessed or executed, while Non-Resident viruses don't become a permanent part of system memory. Instead, they work by modifying or manipulating existing files. Polymorphic Viruses change their code or appearance every time they infect a new file, which makes them challenging to detect with traditional antivirus signatures, and Metamorphic Viruses go a step further by completely rewriting their code with each infection, making them highly complex and challenging to identify. Lastly, Multipartite Viruses combine characteristics of other virus types. These viruses can infect both files and boot sectors, making them versatile and challenging to remove. An example of a Multipartite Virus is the Tequila Virus.
Three mitigation techniques for Virus attacks include Anti-Virus (AV) Software, system/software patches and updates and user awareness training. Anti-Virus Software is a mitigation technique for virus attacks that actively scans files and programs for known patterns or signatures of malicious code. By regularly updating virus definitions, this software can detect and quarantine viruses, preventing them from infecting the system and minimising the impact of potential attacks. In addition, regularly applying system and software patches and updates is a mitigation technique for virus attacks that helps address vulnerabilities in operating systems and applications. Keeping systems up-to-date ensures that known security flaws are patched, reducing the likelihood of viruses exploiting these weaknesses to gain unauthorised access and compromise the integrity of the system. Lastly, user awareness training is a proactive mitigation technique for virus attacks that educates users about safe computing practices. By teaching users to recognize phishing emails, suspicious links, and the importance of not downloading or executing unknown files, organizations can reduce the likelihood of users inadvertently introducing viruses into the system, enhancing overall cybersecurity. Other Virus attack mitigation techniques may include firewall configuration, network segmentation, Least Privilege Principle, application whitelisting, data backup and recovery tools, Multi-Factor Authentication (MFA) systems, Mobile Device Management (MDM) solutions, web filtering, content inspection/sandboxing, security audits and penetration testing.
Ransomware Attacks
Ransomware, with motives encompassing financial extortion, data encryption, and operational disruption, can bring businesses, organisations, and even individuals to a standstill, demanding a heavy toll for data recovery and system restoration. Ransomware attacks are defined by the Kaspersky Encyclopedia as “malicious software that encrypts data or blocks access to it, demanding that the user pay for unlocking or decrypting the data. Different varieties of malware target desktop systems and mobile devices.” The next paragraph will cover some of the different Ransomware attack techniques that are being utilised within the industry.
Ransomware takes many forms. The most common include; Encrypting Ransomware, Locker Ransomware, Maze Ransomware, DoppelPaymer Ransomware and Ryuk Ransomware. Encrypting Ransomware encrypts a victim's files, making them inaccessible and typically demands a ransom payment for the decryption key. Two notable Encrypting Ransomware examples include WannaCry and CryptoLocker. Locker Ransomware, also known as Screen-Locker Ransomware, locks the victim out of their system by displaying a full-screen ransom note. In contrast to Encryption Ransomware, it does not encrypt files but rather, it restricts access. Maze Ransomware, however, not only encrypts files but often also exfiltrates data before encryption. DoppelPaymer Ransomware is known for its complex encryption algorithms and often targets businesses and organisations. Lastly, Ryuk Ransomware is a highly targeted and often manually deployed ransomware and is associated with more sophisticated attack campaigns and organisations.
Three mitigation techniques for Ransomware attacks include data backup, encryption, loss prevention and recovery tools. Data backup is a mitigation technique for ransomware attacks that involves regularly creating and storing copies of critical data in a secure and isolated location. In the event of a ransomware attack, organisations can restore their systems and data from backups, minimising the impact and reducing the incentive for paying the ransom. In addition, encryption serves as a mitigation technique for ransomware attacks by securing sensitive data through the use of cryptographic algorithms. Even if ransomware manages to infiltrate a system, encrypted data remains unreadable to unauthorized parties, reducing the potential impact of a successful attack and protecting the confidentiality of information. Lastly, loss prevention and recovery tools are mitigation measures for ransomware attacks that can detect and block malicious activities in real-time. These tools help prevent the encryption of files and enable organisations to recover encrypted data by restoring affected systems to a known, secure state, reducing the overall impact of a ransomware incident. Other Ransomware attack mitigation techniques may include software/system patches and updates, user training and awareness, email/endpoint security solutions, access control, Least Privilege Principle, network segmentation, Multi-Factor Authentication (MFA), firewall configuration, Intrusion Detection and Prevention Systems (IDPSs), content inspection/sandboxing, secure password policies, behaviour-based detection tools (including SIEM systems), web filtering, security audits, vulnerability assessments and ransomware decryption tools.
Trojan Attacks
Trojans, driven by motives ranging from data theft and espionage to facilitating further attacks, can infiltrate systems, establish backdoors, and execute a wide array of malicious actions, making them a potent weapon in the cybercriminal arsenal. Trojan attacks are defined by the Kaspersky Encyclopedia as “malicious programs that perform actions which are not authorized by the user: they delete, block, modify or copy data, and they disrupt the performance of computers or computer networks. Unlike viruses and worms, the threats that fall into this category are unable to make copies of themselves or self-replicate.” The next paragraph will cover some of the different Trojan attack techniques that are being utilised within the industry.
Cyber attack Trojans come in many forms. Some of these forms include Backdoor Trojans, Dropper Trojans, Fake Anti-Virus Trojans and Fileless Trojans. Firstly, Backdoor Trojans are utilised for providing unauthorised remote access to a compromised system. Attackers can control the system, steal data, or use it as a launchpad for other attacks. Droppers are designed to deliver and execute malicious payloads on a target system and are often used to install a variety of malware, including ransomware or information stealers. Fake Anti-Virus Trojans mimic legitimate antivirus software to deceive users into installing them. Once installed, they may demand payment for "removing" nonexistent threats. Lastly, Fileless Trojans operate in memory without leaving files on the victim's system, making them difficult to detect. They can perform various malicious actions, such as data theft and system compromise.
Three mitigation techniques for Trojan attacks include Anti-Virus/Anti-Malware software, software/system patches/updates and user awareness training. Anti-Virus and Anti-Malware software serve as a mitigation technique for trojan attacks by continuously scanning and detecting malicious code, including trojans, on systems. Regular updates to the software's signature databases enhance its ability to identify and remove trojans, helping to protect systems from unauthorised access and data compromise. In addition, regularly applying software and system patches and updates is a mitigation technique for trojan attacks that helps address vulnerabilities in operating systems and applications. By staying current with security updates, organisations can close potential entry points exploited by trojans, reducing the risk of unauthorised access and data exfiltration. Lastly, user awareness training is a proactive mitigation technique for trojan attacks that educates users on recognising social engineering tactics and avoiding suspicious downloads or email attachments. By promoting cautious online behaviour, organisations can reduce the likelihood of users inadvertently installing trojans, enhancing overall cybersecurity. Other Trojan attack mitigation techniques may include email/endpoint security solutions, access control, Least Privilege Principle, network segmentation, Multi-Factor Authentication (MFA), firewall configuration, Intrusion Detection/Prevention Systems (IDPSs), content inspection/sandboxing, secure password policies, file recovery/data loss prevention and encryption tools, web filtering, security audits and vulnerability assessments.
Worm Attacks
Worms, which are virulent and self-propagating attack vectors, fuelled by motives that span from information theft to system disruption, can lead to rapid, widespread infections, crippling networks, and causing extensive damage to both individuals and organisations alike. Worm attacks are defined by the Computer Security Resource Center (CSRC) as a “computer program that can run independently, can propagate a complete working version of itself onto other hosts on a network, and may consume computer resources destructively.” The next paragraph will cover some of the different Worm attack techniques that are being utilised within the industry.
The most common cyber attack Worms include Network, File-Sharing, Internet-Based, Botnet, Drive-By-Download and Payload Worms. Network Worms exploit vulnerabilities in network services or protocols to spread across computers connected to the same network. File-Sharing Worms spread through shared network drives or peer-to-peer file-sharing networks by placing malicious copies of themselves in shared directories. Internet Worms utilise vulnerabilities in internet-facing services and devices to spread across the internet, scanning for and exploiting new targets. Botnet Worms infect systems and turn them into part of a botnet, allowing attackers to control and coordinate a network of compromised computers. Drive-by-download worms exploit vulnerabilities in web browsers and plugins to infect systems when users visit compromised websites. Payload worms are a category of worms that deliver a payload, which can be any type of malware (e.g., ransomware, spyware, or botnet agents) to the infected systems.
Three mitigation techniques for Worm attacks include network/system/software patch and update management, network segmentation and Intrusion Detection and Prevention Systems (IDPSs). Effective patch and update management is a mitigation technique for worm attacks that involves promptly applying security patches to operating systems, software, and network devices. By addressing vulnerabilities, organisations can minimise the risk of worm propagation and reduce the likelihood of exploitation, enhancing overall system security. In addition, network segmentation is a mitigation technique for worm attacks that involves dividing a network into isolated segments. This helps contain the spread of a worm by restricting its ability to move laterally across the network. In the event of an infection, segmented networks can prevent the rapid proliferation of the worm, limiting its impact. Lastly, Intrusion Detection and Prevention Systems serve as a mitigation technique for worm attacks by monitoring network traffic for suspicious behavior and known attack signatures. IDPSs can detect and block the propagation of worms in real-time, helping organisations respond swiftly to contain and mitigate the impact of a worm outbreak on their network. Other Worm attack mitigation techniques may include Anti-Virus/Anti-Malware solutions, email/web filtering, user awareness training, network monitoring and logging, strong password policies, application whitelisting, network access controls, network backup/recovery tools, network virtualisation tools, isolation/quarantine tools, Zero Trust Network Model, Software Restriction Policies (SRP), network/system hardening, vulnerability scanning and penetration testing.
Spyware Attacks
Spyware, yet another threat, represents a stealthy and intrusive attack vector, motivated by a range of objectives including espionage, data exfiltration, and invasive surveillance, with usages that compromise privacy, steal sensitive information, and compromise the security of individuals and organisations. Spyware attacks are defined by the Computer Security Resource Center (CSRC) as "software that is secretly or surreptitiously installed into an information system to gather information on individuals or organisations without their knowledge; a type of malicious code.” The next paragraph will cover some of the different Spyware attack techniques that are being utilised within the industry.
The most common Spyware techniques include Screen Recorders, RATs with Spyware functionality and Stalkerware. Screen recorders capture and record the user's screen activity, including what is displayed on the monitor and email monitoring spyware tracks and records a user's email communications, including sent and received emails. Remote Access Trojans (RATs) with spyware functionality combine remote control capabilities with spyware features, allowing attackers to surveil and control compromised systems. Lastly, Stalkerware, often used in cases of domestic abuse or harassment, is designed to monitor and track victims, including their location, messages, calls, and online activities.
Three mitigation techniques for Spyware attacks include Anti-Virus/Anti-Spyware solutions, update/patch management and network segmentation/monitoring. Anti-Virus/Anti-Spyware solutions act as mitigation techniques for worm attacks by continuously scanning for and removing malicious code on individual systems. These solutions play a crucial role in preventing the initial infection and spread of worms, providing a first line of defence against potential threats. In addition, update and patch management is a mitigation technique for worm attacks that involves regularly applying security updates to operating systems and software. By keeping systems up-to-date, organisations can close known vulnerabilities exploited by worms, reducing the risk of successful attacks and minimizing the potential impact of a worm outbreak. Lastly, network segmentation and monitoring serve as mitigation techniques for worm attacks by isolating different segments of a network and closely monitoring network traffic. This strategy helps contain the spread of a worm by limiting its lateral movement. Additionally, continuous network monitoring can detect unusual patterns of behaviour associated with worm activity, allowing for rapid response and mitigation. Other Spyware attack mitigation techniques may include endpoint security solutions, browser security solutions, email/web filtering, user awareness training, strong password policies, application whitelisting, network access controls, network backup/recovery tools, isolation/quarantine tools, Zero Trust Network Model, Software Restriction Policies (SRP), network/system hardening, vulnerability scanning and penetration testing.
Rootkit Attacks
Rootkits are a clandestine and insidious attack vector, driven by motives that encompass maintaining persistent access, evading detection, and facilitating a wide range of malicious actions, making them a potent and elusive tool in the hands of cybercriminals. Rootkit attacks are defined by the Computer Security Resource Center (CSRC) as a “set of tools used by an attacker after gaining root-level access to a host to conceal the attacker’s activities on the host and permit the attacker to maintain root-level access to the host through covert means.” The next paragraph will cover some of the different Rootkit attack techniques that are being utilised within the industry.
In this section, these types of Rootkits are discussed; User Mode Rootkits, Kernel Mode Rootkits, Bootkits, Memory Resident Rootkits, Hardware/Firmware Rootkits, Hypervisor Rootkits, Virtual Rootkits, Polymorphic Rootkits, Library Rootkits and Master Volume Record (MVR) Rootkits. Firstly, User Mode Rootkits operate in user-level processes, making them less privileged than the kernel, and can modify user-mode applications and APIs. However, Kernel mode rootkits operate at the kernel level, allowing them to manipulate the operating system's core functions and drivers. Next, Bootkits target the boot process of the operating system, often replacing or modifying the bootloader to gain control before the operating system loads. Memory resident rootkits remain active in the system's memory (RAM) and can manipulate the execution of system processes. In addition, Hardware or Firmware Rootkits infect system components, such as the BIOS or hardware peripherals, making them challenging to detect. Hypervisor Rootkits target Virtual Machine (VM) environments, often by compromising the hypervisor layer itself. Virtual Rootkits operate in virtualized environments, such as Virtual Machines (VMs), and can manipulate VM resources. Polymorphic Rootkits change their code and characteristics each time they run, making it challenging for signature-based detection methods to identify them. Library rootkits manipulate system libraries to redirect function calls and hide malicious actions and MVR rootkits infect the Master Boot Record (MBR) or Master Volume Record, making them challenging to detect and remove.
Three mitigation techniques for Rootkit attacks include vulnerability scanning, security audits/penetration testing and software/operating system/application/network equipment patch and update management. Vulnerability scanning is a mitigation technique for rootkit attacks that involves systematically identifying and assessing weaknesses in software and systems. By conducting regular vulnerability scans, organisations can detect and address potential entry points exploited by rootkits, enhancing overall security and reducing the risk of unauthorised access. In addition, security audits and penetration testing serve as mitigation techniques for rootkit attacks by simulating real-world attack scenarios. These assessments help identify and remediate security weaknesses, including vulnerabilities that could be exploited by rootkits. By proactively testing defenses, organizations can strengthen their security posture and minimize the risk of rootkit infiltration. Lastly, patch and update management is a mitigation technique for rootkit attacks that involves regularly applying security updates to software, operating systems, applications, and network equipment. By staying current with patches, organisations can close known vulnerabilities exploited by rootkits, reducing the risk of infiltration and limiting the potential impact of a rootkit attack. Other Rootkit attack mitigation techniques may include Intrusion Detection and Prevention Systems (IDPS), firewall configuration, network access controls/segmentation/monitoring/backup and recovery tools, user awareness training, user account/permission management and monitoring, Security Information and Event Management (SIEM) tools, Endpoint Detection and Response (EDR) tools and security audits.
Man-in-the-Middle (MitM) Attacks
Man-in-the-Middle (MitM) attacks represent a stealthy and deceptive vector, motivated by a spectrum of objectives including eavesdropping, data interception, and unauthorised access, with usages that can compromise the confidentiality and integrity of communications, making them a formidable adversary in the world of cyber threats. MitM attacks are defined by the Computer Security Resource Center (CSRC) as an “attack where the adversary positions himself in between the user and the system so that he can intercept and alter data travelling between them.” The next paragraph will cover some of the different MitM attack techniques that are being utilised within the industry.
Man-in-the-Middle Attacks, also, come in many forms. The most common include; Network Sniffing, DNS/IP/ARP/Cache Spoofing, HTTPS/SSL Stripping and BGP Hijacking. Network sniffing involves eavesdropping on network traffic to capture data packets in transit between two communicating parties. In addition, Spoofing attacks manipulate the Domain Name System (DNS), Internet Protocol (IP), Address Resolution Protocol (ARP), or cache data to redirect traffic to an attacker-controlled system. HTTPS and SSL stripping attacks force web traffic to use unencrypted HTTP connections instead of secure HTTPS connections, making it easier for the attacker to intercept data. Lastly, BGP hijacking manipulates Border Gateway Protocol (BGP) routing tables to reroute internet traffic through the attacker's network or systems.
Three mitigation techniques for Man-in-the-Middle (MitM) attacks include data encryption, Public Key Infrastructure (PKI) and SSL/TLS Certificate Pinning. Data encryption is a mitigation technique for man-in-the-middle (MitM) attacks that involves securing communication by encoding information in a way that only authorised parties can decipher it. Encrypting data prevents unauthorised interception and manipulation by attackers attempting to insert themselves into the communication flow, thereby protecting sensitive information from MitM attacks. In addition, Public Key Infrastructure is a mitigation technique for MitM attacks that establishes a framework for secure communication through the use of public and private key pairs. PKI enables the verification of the identity of communication partners, making it more difficult for attackers to insert themselves into the communication chain and conduct unauthorized interception or modification. Lastly, SSL/TLS Certificate Pinning is a mitigation technique for MitM attacks that involves associating a specific cryptographic certificate with a particular service or application. By "pinning" the certificate, the client ensures that it only connects to servers presenting the expected certificate, making it harder for attackers to substitute their own certificates and intercept or manipulate the communication. Other MitM attack mitigation techniques may include the use of secure Wi-Fi networks, Multi-Factor Authentication (MFA), software/system updates, network segmentation, Intrusion Detection and Prevention Systems (IDPS), Certificate Transparency (CT), network monitoring/analysis, security awareness training, server authentication verification strategies and strict security policies.
Structured Query Language (SQL) Injection Attacks
Structured Query Language (SQL), also known as “Sequel”, injection attacks stand as a persistent and insidious menace, motivated by both financial gain and data theft, and their usages can exploit vulnerabilities in web applications, enabling malicious actors to compromise databases, steal sensitive information, and wreak havoc on targeted systems. Structured Query Language (SQL) Injection attacks are defined by the Computer Security Resource Center (CSRC) as “attacks that look for websites that pass insufficiently processed user input to database back-ends." The next paragraph will cover some of the different SQL Injection attack techniques that are being utilised within the industry.
SQL Injection Attacks primarily consist of the following three main types; Classic, Blind and Time-Based Blind. In Classic SQL Injections attackers exploit vulnerabilities in web application input fields, such as search boxes or login forms, by injecting malicious SQL code. The injected code can manipulate the database and potentially extract, modify or delete data. Blind SQL injection attacks occur when attackers exploit vulnerabilities without receiving direct responses from the database. Instead, they infer results based on true/false conditions. Attackers inject SQL queries with conditional statements, and the application's response or behaviour indicates whether the condition is true or false. Lastly, Blind SQL injection introduces time delays in the application's response to infer the success of the injected query. Attackers use SQL commands that pause the execution of the application's response, and if the application takes longer to respond, it confirms the success of the injection, which is particularly effective for uncovering hidden or sensitive data.
Three mitigation techniques for Structured Query Language (SQL) injection attacks include input validation and sanitisation, parameterised queries and stored procedures. Input validation and sanitisation are mitigation techniques for SQL injection attacks that involve thoroughly validating and cleaning user input before it is processed by the database. By ensuring that input adheres to expected formats and removing any potentially malicious elements, organisations can prevent SQL injection attacks that exploit vulnerabilities through manipulated user input. In addition, parameterised queries serve as a mitigation technique for SQL injection attacks by separating SQL code from user input. Instead of directly embedding user input into SQL statements, parameterised queries use placeholders, reducing the risk of SQL injection. This technique ensures that input is treated as data rather than executable code, making it more challenging for attackers to inject malicious SQL commands. Lastly, stored procedures are a mitigation technique for SQL injection attacks that involves using precompiled SQL statements stored on the database server. By utilising stored procedures, organisations can define and control database operations, minimising the risk of SQL injection. This approach ensures that user input is handled within the confines of the stored procedure, reducing the surface area vulnerable to injection attacks. Other SQL injection attack mitigation techniques may include the use of Web Application Firewalls (WAF), Object-Relational Mapping (ORM), software patching/updates, database auditing/monitoring, Content Security Policy (CSP), Intrusion Detection and Prevention Systems (IDPSs) and Application Programming Interface (API) security hardening.
Password Cracker Attacks
Password cracking attacks, ranging from keyloggers to brute force methods, appear as a formidable adversary, motivated by goals that encompass unauthorised access, data theft, and system compromise and their usage can infiltrate and undermine the security of digital systems, posing a persistent risk to individuals and organisations alike. The Computer Security Resource Center (CSRC) describes Keylogger password cracker attacks as “program[s] designed to record which keys are pressed on a computer keyboard used to obtain passwords or encryption keys and thus bypass other security measures” and Brute Force password cracker attacks as “method of accessing an obstructed device by attempting multiple combinations of numeric/alphanumeric passwords.” The next couple of sections will cover some of the different Keylogger and Brute Force Password Cracker attack techniques that are being utilised within the industry.
With many distinct types of Password Cracking capabilities, Keyloggers have a few main methods; Software, Hardware, Memory-Resident, File-Based and Memory-Injection. Software keyloggers are installed as applications or malware on the victim's computer or device. They can run in the background, capturing keystrokes and other input, whereas Hardware Keyloggers are physical devices connected between a computer's keyboard and its USB or PS/2 port, which intercept and record keystrokes as they pass through the device. Memory-resident keyloggers operate in the system's memory (RAM) and capture keystrokes as they are processed in memory, and File-based Keyloggers save captured keystrokes to log files on the victim's computer. These log files can be accessed and later retrieved by the attacker. Lastly, Memory-Injection Keyloggers inject themselves into running processes or applications in memory. They capture keystrokes and other input from within the process.
Next, Brute Force Password Cracking Attacks often include Traditional, Dictionary, Hybrid, Rainbow Table, Online/Offline and Parallel Processing. Traditional Brute Force attacks systematically try every possible combination of characters, such as letters, numbers, and symbols, until the correct password is found, while Dictionary Attacks use a predefined list of words, phrases, or common passwords to guess the target password. Hybrid attacks combine elements of both traditional brute force and dictionary attacks and may include variations of common words and numbers. Rainbow Table Attacks use precomputed tables of password hashes and their corresponding plaintext passwords. This allows attackers to quickly reverse hash values to reveal passwords. Online Brute Force Attacks occur directly against the target system or account. Attackers make repeated login attempts, which may trigger account lockouts or alarms, and Offline Brute Force Attacks are performed on stolen password hashes or encrypted data, where attackers can attempt to crack the hashes without interacting with the target system. Lastly, Parallel Processing Attacks use multiple systems or processors to simultaneously attempt various password combinations, significantly speeding up the brute force process.
Three mitigation techniques for Password Cracker attacks include user education/awareness training, strong passwords and Multi-Factor Authentication (MFA) systems. Security education and awareness training serve as mitigation techniques for both keylogger and brute force password cracking attacks by educating users about the risks associated with phishing, malware, and password security. Informed users are more likely to recognise and avoid potential threats, reducing the likelihood of falling victim to keyloggers or weak password vulnerabilities. In addition, strong passwords are a mitigation technique for password cracking attacks by requiring users to create complex and unique passwords. Robust password policies, including a mix of uppercase and lowercase letters, numbers, and special characters, enhance the difficulty of brute force attacks. Strong passwords also provide an additional layer of defence against keyloggers attempting to capture login credentials. Lastly, Multi-Factor Authentication serves as a mitigation technique for both keylogger and brute force password cracking attacks by requiring users to provide multiple forms of identification before accessing an account. Even if keyloggers capture passwords or attackers attempt brute force attacks, MFA adds an extra layer of security, such as a temporary code sent to a mobile device, making unauthorised access more challenging. Other Password Cracker attack mitigation techniques may include the use of Anti-Virus/Anti-Malware software, software/system updates, account lockout policies, rate limiting, password expiry and rotation, account monitoring, captcha and challenge response tools, security tokens/biometrics, network security hardening tools and Security Information and Event Management (SIEM) tools.
Steganographic & Cryptographic Threats
Steganographic and cryptographic techniques are sophisticated and covert attack vectors, motivated by the goals of concealing malicious activities, data exfiltration, or facilitating secure communications, with usages that span from hidden malware delivery to safeguarding sensitive information, rendering them a challenging and elusive aspect of the ever-evolving threat landscape. The Computer Security Resource Center (CSRC) describes Steganography as the “art and science of communicating in a way that hides the existence of communication” and Cryptography as the “discipline that embodies the principles, means, and methods for the transformation of data to hide their semantic content, prevent their unauthorized use, or prevent their undetected modification.” The next paragraph will cover some of the different Steganographic and Cryptographic attack techniques that are being utilised within the industry.
Types of Steganographic threats may include; Data Exfiltration, Malware Delivery, Communication with Command-and-Control Servers and Insider Threats. Steganographic data exfiltration involves concealing stolen or sensitive data within legitimate files or communication to exfiltrate it undetected, and steganographic malware delivery techniques use steganography or encryption to hide malware within files, emails, or websites. In addition, attackers use steganography or encryption to communicate with Command-and-Control (C&C) servers, which are computers controlled by an attacker or cybercriminal which is used to send commands to systems compromised by malware and receive stolen data from a target network, making it difficult to trace or identify malicious data through standard network traffic. With Insider Threats, insiders, such as employees or trusted individuals, may use steganography to steal and exfiltrate data or to conduct malicious activities from within an organisation.
Three mitigation techniques for Steganographic and Cryptographic attacks include steganalysis tools, whitelisting and content validation tools and network traffic analysis. Steganalysis tools serve as a mitigation technique for steganographic attacks by detecting and analysing hidden information within seemingly innocuous files. These tools help identify and neutralise covert communication channels, enhancing security measures against the surreptitious embedding of data using steganographic techniques. In addition, whitelisting and content validation tools are mitigation techniques for both steganographic and cryptographic attacks. By establishing a whitelist of approved applications and scrutinising content for anomalies, these tools can prevent the execution of unauthorised or potentially malicious files, thwarting attacks that may leverage covert channels or cryptographic methods for malicious purposes. Lastly, network traffic analysis serves as a mitigation technique for both steganographic and cryptographic attacks by monitoring and scrutinising the flow of data within a network. By identifying patterns consistent with encryption or steganography, network traffic analysis tools can detect and alert on potential security threats, allowing for timely intervention and mitigation against covert communication or malicious cryptographic activities. Other Steganographic/Cryptographic attack mitigation techniques may include the use of anomaly/behaviour analysis tools, security awareness training, restricted data sharing, file integrity checks, encryption algorithms, effective encryption key management, access control, end-to-end encryption, certificate management, secure channels (HTTPS) and system/network auditing and monitoring.
Cryptojacking Attacks
Lastly, cryptojacking presents itself as a stealthy and monetarily motivated attack vector, driven by the desire for cryptocurrency gains at the expense of victims, with usages that involve the illicit hijacking of computing resources to mine digital currencies, posing a unique and financially lucrative threat to both individuals and organisations. Cryptojacking attacks are defined by the Computer Security Resource Center (CSRC) as “using a compromised device to generate cryptocurrency without the owner’s knowledge. Mining can be performed either by installing a malicious program on the target computer or by means of fileless malware.” The next paragraph will cover some of the different Cryptojacking attack techniques that are being utilised within the industry.
Potential Cryptojacking cyber attack methods may include; Browser-Based, Files-Based/Fileless Cryptojacking, XMRig Mining Malware and Mining Scripts embedded in Applications. Firstly, Browser-Based Cryptojacking occurs when a website or web application runs JavaScript code in the victim's browser to mine cryptocurrency, and File-based cryptojacking involves downloading and executing cryptocurrency mining software on the victim's device, while Fileless cryptojacking operates in system memory without leaving traditional files. Next, XMRig is a popular open-source Monero (XMR) mining software, that users use to create malware to infect a victim's device and mine Monero without authorisation. Lastly, crypto-mining scripts can be embedded within legitimate applications, either as part of the application's functionality or as a concealed feature.
Three mitigation techniques for Cryptojacking attacks include network/endpoint security solutions, system updates/patch management and security policies/user training. Network and endpoint security solutions serve as mitigation techniques for cryptojacking attacks by detecting and blocking malicious activities related to unauthorised cryptocurrency mining. These solutions can identify and prevent the execution of cryptojacking scripts on both networked systems and individual endpoints, enhancing overall security against such illicit activities. In addition, system updates and patch management are mitigation techniques for cryptojacking attacks that involve regularly applying security updates to operating systems and software. By staying current with patches, organisations can address vulnerabilities exploited by cryptojacking scripts, reducing the risk of unauthorised cryptocurrency mining on compromised systems. Lastly, security policies and user training serve as mitigation techniques for cryptojacking attacks by establishing guidelines and educating users about safe computing practices. By promoting awareness of the risks associated with visiting malicious websites or downloading suspicious content, organisations can empower users to avoid inadvertently contributing to cryptojacking schemes, bolstering overall cybersecurity. Other Cryptojacking attack mitigation techniques may include the use of security browser extensions/add-ons/ad-blocks and other privacy tools, traffic/behavioural analysis (including SIEM systems), resource/power limitation policies, network monitoring, hardware/device inventory management and monitoring and the blocking of access to mining pools and known miners.
Conclusion
In a world defined by technological progress, the technology industry has undeniably enhanced our lives in countless ways. However, as this essay has highlighted, this progress has not come without its challenges. The increasing reliance on technology has led to a corresponding surge in cybersecurity threats, ranging from disruptive Distributed Denial of Service (DDoS) attacks to the stealthy and persistent Advanced Persistent Threats (APTs), not to mention the ever-present spectre of viruses and the clandestine menace of steganographic threats. Throughout this essay, we've explored the methods and motivations of these threats, understanding that malicious actors, driven by diverse and complex motives, pose a constant risk to the integrity of our technology systems.
In recognising the multifaceted nature of these challenges and the motivations that underpin them, the importance of adaptable and effective cybersecurity strategies becomes all the more apparent. By doing so, we can ensure the continued growth and innovation of the technology industry, preserving the many benefits it bestows upon society. As we forge ahead into an increasingly digital future, vigilance, collaboration, and innovation in the realm of cybersecurity will remain paramount in securing the promise of technology while guarding against its vulnerabilities.
Bibliography
An overview of the DoppelPaymer ransomware (2021). https://www.trendmicro.com/en_za/research/21/a/an-overview-of-the-doppelpaymer-ransomware.html.
Buckbee, M. (2023) 'CryptoLocker: Everything You Need to Know,' Varonis, 26 May. https://www.varonis.com/blog/cryptolocker.
Cloudflare (no date) Slowloris DDoS attack tools. https://www.cloudflare.com/en-gb/learning/ddos/ddos-attack-tools/slowloris/.
Command and Control [C&C] server (no date). https://www.trendmicro.com/vinfo/us/security/definition/command-and-control-server.
CrowdStrike (2023) What Are Living Off the Land (LOTL) Attacks? - CrowdStrike. https://www.crowdstrike.com/cybersecurity-101/living-off-the-land-attacks-lotl/.
CSRC Content Editor (no date a) APT - Glossary | CSRC. https://csrc.nist.gov/glossary/term/apt.
CSRC Content Editor (no date b) Brute Force password attack - Glossary | CSRC. https://csrc.nist.gov/glossary/term/brute_force_password_attack.
CSRC Content Editor (no date c) cryptography - Glossary | CSRC. https://csrc.nist.gov/glossary/term/cryptography.
CSRC Content Editor (no date d) DDOS - Glossary | CSRC. https://csrc.nist.gov/glossary/term/ddos.
CSRC Content Editor (no date e) key logger - Glossary | CSRC. https://csrc.nist.gov/glossary/term/key_logger.
CSRC Content Editor (no date f) MITM - Glossary | CSRC. https://csrc.nist.gov/glossary/term/mitm.
CSRC Content Editor (no date g) phishing - Glossary | CSRC. https://csrc.nist.gov/glossary/term/phishing.
CSRC Content Editor (no date h) rootkit - Glossary | CSRC. https://csrc.nist.gov/glossary/term/rootkit.
CSRC Content Editor (no date i) spyware - Glossary | CSRC. https://csrc.nist.gov/glossary/term/spyware.
CSRC Content Editor (no date j) SQL injection - Glossary | CSRC. https://csrc.nist.gov/glossary/term/sql_injection.
CSRC Content Editor (no date k) steganography - Glossary | CSRC. https://csrc.nist.gov/glossary/term/steganography.
CSRC Content Editor (no date l) virus - Glossary | CSRC. https://csrc.nist.gov/glossary/term/virus.
CSRC Content Editor (no date m) worm - Glossary | CSRC. https://csrc.nist.gov/glossary/term/worm.
Exploring the dangers of remote access tools | Darktrace Blog (no date). https://darktrace.com/blog/exploring-the-dangers-of-remote-access-tools.
Georgescu, E. (2021) Man-in-the middle (MITM) attack. https://heimdalsecurity.com/blog/man-in-the-middle-mitm-attack/.
Gillis, A.S., Brush, K. and Teravainen, T. (2021) spyware. https://www.techtarget.com/searchsecurity/definition/spyware.
Gurney, T. (no date) Tequila virus. https://www.sqasolar.org.uk/solar/material/IS01CGCD/page_25.htm.
How to prevent a password attack (2023). https://www.threatlocker.com/blog/how-to-prevent-a-password-attack.
https://uniserveit.com/ (2021) What Are The Different Types Of Computer Viruses? | Uniserve IT. https://uniserveit.com/blog/what-are-the-different-types-of-computer-viruses.
Imperva Inc (2023) DDOS attack types & mitigation Methods | Imperva, Learning Center. https://www.imperva.com/learn/ddos/ddos-attacks/.
Irwin, L. (2023) The 5 most common types of phishing attack. https://www.itgovernance.eu/blog/en/the-5-most-common-types-of-phishing-attack.
Kaspersky (2018) 'Cryptojacking,' Kaspersky IT Encyclopedia, 11 December. https://encyclopedia.kaspersky.com/glossary/cryptojacking/.
Kaspersky (2020) 'RAT (Remote access tools),' Kaspersky IT Encyclopedia, 26 October. https://encyclopedia.kaspersky.com/glossary/rat-remote-access-tools/.
Kaspersky (2021) 'Trojan,' Kaspersky IT Encyclopedia, 30 July. https://encyclopedia.kaspersky.com/glossary/trojan/.
Kaspersky (2023) 'Ransomware,' Kaspersky IT Encyclopedia, 4 October. https://encyclopedia.kaspersky.com/glossary/ransomware/.
Kaspersky Threats — CIH (no date). https://threats.kaspersky.com/en/threat/Virus.Win9x.CIH/.
Pedamkar, P. (2023) Types of computer worms. https://www.educba.com/types-of-computer-worms/.
Ryuk - What is Ryuk Ransomware? (no date). https://www.malwarebytes.com/ryuk-ransomware.
Slandau (2023) What is an 'island hopping' attack? (and how to stop one) - CyberTalk. https://www.cybertalk.org/2023/04/06/what-is-an-island-hopping-attack-and-how-to-stop-one/.
Steganography: Combatting threats hiding in plain sight (2018). https://www.fortinet.com/blog/threat-research/steganography--combatting-threats-hiding-in-plain-sight.
The Melissa virus (2019). https://www.fbi.gov/news/stories/melissa-virus-20th-anniversary-032519.
What Are The Different Types Of Trojan Malware? - Galaxkey (no date). https://www.galaxkey.com/blog/what-are-the-different-types-of-trojan-malware/.
What is a Brute Force Attack? | Definition, Types & How It Works (no date). https://www.fortinet.com/resources/cyberglossary/brute-force-attack.
What is a Keylogger? How to Detect a Keylogger? (no date). https://www.fortinet.com/resources/cyberglossary/what-is-keyloggers.
What is a rootkit? How to defend and stop them? | Fortinet (no date). https://www.fortinet.com/resources/cyberglossary/rootkit.
What is cryptojacking? Definition and Explanation | Fortinet (no date). https://www.fortinet.com/resources/cyberglossary/cryptojacking.
What is WannaCry ransomware? (2023). https://www.kaspersky.com/resource-center/threats/ransomware-wannacry.
コメント