Click any of them to learn more.
Deceptive emails that trick users into giving up credentials or downloading malware. The most reported cybercrime in 2025 with 191,561 FBI complaints.
191,561 complaints to the FBI in 2025, the most reported cybercrime. Losses hit $215.8M, nearly triple the $70M reported in 2024.
Source: FBI Internet Crime Complaint Center (IC3) 2025 Annual Report
Phishing uses deceptive emails, messages, or links to trick recipients into revealing credentials, downloading malware, or transferring funds. Spear phishing targets specific individuals; business email compromise (BEC) targets finance or executive personas. The domain looks clean, the email looks real, and most gateways let it through.
DWELL TIME
Days to weeks. Phishing is typically detected when downstream credential misuse is noticed, not the moment the credentials are compromised.
DETECTION GAP
Phishing is hardest to catch before the click. The email bypasses the gateway because the domain is clean at delivery time. Post-click signals are often buried in log volume. Most organizations detect phishing-initiated breaches only when downstream effects surface—credential misuse, unusual logins, data loss—and that can be days to weeks after the click.
ATTACK TIMELINE
The attacker scrapes LinkedIn, company websites, and job postings to build a believable pretext. No cost, no noise—all of this happens entirely outside your organization’s perimeter.
A phishing email is sent from a lookalike domain registered days earlier, complete with a valid TLS certificate. It impersonates IT, a vendor, or an executive. Urgency framing suppresses the recipient’s scepticism.
The user clicks the link and lands on a pixel-perfect login clone. Credentials are silently captured as the user types them in. Or, an attachment may open and a dropper executes on the endpoint.
The attacker logs into the corporate email or VPN from a new IP. Email forwarding rules are created. Internal resources are enumerated. This is often the first detectable moment.
Using harvested credentials, the attacker moves to connected systems—cloud apps, VPNs, file servers. The blast radius grows by the hour.
Attackers social-engineered Twitter employees by phone to gain access to internal admin tools, then hijacked accounts belonging to Obama, Biden, Musk, and Gates to run a Bitcoin scam. $120,000 stolen along with significant reputational damage.
An Austrian aerospace parts manufacturer lost €50M in a CEO fraud attack. An attacker impersonating the CEO instructed a finance employee to wire funds to an external account. Initial transfer: €50M. Approximately €10.9M was later recovered.
Initial access achieved via vishing—an attacker called the IT help desk impersonating an employee. This single call led to $100M+ in operational losses and days of disrupted casino operations.
Encrypts your files, destroys your backups, and demands payment. Modern ransomware exfiltrates data first, so even a clean backup doesn't stop the leak.
Ransomware featured in 44% of all confirmed breaches in 2025, up from 32% the year before. 88% of SMB breaches involved ransomware.
Source: Verizon Data Breach Investigations Report 2025
Ransomware is malware that encrypts an organization’s files and demands payment for the decryption key. Modern double extortion variants exfiltrate data before encrypting it. Even if backups exist, the stolen data becomes additional leverage. The attacker wins either way.
DWELL TIME
Incident response (IR) cases—investigations triggered after an attack is discovered—take a median of four days. Organizations that leverage managed detection and response (MDR), which entails active, continuous threat hunting rather than reactive investigation, see a median of three days.
Source: Sophos Active Adversary Report 2025
DETECTION GAP
The command almost nobody catches in time is vssadmin delete shadows /all /quiet—the step where the attacker silently destroys your backup copies before deploying the ransomware. There is no legitimate reason to run this command on a production system. If it does not generate an immediate alert in your environment, you have a monitoring gap.
By the time this command runs, the attacker has typically been inside for 4–9 days, working quietly through reconnaissance, privilege escalation, and lateral movement. But the encryption—the final, visible, destructive step—has not yet happened. Catching this backup deletion in your logs is the last practical opportunity to stop the attack before files are encrypted and the ransom clock starts.
ATTACK TIMELINE
Entry via phishing email, an exposed RDP port, or a VPN with weak or stolen credentials. A dropper establishes a quiet command-and-control beacon—low traffic, no immediate alerts.
The attacker maps the network quietly: Active Directory, file servers, backup systems. This phase can last days. It looks like normal administrative traffic.
The attacker uses techniques like Kerberoasting—requesting service tickets and cracking them offline—or pass-the-hash, which reuses captured password hashes without needing to know the actual password. The objective is full Domain Admin access, and by the end of it, the attacker typically has it. With that level of access, they disable antivirus and endpoint defenses. The environment now belongs to them.
The attacker moves across all reachable systems. Backup agents are identified and targeted.
The attacker runs vssadmin delete shadows /all /quiet—a Windows command that silently destroys all Shadow Copy backups, eliminating your fastest recovery path. Once backups are gone, data is exfiltrated before encryption begins. This sequence is deliberate: the attacker removes your escape routes first.
Encryption deployed simultaneously across all compromised systems. Ransom note appears.
DarkSide ransomware deployed via a single compromised VPN credential with no MFA enforced. Pipeline operations shut down for five days. $4.4M ransom paid in Bitcoin.
ALPHV/BlackCat ransomware attack on the largest healthcare payment processor in the US. $22M ransom paid, 100M+ patient records compromised—the largest healthcare data breach in US history.
Qilin ransomware hit a pathology lab provider serving major London hospitals. 800+ procedures cancelled. Patient data published after ransom was not paid.
Attackers don't break in, they log in. Billions of stolen passwords are tested against your login pages every month using automated tools.
Stolen credentials are the single most common initial access vector, used in 22% of all data breaches. In 56% of Sophos IR and MDR cases in 2023, the adversary logged in with valid credentials rather than exploiting a vulnerability.
Source: Verizon DBIR 2025; Sophos Active Adversary Report 2023
Credential attacks use automated tools to gain access by testing large volumes of username and password combinations. Brute force tries all combinations systematically. Credential stuffing exploits password reuse, taking credentials leaked from one breach and testing them against other services. Account takeover is the outcome.
DWELL TIME
Variable. A successful credential login may be acted on immediately or sit dormant for weeks. Detection typically happens when the account does something out of character, not at the login event itself.
DETECTION GAP
Credential stuffing is hard to catch because each individual attempt looks like a legitimate failed login. The signals follow specific patterns—one IP testing 10,000 accounts, or 100 IPs each testing 100 accounts. This requires analytics across accounts, not per-account rules. Most organisations rely on account lockout policies, which catch brute force on a single account but miss spraying attacks entirely.
ATTACK TIMELINE
The attacker purchases dark web dumps of breached credentials, harvests them via infostealer malware logs, or phishes them directly.
Tools test credentials at scale against login endpoints—email portals, VPNs, cloud apps. Thousands of attempts per hour, distributed across many IPs to evade lockout thresholds.
A valid combination found. The attacker validates the account’s value: access level, connected systems, and the data it holds.
Data accessed, privileges escalated, or the account credentials are sold to another threat actor.
The same credentials tested against internal systems—VPN, cloud apps, and file servers. Many people reuse passwords across corporate and internal systems.
165+ Snowflake customers breached via stolen credentials with no MFA enforced. Affected organizations included Ticketmaster (560M records), AT&T, and Santander.
6.9M user records exposed via credential stuffing. Attackers used credentials leaked from unrelated breaches to access 23andMe accounts—the accounts themselves were never directly breached.
Multiple credential-based breaches compromised Okta customer admin accounts over successive years. Downstream customers including Cloudflare, 1Password, and MGM were affected.
Malicious software that runs quietly in the background harvesting your credentials, browser sessions, and crypto wallets—then ships everything to an attacker's server.
82% of intrusions in 2025 were malware-free. Attackers used stolen credentials and built-in system tools rather than dropping executable files. Signature-based antivirus alone is blind to the majority of modern intrusions.
Source: CrowdStrike Global Threat Report 2025
Malware is malicious software designed to damage, disrupt, or gain unauthorized access to systems. Infostealers, the fastest-growing subcategory, silently harvest credentials, session cookies, browser data, and crypto wallets from infected devices. They are typically delivered via phishing, malvertising, or Trojanized software downloads, and operate quietly for weeks before the stolen data is used.
DWELL TIME
Infostealers often operate for weeks to months before the stolen credentials are used. By the time account takeover is noticed, the original infection may be long gone from the endpoint.
DETECTION GAP
Modern infostealers run in memory, use signed Windows binaries (living-off-the-land techniques), and mimic legitimate HTTPS traffic. With 82% of intrusions being malware-free, it’s clear attackers have moved away from detectable file drops.
Environments relying on signature-based antivirus solutions alone will miss the majority of these infections. Behavioral analysis—what did this process do, not just what it is—is the primary control.
ATTACK TIMELINE
Dropper delivered via phishing email, malvertising, or a Trojanized software download from a compromised or fake source.
Registry key, scheduled task, or DLL sideloading established. The dropper survives restarts and runs silently in the background.
The dropper downloads the actual payload: infostealer, remote access Trojan (RAT), or banking Trojan.
Browser password databases scraped. Session cookies extracted. Keylogging begins. Crypto wallet files located and copied.
Data packaged and sent to a command-and-control server via low-traffic HTTPS—designed to blend in with normal web traffic.
Credentials sold on dark web marketplaces or used directly to take over accounts and initiate downstream attacks.
The dominant infostealer of 2025, sold as Malware-as-a-Service. Microsoft disrupted Lumma’s infrastructure in May 2025, seizing approximately 2,300 malicious domains. Approximately 394,000 Windows devices infected between March and May 2025. FBI estimates total historical infections at approximately 10M devices.
Two of the most prolific infostealers from 2022 to 2024. Credentials harvested by these tools were directly used to access Snowflake customer environments in the 2024 breaches affecting Ticketmaster, AT&T, and others.
Banking Trojan that evolved into a full modular botnet and malware delivery platform used to distribute Ryuk and Conti ransomware to thousands of organizations. Disrupted by Europol in January 2021.
The hardest attack to detect, because the person is authorized to be there. They know exactly where the data is and how to get it out.
Average annual cost of insider risk: $19.5M per organization. Average time to contain an insider incident once discovered: 67 days. 93% of organizations find insider threats as difficult or more difficult to detect than external attacks.
Source: Ponemon Institute, DTEX Systems Insider Risk Report 2025
Insider threats originate from individuals with legitimate organizational access—employees, contractors, or partners. They may be malicious (intentional data theft or sabotage), negligent (accidental data exposure), or compromised (account taken over by an external attacker). The common thread is that the activity looks authorized, because it is—or at least, it was.
DWELL TIME
Average 67 days to contain once discovered.
Source: Ponemon Institute 2025
DETECTION GAP
The core challenge is that the activity looks legitimate; the person is authorized. Detection requires behavioral baselines built over time for each specific user and alerts when they deviate.
Most organizations don’t have this in place; 93% report insider threats are as hard or harder to detect than external attacks. Without UEBA, the typical discovery method is a tip, an audit, or a resignation that prompts a review.
Source: Ponemon Institute 2025
ATTACK TIMELINE
The insider starts with authorized access to systems and data. Nothing about this stage is unusual.
Unusual queries, after-hours access, accessing files or systems outside their normal scope. Gradual, easy to rationalize as work-related.
Files copied to personal drives, cloud storage, or emailed to personal accounts. Large batches downloaded to local storage before exfiltration.
USB transfer, personal email, unauthorized cloud sync, or direct database export. The data leaves the organization.
Most insider incidents are discovered through an HR tip, a system audit, or when the person leaves the organization—not through automated monitoring catching it in real time.
Two former employees leaked personal data belonging to 75,000 current and former Tesla employees to a German newspaper. Data included names, home addresses, Social Security numbers, and bank account information.
NSA contractor exfiltrated approximately 1.7M classified documents over several months using authorized access with no apparent anomalies that triggered alerts. The definitive example of privileged access without behavioral monitoring.
A former employee allegedly stole source code and trade secrets before joining a competitor. A lawsuit was filed. Illustrates the elevated risk during the offboarding window.
Attackers compromise a trusted vendor to get inside your organization. The malware arrives as a legitimate, signed software update—and your security tools welcome it.
Third-party breaches now account for 30% of all data breaches—a 100% increase from 15% the prior year.
Source: Verizon Data Breach Investigations Report 2025
Supply chain attacks compromise a trusted third party—a software vendor, managed service provider, or open-source component—to gain access to that vendor’s customers. Instead of attacking the target directly, adversaries compromise the delivery mechanism that already has trusted access inside it. The malicious code arrives signed, legitimate-looking, and through a channel that security tools are configured to trust.
DWELL TIME
Vendor-side: Months to over a year before customer exposure. Customer-side: Depends on how actively the backdoor is used.
DETECTION GAP
Supply chain attacks are among the hardest to detect precisely because the malicious code arrives trusted and signed. Standard security tooling is configured to allowlist vendor software.
Detecting these attacks requires applying the same scrutiny to trusted software that you apply to unknown software: file integrity monitoring on vendor binaries, behavioral analysis of what installed applications actually do on the network, and monitoring for outbound connections from processes that should never initiate them.
ATTACK TIMELINE
The adversary targets a software vendor or MSP via phishing, credential attack, or exploiting an unpatched vulnerability in the vendor’s own infrastructure.
The attacker embeds quietly in the vendor’s development or build pipeline, sometimes for months or years, without triggering alerts.
Malicious code inserted into a legitimate software component or update, signed with the vendor’s own certificate.
The update is pushed to all customers through normal update mechanisms. Customers install it because they trust the vendor.
The backdoor or malware activates. It appears to originate from a trusted, allowlisted source—standard security tools do not flag it.
The adversary activates the backdoor only in high-value targets, staying dormant in others to avoid detection.
Lazarus Group (North Korea) compromised 3CX via a prior supply chain attack on another vendor. The first publicly documented case of a supply chain attack originating from another supply chain attack.
A single adversary spent two years building credibility in an open-source Linux project before inserting a backdoor into XZ Utils, a compression library present in millions of Linux systems. Discovered accidentally by a Microsoft engineer during unrelated performance testing.
Russian state actors (Cozy Bear/APT29) inserted malware into a SolarWinds Orion software update, delivered to approximately 18,000 organizations including US government agencies. Among the most significant espionage operations ever conducted.
A vulnerability the vendor doesn't know about yet—no patch exists, no signature exists. The attacker owns the attack window.
90 zero-day vulnerabilities exploited in the wild in 2025—a 15% increase from 78 in 2024. 48% targeted enterprise technologies, an all-time high.
Source: Google Threat Intelligence Group (GTIG) 2025 Zero-Day Review
A zero-day exploit takes advantage of a software vulnerability that is unknown to the vendor or for which no patch yet exists. The name refers to the fact that developers have had zero days to fix it. Attackers may discover the vulnerability independently or purchase the exploit on gray or black markets—sometimes from nation-state stockpiles.
DWELL TIME
The critical exposure window runs from when the exploit becomes available to when organizations apply the patch. With a mean time-to-exploit of approximately five days and many organizations patching on monthly cycles, the window can be weeks.
DETECTION GAP
Zero-days cannot be patched before exploitation; that is the defining characteristic. The only realistic defensive posture is to minimize the attack surface (fewer internet-exposed services), detect post-exploitation behavior that follows known patterns even when the exploit is novel, and deploy patches rapidly once available. Mean time to exploit averages approximately five days from the point of vulnerability disclosure.
Source: Mandiant, Google Threat Intelligence Group analysis
ATTACK TIMELINE
Adversary finds or purchases an unknown vulnerability in widely deployed software found on edge devices, VPN appliances, enterprise applications, or operating system components.
An exploit is developed, tested, and prepared for delivery. Nation-state actors may sit on a zero-day for months before deploying it.
Exploit delivered via a network-facing service, a malicious file, or a browser-based drive-by download. Many network-facing CVEs require no user interaction.
The exploit fires. The attacker achieves code execution on the target system with no prior foothold required.
Privilege escalation, lateral movement, persistence: The post-exploitation chain follows well-known patterns even though the exploit itself was novel.
The vendor eventually discovers the vulnerability and releases a patch. Exploitation began before this—and continues until organizations apply it.
Zero-day in Apache Log4j, a logging library embedded in millions of enterprise applications. Exploited within hours of public disclosure. Attack attempts peaked at 1.8 million per day. CISA described it as “one of the most serious vulnerabilities ever.”
Zero-day in a widely used managed file transfer platform. Exploited by the Cl0p ransomware group before a patch existed. Affected 2,600–2,800 organizations and compromised data belonging to over 90M individuals.
Two chained zero-day exploits in Ivanti VPN appliances exploited by Chinese nation-state actors before patch availability. Thousands of organizations affected globally.
Thousands of compromised devices flood your infrastructure simultaneously. Legitimate users can't get through. For businesses that run on uptime, minutes matter.
20.5 million DDoS attacks blocked in Q1 2025 alone — a 358% year-over-year increase. A new record of 31.4 Tbps was set in November 2025.
Source: Cloudflare Q1 2025 DDoS Threat Report
DDoS attacks overwhelm a target’s servers, network, or applications with traffic from thousands of distributed sources—typically compromised devices in a botnet—making the service unavailable to legitimate users. Motivations range from extortion and competitive disruption to hacktivism and nation-state sabotage.
DWELL TIME
DDoS attacks are real-time events, not persistent intrusions. Duration ranges from minutes (hyper-volumetric bursts) to days (sustained campaigns), depending on attacker motivation and mitigation effectiveness.
DETECTION GAP
DDoS attacks are among the more detectable attacks; the traffic spike is visible and service degradation is immediate. The gap is response time, not detection. By the time the NOC confirms it is a DDoS and not a traffic spike, service is already down. Prevention-oriented controls—pre-provisioned upstream scrubbing partnerships, anycast routing, rate limiting—provide more value than detection. You cannot detect your way out of a 31 Tbps attack.
ATTACK TIMELINE
The attacker assembles or rents a botnet of compromised IoT devices, servers, or cloud instances. Modern botnets can be rented for as little as a few hundred dollars per hour.
Attack type chosen based on the target’s infrastructure: volumetric (flood bandwidth), protocol (exhaust connection tables), or application layer (target specific endpoints).
Flood of packets or requests launched simultaneously from distributed sources. Traffic volume overwhelms the target’s infrastructure within seconds.
Legitimate users experience timeouts, slow response, or complete unavailability. For SaaS, e-commerce, or financial services, the impact is immediate and measurable.
Attacker issues a ransom demand. RDDoS (Ransom DDoS) campaigns frequently follow through regardless of payment.
Upstream scrubbing, rate limiting, IP blocking, or CDN-based absorption. Mitigation is typically reactive—the attack is already underway.
31.4 Tbps, the largest DDoS attack ever recorded at the time of writing. Lasted approximately 35 seconds. Part of a series of hyper-volumetric attacks in Q3–Q4 2025, during which the global record was broken multiple times.
2.3 Tbps attack mitigated via AWS Shield, the largest publicly confirmed attack at that point. AWS did not publicly name the targeted customer.
The Mirai botnet, built from compromised IoT devices, took down Dyn’s DNS infrastructure, making Twitter, Reddit, Netflix, and PayPal unreachable across the US East Coast for several hours.
Nation-state-level attackers get in, go quiet, and watch everything—for months. They are not after a quick win. They are after everything.
Espionage-motivated breaches accounted for 17% of all confirmed breaches in 2025—a 163% year-over-year increase. Organizations that detect intrusions internally find them in a median of 10 days; those notified externally: 26 days.
Source: Verizon DBIR 2025; Mandiant M-Trends 2025
APTs are sophisticated, long-duration, targeted attacks conducted almost exclusively by nation-state actors or well-funded criminal groups. Unlike opportunistic attacks, APTs are manually operated against specific targets. The goal is prolonged access for espionage, intellectual property theft, or pre-positioning for potential sabotage—not a quick financial return.
DWELL TIME
Global median is 11 days overall. 10 days when discovered internally. 26 days when notified by an external party.
Source: Mandiant M-Trends 2025
DETECTION GAP
APTs are purpose-built to evade detection. Stolen credentials make the activity appear authorized. Custom implants have no signatures. Living-off-the-land techniques use tools that are already allowlisted.
The only reliable detection approach is behavioral: What is this account doing that it has never done before, at what time, against which systems? This requires building a baseline of normal behavior over time across every identity, endpoint, and network simultaneously—then continuously comparing current activity against that baseline to surface unusual patterns. Organizations with this capability find APTs 2.5 times faster than those waiting for external notification.
Source: Mandiant M-Trends 2025
ATTACK TIMELINE
Months of research: LinkedIn profiles, job postings, public code repositories, organizational charts, conference presentations, press releases. The attacker knows the organization better than some employees do before they send a single packet.
Highly targeted spear phishing tailored to a specific individual, a zero-day exploit against an internet-facing system, or compromise through a trusted supply chain vendor.
Custom implants, not commodity malware, designed to evade detection. Small, quiet, and often residing in memory rather than on a disk.
Network mapping, identifying high-value systems, learning access patterns, and operational rhythms. The attacker behaves like a careful, patient employee.
Using stolen credentials and built-in Windows tools—certutil, bitsadmin, mshta—the attacker moves laterally without dropping custom binaries.
Data collected and staged in encrypted archives internally. Exfiltration is slow and disguised as legitimate traffic, often to cloud services or typosquatted domains.
Multiple persistence mechanisms established: scheduled tasks, WMI subscriptions, modified startup items. Access is maintained for months or years.
Breached nine US telecommunications companies including AT&T, Verizon, and Lumen. Intercepted communications of US government officials. Described by US officials as the worst telecom hack in US history.
Ongoing campaign targeting US critical infrastructure—energy, water, and communications sectors. CISA and FBI issued joint advisories. The objective is pre-positioning for potential conflict disruption, not immediate data theft.
Russian APT29 used a supply chain compromise to conduct a long-running espionage campaign against US government agencies and major enterprises. Went undetected for approximately nine months.
The attacker sits silently between you and whatever you are connecting to—reading everything, sometimes altering it. You never know they are there.
In 2024, Australian Federal Police arrested a man for running evil-twin Wi-Fi hotspots on domestic flights and at airports, capturing passenger credentials as devices auto-connected to the spoofed network.
Source: Australian Federal Police press release, 2024
In a MITM attack, the adversary secretly positions themselves between two communicating parties—a user and a website, an application, or a corporate service—intercepting and potentially altering the communications without either party knowing. Used to steal credentials, session tokens, financial data, and sensitive communications. The attack works precisely because the connection appears normal to both sides.
DWELL TIME
Ranges widely. Opportunistic attacks at public Wi-Fi hotspots can be minutes wheras CA-level or BGP-level compromises can take weeks to months.
DETECTION GAP
MITM attacks are particularly hard to detect because the attacker is a transparent relay—traffic reaches its destination, so users don’t experience failure or degradation. Certificate warnings are the most visible signal, but they are routinely dismissed.
Effective detection requires network-level monitoring—ARP inspection, DNS response monitoring, certificate transparency logging—that most organizations do not apply to their internal networks, only to their perimeter.
ATTACK TIMELINE
The attacker establishes a position in the network path: rogue Wi-Fi access point, ARP cache poisoning on the local network, BGP route hijacking, or DNS spoofing.
Target device connects—often automatically, because the spoofed network looks familiar—to the attacker-controlled relay.
All traffic flows through the attacker to the real destination. The user’s experience is normal. Nothing seems wrong.
If the target site accepts HTTP before redirecting to HTTPS, the attacker intercepts the cleartext version of the traffic before the upgrade happens.
Login credentials, session cookies, and sensitive data harvested from the intercepted traffic.
The attacker uses the captured session token to impersonate the user on the real site—no password required. The session is already authenticated.
Iranian state actors compromised the Dutch certificate authority DigiNotar, issuing fraudulent SSL certificates used to conduct large-scale MITM attacks against approximately 300,000 Iranian Gmail users. DigiNotar was declared bankrupt within weeks of the disclosure.
Lenovo pre-installed adware on consumer laptops that used a self-signed root certificate to intercept all HTTPS traffic on the device—a manufacturer-deployed MITM affecting millions of devices.
Nation-states and criminal actors repeatedly exploit the Border Gateway Protocol (BGP) to redirect internet traffic through adversary-controlled infrastructure—a large-scale MITM at the internet-routing level.
