Preventing common
cyberattacks with ManageEngine

Phishing is a form of social engineering attack where malicious actors send out seemingly legitimate emails and messages to trick victims into sharing sensitive information or paying money. It is also used as a means to deliver malware (like ransomware).

You can learn more about phishing and other social engineering attacks in our webcast, "Social engineering and Zero Trust—The human element in cybersecurity."

Brute-force attacks use trial and error to gain access to a system. The attackers usually use a bot that tries various combinations of usernames and passwords.

Credential stuffing attacks are a type of brute-force attack where the attackers use credentials that have been leaked in breaches of other organizations. While the overall attack success rate is low, the low effort involved and the high volume of leaked credentials available online make this a worthwhile weapon in an attacker's arsenal.

Credential dumping is yet another form of credential-based attack that organizations face.

Ransomware is a variety of malware that's used to encrypt key files within a victim's networks. Modern varieties of ransomware go further—they steal data and delete any backup copies before encrypting the files. This adds an extra layer of danger because victims can't restore data from backups since they no longer exist, and even if they do manage to recover their files, the stolen data is still in the hands of the criminals.

Check out our e-book, Ransomware demystified, to learn about these attacks in more detail.

Denial-of-service (DoS) and DDoS attacks are designed to paralyze an organization's network by flooding it with traffic. Attackers do this by flooding your servers, networks, or applications with an overwhelming number of requests, packets, or messages. This can be done from a single source or from multiple sources using a botnet (hence the use of "distributed" in the name DDoS).

In a man-in-the-middle-attack, attackers position themselves between a user and a website or application that they're trying to access. The attackers then eavesdrop on the traffic sent between the user and the website or app. Alternatively, attackers may redirect users to a fake but seemingly legitimate website to steal sensitive information. These attacks are often used to steal login credentials, credit card information, and other sensitive data.

As the name implies, an insider threat refers to a case where the attacker (or one of the attackers) is an employee in the organization. They could be a disgruntled employee or an employee who is being enticed or manipulated through various means into acting against their employer.

Since they work for the company, they can easily access files or assets that external adversaries cannot. Depending on their level of seniority and their role, they could be uniquely placed to cause extensive damage to the organization.

These attacks are harder to detect. The employee in question may be allowed to access sensitive information or assets as part of their duties, so their activities normally don't raise any alerts.

APTs are usually complex, multistep attacks. Unlike other attacks, they are focused on specific targets and are manually triggered. Unlike a quick hit-and-run attack that focuses on causing damage to one part of a network, an APT is a long-term attack that aims to infiltrate as much of the network as possible. The goal is to lurk in the network for as long as possible to collect and extract as much sensitive data as possible.

APTs typically have three stages:

1. Infiltration: Adversaries establish a foothold within the target's network through social engineering, malware, or exploiting vulnerabilities.

2. Lateral movement: Next, adversaries attempt to increase their presence within the network by compromising more systems and accounts, especially those with higher privileges. They also establish additional points of compromise so the attack can continue even if some of these points are locked down.

3. Data exfiltration: During an APT, adversaries store the stolen data in secure locations within the target network. Once they have enough data, they try to extract it without being discovered. This stage can continue for as long as the adversaries need or until they get discovered.

You can read more about APTs here.