Why Understanding Attack Types Matters
Most security breaches are not sophisticated operations. The 2026 Verizon Data Breach Investigations Report (DBIR), which analysed tens of thousands of security incidents, found that the majority of breaches still involve the same categories of attack that have dominated threat reports for the past decade: social engineering, credential abuse, vulnerability exploitation, and ransomware. What changes year to year is not the attack category but the execution — how automated, how targeted, and how fast attackers move once they gain initial access.
This article is the third in our cybersecurity fundamentals series. The first article covered Types of Hackers: White Hat, Black Hat, and Grey Hat Explained — understanding who is attacking and why. The second article covered the 8 CISSP Security Domains — the professional framework defenders use to organise their knowledge. This article connects both: it explains exactly how the attackers identified in article one execute their attacks, and why the domains covered in article two exist as defences against them.
One figure from the 2026 DBIR is worth holding in mind throughout this guide: vulnerability exploitation has surpassed credential abuse as the most common initial attack vector for the first time, now accounting for 31% of breaches. Stolen credentials — the previous leader — have fallen to 13% as an initial vector, though they still appear in 39% of all incidents when the full attack chain is considered. The practical implication is that patching matters more than ever, and the window between vulnerability disclosure and active exploitation has narrowed to days or hours rather than weeks.
Phishing and Social Engineering Attacks
Phishing is consistently the most widely used technique across virtually every attack category — not because it is the most technically sophisticated, but because it is the most reliable. The 2026 Verizon DBIR confirms that the human element is involved in 60% of all breaches, ranging from clicking a phishing link to reusing a credential from a previous breach to falling for a pretexting call. IBM’s 2025 Cost of a Data Breach report identifies phishing as one of the most common initial attack vectors in confirmed breaches.
The mechanics of a phishing attack are straightforward: an attacker sends a message — typically via email, but increasingly via SMS (smishing) or voice call (vishing) — that impersonates a trusted entity and prompts the recipient to take an action. That action might be clicking a link to a credential-harvesting page, opening a malicious attachment that executes malware, or transferring funds to an attacker-controlled account. Business Email Compromise (BEC), a specific form of phishing that impersonates executives or suppliers to authorise fraudulent payments, was responsible for over $2.9 billion in losses reported to the FBI’s Internet Crime Complaint Center (IC3) in 2024 alone.
Spear phishing is the targeted variant: rather than sending generic lures to thousands of recipients, the attacker researches a specific individual or organisation and crafts a message using personal details, internal terminology, or realistic business context that makes the deception far more convincing. State-sponsored threat actors use spear phishing almost exclusively because it produces higher success rates against high-value targets.
Defending against phishing requires layered controls because no single measure eliminates the risk. Email gateway filtering reduces the volume of malicious messages that reach inboxes. Multi-factor authentication (MFA) means that even when credentials are stolen, they cannot be used alone to access systems — Microsoft’s research indicates that MFA blocks over 99% of identity-based attacks. Security awareness training, measured through regular simulated phishing exercises rather than once-a-year compliance videos, reduces click rates. And URL filtering at the DNS or proxy level prevents users from reaching credential-harvesting pages even when they do click.
Ransomware: The Most Costly Attack Pattern
Ransomware appeared in 44% of all data breaches in 2025 — the largest single-year jump ever recorded in the Verizon DBIR, up from 32% the prior year. The average cost of a ransomware breach reached $5.08 million per incident according to IBM’s 2025 report, and 88% of small and medium business breaches involved ransomware. Healthcare organisations, which have topped IBM’s most-expensive-breach industry list for fifteen consecutive years, face average breach costs of $11.2 million — 2.5 times the global average.
A ransomware attack typically follows a predictable sequence. Initial access is gained through phishing, stolen credentials, or exploitation of a public-facing vulnerability. The attacker then establishes persistence and moves laterally through the network over days or weeks, identifying high-value data and backup systems. When ready, they deploy encryption software that locks all accessible files and presents a ransom demand in exchange for the decryption key. Modern ransomware groups also exfiltrate data before encrypting it, enabling a second layer of extortion: pay the ransom or the stolen data gets published on a leak site. The Dark Angels ransomware group extracted a record $75 million single ransom payment in 2024, demonstrating the scale achievable by sophisticated operators.
The defences against ransomware are well-understood. The 3-2-1 backup principle — three copies of data, on two different media types, with one stored offline and tested regularly — is the most important single control, because it ensures recovery is possible without paying the ransom. Network segmentation limits the blast radius when encryption does begin by preventing it from spreading unchecked across the entire environment. Endpoint Detection and Response (EDR) tools detect ransomware behaviour patterns early in the encryption process. Restricting administrative privileges means that even when an attacker gains initial access, they do not immediately have the access required to deploy encryption across the network.
Credential Attacks: Stolen Passwords and Brute Force
Stolen or compromised credentials were present in 53% of incidents tracked in the 2025 Verizon DBIR, making them the single most common element in the full attack chain even as their role as the initial entry point has declined. IBM’s 2025 report identifies stolen credentials as among the costliest initial attack vectors at $4.50 million per breach. The abundance of credentials is not the result of sophisticated hacking — it is the result of massive data breach databases, password reuse across services, and the absence of MFA on systems that should require it.
Credential attacks take several forms. Credential stuffing uses lists of username and password pairs from previous breaches, tested automatically against other services on the assumption that users reuse passwords. Brute force attacks systematically try password combinations against login interfaces that do not limit attempt frequency. Password spraying reverses the approach — instead of trying many passwords against one account (which triggers lockouts), it tries one common password against many accounts simultaneously, staying under lockout thresholds. Keylogging malware and phishing harvest credentials in real time from active users.
Privileged account credentials — administrator accounts, service accounts, and accounts with access to sensitive systems — are the highest-value targets. The IBM 2025 report found that malicious insider attacks, which frequently involve privileged credential abuse, cost an average of $4.92 million per breach, the highest of any initial attack vector category. Privileged Access Management (PAM) solutions enforce just-in-time access, record privileged sessions, and vault credentials so that even administrators do not know the passwords to the systems they manage — reducing the attack surface dramatically.
The foundational defence is MFA on every external-facing system and every privileged account. Password managers address reuse by generating unique, complex credentials for each service. Monitoring for anomalous login activity — unusual hours, unfamiliar IP addresses, impossible travel between locations — provides detection capability when credentials are used by an attacker rather than their legitimate owner.
SQL Injection and Web Application Attacks
SQL injection has appeared on the OWASP Top 10 list of most critical web application vulnerabilities for nearly two decades, and it remains a real-world threat. In January 2025, attackers exploited a SQL injection vulnerability in PostgreSQL (CVE-2025-1094) to breach BeyondTrust’s Remote Support platform — an intrusion chain that ultimately reached the US Treasury Department. The vulnerability was the same class of bug that security education has been emphasising since the late 1990s: unsanitised user input passed directly into a database query.
The attack mechanism is conceptually simple. When a web application builds a database query by concatenating user-supplied input directly into the SQL string, an attacker can inject SQL syntax that changes the query’s logic. A login form that constructs SELECT FROM users WHERE username = '[input]' becomes vulnerable when the attacker inputs admin'--, transforming the query to SELECT FROM users WHERE username = 'admin'--' — the double dash comments out the password check entirely, granting access without valid credentials. More sophisticated variants use UNION statements to extract data from other tables, time-based blind injection to exfiltrate information without visible output, or stacked queries to modify or delete data.
Cross-Site Scripting (XSS) is the complementary web attack that targets the browser rather than the database. Where SQL injection manipulates the server-side database query, XSS injects malicious JavaScript into pages served to other users. A stored XSS vulnerability on a web application means that an attacker can post content containing a script that executes in the browser of every subsequent visitor — stealing session cookies, redirecting to phishing pages, or performing actions on the user’s behalf. A stored XSS vulnerability in the Homarr dashboard application allowed privilege escalation to full administrative access through malicious SVG file uploads, discovered in 2025.
The defences are established and effective: parameterised queries (also called prepared statements) for all database interactions eliminate SQL injection entirely by separating SQL code from user-supplied data. Output encoding prevents XSS by ensuring that user-supplied content is rendered as text rather than executed as code. Web Application Firewalls (WAF) provide a secondary detection layer. CISA and the FBI issued a Secure by Design Alert in January 2026 specifically highlighting that SQL injection and OS command injection remain preventable vulnerabilities that continue to surface in critical infrastructure — reflecting frustration that known fixes are still not being applied universally.
Ransomware Delivery via Malware and Trojans
Malware is the umbrella term for malicious software — ransomware, spyware, keyloggers, remote access trojans (RATs), rootkits, and worms all fall under this category. Understanding the delivery mechanism is as important as understanding the payload, because defences must intercept malware before it executes rather than after. Microsoft screens approximately 5 billion emails per day for malware and phishing, reflecting the scale of email-based malware delivery attempts.
Remote Access Trojans (RATs) are among the most dangerous malware category for organisations because they provide the attacker with persistent, covert control of the infected machine — appearing as legitimate software while opening a back channel to an attacker-controlled server. RATs are typically delivered through phishing attachments, drive-by downloads from compromised websites, or bundled with pirated software. Once installed, they can capture screenshots, record keystrokes, exfiltrate files, and serve as the launch point for lateral movement and ransomware deployment. Cobalt Strike, a legitimate penetration testing tool that has been widely pirated and repurposed by criminal groups, is used in the post-exploitation phase of a significant proportion of ransomware incidents.
Rootkits operate at an even deeper level, modifying operating system components to hide the presence of malware from security tools. A rootkit-infected system may show no evidence of compromise to a standard antivirus scan while the attacker maintains full control. Bootkit variants — rootkits that load before the operating system — are particularly resistant to removal. Fileless malware takes a different approach, residing entirely in memory and using legitimate system tools (PowerShell, WMI, MSHTA) to execute malicious actions without writing files to disk that signature-based tools can detect.
Defence in depth is the only effective strategy against the diversity of malware types. Next-generation endpoint protection with behavioural detection (EDR/XDR) identifies suspicious activity patterns rather than relying on known-bad file signatures. Application allowlisting restricts which executables can run on a system. Network segmentation and egress filtering limit malware’s ability to communicate with command-and-control servers even after infection. Regular patching closes the exploitation pathways that deliver malware via drive-by downloads and vulnerability exploitation.
Man-in-the-Middle (MitM) Attacks
A Man-in-the-Middle attack positions the attacker between two communicating parties — intercepting, reading, and potentially modifying traffic without either party’s knowledge. The classic scenario involves a rogue wireless access point: an attacker sets up a Wi-Fi network with a name similar to a legitimate public hotspot, waits for users to connect, and intercepts all traffic between those users and the internet. Unsecured HTTP traffic is fully readable; even HTTPS traffic can be intercepted through SSL stripping attacks that downgrade the connection to unencrypted HTTP if the target site is not configured to enforce HTTPS.
ARP poisoning is the LAN-based variant: the attacker sends forged ARP (Address Resolution Protocol) messages to associate their MAC address with the IP address of a legitimate gateway, causing traffic meant for the router to flow through the attacker’s machine first. BGP hijacking operates at the internet routing level, manipulating Border Gateway Protocol advertisements to reroute traffic through attacker-controlled infrastructure — documented in attacks where entire country-level internet traffic was briefly redirected through rogue autonomous systems. DNS spoofing corrupts DNS resolution to send users to attacker-controlled IP addresses rather than legitimate servers.
The primary defence against MitM attacks is encryption in transit. HTTPS (TLS 1.2 minimum, TLS 1.3 preferred) with HTTP Strict Transport Security (HSTS) headers prevents SSL stripping. Certificate pinning in mobile applications prevents acceptance of fraudulent certificates. On local networks, Dynamic ARP Inspection (DAI) on managed switches blocks ARP poisoning. For employees connecting remotely, VPNs with strong authentication encrypt traffic before it reaches potentially hostile network infrastructure. Users should be trained to verify HTTPS before submitting credentials and to treat public Wi-Fi as hostile by default.
DDoS: Taking Systems Offline
A Distributed Denial-of-Service (DDoS) attack overwhelms a target system — typically a web server, network device, or application — with traffic from thousands or millions of compromised machines (a botnet) until the system is unable to serve legitimate users. DDoS attacks are not typically used to steal data; their goal is disruption. They are used by hacktivists to silence organisations, by competitors for economic sabotage, and by criminal groups as extortion leverage. DDoS attacks targeting APIs specifically increased by over 200% in 2025, reflecting the shift toward API-centric application architectures.
Volumetric attacks flood the target with raw traffic — measured in gigabits per second — overwhelming the bandwidth capacity of the target’s network connection. Protocol attacks exploit weaknesses in network protocol implementations, such as SYN flood attacks that exhaust server connection state tables by sending TCP SYN packets without completing the handshake. Application-layer attacks are the most sophisticated variant: rather than overwhelming bandwidth, they send requests that appear legitimate but are computationally expensive to process, such as complex search queries or file upload operations repeated at scale. A relatively small botnet can take down a web application with application-layer attacks by targeting a computationally intensive endpoint.
Mitigating DDoS attacks requires infrastructure that can absorb or filter malicious traffic before it reaches the protected service. Content Delivery Networks (CDNs) with DDoS mitigation capabilities — provided by services like Cloudflare, Akamai, and AWS Shield — absorb volumetric attacks by distributing traffic across geographically dispersed capacity. Rate limiting and challenge pages at the application layer reduce the effectiveness of application-layer attacks by requiring proof of legitimacy. Anycast routing distributes incoming traffic across multiple data centres, making it difficult for a single flood to saturate any one location.
Supply Chain Attacks: The Fastest-Growing Threat
The single most alarming trend in the 2025 Verizon DBIR and IBM 2025 Cost of a Data Breach report is the acceleration of supply chain attacks. Third-party involvement was a factor in 30% of all breaches in 2025 — double the proportion recorded the prior year. IBM’s 2025 report found supply chain compromises cost an average of $4.73 million per breach, above the global average, and supply chain breaches are now the fastest-growing initial access category in the DBIR.
A supply chain attack compromises a trusted third party — a software vendor, managed service provider, or SaaS platform — and uses that trusted relationship to reach the actual target. The 2020 SolarWinds attack is the defining example: attackers compromised the SolarWinds Orion software build process and distributed malicious updates to approximately 18,000 customers, gaining access to US government agencies and major corporations. The 2023 MOVEit Transfer vulnerability was exploited within days of disclosure across hundreds of organisations that used the file transfer software, with data from thousands of downstream companies exfiltrated before patches could be deployed. The 2024 XZ Utils backdoor, discovered just before it reached major Linux distributions, demonstrated that even open-source software supply chains are targeted.
The defences require a shift in how organisations think about trust. Software Bill of Materials (SBOM) — a formal inventory of every component in a software product — enables organisations to rapidly identify exposure when a component is found to be compromised. Third-party risk assessments and vendor security requirements should be contractual, not optional. Network segmentation between third-party access and internal systems limits the blast radius when a trusted vendor is compromised. Zero Trust Architecture — which treats every connection as potentially hostile regardless of source, requiring continuous verification rather than perimeter-based trust — is the strategic response to an environment where the perimeter includes every vendor and supplier.
Zero-Day Exploits and Vulnerability Exploitation
A zero-day vulnerability is a software flaw that is unknown to the software vendor — meaning no patch exists at the moment of exploitation. Zero-days are extremely valuable to attackers because defenders cannot patch what they do not know exists. State-sponsored threat actors are the primary users of zero-days against high-value targets; criminal groups more commonly exploit known vulnerabilities for which patches have been available but not applied. Only 54% of perimeter-device vulnerabilities were fully remediated by organisations in 2025 — meaning nearly half of known vulnerabilities on internet-facing devices remained unpatched, giving attackers rich exploitation opportunities without needing zero-days at all.
The window between vulnerability disclosure and active exploitation has collapsed in recent years. Edge devices — firewalls, VPN concentrators, and network appliances — are particularly targeted because they sit on the perimeter, are often difficult to patch without service interruption, and provide immediate network access upon compromise. The 2025 Verizon DBIR noted that the median time from vulnerability disclosure to exploitation in the wild is now measured in days for high-profile edge device vulnerabilities, down from weeks in prior years.
Vulnerability management programmes must be prioritised and risk-based rather than calendar-based. Patching everything within thirty days is no longer an adequate framework when critical vulnerabilities are being exploited within seventy-two hours of disclosure. CISA’s Known Exploited Vulnerabilities (KEV) catalogue provides a prioritised list of vulnerabilities that are actively exploited in the wild — organisations should treat KEV entries as requiring emergency patching timelines. Attack surface management tools continuously discover and assess internet-facing assets, identifying unpatched systems before attackers do. Where immediate patching is impossible, compensating controls — WAF rules, network segmentation, and disabling affected features — reduce exposure while patch deployment is prepared.
How to Build Defences Against All Attack Types
The attack types covered in this guide share a common characteristic: they predominantly succeed because of preventable weaknesses. Phishing succeeds because MFA is absent. Ransomware spreads because networks are flat and backups are online. SQL injection succeeds because parameterised queries are not used. Credential attacks succeed because passwords are reused and MFA is not enforced. Understanding this is strategic — it means that a relatively small set of foundational controls addresses the vast majority of real-world attacks.
The controls with the highest return on investment across all attack categories are consistent: MFA on all external-facing systems and privileged accounts blocks the majority of credential-based attacks. Regular, tested, offline backups ensure ransomware does not result in data loss. A vulnerability management programme with risk-based prioritisation closes the exploitation pathways that malware and attackers use for initial access. Network segmentation limits lateral movement and blast radius regardless of which attack category gains initial access. Security awareness training measured through simulated exercises reduces the human element that appears in 60% of breaches.
Layered defences — the security principle of defence in depth — matter because no single control is perfect. The attacker who is blocked by MFA may try phishing instead. The phishing filter that catches 99% of malicious emails misses 1%. The WAF that blocks SQL injection may not catch a novel bypass technique. Building multiple overlapping controls means that a failure in any single layer does not result in a breach.
Conclusion
The most important insight from the current threat data is that attackers are not primarily succeeding through novel, sophisticated techniques — they are succeeding through consistent exploitation of known weaknesses in environments that have not applied known fixes. Vulnerability exploitation is now the leading initial access vector. Phishing and credential abuse remain the dominant mechanisms for gaining foothold in the 60% of breaches where the human element is present. Ransomware has reached 44% of all breaches. Supply chain attacks doubled year-over-year. None of these trends require defenders to solve unsolvable problems — they require applying well-understood controls consistently and completely.
For security professionals working toward or holding the CISSP certification, the attack types covered in this guide map directly to the defensive domains covered in the CBK — as explained in our complete guide to the 8 CISSP security domains. Phishing and social engineering defences live in Domain 1 (Security and Risk Management) and Domain 7 (Security Operations). Vulnerability management spans Domains 3, 6, and 7. Web application security is Domain 8 (Software Development Security). Identity and credential controls are Domain 5 (Identity and Access Management). The domains provide the framework; understanding the attacks provides the motivation for why each framework element matters.
Next Article Preview:
In the next article, we will explore “Cryptography Fundamentals: How Encryption Actually Protects Your Data” — a practical breakdown of symmetric and asymmetric encryption, hashing, digital signatures, and PKI, with real-world examples of how each mechanism protects data in transit and at rest.
