Types of Cyber Threats

A cyber threat is any potential action or event that could damage, disrupt, or gain unauthorised access to a system, network, or data. Understanding the different types isn't academic — each one behaves differently, spreads differently, and requires a different defence.

Malware — software built to cause harm

Malware is the umbrella term for any software written with malicious intent. It's not a single thing — it's a category containing several distinct types, each designed to do something different. Knowing the differences matters because each type requires a different detection approach and a different response.

Phishing — the human exploit

Phishing is the practice of tricking people into handing over credentials, clicking malicious links, or transferring money — by impersonating someone or something they trust. It's consistently the most common initial attack vector across every sector, every year. Not because it's technically sophisticated, but because it works.

The basic version — a mass email pretending to be your bank asking you to verify your account — everyone knows about. The dangerous version is spear phishing: targeted, researched, personalised attacks that reference real people, real projects, and real relationships. In 2020, the CEO of a UK energy company received a phone call from someone who convincingly impersonated the voice of his German parent company's CEO — using AI-generated audio — and authorised a €220,000 transfer. That's phishing at its most evolved.

Other variants include smishing (phishing via SMS), vishing (voice calls), and whaling (spear phishing specifically targeting executives). The delivery method changes. The underlying manipulation doesn't.

Social engineering — the broader category

Phishing is a subset of social engineering — the art of manipulating people rather than systems. Where technical attacks exploit software vulnerabilities, social engineering exploits psychological ones: authority, urgency, fear, helpfulness, and trust.

Pretexting is when an attacker fabricates a scenario to extract information. A classic example: someone calls the IT helpdesk pretending to be a new employee who can't log in. With enough plausible detail — a manager's name, a department, a recent company event — they can often get a password reset without any authentication.

Baiting works by leaving something tempting — a USB drive in a car park labelled "Payroll Q4", for instance. In studies, a significant percentage of people who found such drives plugged them into their work machines out of curiosity. Once plugged in, the drive installs whatever's on it automatically.

Denial of Service attacks

A Denial of Service attack floods a target system — a website, an API, a network — with so much traffic that it can't respond to legitimate requests. The goal isn't theft or access — it's disruption. Sometimes it's extortion ("pay us or we keep the attack going"). Sometimes it's competitive sabotage. Sometimes it's a distraction while a more subtle attack happens elsewhere.

The more dangerous variant is a Distributed Denial of Service (DDoS) attack, where the traffic comes from thousands or millions of compromised machines — a botnet — rather than a single source. This makes it much harder to block because you can't just firewall one IP address. In 2016, the Mirai botnet — composed almost entirely of compromised IoT devices like security cameras and home routers — launched a DDoS attack that took down Dyn, a major DNS provider, temporarily making Twitter, Netflix, Reddit, and CNN inaccessible for much of the US East Coast.

Man-in-the-Middle and Insider Threats

A Man-in-the-Middle (MitM) attack happens when an attacker positions themselves between two parties who think they're communicating directly with each other. The attacker intercepts, and potentially modifies, the traffic passing between them. Public Wi-Fi networks are a common setup for this — an attacker creates a hotspot with a plausible name ("Airport_WiFi_Free"), users connect to it, and every unencrypted request they make goes through the attacker's machine first.

Insider threats are a different category entirely — damage caused by people who already have legitimate access. This includes disgruntled employees deliberately exfiltrating data, careless staff who misconfigure systems or fall for phishing attacks, and contractors with broader access than they need. The 2013 Edward Snowden case is the most famous example, but insider threats in corporate settings are far more common and far less reported. They're also significantly harder to detect because the person is using legitimate credentials to do what looks, at first glance, like legitimate work.

Checking a file for known malware signatures

Before running any unfamiliar file — an attachment, a downloaded tool, a binary from an unknown source — it's worth checking it against known malware signatures. Here's how to do a quick hash check and submit it to VirusTotal from the command line:

# Step 1: Generate the SHA256 hash of the suspicious file
# This gives you a unique fingerprint of the file's contents
sha256sum suspicious_file.exe

# Step 2: Query the VirusTotal API with the hash
# Replace YOUR_API_KEY with a free key from virustotal.com
# Replace the hash below with the output from step 1
curl -s --request GET \
  --url "https://www.virustotal.com/api/v3/files/a3b4c5d6e7f8..." \
  --header "x-apikey: YOUR_API_KEY" \
  | python3 -m json.tool | grep -E '"malicious"|"undetected"|"name"'

# Step 1 output — SHA256 hash of the file
a3b4c5d6e7f8901234567890abcdef1234567890abcdef1234567890abcdef12  suspicious_file.exe

# Step 2 output — VirusTotal scan results (abbreviated)
            "malicious": 41,
            "undetected": 31,
        "name": "suspicious_file.exe",
        "name": "Trojan.GenericKD.47821933",
        "name": "Win32:Malware-gen",
        "name": "Ransom.FileCryptor",

Practice Questions

Quiz