Key Terms
This malware locks or encrypts a victim's files and demands payment to restore access.
What is ransomware?
Ransomware is the signature tool of financially motivated cybercriminals.
At 15, I used attack tools I did not write to knock Yahoo, CNN and eBay offline in 2000, then bragged about it in chat rooms.
Who is a script kiddie?
Script kiddies run other people's tools with little skill, often for attention. He was caught partly because he bragged online.(Michael "Mafiaboy" Calce)
Verizon's 2022 DBIR found roughly 93% of breaches were driven by this motive.
What is financial gain?
Most real-world attackers are criminals after money, even though headlines focus on spies. Only about 6% of breaches in that report were clearly espionage.
Many ransomware attacks begin when an employee is tricked by a fake email. Name this attack.
What is phishing?
CISA and FBI reported that DarkSide, the group behind the Colonial Pipeline attack, typically gained initial access this way. Defenses: security awareness training, email filtering, and multi-factor authentication so a stolen password alone is not enough.
Ransomware developers rent their malware to "affiliates" and share the profits. Give the three-letter abbreviation for this business model.
What is RaaS (Ransomware-as-a-Service)?
Because developers rent the tool, affiliates can be less skilled, which makes the actor types on our cheat sheet blur together. Defenders therefore focus on behaviors and entry points, not just group names.
Hacking carried out to promote a political or social cause.
What is hacktivism?
Hacktivists want attention for a cause, not profit. A favorite tool is the DDoS attack, which floods a site with traffic until it stops responding.
I am funded and directed by a government, play a long game, and my goals are spying or sabotage.
Who is a state-sponsored attacker?
These actors have the most money, time, and expertise. Their attacks are rare but can be extremely damaging, like Stuxnet.
A group defaces a company's website and floods its servers to protest a policy. This motive explains it.
What is ideology (a political or social cause)?
Ideology, fun and grudges are real motives but a small slice of breaches overall. Hacktivism is loud and visible, which is part of the point.
Giving each user only the access needed for their job limits damage from insiders and stolen accounts. Name this principle.
What is least privilege?
Apply it to administrators too, and review access when people change roles or leave the organization.
A stealthy, well-funded attacker that keeps long-term access to a target, often state-backed, goes by this three-letter abbreviation.
What is an APT (Advanced Persistent Threat)?
APTs aim to stay hidden for a long time to spy or sabotage rather than make quick money. Stuxnet shows the level of resources involved in state-backed operations.
I already have a login and a badge, so your firewall cannot keep me out. My motive may be money, a grudge, or even carelessness.
Who is an insider threat?
CISA defines an insider threat as someone using authorized access to harm the organization, intentionally or unintentionally. Because the access is legitimate, detection depends on behavior monitoring.
Stealing another nation's defense plans, or sabotaging its nuclear program, serves this kind of motive.
What is espionage or geopolitical advantage?
State-sponsored actors measure success in strategic advantage, not dollars. That changes how defenders should think about their patience and persistence.
Tested copies of data kept offline let a ransomware victim restore systems without paying. These are called this.
What are backups (offline and tested)?
Backups only help if you test restoring them and keep at least one copy that ransomware cannot reach on the network.