Common Threats

Common cybersecurity threats are malware, ransomware, phishing, credential theft and account abuse, AI attacks, cryptojacking, and DDoS.

Malware: short for "malicious software", is any software code or computer program that is intentionally written to harm a computer system or its users. Hackers and cybercriminals create and use malware to gain unauthorized access to computer systems and sensitive data, hijack computer systems and operate them remotely, disrupt or damage computer systems, or hold data or systems hostage for large sums of money.

Ransomware: type of malware that encrypts a victim’s data or device and threatens to keep it encrypted—or worse—unless the victim pays a ransom to the attacker.

Phishing: email, text or voice messages that trick users into downloading malware, sharing sensitive information or sending funds to the wrong people. Most users are familiar with bulk phishing scams—mass-mailed fraudulent messages that appear to be from a large and trusted brand, asking recipients to reset their passwords or reenter credit card information. More sophisticated phishing scams, such as spear phishing and business email compromise (BEC), target specific individuals or groups to steal especially valuable data or large sums of money.

Credential theft and account abuse: hijack legitimate user accounts and abuse their privileges, account for 30% of attacks. This makes identity-based attacks the most common entry point into corporate networks. Hackers have many techniques for stealing credentials and taking over accounts. Insider threats: threats that originate with authorized users—employees, contractors, business partners—who intentionally or accidentally misuse their legitimate access or have their accounts hijacked by cybercriminals. Insider threats can be harder to detect than external threats because they have the earmarks of authorized activity and are invisible to antivirus software, firewalls and other security solutions that block external attacks.

CAI attacks: scammers use generative AI to produce fake emails, applications and other business documents to fool people into sharing sensitive data or sending money.

Cryptojacking: hackers gain access to an endpoint device and secretly use its computing resources to mine cryptocurrencies such as bitcoin, ethereum or monero. Now among the top three areas of operations for cybercriminals.

Distributed denial of service (DDoS): attempts to crash a server, website or network by overloading it with traffic, usually from a botnet—a network of distributed systems that a cybercriminal hijacks by using malware and remote-controlled operations. The global volume of DDoS attacks spiked during the COVID-19 pandemic. Increasingly, attackers are combining DDoS attacks with ransomware attacks, or simply threatening to launch DDoS attacks unless the target pays a ransom. (IBM)