MODULE 2: Cyber Threats & Attack Types

Lesson 1: Malware — Viruses, Worms, Trojans, Ransomware

What is Malware?

Malware = Malicious Software.
Any software created to damage, disrupt, spy on, or gain unauthorized access to systems.

Main Types of Malwares

1. Virus

• Attaches itself to a legitimate file or program
• Spreads when that program/file is executed or shared
• Often corrupts data, slows systems, or deletes files

Example:
A user downloads a “Keygen” to crack software → it contains a virus that spreads through USB drives inside the company.

2. Worm

• Self-replicating malware
• Does not need user action to spread
• Spreads across networks by exploiting vulnerabilities

Example:
A worm finds a vulnerable Windows server, copies itself, then starts scanning the network for other vulnerable machines.

3. Trojan (Trojan Horse)

• Looks legitimate (game, tool, installer)
• User installs it willingly
• Once inside, attacker gets a “backdoor” to the system

Example:
A user installs a fake “PDF reader update” → it opens a remote access tool (RAT) for the attacker.

4. Ransomware

• Encrypts files or entire systems
• Attacker demands payment (usually in crypto) to decrypt
• Affects businesses, hospitals, government institutions, etc.

Example:
All shared drives of a company become unreadable. A message appears:
“Your files are encrypted. Pay 5 BTC within 72 hours.”

How Malware Spreads

• Email attachments
• Infected USBs
• Malicious websites & downloads
• Exploiting unpatched systems
• Pirated software & cracks

Defending Against Malware

• Up-to-date antivirus/EDR
• Disable autorun on USB drives
• Patch OS and apps regularly
• Block known malicious websites
• Train users: don’t install unknown software
• Regular backups (especially against ransomware)

Lesson 2: Phishing, Social Engineering & Email Attacks

What is Social Engineering?

Attacking the human mind instead of the system.
Tricking people into:

• Sharing passwords
• Clicking malicious links
• Sending money
• Approving actions

Phishing

Fake messages (email, SMS, social media) designed to make users:

• Enter their credentials on fake sites
• Download malware
• Transfer money

Example (Email):
“Your Microsoft 365 password expired. Click here to renew.” → Fake login page steals credentials.

Types of Phishing

1. Phishing (General)
   Mass emails sent to many people hoping someone will fall for it.
2. Spear Phishing
   Targeted at a specific person or company.
   Example: Email that looks like it’s from the CEO to the finance officer.
3. Whaling
   Targeting high-profile people (CEO, CFO, Directors).
4. Smishing (SMS Phishing)
   Via SMS: “Your bank account is locked. Click this link.”
5. Vishing (Voice Phishing)
   Phone calls pretending to be bank, IT support, or police.

Email Attack Techniques

• Fake domains (micros0ft.com instead of microsoft.com)
• Display name spoofing (From: “IT Support”)
• Malicious attachments (invoice.pdf.exe)
• Links masked using URL shorteners

Defending Against Phishing & Social Engineering

• User awareness training
• Email filtering / spam filters
• Never click unknown links or attachments
• Verify requests via separate channel (e.g., call the person)
• Multi-factor authentication (MFA) limits damage
• Use official apps/websites, not links in messages

Lesson 3: Network Attacks (DDoS, MITM, Spoofing, Scanning)

What Are Network Attacks?

Attacks that target communication channels, protocols, and devices on the network.

1. DDoS (Distributed Denial of Service)

• Goal: Make a website/server unavailable
• Many compromised machines (botnet) flood server with traffic
• Server becomes overloaded and stops responding

Example:
A bank’s website is flooded with millions of fake requests and becomes unreachable for customers.

Defense:

• DDoS protection services
• Traffic filtering & rate limiting
• Firewalls and CDNs

2. Man-in-the-Middle (MITM) Attack

• Attacker secretly sits between two communicating parties
• Can read, modify, or inject data
• Often done on unsecured Wi-Fi networks

Example:
User connects to free Wi-Fi; attacker intercepts traffic and steals login details.

Defense:

• Use HTTPS (TLS encryption)
• VPN on untrusted networks
• Strong Wi-Fi security (WPA3)

3. Spoofing

Pretending to be someone/something else on the network.

Types:

• IP Spoofing – Fake IP address to bypass filters or impersonate system
• MAC Spoofing – Fake MAC address
• DNS Spoofing – Redirecting users to fake websites

Defense:

• Network access control (NAC)
• DNSSEC
• Proper firewall rules and validation

4. Scanning & Enumeration

Attackers use tools like Nmap to:

• Discover live hosts
• Identify open ports
• Detect running services/versions (e.g., FTP, SSH, HTTP)

This is reconnaissance before an attack.

Defense:

• Close unnecessary ports
• Use firewalls
• Intrusion Detection Systems (IDS)
• Regular vulnerability scans

Lesson 4: Web Application Attacks (SQL Injection, XSS, CSRF, etc.)

Web apps (websites, portals, online services) are often directly exposed to the internet, so attackers try to exploit them.

1. SQL Injection (SQLi)

• Attacker injects SQL commands into input fields
• Goal: Read, modify, or delete data from the database

Example:
Login field:

Username: admin

Password: ‘ OR ‘1’=’1

If not properly validated, the query returns true, and attacker logs in without a real password.

Defense:

• Use parameterized queries (prepared statements)
• Input validation & sanitization
• Least privilege on database accounts

2. Cross-Site Scripting (XSS)

Attacker injects malicious JavaScript into a web page.

Types:

• Stored XSS (script saved in DB, shown to many users)
• Reflected XSS (script in URL or input, reflected back to user)

Impact:

• Steal cookies
• Hijack sessions
• Redirect users

Defense:

• Encode user input before displaying
• Input validation
• Use security headers (Content-Security-Policy)

3. Cross-Site Request Forgery (CSRF)

• Forces a logged-in user to perform an action they didn’t intend
• Example: Change password, transfer money, submit a form

Example:
User is logged into banking site.
They click a malicious link that silently sends a request to transfer money.

Defense:

• CSRF tokens in forms
• SameSite cookies
• Confirm sensitive actions with re-authentication

4. Other Web Attacks

• File Upload Abuse – Uploading malicious files (web shells)
• Directory Traversal – Accessing files outside allowed folder
• Broken Authentication – Weak login/session handling
• Insecure Direct Object References (IDOR) – Accessing others’ data by changing IDs in URL

Good Practices for Web Security

• Follow OWASP Top 10
• Use secure coding practices
• Regular code review & security testing
• Web Application Firewall (WAF)

Lesson 5: Insider Threats (Employees, Vendors, Partners)

Not all threats are from “hackers on the internet.”
Sometimes, the threat is inside the organization.

Types of Insider Threats

1. Malicious Insider
   Employee or contractor intentionally:

• Steals data
• Damages systems
• Sells information to competitors
• Sabotages operations

1. Negligent Insider
   Employee doesn’t follow policy:

• Uses weak passwords
• Loses laptop
• Sends data to wrong email
• Plugs random USB drives

1. Compromised Insider
   Legitimate user account is hacked:

• Attacker uses their credentials
• Looks like normal user behavior from outside

Why Insider Threats Are Dangerous

• Insiders already have some level of access
• They know internal systems and processes
• Often trusted → less monitoring
• Their activities may look “normal”

Defending Against Insider Threats

• Principle of Least Privilege (only necessary access)
• Role-Based Access Control (RBAC)
• Monitor user activity (logs, SIEM)
• Strong offboarding process (disable accounts immediately)
• Security awareness training
• Data Loss Prevention (DLP) tools
• Segregation of duties (no single person has full control over critical actions)

Module 2 Summary (For Students)

By the end of this module, students understand:

• What malware is and how viruses, worms, trojans, and ransomware work
• How phishing and social engineering trick users and how to detect them
• Core network attack types (DDoS, MITM, spoofing, scanning)
• How web applications are attacked using SQLi, XSS, CSRF, etc.
• Insider threats and why employees, vendors, and partners can be security risks

This module answers the question:
“How do attackers actually break in and cause damage?”