In the simplest sense, a cybersecurity threat, or cyberthreat, is an indication that a hacker or malicious actor is attempting to gain unauthorized access to a network for the purpose of launching a cyberattack.
Cyberthreats can range from the obvious, such as an email from a foreign potentate offering a small fortune if you’ll just provide your bank account number, to the deviously stealthy, such as a line of malicious code that sneaks past cyberdefenses and lives on the network for months or years before triggering a costly data breach. The more security teams and employees know about the different types of cybersecurity threats, the more effectively they can prevent, prepare for, and respond to cyberattacks.
Malware
Malware—short for “malicious software”—is software code written intentionally to harm a computer system or its users.
Almost every modern cyberattack involves some type of malware. Threat actors use malware attacks to gain unauthorized access and render infected systems inoperable, destroying data, stealing sensitive information, and even wiping files critical to the operating system.
Common types of malware include:
- Ransomware locks a victim’s data or device and threatens to keep it locked, or leak it publicly, unless the victim pays a ransom to the attacker. According to the IBM Security X-Force Threat Intelligence Index 2023, ransomware attacks represented 17 percent of all cyberattacks in 2022.
- A Trojan horse is malicious code that tricks people into downloading it by appearing to be a useful program or hiding within legitimate software. Examples include remote access Trojans (RATs), which create a secret backdoor on the victim’s device, or dropper Trojans, which install additional malware once they gain a foothold on the target system or network.
- Spyware is a highly secretive malware that gathers sensitive information, like usernames, passwords, credit card numbers and other personal data, and transmits it back to the attacker without the victim knowing.
- Worms are self-replicating programs that automatically spread to apps and devices without human interaction.
Learn more about malware
Social engineering and phishing
Frequently referred to as “human hacking,” social engineering manipulates targets into taking actions that expose confidential information, threaten their own or their organization’s financial well-being, or otherwise compromise personal or organizational security.
Phishing is the best-known and most pervasive form of social engineering. Phishing uses fraudulent emails, email attachments, text messages or phone calls to trick people into sharing personal data or login credentials, downloading malware, sending money to cybercriminals, or taking other actions that might expose them to cybercrimes.
Common types of phishing include:
- Spear phishing—highly targeted phishing attacks that manipulate a specific individual, often using details from the victim’s public social media profiles to make the scam more convincing.
- Whale phishing—spear phishing that targets corporate executives or wealthy individuals.
- Business email compromise (BEC)—scams in which cybercriminals pose as executives, vendors, or trusted business associates to trick victims into wiring money or sharing sensitive data.
Another common social engineering scam is domain name spoofing (also called DNS spoofing), in which cybercriminals use a fake website or domain name that impersonates a real one—e.g., ‘applesupport.com’ for support.apple.com—to trick people into entering sensitive information. Phishing emails often use spoofed sender domain names to make the email seem more credible and legitimate.
Man-in-the-Middle (MITM) attack
In a man-in-the-middle attack, a cybercriminal eavesdrops on a network connection to intercept and relay messages between two parties and steal data. Unsecured Wi-Fi networks are often happy hunting grounds for hackers looking to launch MITM attacks.
Denial-of-Service (DoS) attack
A denial-of-service attack is a cyberattack that overwhelms a website, application, or system with volumes of fraudulent traffic, making it too slow to use or entirely unavailable to legitimate users. A distributed denial-of-service attack, or DDoS attack, is similar except it uses a network of internet-connected, malware-infected devices or bots, known as a botnet, to cripple or crash the target system.
Zero-day exploits
A zero-day exploit is a type of cyberattack that takes advantage of a zero-day vulnerability—an unknown or as-yet-unaddressed or unpatched security flaw in computer software, hardware, or firmware. “Zero day” refers to the fact that a software or device vendor has “zero days”—or no time—to fix the vulnerabilities because malicious actors can already use them to gain access to vulnerable systems.
One of the best-known zero-day vulnerabilities is Log4Shell, a flaw in the widely-used Apache Log4j logging library. At the time of its discovery in November 2021, the Log4Shell vulnerability existed on 10 percent of global digital assets, including many web applications, cloud services and physical endpoints like servers.
Learn more about detecting and patching a Log4j vulnerability
Password attack
As the name suggests, these attacks involve cybercriminals trying to guess or steal the password or login credentials to a user’s account. Many password attacks use social engineering to trick victims into unwittingly sharing this sensitive data. However, hackers can also use brute force attacks to steal passwords, repeatedly trying different popular password combinations until one is successful.
Internet of things (IOT) attack
In an IoT attack, cybercriminals exploit vulnerabilities in IoT devices, like smart home devices and industrial control systems, to take over the device, steal data, or use the device as a part of a botnet for other malicious ends.
Injection Attacks
In these attacks, hackers inject malicious code into a program or download malware to execute remote commands, enabling them to read or modify a database or change website data.
There are several types of injection attacks. Two of the most common include:
- SQL injection attacks—when hackers exploit the SQL syntax to spoof identity; expose, tamper, destroy, or make existing data unavailable; or become the database server administrator.
- Cross-site scripting (XSS)—these type of attacks are similar to SQL injection attacks, except instead of extracting data from a database, they typically infect users who visit a website.
Sources of cybersecurity threats
The sources of cyberthreats are almost as varied as the types of cyberthreats. Many threat actors have malicious intent, while others—such as ethical hackers or unwitting insider threats—have positive or, at the very least, neutral intentions.
Knowing the motivations and tactics of various threat actors is critical for stopping them in their tracks or even using them to your advantage.
Some of the most well-known perpetrators of cyberattacks include:
Cybercriminals
These individuals or groups commit cybercrimes, mostly for financial gain. Common crimes committed by cybercriminals include ransomware attacks and phishing scams that trick people into making money transfers or divulging credit card information, login credentials, intellectual property, or other private or sensitive information.
Hackers
A hacker is someone with the technical skills to compromise a computer network or system.
Keep in mind that not all hackers are threat actors or cybercriminals. For example, some hackers—called ethical hackers—essentially impersonate cybercriminals to help organizations and government agencies test their computer systems for vulnerabilities to cyberattacks.
Nation-state actors
Nation states and governments frequently fund threat actors with the goal of stealing sensitive data, gathering confidential information, or disrupting another government’s critical infrastructure. These malicious activities often include espionage or cyberwarfare and tend to be highly funded, making the threats complex and challenging to detect.
Insider threats
Unlike most other cybercriminals, insider threats do not always result from malicious actors. Many insiders hurt their companies through human error, like unwittingly installing malware or losing a company-issued device that a cybercriminal finds and uses to access the network.
That said, malicious insiders do exist. For example, a disgruntled employee may abuse access privileges for monetary gain (e.g., payment from a cybercriminal or nation state), or simply for spite or revenge.
Staying ahead of cyberattacks
Strong passwords, email security tools, and antivirus software are all critical first lines of defense against cyberthreats.
Organizations also rely on firewalls, VPNs, multi-factor authentication, security awareness training, and other advanced endpoint security and network security solutions to protect against cyberattacks.
However, no security system is complete without state-of-the-art threat detection and incident response capabilities to identify cybersecurity threats in real-time, and help rapidly isolate and remediate threats to minimize or prevent the damage they can do.
IBM Security® QRadar® SIEM applies machine learning and user behavior analytics (UBA) to network traffic alongside traditional logs for smarter threat detection and faster remediation. In a recent Forrester study, QRadar SIEM helped security analysts save more than 14,000 hours over three years by identifying false positives, reduce time spent investigating incidents by 90%, and reduce their risk of experiencing a serious security breach by 60%.* With QRadar SIEM, resource-strained security teams have the visibility and analytics they need to detect threats rapidly and take immediate, informed action to minimize the effects of an attack.
Learn more about IBM QRadar SIEM
*The Total Economic Impact™ of IBM Security QRadar SIEM is a commissioned study conducted by Forrester Consulting on behalf of IBM, April 2023. Based on projected results of a composite organization modeled from 4 interviewed IBM customers. Actual results will vary based on client configurations and conditions and, therefore, generally expected results cannot be provided.
