How Every Cyber Attack Works

You are in charge of the financial department of your organization, and you just received an email from a C-level executive.It orders you to pay an invoice of $78,000 before 2 p.m. and consists of instructions for how to wire the funds to your vendor’s account.You do as per the instructions, and it rapidly moves to a number of small U.S. banks and then eventually transfers to an overseas account, where it is doubtful that your organization—or law enforcement—will be able to recover it.

An attack, according to cyber fraud lawyers predominantly if carried out by an accomplished adversary, may consist of repeated stages. Understanding the types of attack, and the intricate stages will help you to defend yourself better.

This is how a cyber attack works.

It's convenient to classify attacks into two types: targeted and UN-targeted.

Un-targeted cyber attacks

In UN-targeted attacks, attackers generally target as many services, devices, or users they come in contact with. There is no consideration to the particular victim as there will be a number of services machines with vulnerabilities. To achieve this, they use techniques that take advantage of the feasibility of the Internet, which comprise of:

Phishing - sending emails to a group of individuals looking for sensitive information (like bank details) or encouraging them to view a fake website.

Water holing – creating a fake website or compromising the legitimacy of a former one in order to exploit visiting audience

Ransomware - which could comprise of disseminating disk encrypting extortion malware

Scanning - attacking vast swathes of the Internet at random

Targeted cyber attacks

In targeted types, your organization is singled out since the attacker has a precise interest in your business, or has been rewarded to target you. The underpinning for the attack could take from weeks to months so that they can find the finest route to deliver their exploit directly to the users or your system. A targeted attack is generally more damaging than an UN-targeted one since it has been exactly tailored to attack your processes, systems, or personnel, in the office and occasionally at home. Targeted attacks may comprise of:

spear-phishing - sending emails to targeted people that could entail an attachment with malicious software or a link that redirects to malicious software download

positioning a botnet - to deliver a Distributed Denial of Service (DDOS) attack

overthrowing the supply chain - to attack software or equipment being delivered to the organisation

Stages of an attack

Irrespective of whether an attack is targeted or un-targeted, or the attacker is using regular or bespoke tools, Legal help in Winnipeg describes that cyber-attacks have a number of stages that are common to almost all of them.

Here are the four main stages present in most cyberattacks:

Survey - investigating and evaluating available information about the target in order to recognise potential vulnerabilities

Delivery – reaching the point in a system where vulnerabilities can be exploited

Breach - exploiting the vulnerability/vulnerabilities to obtain some form of unauthorized access

Affect – conduct activities within a system that accomplish the attacker’s goal.