Threats, Vulnerabilities, and Social Engineering

Week of 2026-09-22 · Download .docx

Objectives

Classify threat actors by motivation: financial, ideological, geopolitical, and opportunistic.
Distinguish phishing, spear phishing, whaling, vishing, smishing, and pretexting by channel and target.
Categorize malware types — virus, worm, ransomware, rootkit, spyware — by behavior and propagation method.
Explain why zero-day vulnerabilities are particularly dangerous and describe how APTs exploit them.
Describe the MITRE ATT&CK framework and explain how CVE differs from ATT&CK.

Key terms

threat actor: Any person or group that carries out or sponsors a cyberattack; classified by motivation, resources, and sophistication.
nation-state: Government-sponsored hacker group with substantial resources; motivated by espionage, sabotage, or geopolitical advantage.
hacktivist: Attacker motivated by political or social ideology who uses hacking to promote a cause or embarrass a target.
phishing: Email-based social engineering attack using spoofed sender addresses, urgent language, and malicious links to steal credentials or deliver malware.
whaling: Highly targeted phishing attack directed specifically at senior executives or board members who have broad authority and access.
pretexting: Social engineering in which the attacker creates a fabricated scenario and false identity to manipulate a victim into sharing information.
ransomware: Malware that encrypts the victim's files and demands payment — typically in cryptocurrency — for the decryption key.
worm: Self-replicating malware that propagates across networks without requiring a host file, often exploiting unpatched network vulnerabilities.
rootkit: Malware that embeds in the operating system kernel or bootloader to conceal its presence from antivirus tools while maintaining persistent privileged access.
zero-day: A software vulnerability that is exploited before the vendor has released a patch — no signature or patch-based defense exists at the time of attack.
CVE: Common Vulnerabilities and Exposures — the public database maintained by MITRE and CISA that assigns unique IDs to known software vulnerabilities.
MITRE ATT&CK: A knowledge base of adversary tactics and techniques observed in real-world attacks, organized by the attacker's goal (tactic) and method (technique).
watering hole: An attack that compromises a website frequently visited by the target group; victims infect themselves by visiting what they believe is a trusted site.

The concept

Understanding who attacks organizations and how they operate is the foundation of Security+ Domain 1. The CompTIA exam tests both the vocabulary of threat classification and the practical ability to recognize attack techniques from scenario descriptions.

## Threat Actor Categories

Threat actors are grouped by motivation and capability. Nation-state actors have the greatest resources and sophistication — they conduct long-term espionage campaigns (APTs) targeting government agencies, critical infrastructure, and defense contractors. Cybercriminals and organized crime groups are motivated by financial gain; ransomware is their most profitable tool. Hacktivists attack organizations whose policies they oppose, seeking publicity rather than profit. Insider threats — employees or contractors with authorized access — pose a unique risk because they bypass perimeter controls. Script kiddies use pre-built tools with low skill but can still cause significant damage at scale.

## Social Engineering Techniques

Social engineering attacks exploit human psychology rather than software vulnerabilities. Phishing sends deceptive emails to large populations; spear phishing refines the target to a specific individual or organization; whaling targets executives. Vishing uses phone calls and vishing uses SMS text messages. Pretexting constructs a fabricated identity — an IT technician, auditor, or vendor — to create context that makes a request seem legitimate. A watering hole attack is passive: the attacker compromises a trusted website and waits for the target to visit, delivering malware without any direct contact.

## Malware Classification

Malware is classified by behavior, not just by harm caused. A virus requires a host executable to spread; a worm spreads independently across the network. Ransomware encrypts data and demands payment — recovery without the key requires having tested backups. A rootkit modifies OS internals to hide itself and is the hardest malware type to detect and remove. Spyware collects keystrokes, screenshots, or browsing data; a RAT (Remote Access Trojan) gives the attacker an interactive shell on the victim's machine.

## Zero-Days and Vulnerability Intelligence

A zero-day vulnerability has no patch at the time of exploitation. The window between a vulnerability being discovered by an attacker and the vendor releasing a fix can last days, weeks, or months. CVE numbers are assigned by MITRE once a vulnerability is disclosed; CVSS scores quantify severity. MITRE ATT&CK does not track vulnerabilities — it tracks attacker behavior after initial access, organized by the 14 tactic categories from Reconnaissance through Impact. Security teams use ATT&CK to map their detections to real adversary techniques and identify gaps.

Worked examples

Example 1: Identifying the correct threat actor: A company discovers its network has been secretly monitored for 11 months; the attackers used custom malware, zero-day exploits, and covered their tracks thoroughly. Classify the threat actor. The indicators point to a nation-state APT: the long dwell time (11 months of persistent presence), custom malware suggesting significant development resources, zero-day exploits indicating access to unreported vulnerabilities, and operational security (covering tracks) indicating professional tradecraft. A cybercriminal group would likely have deployed ransomware for financial gain. A hacktivist group would have defaced websites or leaked data publicly. A script kiddie lacks the capability to sustain an 11-month undetected intrusion with custom malware.

Example 2: Distinguishing social engineering techniques: Read the following scenarios and identify the technique. Scenario A — an employee receives an email appearing to come from the CEO asking them to immediately wire $47,000 to a new vendor; the email uses the CEO's real name and photo. This is whaling (the target is an executive) via business email compromise (BEC). Scenario B — the IT help desk receives a call from someone claiming to be a new employee who forgot their login; the caller provides the new hire's real name and start date and asks for a password reset. This is vishing combined with pretexting — the attacker fabricated a plausible identity and used a voice channel. Scenario C — employees at a financial firm begin getting infected with malware after visiting an industry news site. The news site was not involved in any email campaign and no one received suspicious messages. This is a watering hole attack — the attacker compromised a trusted industry resource and waited for the victims to visit.

Common mistakes

Confusing spear phishing with whaling. Spear phishing is targeted at any specific individual or organization. Whaling is the subset of spear phishing where the target is specifically a senior executive. On Security+ exams, 'an attack targeting the CFO' is whaling; 'an attack targeting the IT helpdesk staff' is spear phishing.
Thinking a zero-day requires nation-state involvement. Zero-days are exploited by all types of threat actors including cybercriminals who purchase them on dark markets. The defining characteristic is the absence of a patch, not the sophistication of the attacker.
Confusing MITRE ATT&CK with CVE. CVE catalogs known vulnerabilities in software. MITRE ATT&CK catalogs attacker behaviors after access is gained. They are complementary but distinct: CVE answers 'what software flaw exists?' ATT&CK answers 'how do attackers behave once inside?'
Calling a worm a virus. A virus requires a host file to carry and execute its payload; it spreads when users share infected files. A worm spreads across networks under its own power without any host file. The self-propagating network behavior is the key distinguishing trait of a worm.
Assuming rootkits are always detectable by antivirus. Rootkits are specifically designed to hide from the OS and from antivirus tools that rely on the OS to enumerate files and processes. Detection requires a bootable offline scanner or specialized rootkit detection software that operates outside the infected OS environment.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. An attack that sends deceptive emails to thousands of users hoping some will click a malicious link is called:

Spear phishing
Vishing
Phishing
Whaling

2. Malware that self-replicates across networks without requiring a host file is a:

Virus
Worm
Rootkit
RAT

3. A zero-day vulnerability is uniquely dangerous because:

It only affects government systems
No patch exists at the time it is exploited
It is always delivered by email
It requires physical hardware access

4. Which framework catalogs the tactics and techniques adversaries use after gaining access to a network?

CVE database
MITRE ATT&CK
NIST CSF
CIS Benchmarks

5. An attacker compromises a financial industry website frequently visited by hedge fund employees and embeds malware that runs when visitors load the page. This is a:

Phishing attack
Watering hole attack
Pretexting attack
Smishing attack

Self-check answers

1. C — Phishing is broad and untargeted — it sends the same or similar deceptive email to a large population. Spear phishing and whaling are targeted variants; vishing uses phone calls.
2. B — A worm propagates autonomously across the network by exploiting vulnerabilities, requiring no host executable to carry it. A virus needs a host file; rootkits hide in the OS; RATs provide remote access.
3. B — The defining risk of a zero-day is that no patch exists when exploitation begins — defenders cannot use signatures or patches and must rely on behavioral detection and network controls.
4. B — MITRE ATT&CK organizes observed attacker behaviors by tactic (the goal, such as Persistence or Lateral Movement) and technique (the specific method used). CVE catalogs vulnerabilities; NIST CSF is a risk management framework.
5. B — A watering hole attack identifies trusted sites visited by the target group, compromises those sites, and waits for victims to visit — no direct contact with the victim is required.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top