Chapter 3: Threats, Attacks, and Defenders

Threats, Attacks, and Defenders 🎭

Assume breach, detect fast, recover well.

In May 2021, a ransomware group locked computers at Colonial Pipeline, the company that carries a large share of the fuel used on the U.S. East Coast. The company shut its pipeline down as a precaution, and drivers across several states lined up at empty gas stations for days. Investigators later reported that the attackers had entered through an old remote-access account protected only by a password, with no second factor.

Real attacks look like that: a person with a motive, a chain of ordinary weaknesses and consequences far beyond the computer screen. This chapter is about understanding attacks so you can stop them. You will study who attacks and why, build a field guide to the major attack types, see how the same scripts serve attackers and defenders, follow how security teams watch for trouble, and test whether layered defenses really hold when an attack unfolds in stages. Throughout, the goal is recognition and defense; nothing here is a recipe for breaking into anything.

3.1 — Threat Actors and Motives 🎭

A threat actor is anyone who carries out or attempts a cyberattack. Defenders study threat actors the way a coach studies an opposing team: knowing who is likely to come, what they want and how well funded they are tells you where to put your defense.

The Main Types

Actor	Typical motive	Resources and skill	Common tactics
Nation-state groups	Espionage, military advantage, disruption	Very high; patient, long campaigns	Custom malware, zero-days, quiet long-term access
Organized cybercriminals	Money	High; run like businesses	Ransomware, fraud, stolen-data sales
Hacktivists	Political or social causes	Low to medium	Website floods, defacement, leaking documents
Insiders	Revenge, money, ideology, or simple mistakes	Already have legitimate access	Misusing access, copying data, careless errors
Unskilled attackers	Curiosity, status, thrills	Low; reuse others’ tools	Ready-made scripts, guessing weak passwords
Competitors	Business advantage	Varies	Stealing trade secrets, often through insiders

Motive Shapes Behavior

Motive predicts what an attacker will do. Criminals want a return on investment, so they favor targets that will pay quickly and cannot afford downtime: hospitals, manufacturers and, increasingly, school districts. Many ransomware gangs now practice double extortion: they steal data before encrypting it, then threaten to publish it if the victim restores from backups instead of paying. Some operate as ransomware-as-a-service, renting their tools to affiliates who carry out the break-ins and share the profits.

Nation-state groups behave differently because their goal is usually information or position, not a quick payout. In 2024 CISA and partner agencies warned that a group they attributed to China’s government, called Volt Typhoon, had quietly gained access to U.S. critical infrastructure networks, apparently to be ready to disrupt them in a future conflict. Such groups are often called advanced persistent threats (APTs) because they stay hidden for months.

Schools are on the list, too. In a 2023 report on K-12 cybersecurity, CISA warned that districts hold valuable data about students and staff while often running on small IT teams and tight budgets, a combination that criminals notice. That same year a ransomware group published files stolen from Minneapolis Public Schools after the district refused to pay. The lesson is not fear; it is that schools deserve the same careful defense as any business.

Insiders are the hardest to see because they are supposed to be there. Not every insider is malicious; a staff member who emails a spreadsheet of student records to the wrong address is an insider incident too. Unskilled attackers, sometimes called script kiddies, cause real harm by running tools they do not understand against whatever they can reach.

Analyzing an Actor

When you analyze a threat actor, ask five questions: Are they inside or outside? What do they want? How skilled and well resourced are they? How patient are they? What would success look like for them? A school’s most likely threats are criminals seeking ransom and data, opportunists exploiting weak passwords, and insiders making mistakes, so its defenses should be tuned to those first. Remember too that attribution, proving who did it, is hard. Groups copy each other’s tools and sometimes plant false clues, which is why professionals state attributions with levels of confidence.

3.2 — A Field Guide to Attack Types 🐛

A threat is something that could cause harm; a vulnerability is a weakness it could exploit; risk is the likelihood and impact of the two meeting. Attack types are the specific ways threats meet vulnerabilities. Knowing them by name lets you recognize them early and match them to defenses.

Malware

Malware is software built to cause harm. A virus attaches to files and spreads when they are shared; a worm spreads across networks on its own; a trojan pretends to be something useful; spyware watches and reports; a rootkit hides deep in the system to keep access. ransomware is the most costly category for most organizations, attacking availability and, with double extortion, confidentiality too.

social engineering attacks people instead of machines. Phishing uses fake messages; spear phishing targets one person using researched details; smishing and vishing use text messages and voice calls; pretexting invents a believable story, such as a caller pretending to be the help desk. Business email compromise tricks staff into sending payments or data to criminals posing as an executive or vendor. Warning signs include urgency, secrecy, unusual requests and links or senders that are almost right. In 2023, attackers disrupted MGM Resorts after reportedly persuading the company’s help desk to reset access for an employee they had impersonated.

The best defense against social engineering is a habit, not a tool: verify through a second channel. If a message from “the principal” asks you to buy gift cards, call the principal at the number you already know, not the one in the message. If a caller from “IT” asks for your code, hang up and call the help desk yourself. Organizations back this up with clear rules, such as “IT will never ask for your password or MFA code,” so that a request breaking the rule is itself the alarm.

Application and Password Attacks

Web applications can be attacked when they trust user input. In SQL injection, input is crafted so the application’s database treats it as a command; in cross-site scripting (XSS), a site is tricked into delivering an attacker’s script to other visitors. Both are prevented by developers treating all input as data, never code. Password attacks include credential stuffing (reusing leaked pairs), password spraying (trying a few common passwords across many accounts) and brute force (trying every combination). A zero-day is a flaw nobody has patched yet, which makes it valuable to well-funded attackers.

Network Attacks

Attack	What happens	CIA impact	Key defenses
Denial of service (DoS/DDoS)	Floods a service with traffic, often from thousands of hijacked devices	Availability	DDoS protection services, rate limiting, extra capacity
On-path (man-in-the-middle)	Attacker secretly relays and reads or alters traffic	Confidentiality, integrity	Encryption (TLS, VPN), certificate checks
DNS spoofing or poisoning	Fake DNS answers send users to the wrong server	Integrity, confidentiality	DNSSEC, trusted resolvers, encrypted DNS
ARP spoofing	A device on the LAN falsely claims another’s address	Confidentiality, integrity	Switch protections, segmentation, encryption
Evil twin access point	A fake Wi-Fi network copies a real one’s name	Confidentiality	WPA3-Enterprise, certificate validation, VPN
Replay	Captured valid traffic is resent later	Integrity	Timestamps, one-time challenges, session tokens

Evaluating network attacks means asking how likely each is for your organization and how much damage it would do. A school is more likely to face an evil twin at a sports event than a nation-state on-path attack on its core network.

3.3 — Scripting on Both Sides 💻

A script is a short program that automates a task. Languages such as Python, PowerShell, Bash and JavaScript let one person do the work of a hundred, and that is true for attackers and defenders alike. The code itself is neutral. What matters is intent, authorization and what the script is allowed to touch.

How Attackers Use Scripts

Attackers use scripts to scale. Automated scanners sweep the internet for unpatched services within hours of a vulnerability being announced. Credential-stuffing tools test leaked passwords against thousands of sites. Malicious macros in documents and scripts hidden in email attachments start infections. A growing technique is living off the land: instead of installing obvious malware, an intruder uses tools already built into the operating system, such as PowerShell or Windows management utilities, so their activity blends in with normal administration. Agencies warned that Volt Typhoon relied heavily on exactly this approach.

How Defenders Use Scripts

Defenders use scripts to scale, too. Scripts collect logs from hundreds of servers, check every laptop for missing patches, find accounts that have not been used in ninety days, disable access when an employee leaves and pull suspicious attachments out of every mailbox at once. Security orchestration, automation and response (SOAR) platforms chain these scripts into playbooks that run in seconds when an alert fires.

Here is a defensive example: a short Python script that reads a practice log file and flags addresses with many failed logins, a common sign of password guessing.

from collections import Counter

failed = Counter()
with open("auth_sample.log") as log:      # a practice log your teacher provides
    for line in log:
        if "FAILED LOGIN" in line:
            ip = line.split("from ")[-1].strip()
            failed[ip] += 1

for ip, count in failed.most_common():
    if count >= 5:
        print(f"ALERT: {count} failed logins from {ip}")

Notice the judgment built in: the threshold of five is a choice. Set it too low and analysts drown in false alarms; set it too high and a slow, careful attacker slips through. Password sprayers deliberately try only one or two guesses per account to stay under thresholds like this, so a stronger version would also count failures per account and across the whole system.

Controlling Scripts

Because scripts are powerful, defenders also control them. Windows can log every PowerShell script block that runs, so living-off-the-land activity leaves a trail. Application control can allow only signed or approved scripts. Macros from the internet can be blocked by default, as Microsoft began doing for Office files in 2022. And defenders keep their own scripts in version control, reviewed like any other code, because a buggy automation can do damage at the same speed as an attacker.

Weighing the Balance

Does scripting help attackers or defenders more? Attackers need only one working path, and automation lets them try millions. But defenders own the environment: they can see every log, set every rule and fix flaws at scale. Teams that automate the routine work free their people for the hard judgment calls only humans can make.

3.4 — Monitoring, Logging, and the SOC 📊

Prevention eventually fails. A new phishing message gets through, or a password leaks. What separates a small incident from a disaster is how quickly someone notices. That is the job of monitoring.

Security Software That Watches

Modern organizations run several layers of security software, each collecting different evidence:

Endpoint detection and response (EDR) on laptops and servers records processes, file changes and network connections, and can isolate a device with one click.
Firewalls and intrusion detection or prevention systems log and inspect traffic between zones.
Email security filters scan links and attachments and record who received what.
Identity systems log every sign-in: who, when, from where and with which factor.
Cloud services log administrative changes and file sharing.

Each tool alone sees a sliver. A SIEM (security information and event management system) gathers all those logs in one place, puts them in a common format, and correlates them. One failed login means nothing. But fifty failed logins on one account, followed by a success from a new country, followed by that account downloading thousands of files at 3 a.m., is a story, and the SIEM can turn it into a single high-priority alert.

Inside the SOC

The people who read those alerts work in a security operations center (SOC). In many SOCs, Tier 1 analysts triage incoming alerts and close false positives; Tier 2 analysts investigate confirmed incidents; Tier 3 specialists hunt for threats that no alert has caught. Two errors haunt every SOC. A false positive is an alert on harmless activity; too many cause alert fatigue. A false negative is real attack activity that raised no alert at all, which is far more dangerous because nobody knows it happened.

Modeling a Risk Response with Logs

Logging is part of risk management, which follows a cycle. Identify the risk (for example, stolen staff passwords). Assess its likelihood and impact. Choose a response: mitigate it with controls, transfer it (such as with cyber insurance), avoid it by stopping the risky activity, or accept it if it is small. Then monitor and adjust.

Logs are only useful if they can be trusted. Every system must agree on the time, usually through the Network Time Protocol, or events from different machines cannot be lined up into one timeline. Logs must be kept long enough to investigate attacks that went unnoticed for months, and they should be copied somewhere an intruder cannot edit, because one of the first things a careful attacker tries is erasing their tracks.

Monitoring and logging make that cycle measurable. A good plan names which logs are collected, how long they are kept, what normal looks like (a baseline), which events trigger alerts, who responds and how quickly. NIST’s Cybersecurity Framework 2.0, released in 2024, organizes this work into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Incident responders follow a lifecycle: prepare; detect and analyze; contain, eradicate and recover; then learn lessons and improve.

3.5 — Defense in Depth Under Pressure 🏰

No single control stops every attack. Passwords leak, filters miss messages, people click. defense in depth stacks independent layers so that an attacker must defeat all of them, and every layer is a chance to be noticed.

The Layers

From the outside in, a typical design includes policies and training, physical security, the network perimeter (firewalls, email filters), internal network controls (segmentation, monitoring), endpoints (hardening, EDR, patching), applications (secure code, MFA) and the data itself (encryption, backups, access control). The layers must be independent: two controls that both fail when one password is stolen are really one layer.

Walking Through a Multi-Stage Attack

Validating defense in depth means testing it against a realistic attack that unfolds in stages, the way frameworks such as Lockheed Martin’s Cyber Kill Chain and MITRE ATT&CK describe them. Consider this fictional ransomware intrusion at a school district:

Stage	What the attacker attempts	Layer that should stop it	Layer that should detect it
1. Reconnaissance	Collect staff names and email formats from the website	Limit public staff details	Threat intelligence
2. Initial access	Phishing email with a fake sign-in page	Email filter, passkeys	User reports, email logs
3. Foothold	Sign in to the remote-access portal	MFA on every remote login	Unusual sign-in alert in the SIEM
4. Privilege escalation	Find an admin password in a shared file	Least privilege, password vault	EDR alert on credential access
5. Lateral movement	Reach the file servers from a staff laptop	Segmentation, host firewalls	Network monitoring
6. Impact	Steal data, then encrypt servers	Data loss prevention, immutable backups	EDR mass-encryption alert

The defender’s advantage is that the attacker must succeed at every stage, while the defender needs to win at only one. Change Healthcare learned the opposite lesson in 2024: its parent company told Congress that attackers entered through a remote-access portal without multi-factor authentication, and the resulting ransomware attack disrupted payments across much of the U.S. health system.

Testing the Layers

Organizations validate their layers in several authorized ways. Tabletop exercises walk leaders through a scenario on paper. Penetration tests hire professionals, with written permission and a defined scope, to try to break in. Red teams emulate a real adversary over weeks while the blue team defends, and purple teaming puts them in the same room to improve detections together. Each finding becomes a fix, and the exercise is repeated.

Pressure tests reveal something technology diagrams hide: people are a layer too, and often the strongest one. In many real incidents the first alarm came not from a tool but from an employee who reported an odd email or a teacher who noticed a strange pop-up. Organizations that thank people for reporting, even when they clicked, hear about attacks hours earlier than organizations that punish mistakes. A culture where reporting is easy and blame-free is a security control.

Zero Trust

The modern evolution of defense in depth is zero trust, described in NIST’s guidance on zero trust architecture. Old networks trusted anything inside the firewall. Zero trust assumes the attacker may already be inside, so every request is verified based on identity, device health and context, every time, with least-privilege access. It is the mindset in this chapter’s motto: assume breach, detect fast, recover well.

Chapter 3 Activity: Tabletop Incident 🚨

Your class is the security team for Harbor County Schools, a fictional district. At 6:40 a.m. on a Monday, teachers report that files on the shared drive have strange extensions and a ransom note is on several screens. Run this as a tabletop exercise on paper; no real systems are touched.

Part 1: Who Did This and Why?

Read the ransom note your teacher provides. Using the threat actor table, decide which type of actor is most likely, list the evidence for your choice and predict what they will do next if the district does not respond. Explain how double extortion changes the district’s options.

Part 2: Read the Logs

Your teacher will give you a printed or district-approved digital practice log of sign-ins, email deliveries and file activity. Identify the events that belong to the attack, name the attack type at each step (phishing, credential use, lateral movement and so on) and mark which events a SIEM should have correlated into one alert. If your class has school-approved tools, adapt the Python script from section 3.3 to count the suspicious events.

Part 3: Model the Response

Write a risk management response for the incident: the immediate containment steps, who is notified, which logs must be preserved, how systems will be restored from backup and how the district will communicate with families. Then name two risks you would mitigate, one you would transfer and one you would accept, with reasons.

Part 4: Validate the Layers

Map the attack onto the six-stage table from section 3.5. For each stage, identify which layer failed at Harbor County and which layer should have stopped or detected it. Recommend the three changes that would break the most stages, and explain how a scripted defense could have shortened the response.