← All Modules
Domain 1 · SY0-701

Threats & Attacks

Threat actors, malware types, social engineering, attack vectors, and vulnerability categories. Weight: ~22% of exam.

0 / 6 concepts
🎭
Threat Actors & Motivations
Nation-state · Hacktivist · Insider · Script kiddie · Cybercriminal

A threat actor is any entity that poses a risk to your systems (CompTIA, 2023). The exam tests you on matching actor TYPE to their likely MOTIVATION and SOPHISTICATION level (CompTIA, 2023).

🏛️
Nation-State
Highest sophistication. Motivation: espionage, disruption. APT groups. Example: Volt Typhoon (CISA et al., 2023), Lazarus Group (FBI et al., 2022).
Hacktivist
Political/ideological motivation. Medium skill. DDoS, defacement. Example: Anonymous (Stallings & Brown, 2023).
💰
Cybercriminal
Financial motivation. Ransomware, fraud, data theft. Operates in dark web markets (Verizon, 2024).
🏢
Insider Threat
Current or former employee. Can be malicious (revenge, money) or unintentional (negligence) (NIST, 2012).
👾
Script Kiddie
Low skill. Uses existing tools/exploits. Motivation: notoriety. Opportunistic, not targeted (CompTIA, 2023).
🤝
Competitor
Corporate espionage. Motivation: financial advantage. Often hires others (Stallings & Brown, 2023).
Memory Hook
"Nations Hack, Criminals Invade, Scripts Copy" → Nation-state, Hacktivist, Cybercriminal, Insider, Script kiddie, Competitor
🦠
Malware Types
Virus · Worm · Trojan · Ransomware · Rootkit · Spyware · Keylogger

The key exam distinction is how malware spreads and what it does (CompTIA, 2023). Know these pairs cold (Souppaya & Scarfone, 2013):

TypeSpreads How?What It DoesExam Clue
VirusRequires user action (open file)Attaches to/infects other files"Needs a host file"
WormSelf-replicating, no user actionSpreads across networks"Spreads itself"
TrojanDisguised as legitimate softwareOpens backdoor, drops payload"Looks innocent"
RansomwareEmail, exploit kitsEncrypts files, demands payment"Pay to decrypt"
RootkitExploits, trojansHides at OS/firmware level"Hardest to detect/remove"
KeyloggerTrojan, physicalRecords keystrokes"Steals credentials"
SpywareDrive-by downloadMonitors and exfiltrates data"Watches silently"
Botnet/BotWorm, trojanC2 controlled, used for DDoS/spam"Command & Control"

Ransomware and extortion techniques were involved in 32% of all breaches in 2023, highlighting the persistent financial motivation behind malware deployment (Verizon, 2024). Rootkits operate at the OS or firmware level and are among the most difficult malware categories to detect and remove (Stallings & Brown, 2023).

Key Rule
Worm = self-spreads. Virus = needs a host file. Trojan = disguised. These three are the most commonly confused on the exam.
🎣
Social Engineering Attacks
Phishing · Spear phishing · Vishing · Smishing · Pretexting · Baiting

Social engineering exploits human psychology, not technical vulnerabilities (Cialdini, 2007). The exam loves scenario questions: read the scenario, identify the attack type (CompTIA, 2023). The 2024 DBIR found that 68% of breaches involved a non-malicious human element, such as falling victim to a social engineering attack (Verizon, 2024).

AttackVectorKey Feature
PhishingEmail (mass)Generic "click this link" to many targets
Spear PhishingEmail (targeted)Uses victim's name, role, or context
WhalingEmailTargeted at executives (C-suite)
VishingVoice/phone call"Your account has been compromised, verify now"
SmishingSMS textMalicious link in a text message
PretextingAny channelAttacker fabricates a scenario/identity
BaitingPhysical (USB drop)Leave infected USB in parking lot
TailgatingPhysicalFollowing someone through a secure door
UrgencyAuthorityScarcityFamiliarityFear

These are the six principles of influence that social engineers exploit (Cialdini, 2007). The exam may ask which principle is being used (CompTIA, 2023). Phishing remains one of the most prevalent initial access vectors across all industries (CISA et al., 2023).

Memory Hook
Phishing = mass email. Spear = specific. Whaling = C-suite. Vishing = Voice. Smishing = SMS. "PSW VS" — think Password Stolen Via Verbal/SMS.
💥
Network Attack Types
DoS · DDoS · MitM · Replay · SQL Injection · XSS · Buffer Overflow

DoS vs DDoS: A DoS (Denial of Service) comes from one source. A DDoS (Distributed DoS) comes from many — typically a botnet (Stallings & Brown, 2023). Both overwhelm a target with traffic or requests, disrupting service availability (NIST, 2012).

1
SYN FloodSends many TCP SYN packets, never completes handshake — exhausts connection table
2
Man-in-MiddleAttacker intercepts traffic between two parties — ARP poisoning, rogue AP
3
Replay AttackCaptures valid auth token and replays it — mitigated by timestamps/nonces
4
SQL InjectionInserts SQL code into input fields — ' OR '1'='1 — mitigated by parameterized queries (OWASP, 2021)
5
XSSCross-Site Scripting — injects malicious script into web page viewed by other users (OWASP, 2021)
6
Buffer OverflowSends more data than buffer can hold — overwrites memory, executes arbitrary code

SQL injection and XSS are ranked among the most critical web application security risks (OWASP, 2021). Buffer overflow vulnerabilities result from insufficient input validation and can allow arbitrary code execution (Stallings & Brown, 2023).

Exam Trap
XSS injects into a web page. CSRF forces a logged-in user to take an action. These are commonly confused — different targets, different mechanisms.
🗺️
Attack Frameworks
MITRE ATT&CK · Cyber Kill Chain · Diamond Model

The Cyber Kill Chain (Lockheed Martin) describes the 7 stages of an advanced attack, from initial reconnaissance through to the final objective (Hutchins et al., 2011):

ReconResearch
WeaponizeBuild payload
DeliverEmail/web
ExploitRun code
InstallPersistence
C2Command
ExfilGoal

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques (TTPs) based on real-world observations (MITRE, 2024). Used by security teams to map real-world attack behaviors, it enables defenders to anticipate and detect adversary actions. The exam expects you to know it exists and its purpose — not memorize every technique (CompTIA, 2023).

The Diamond Model analyzes attacks through four points: Adversary, Infrastructure, Capability, Victim — useful for threat intelligence correlation (Stallings & Brown, 2023).

Kill Chain Mnemonic
Real Women Don't Eat Icy Cake Every Day — Recon, Weaponize, Deliver, Exploit, Install, C2, Exfiltrate
🔍
Vulnerability Categories
Zero-day · CVE · CVSS · Misconfigs · Weak credentials · Supply chain

A vulnerability is a weakness. A threat exploits it. A risk is the probability × impact (NIST, 2012). Know this triangle cold (CompTIA, 2023). Misconfigurations remain the most common real-world vulnerability category, while supply chain attacks — exemplified by the 2020 SolarWinds compromise — represent an increasingly prevalent threat vector (CISA & FBI, 2020; Verizon, 2024).

TermDefinitionKey Detail
Zero-dayUnknown vulnerability, no patch existsMost dangerous — no defense except behavior monitoring (CompTIA, 2023)
CVECommon Vulnerabilities and ExposuresStandardized ID: CVE-2024-XXXXX (MITRE, 2024)
CVSSCommon Vulnerability Scoring System0–10 severity score; drives patch priority (CompTIA, 2023)
MisconfigurationDefault settings, open ports, weak ACLsMost common real-world vuln category (Verizon, 2024)
Supply ChainCompromise via third-party software/hardwareSolarWinds is the canonical example (CISA & FBI, 2020)
Weak CredentialsDefault/reused/simple passwordsMitigated by MFA, PAM, password policy (NIST, 2012)
Patch ManagementVulnerability ScanningPenetration TestingThreat Intelligence

CVE identifiers and CVSS scores provide a standardized framework for communicating vulnerability severity and guiding patch prioritization decisions (Stallings & Brown, 2023; CompTIA, 2023).

🧪 Knowledge Check
0 / 12 answered
0/12
Threats & Attacks Quiz

Cialdini, R. B. (2007). Influence: The psychology of persuasion (rev. ed.). HarperCollins.

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r2

CISA, NSA, FBI, ACSC, CCCS, NCSC-NZ, & NCSC-UK. (2023). People’s Republic of China state-sponsored cyber actor living off the land to evade detection (Advisory AA23-144A). Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

CISA & FBI. (2020). Ransomware activity targeting the healthcare and public health sector (Alert AA20-302A). Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a

CompTIA. (2023). CompTIA Security+ SY0-701 certification exam objectives (Version 6.0). CompTIA. https://www.comptia.org/certifications/security

FBI, CISA, & U.S. Treasury. (2022). TraderTraitor: North Korean state-sponsored APT targets blockchain companies (Advisory AA22-108A). Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a

Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains [White paper]. Lockheed Martin Corporation. https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf

MITRE. (2024). MITRE ATT&CK®: Adversarial tactics, techniques, and common knowledge. The MITRE Corporation. https://attack.mitre.org/

MITRE. (2024). Common vulnerabilities and exposures (CVE). The MITRE Corporation. https://cve.mitre.org/

National Institute of Standards and Technology. (2012). Computer security incident handling guide (NIST Special Publication 800-61 Rev. 2). U.S. Department of Commerce. https://doi.org/10.6028/NIST.SP.800-61r2

OWASP Foundation. (2021). OWASP Top 10:2021 — The ten most critical web application security risks. OWASP. https://owasp.org/Top10/

Souppaya, M., & Scarfone, K. (2013). Guide to malware incident prevention and handling for desktops and laptops (NIST Special Publication 800-83 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-83r1

Stallings, W., & Brown, L. (2023). Computer security: Principles and practice (5th ed.). Pearson.

Verizon. (2024). 2024 data breach investigations report. Verizon Business. https://www.verizon.com/business/resources/reports/dbir.html