Cyberattacks are attempts to compromise digital systems, disrupt services or gain unauthorized access to information. They can target people, applications, networks and the organizations that depend on them.
Attack methods range from deceptive messages and stolen credentials to malicious software and weaknesses in public-facing applications. Understanding the entry point, the method and the intended impact helps teams connect threats to practical defenses.
Common cyberattack methods
Phishing and social engineering
Deceptive interactions exploit trust to obtain access, information or a consequential action.
Malware and ransomware
Malicious software can steal information, establish unauthorized access or disrupt operations.
Credential attacks
Stolen credentials, weak passwords and compromised sessions create different routes into an account.
Web application attacks
Unsafe input handling and missing authorization can permit unintended data access or actions.
Distributed denial of service (DDoS)
Distributed activity can exhaust network, connection or application resources and interrupt legitimate use.
Supply chain attacks
A compromised component, delivery process or supplier connection can affect downstream systems.
What it is
An attack type describes a mechanism or pattern, not a complete risk assessment. Phishing describes deceptive interaction; credential abuse describes misuse of identity material; application attacks describe failures in software behavior; denial of service describes interference with availability. These categories can overlap within the same incident.
A useful description separates the actor, entry point, technique, affected asset and outcome. “A public login was observed” is an exposure statement. “An unauthorized session changed payment details” is a statement about activity and consequence. The second requires evidence that the first does not provide.
How it works
Attacks exploit a gap between intended and actual control. The gap may be technical, such as missing authorization, or procedural, such as accepting an unverified payment instruction. Initial access is only one possible stage. An actor may then seek additional privileges, access data, disrupt operations or maintain access.
Methods can be combined
A deceptive message may obtain credentials, and those credentials may access a public service. A compromised software supplier may introduce malicious code through a trusted update process. A vulnerable application may expose data directly without a user interaction. The sequence varies; there is no universal chain every incident must follow.
Not every observation is an incident
Internet-facing systems receive scans, malformed requests and failed logins. Some are malicious attempts, some are research or routine automation, and some are operational errors. The evidence should establish the behavior observed and its effect before a report claims successful compromise.
Technical references: MITRE ATT&CK · Enterprise Techniques · NIST SP 800-61 Rev. 3 · Incident Response
How attackers use it
Attackers choose methods that fit their objective and available access. A financially motivated actor may seek a fraudulent transaction, account access or extortion leverage. Another actor may prioritize disruption or information collection. Attribution and motive can remain uncertain even when the harmful behavior is well established.
Defenders gain more immediate value from understanding the usable path and the affected business function than from guessing an actor’s identity. Identify which control failed, what the actor could reach and what evidence shows they actually did.
Warning signs
Signals include unexpected account actions, unauthorized configuration changes, unfamiliar destinations, unusual data access and unexplained service disruption. Each signal needs context. A certificate change can be routine renewal; a traffic spike can be a successful campaign; a failed login can be a mistyped password.
Build a timeline with confidence levels
Record the observation, source, timestamp and interpretation separately. Correlate external changes with identity, application, endpoint and provider evidence as appropriate. Mark confirmed facts, plausible explanations and unresolved questions. This lets responders update a conclusion without losing the original evidence.
Business impact
Cyberattacks can affect confidentiality, integrity and availability, but the business expression varies. A data export can expose customer information; a changed payment instruction can cause fraud; a service outage can halt operations. The importance of an asset depends on the function and dependencies behind it, not only its traffic volume.
Recovery costs can include investigation, restoration, customer support and process changes. Do not infer a breach scale from an exposure count. Assess which records, actions and users were actually affected and identify where evidence remains incomplete.
Prevention and remediation
Use layered controls that match the relevant paths: strong identity protection, explicit authorization, safe application development, maintained software, constrained public access and practiced recovery. Discovery and ownership make these controls actionable by identifying which team is responsible for each system.
From finding to verified action
- Establish the condition and the evidence supporting it. - Confirm asset ownership, scope and the affected business function. - Determine whether the issue is exposure, vulnerability, attempted activity or confirmed incident. - Select containment or remediation appropriate to that state. - Verify the intended change using comparable evidence. - Review the broader cause and related paths rather than closing only the first symptom.
Incident response and routine remediation can overlap, but their questions differ. Restoring a correct configuration does not establish whether prior data access occurred. An incident conclusion needs the relevant historical evidence as well as the present-state fix.
How Ariema detects or handles it
Ariema connects external observations about domains, DNS, hosting, certificates, mail policy, public web surfaces and approved services. Possible vulnerability context and timestamped evidence help reviewers understand changes and route follow-up to the appropriate owner.
These capabilities support external exposure review. They do not replace identity, endpoint, mail or application investigations and should not be described as blocking every attack type in this library. The dedicated articles explain where Ariema’s observed evidence helps and which additional assessment is needed for a particular mechanism.
Common questions
What is the difference between a threat and an attack?
A threat concerns the possibility of harm. An attack is an attempt to cause an unauthorized effect. An exposed condition can increase opportunity without establishing that an attack occurred.
Can one incident involve several attack types?
Yes. A phishing interaction can lead to credential misuse, which can enable malware deployment or data theft. Classify the observed stages rather than forcing the whole incident into one label.
Which type should a business prioritize?
Prioritize the paths relevant to its actual systems, identities and dependencies. Combine exposure, likely consequences and evidence of activity rather than choosing only the most recognizable attack name.
Sources & further reading
Primary technical references for this guide. Scenarios are illustrative; they are not customer observations.
MITRE ATT&CK · Enterprise TechniquesNIST SP 800-61 Rev. 3 · Incident ResponseCISA · Phishing GuidanceCISA, FBI and MS-ISAC · Understanding and responding to DDoS attacksMITRE ATT&CK · Supply chain compromise