This framework provides a comprehensive overview of
modern cyber threats, covering human, identity, endpoint, network,
cloud, and supply chain attack vectors.
It also highlights advanced attack techniques, insider threats,
vulnerability exploitation, and the ultimate objectives of attackers
such as data theft, ransomware, and sabotage.
1. HUMAN
-Phishing (email, SMS, WhatsApp)
-Spear phishing / Whaling
-Deepfake (voice / video)
-Social engineering (IT support, fake recruiter, etc.)
2. IDENTITY & ACCESS (IAM = Core of Modern
Attacks)
-Password theft
-Credential stuffing / brute force
-Token hijacking (OAuth, session)
-MFA bypass / MFA fatigue
-Privilege escalation
3. ENDPOINTS (Workstations & Servers)
-Malware (viruses, trojans, ransomware)
-Fileless malware
-Living-off-the-Land (LOLBins) – Scripts (PowerShell, WMI, Bash)
-Local exploitation
4. NETWORK (Propagation & Movement)
-Network scanning
-Lateral movement (RDP, SMB, WMI)
-Man-in-the-Middle (MITM) attacks
-DNS tunneling
-Protocol attacks (SMB, RDP, etc.)
-Pass-the-hash / pass-the-ticket
5. CLOUD / SaaS / API (Modern Attack Surface)
-Misconfiguration (public S3, weak IAM)
-API key theft
-API attacks (injection, abuse)
-SaaS compromise (Microsoft 365, Google Workspace)
6. SUPPLY CHAIN (Indirect Attacks)
-Compromised libraries (npm, pip)
-Compromised CI/CD pipeline
-Tampered software updates
-Compromised vendors
7. ADVANCED ATTACKS (APT & Stealth)
-APT techniques (Advanced Persistent Threat)
-Multi-stage attacks
-Advanced living-off-the-land techniques
-Evasion of EDR/XDR
-AI-driven attacks
-Stealth techniques (low & slow)
-Obfuscation / encryption
8. INSIDER THREAT (Internal Threat)
-Malicious employee
-Critical human error
-Privilege abuse
-Internal data exfiltration
9. VULNERABILITY EXPLOITATION (Vulnerabilities
/ Attacks)
-Web attacks (SQLi, XSS, RCE)
-API abuse
-Software exploits (RCE, LPE)
-Zero-day / N-day vulnerabilities
10. ATTACKER OBJECTIVES (Final Impact)
-Data exfiltration
-Destruction (wiper)
-Ransomware
-Espionage
-Sabotage
Copyright © All rights reserved.