In the simplest sense, a cybersecurity threat, or cyberthreat, is an indication that a hacker or malicious actor is attempting to gain unauthorized access to a network for launching a cyberattack.

Cyberthreats can range from the obvious, such as an email from a foreign potentate offering a small fortune if you’ll provide your bank account number, to the deviously stealthy, such as a line of malicious code that sneaks past cyberdefenses and lives on the network for months or years before triggering a costly data breach. The more security teams and employees know about the different types of cybersecurity threats, the more effectively they can prevent, prepare for and respond to cyberattacks.

Malware—short for “malicious software”—is software code that is written intentionally to harm a computer system or its users.

Almost every modern cyberattack involves some type of malware. Threat actors use malware attacks to gain unauthorized access and render infected systems inoperable, destroying data, stealing sensitive information and even wiping files critical to the operating system.

Common types of malware include:

• Ransomware locks a victim’s data or device and threatens to keep it locked, or leak it publicly, unless the victim pays a ransom to the attacker. According to the IBM Security X-Force Threat Intelligence Index 2023, ransomware attacks represented 17 percent of all cyberattacks in 2022.
• A Trojan horse is malicious code that tricks people into downloading it by appearing to be a useful program or hiding within legitimate software. Examples include remote access Trojans (RATs), which create a secret backdoor on the victim’s device, or dropper Trojans, which install additional malware once they gain a foothold on the target system or network.
• Spyware is a highly secretive malware that gathers sensitive information, like usernames, passwords, credit card numbers and other personal data, and transmits it back to the attacker without the victim knowing.
• Worms are self-replicating programs that automatically spread to apps and devices without human interaction.

Frequently referred to as “human hacking,” social engineering manipulates targets into taking actions that expose confidential information, threaten their own or their organization’s financial well-being or otherwise compromise personal or organizational security.

Phishing is the best-known and most pervasive form of social engineering. Phishing uses fraudulent emails, email attachments, text messages or phone calls to trick people into sharing personal data or login credentials, downloading malware, sending money to cybercriminals or taking other actions that might expose them to cybercrimes.

Common types of phishing include:

• Spear phishing: highly targeted phishing attacks that manipulate a specific individual, often using details from the victim’s public social media profiles to make the scam more convincing.
• Whale phishing: spear phishing that targets corporate executives or wealthy individuals.
• Business email compromise (BEC): scams in which cybercriminals pose as executives, vendors or trusted business associates to trick victims into wiring money or sharing sensitive data.

Another common social engineering scam is domain name spoofing (also called DNS spoofing), in which cybercriminals use a fake website or domain name that impersonates a real one—for example, ‘‘applesupport.com’’ for support.apple.com—to trick people into entering sensitive information. Phishing emails often use spoofed sender domain names to make the email seem more credible and legitimate.

In a man-in-the-middle (MITM) attack, a cybercriminal eavesdrops on a network connection to intercept and relay messages between two parties and steal data. Unsecured wifi networks are often happy hunting grounds for hackers looking to launch MITM attacks.

A denial-of-service (DoS) attack is a cyberattack that overwhelms a website, application or system with volumes of fraudulent traffic, making it too slow to use or entirely unavailable to legitimate users. A distributed denial-of-service attack, or DDoS attack, is similar except it uses a network of internet-connected, malware-infected devices or bots, which are known as a botnet, to cripple or crash the target system. 

A zero-day exploit is a type of cyberattack that takes advantage of a zero-day vulnerability—an unknown or as-yet-unaddressed or unpatched security flaw in computer software, hardware, or firmware. “Zero day” refers to the fact that a software or device vendor has “zero days”—or no time—to fix the vulnerabilities because malicious actors can already use them to gain access to vulnerable systems.

One of the best-known zero-day vulnerabilities is Log4Shell, a flaw in the widely used Apache Log4j logging library. At the time of its discovery in November 2021, the Log4Shell vulnerability existed on 10 percent of global digital assets, including many web applications, cloud services and physical endpoints like servers.

As the name suggests, these attacks involve cybercriminals trying to guess or steal the password or login credentials to a user’s account. Many password attacks use social engineering to trick victims into unwittingly sharing this sensitive data. However, hackers can also use brute force attacks to steal passwords, repeatedly trying different password combinations until one is successful.

In an Internet of Things (IoT) attack, cybercriminals exploit vulnerabilities in IoT devices, like smart home devices and industrial control systems, to take over the device, steal data or use the device as a part of a botnet for other malicious ends.

In these attacks, hackers inject malicious code into a program or download malware to execute remote commands, enabling them to read or modify a database or change website data.

There are several types of injection attacks. Two of the most common include:

• SQL injection attacks: when hackers exploit the SQL syntax to spoof identity; expose, tamper, destroy or make existing data unavailable; or become the database server administrator.
• Cross-site scripting (XSS): these types of attacks are similar to SQL injection attacks, except instead of extracting data from a database, they typically infect users who visit a website.

These individuals or groups commit cybercrimes, mostly for financial gain. Common crimes that are committed by cybercriminals include ransomware attacks and phishing scams that trick people into making money transfers or divulging credit card information, login credentials, intellectual property or other private or sensitive information. 

These individuals or groups commit cybercrimes, mostly for financial gain. Common crimes that are committed by cybercriminals include ransomware attacks and phishing scams that trick people into making money transfers or divulging credit card information, login credentials, intellectual property or other private or sensitive information. 

A hacker is someone with the technical skills to compromise a computer network or system.

Keep in mind that not all hackers are threat actors or cybercriminals. For example, some hackers—called ethical hackers—essentially impersonate cybercriminals to help organizations and government agencies test their computer systems for vulnerabilities to cyberattacks.

Nation states and governments frequently fund threat actors with the goal of stealing sensitive data, gathering confidential information or disrupting another government’s critical infrastructure. These malicious activities often include espionage or cyberwarfare and tend to be highly funded, making the threats complex and challenging to detect. 

Unlike most other cybercriminals, insider threats do not always result from malicious actors. Many insiders hurt their companies through human error, like unwittingly installing malware or losing a company-issued device that a cybercriminal finds and uses to access the network.

That said, malicious insiders do exist. For example, a disgruntled employee may abuse access privileges for monetary gain (for example, payment from a cybercriminal or nation state), or simply for spite or revenge.

Strong passwords (link resides outside of ibm.com), email security tools and antivirus software are all critical first lines of defense against cyberthreats.

Organizations also rely on firewalls, VPNs, multi-factor authentication, security awareness training and other advanced endpoint security and network security solutions to protect against cyberattacks.

However, no security system is complete without state-of-the-art threat detection and incident response capabilities to identify cybersecurity threats in real-time, and help rapidly isolate and remediate threats to minimize or prevent the damage that they can do.

IBM Security® QRadar® SIEM applies machine learning and user behavior analytics (UBA) to network traffic alongside traditional logs for smarter threat detection and faster remediation. In a recent Forrester study, QRadar SIEM helped security analysts save more than 14,000 hours over three years by identifying false positives, reduce time spent investigating incidents by 90% and reduce their risk of experiencing a serious security breach by 60%.* With QRadar SIEM, resource-strained security teams have the visibility and analytics they need to detect threats rapidly and take immediate, informed action to minimize the effects of an attack.

*The Total Economic Impact™ of IBM Security QRadar SIEM is a commissioned study that is conducted by Forrester Consulting on behalf of IBM, April 2023. Based on projected results of a composite organization modeled from 4 interviewed IBM customers. Actual results will vary based on client configurations and conditions and, therefore, generally expected results cannot be provided.