Types of Cyber Attacks: 15 Common Attacks Explained With Examples

Why Understanding Attack Types Matters

You cannot defend what you do not understand. Security professionals classify attacks so that they can choose the right control: filtering for email threats, patching for software flaws, rate limiting for brute force, backups for ransomware. This guide explains fifteen attack types in plain language and shows how each one appears in real life in India.

Attacks That Target People

1. Phishing

Fraudulent messages that look like they come from a bank, courier, employer or government office. They aim to steal passwords, card details or OTPs or to deliver malware. Variants include spear phishing (targeted), vishing (voice calls) and smishing (SMS). See our detailed guide on phishing.

2. Social engineering

Manipulating people to bypass technology: a caller pretending to be tech support, a fake HR person asking for documents or an attacker following an employee into a building. Read more in what is social engineering.

3. Business email compromise

Criminals impersonate a senior executive or vendor by email and request urgent payment or change of bank details. Losses can be very large because the transaction looks legitimate.

4. Insider threats

Employees, contractors or partners who misuse access, either maliciously or accidentally. Controls include least privilege, logging and awareness.

Malware-Based Attacks

5. Viruses, worms and trojans

A virus attaches to files, a worm spreads by itself across networks and a trojan pretends to be useful software. Together with spyware, adware and rootkits they are called malware, covered in what is malware.

6. Ransomware

Malware that encrypts files and demands payment; many groups also steal data first. Hospitals, schools and manufacturers have been repeatedly hit. See what is ransomware.

7. Fileless and living-off-the-land attacks

Attackers use built-in tools such as PowerShell and WMI so that no obvious malicious file exists. Behavioural monitoring through EDR and SIEM is needed to catch them.

Network and Availability Attacks

8. Denial of service (DoS) and DDoS

Flooding a service with traffic or requests until legitimate users cannot access it. DDoS uses many devices, often part of a botnet. Mitigation uses rate limiting, scrubbing services and resilient architecture.

9. Man-in-the-middle (MITM)

The attacker secretly sits between two parties, reading or altering traffic, for example on an unsecured public Wi-Fi network. HTTPS, VPNs and certificate validation reduce the risk.

10. DNS spoofing and ARP poisoning

Corrupting name resolution or address tables to redirect victims to fake sites or intercept traffic. Segmentation, DNSSEC and switch protections help.

Application and Credential Attacks

11. SQL injection

Inserting malicious database commands through input fields to read or modify data. It is prevented with parameterised queries. Learn more in what is SQL injection.

12. Cross-site scripting (XSS)

Injecting scripts into web pages so that they run in other users’ browsers, stealing sessions or defacing content. Output encoding and content security policy mitigate it.

13. Password attacks

Brute force, dictionary attacks, credential stuffing with leaked passwords and password spraying. Strong unique passwords, MFA and rate limiting reduce the risk.

14. Zero-day exploits

Attacks on vulnerabilities that the vendor has not yet fixed. Defence relies on layered controls, rapid patching once fixes arrive and detection of unusual behaviour.

Supply Chain and Advanced Attacks

15. Supply-chain attacks and APTs

Compromising a trusted vendor, library or update mechanism to reach many victims, often as part of an advanced persistent threat campaign by a skilled, patient adversary. See what is an APT.

Quick Reference Table

How Organisations Detect and Respond

Large organisations run a security operations centre (SOC) that collects logs in a SIEM, writes detection rules mapped to the MITRE ATT&CK framework and follows incident response playbooks. If you want to build this skill, see our SOC analyst course, and read what is a SOC. Individuals should focus on prevention and quick reporting: call 1930 for financial fraud.

The Attack Lifecycle: How an Intrusion Unfolds

Most serious attacks follow a sequence, often described as the cyber kill chain or mapped in the MITRE ATT&CK framework. First comes reconnaissance, where the attacker gathers information about the target. Next is initial access, such as a phishing email or exploiting a public server. The attacker then executes code, establishes persistence, escalates privileges, moves laterally to other systems, collects data and finally achieves the objective: ransom, theft or disruption. Defenders can break the chain at several points, which is why logging and monitoring at each stage matter.

How Attackers Choose Targets

Contrary to popular belief, most attacks are opportunistic. Automated scanners look for exposed services, default passwords and known vulnerabilities across the whole internet. Criminals buy leaked credentials and try them across sites. Targeted attacks appear when the victim holds valuable data or money, such as banks, hospitals, universities, e-commerce firms and government bodies, or when the victim is a stepping stone to a more valuable partner.

Prevention Checklist for Individuals

• Unique passwords and a password manager.
• MFA on email, banking, social media and cloud storage.
• Automatic updates on phone and laptop.
• Install apps only from official stores.
• Regular backups, including one offline copy.
• Skepticism towards urgent messages and unknown links.
• Use of a screen lock and device encryption.
• Awareness of the 1930 helpline and cybercrime.gov.in for reporting.

Prevention Checklist for Businesses

• Maintain an asset inventory and patch critical systems quickly.
• Segment networks so one infected laptop cannot reach everything.
• Enforce MFA for email, VPN and admin accounts.
• Run awareness training and phishing simulations.
• Back up regularly and test restores.
• Collect logs centrally and monitor alerts.
• Prepare and rehearse an incident response plan.
• Review vendors and third-party access.
• Follow applicable regulations and report incidents as required.

Attack Terminology Cheat Sheet

• Vulnerability: a weakness that can be exploited.
• Exploit: code or technique that takes advantage of a vulnerability.
• Payload: the action delivered after exploitation, such as a reverse shell.
• Indicator of compromise (IOC): evidence of an attack, like a malicious IP address or file hash.
• Lateral movement: moving from one compromised system to others.
• Exfiltration: unauthorised transfer of data out of the organisation.
• Persistence: a mechanism that lets the attacker return after reboot.

Common Misconceptions About Attacks

• “Attacks are always sophisticated.” Most use simple tricks like reused passwords.
• “Only large companies are attacked.” Automation targets everyone.
• “If nothing happened, we are safe.” Stealthy intrusions may go unnoticed.
• “Antivirus covers every type.” Different attacks need different controls.
• “Insiders are rare.” Mistakes and misuse by insiders are a significant cause of incidents.

Hands-On Exercise: Classify Ten Headlines

Collect ten recent cyber incident headlines from reputable news sources. For each, write down the likely attack type, the entry point, which CIA property was affected and one control that could have helped. Compare your classification with a friend. This exercise trains the analyst thinking used in SOC triage and in exams such as Security+.

Self-Test

1. Which attack encrypts files for payment? (Ransomware.)
2. Which attack floods a service with traffic? (DoS or DDoS.)
3. What prevents SQL injection? (Parameterised queries.)
4. What reduces password reuse attacks? (Unique passwords and MFA.)
5. Which attack intercepts traffic between two parties? (Man-in-the-middle.)

Where to Go Next: Practice and Resources

Foundational topics become easier once you see how they connect. Treat each article as one piece of a map: networks carry data, operating systems run services, applications process input, people make decisions and attackers look for the weakest link among them. Revisit the basics regularly, because later topics such as cloud security and incident response build directly on them.

• Official documentation and RFCs for protocols you use daily.
• OWASP and MITRE ATT&CK websites for structured knowledge.
• Beginner labs on guided learning platforms.
• Government awareness portals for scams and safe practices.
• A study partner with whom you can explain concepts to each other.

More Questions Learners Ask

What is the best order to learn security topics?

Start with networking and operating systems, then threats and controls, then hands-on labs, and finally a specialisation.

How can I test whether I really understand a concept?

Try to explain it in two minutes to a non-technical friend and then demonstrate it in a lab.

Are free resources enough for fundamentals?

They are a good start, but structured feedback from a live course helps you avoid gaps.

How often do fundamentals change?

Core principles change slowly, while tools and threats change quickly, so invest more in principles.

Which fundamentals matter most for employers?

Networking, Linux and Windows basics, common attack types and clear communication.

Do I need to memorise all these terms?

No. Understand the idea behind each term and how it appears in a real incident; vocabulary becomes natural through labs and repetition.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What is the difference between vulnerability assessment and penetration testing?

An assessment identifies and ranks weaknesses, often with automated scans; a penetration test attempts to exploit them to demonstrate impact. The deliverable of the latter is an attack narrative with proof.

What is hashing and why are salts used?

Hashing creates a fixed-length fingerprint of data and cannot be reversed easily. Salts are random values added before hashing passwords so identical passwords produce different hashes and precomputed attacks fail.

Explain the CIA triad.

Confidentiality keeps data secret from unauthorised people, integrity ensures it is not altered improperly and availability ensures it can be used when needed. Controls such as encryption, hashing and backups map to each.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• ISO 27001: An international standard for an information security management system, often required by enterprise customers.
• Phishing: A fraudulent message, usually email, SMS or WhatsApp, that tricks a person into revealing credentials, paying money or installing malware.
• EDR: Endpoint detection and response software that records activity on laptops and servers and helps contain compromised machines.
• Social engineering: Manipulating people, rather than breaking technology, to gain access or information.
• Least privilege: Giving each user or system only the access needed for the job, limiting damage if an account is compromised.
• Incident response: The organised process of detecting, containing, eradicating and recovering from a security incident and learning from it.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are Cyber Security Course, Ethical Hacking Course and Network Security Course. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: What Is Phishing in Cyber Security? Types, Examples and How to Stay Safe • What Is Ransomware? How It Works, Examples and How to Recover • What Is SQL Injection in Cyber Security? Types, Example and Prevention.