WHITE PAPER

Cyberattack
techniques andwhat they mean foryour business

What is acyberattack andhow does it work

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

2Introduction
There are a lot of cyberthreats out there: different attack types and vectors designed
to penetrate companies and home users cybersecurity. While cybercriminals
usually pursue specific goals like money, data, or disruption, they use a wide array ofmalware and vectors of infection to achieve these goals. Good cyber protection andcybersecurity solutions should be able to deal with all of these. In this whitepaper,
we will explain the different kinds of threats out there, the difference between cyberprotection and cybersecurity in this regard, and how Acronis Cyber Protection
Solutions are able to defend against all attack vectors to provide the ultimate end-toend cyber protection.
WHAT IS A CYBERATTACK?
A cyberattack, on a high level, is a digital assault on acomputer, smart device, or network. Cybercriminals use avariety of attack vectors and techniques to compromise andinfect the system, and finally achieve their malicious goal.

On the other hand, targeted attacks are when the victim
was specifically chosen and profiled in advance andsuch attacks are often performed manually. The mostsophisticated targeted attacks are called advanced
persistent threats (APTs) and these attacks usually involve
many stages, can last for months, and are hard to detect.

It is important to distinguish mass and targeted attacks.
Mass attacks are usually done via campaigns and involve
an “as-a-service” scheme with a broad spectrum ofvictims. Campaigns can be spam, phishing, mass infectionof legitimate sites, and so on. These kinds of attacks areautomated and everyone can be a victim.

All attacks include basic stages: preparation, infection,and post-execution. As you can imagine, if your security
solution can’t react to some of these stages, there’s a highrisk that the threat will be missed or detected too late.

INFECTION LIFECYCLEFILELLESS

Post-execution
RANSOMWARE
WITH LATERALMOVEMENT

0-DAY
EXPLOITATION

Malware offense

MALWARERANSOMWARE

MACROS

POWERSHELL

Cybersecurity
defenseWORMS

Pre-infectionwww.acronis.comVIRUSESCopyright © 2002-2021 Acronis International GmbH.

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

3Vectors of attack
There are several vectors of attacks and it is important to cover all ofthem with your security defense strategy.

THE MOST COMMON ATTACK VECTORS ARE:
•Email e.g. malicious attachments•

Drive-by compromise e.g. websites
with browser exploits•Exposed services e.g. vulnerable RDP servers•

Valid accounts e.g. account takeover•Supply chain e.g. software update hijacking•Hardware e.g. USB sticks

First, a key one, is over email. Attacks can come throughboth web and app email clients. The threat comesthrough email and can come in a variety of forms:
malicious link, malicious attachment, social engineering,and so on. We will discuss all these options later.

Another vector of attack, somewhat similar to an
account takeover, is called a trusted relationship or
supply chain attack. It involves your partner or service
provider getting compromised. If the software vendor ofan application that you use is compromised, you might
automatically download a malicious update from theirsite. This happened to ASUS early in 2019 when they got
compromised and started unknowingly distributing an
infected driver update.
Sometimes attackers make use of physical devices, suchas a USB stick with malware on it, that is deliberately
placed in public places or near a targeted business in thehopes that someone will be curious enough to plug it into
their computer.
It’s worth noting that with each of these attack vectors
different attack techniques may be used. These arewhat people usually think of when we talk about
security threats.

Threats can also come via the exploitation ofvulnerabilities in software, services, and more.
Vulnerabilities are always bad but they’re not dangerous
until they’re exploited. Unfortuately, whether you’re auser or admin, you won’t know if it was exploited or not.
That’s why you need to patch all known vulnerabilities
and be ready for zero-day, unknown vulnerabilities
without a patсh available. Vulnerabililities can reside inan exposed server service, such as the Microsoft DNS
server, which had a remote code execution vulnerability(CVE-2020-1350) fixed in July. However vulnerabilities also
exist in client applications such as web browsers, and canget exploited when you visit a maliciously-crafted website,which is called a drive-by download attack.
You can be infected via an account takeover: acybercriminal gains control over a legitimate accountand performs malicious actions from it. For example, if
cybercriminals guess a password and corrupt an admin
account they can delete backups and copy confidential
information.
www.acronis.com

Copyright © 2002-2021 Acronis International GmbH.

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

4Cyberattack techniques
For all the different attack vectors, there are different methods and techniquesthat can be applied. Some are concepts that apply to various groups (such as socialengineering) while other techniques (like sniffing) allow criminals to find useful
information for further attacks.
SOCIAL ENGINEERING
Social engineering is all about the human element. The attacker

PHISHING AND
SPEAR-PHISHING ATTACKS

creates a convincing story that will trick the user into performing

Phishing is a technique that employs fraudulent communications

certain actions. This is the most dangerous and effective(emails, messages, SMS, and websites) that appear to comecyberattack technique today. People are always the weakest linkfrom a reputable source. The attacker impersonates legitimate

in security, because if you’re creative enough you can convince

service brands in other to use that inherent trust to trick people

people of doing practically anything.

into sharing their credentials. For example, by creating a page

Social engineering can be combined with an account takeoverand impersonation attack, making it very difficult to discover. For
example, if your boss’s account is compromised, it will be difficult
to verify that an email with instructions to open an attachment,
was not sent by your boss. That is why even if you properly train
your personnel regarding phishing scams, you still need to havea proper cybersecurity solution in place.

that looks like the Office 365 web portal cybercriminals can stealuser credentials in the background. It is a very popular attack
technique and often goes hand-in-hand with social engineering.
Phishing can lead you to disclose your confidential data (PII,financial data like credit card numbers, etc.), make you installmalware, or visit an infected or malicious site.
Spear-phishing has the same goal but is specifically targeted toa person who is typically profiled over social networks in real-life

PASSWORD ATTACKS

before the attack. Spear-phishing is typically very convincing andA password attack is an attempt to obtain or use a user’s

hard to recognize unless detected by cybersecurity products.

password with illegal intentions. Cybercriminals can use
password sniffers, dictionary attacks, and cracking programs

DRIVE-BY ATTACKS

to get a user’s password. While largely useless with two-factor

A drive-by attack is a stealthy and dangerous method ofauthentification in place, in some cases password attacks candistributing malware. It’s also a good example you can point to

be enough to get bad guys what they want. Password attacks

with friends who argue against needing cybersecurity by saying

can be prevented by simple common sense (do not tell anyone“I don’t click on any links and don’t visit any shady sites”.

your password, do not write it down, do not use the same
password on multiple services, etc.) and the usage of strong,long passwords or password managers.

Typically drive-by works this way: cybercriminals utilize poorly
configured or unpatched websites and inject malicious script
into one of the pages. Once a user visits the website, this script
will exploit a vulnerability in the browser or a plug-in and installmalware into the computer. In most cases, these scripts areobfuscated and not easy to detect. These attacks are called
drive-by because they don’t require any action on the victim’s
part except visiting the compromised website.

www.acronis.com

Copyright © 2002-2021 Acronis International GmbH.

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

5EXPLOITATION OF A ZERO-DAY
VULNERABILITY

MAN-IN-THE-MIDDLE (MITM) ATTACKSA zero-day vulnerability is a software vulnerability that wasintercept traffic in order to steal or modify transmitted data:

not yet known to the vendor when it appeared in the wild

namely login information, passwords, financial data, and soand therefore has no patch available. Because of this, thereon. The attackers pose as a legitimate service and will passare zero days available to protect yourself by patching. A

all traffic like a proxy. These attacks typically take place on

zero-day vulnerability often comes with a zero-day exploit

unsecured public Wi-Fi networks, where attackers easily canthat can abuse the flaw. It is not easy to detect with averageinsert themselves between a visitor’s device and the network.

cybersecurity solutions as it requires deep system knowledge

Doing so they can install malware or redirect users to aand constant monitoring of all applications. Eventually, every

malicious website. HTTPS is believed to help prevent thesevulnerability becomes known, and the hole will be closed withattacks but this is not true. Simple HTTPS encryption only

a security patch. The problem is that sometimes it can takesecures the traffic to the server end, but does not verify themonths, if not years.

authenticity of the server endpoint.

Man-in-the-middle (MitM) attacks occur when attackers

SQL INJECTION ATTACKSThe Structured Query Language (SQL) is very often used in aservers, including web servers. SQL injection means that anattacker inserts malicious code into a server that uses SQL andforces the server to reveal information it normally would not.
For example, an attacker could carry out a SQL injection simply
by submitting malicious code into a vulnerable website searchbox and receive all user accounts for this web application.

CROSS-SITE SCRIPTING (XSS) ATTACKS
Similar to SQL injection, cross-site scripting (XSS) is a kind ofinjection breach where the attacker sends malicious scripts
into content from otherwise reputable websites. It happens
because poor configuration or vulnerabilities make it possible
to attach code into web applications, the malicious code isbundled together with dynamic content that is then sent
to the victim’s browser. The exploits can include malicious
scripts in many languages including JavaScript, Flash, HTML,Java, and Ajax.

MALWARE ATTACKS
A lot of cyberattacks involve malicious software (malwarefor short). As we already explained, malware can get into thesystem in a variety of ways: downloaded and launched by auser, silently installed through a drive-by, silently downloaded
and executed via a vulnerability, and so on.

www.acronis.com

Copyright © 2002-2021 Acronis International GmbH.

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

6Types of malware
Trojans

Worms

Sometimes called trojan horses,

The distinctive trait of the worm is

Trojans are the most prevalent typethat it’s self-replicating and spread

These were previously known as macroof malicious program. Trojans can’t

over networks. Worms are dangerous

viruses. But in general, they’re any kind of

replicate like viruses but can do a lot

because they can spread without end-

script executed by a legitimate programof damage. Trojans not only launch anuser interaction.

to perform malicious activity. In recent
years they’ve been wrongly associatedattack but also can create a backdoor
for future attacks.

Ransomware

Scripted malware ormalicious scripts

Root and Boot kits
Sophisticated malicious programs
that hide themselves in a master bootwith fileless attacks. But if you think of
the term, the script is still a file in a hard
drive or any other storage source.

A very popular type of malware thatrecord on hard disks or hide theirprevents access to the system’s data.

presence in the operating system.

Ransomware usually encrypts data

Originally, a rootkit was a collection ofYour machine will be controlled

through a very strong encryption

tools that enabled administrator-levelby someone to perform malicious

algorithm so that there is no way toaccess to a computer or network.

activities like spreading malware,

decrypt the data yourself. Instead, it

Today rootkits are rare and generally

Denial-of-Service, and Distributed

demands a ransom in cryptocurrency

associated with malware – such as

Denial-of-Service attacks. A bot alone

to decrypt it. The attacker may also

Trojans, worms, and viruses – thatis relatively harmless, especially when

threaten to publish or delete sensitive

hide their presence and actions fromit’s not connected to the Command

information if the ransom is not paid.

users and other system processes.

and Control server. That’s why bots are

Botnets

combined into botnets and a botnet

Viruses

SpywareA malicious program that most media

This type of malware is designed

outlets and end-users incorrectly label

to collect information on theevery malware program. A digital virus

victim’s machine. Spyware tracks

modifies other legitimate host files (oreverything you do without yourpointers to them) in such a way thatconsent or knowledge and delivers

when a victim’s file is executed, thethe information directly to a remotevirus is also executed. Pure viruses cancybercriminal. It can also install otherreplicate and are uncommon today.

malicious applications onto yourcan do significant harm like completely
disrupting business operations.

system via the internet.

Adware and PUA (PotentiallyUnwanted Applications)Not that dangerous, but very annoying,software programs used by dodgy
businesses as part of their marketing
efforts. They usually manifest as
advertisements or banners displayed
while applications are running.

www.acronis.com

Copyright © 2002-2021 Acronis International GmbH.

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

7

Fileless attacks
Fileless attacks are a type of cyberthreat that’s often associated with malware andexploits. There are many definitions with slight variations for fileless attacks. To put it
simply, fileless attacks are attacks without a specific malicious file on disk.
A fileless attack leverages legitimate apps and processes to perform malicious activities like privilege escalations,
payload deliveries, data gathering, and so on. This technique, when preinstalled legitimate software is used in afileless attack is often called living-off-the-land. Very often we see that only some phases of an attack chain use filelesstechniques, thus making the whole attack technically not fileless.
All this can happen in random access memory (RAM) only and leave no traces after a machine reboot. That means
when one of these attacks strikes nothing related to malicious activity should be written to the target hard drive,
meaning that fileless attacks are very much resistant to existing security detection technologies like file-based
whitelisting, signature detection, hardware verification, etc. because they leave practically no evidence that could be
used by digital forensic investigators to identify and understand the attack later on.

HOW ACRONIS CYBER PROTECTION SOLUTIONSDEAL WITH THESE ATTACK TECHNIQUES
It’s important to use cybersecurity and cyber protection
solutions like Acronis Cyber Protect Cloud or the onpremises solution Acronis Cyber Protect to stop thesepotential cyberattacks and keep systems and data safe. The
problem facing the modern cybersecurity industry is thatit’s very hard to find a product that can protect you from allof these types of threats and quite often business have touse multiple solutions or compromise and leave some holes
in their security perimeter, which is both dangerous andill-advised. Typical cybersecurity solutions can’t protect dataand deliver quick recovery and good business continuity.

www.acronis.com

Acronis Cyber Protection Solutions, which combine
cybersecurity and data protection, is the closest to theideal solution to address all of these threats. It provides
innovative integrated multilayered protection with welltuned technologies inside each solution that work to stop
the threats explained in this white paper. This is what wecall the Acronis Cyber Protection approach. Let’s take alook at the following table which covers all the vectors andtechniques explained before and corresponding Acronis
security technologies.

Copyright © 2002-2021 Acronis International GmbH.

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

8ACRONIS SECURITY TECHNOLOGYATTACK VECTOR OR TECHNIQUE

PROACTIVE STAGE

Attack over email

Usage of vulnerability, including ZeroDay vulnerabilities

Vulnerability assessment,
Patch management

ACTIVE STAGE

REACTIVE STAGE

URL filtering

URL filtering, Behavioral engine, Static
AI-analyzer, Cloud detection, Exploit
prevention

Exploit prevention

Account takeover

URL filtering, Behavioral engine, Static
AI-analyzer, Cloud detection, Exploit
prevention

Trusted relationship or supply chain
attackURL filtering, Behavioral engine, StaticAI-analyzer, Cloud detection, Exploit
prevention

Social Engineering

URL filtering

URL filtering, Behavioral engine, StaticAI-analyzer, Cloud detection, Exploit
prevention

Phishing and spear-phishing attacks

URL filtering

URL filtering

URL filtering,
Behavioral engine, Cloud detection,
Exploit prevention

Static AI-analyzer

Fileless attacks

Vulnerability assessment, Patchmanagement

Drive-by attacks

URL filtering,
Behavioral engine, Exploit prevention

Malware attacks

Behavioral engine, Cloud detection,
Exploit prevention, Acronis Active
Protection, Static AI-analyzer
Behavioral engine, Cloud detection,
URL filtering

Man-in-the-middle (MitM) attacks

Password attacks

Botnet inclusion

2FA

Static AI-analyzer

Brute-force detection

Behavioral engine, Cloud detection

Tampering

Static AI-analyzer

Acronis Notary (via blockchain)

SQL injection attack

URL filtering

Cross-site scripting (XSS) attacks

URL filteringwww.acronis.com

Static AI-analyzer

Copyright © 2002-2021 Acronis International GmbH.

CYBERATTACK TECHNIQUES AND WHAT THEY MEAN FOR YOUR BUSINESS

9PROACTIVE(OR PREVENTIVE) STAGE

ACTIVE STAGE

REACTIVE STAGE

Security technology detects an activeA threat may be in the system already,You get ready for threats in advance,

threat or attack which executes in theor the first stage of the attack ispatch systems, use authentification, etc.

system right now.

executed. For example, you received
a phishing email. It is important tounderstand, that even if a threat is in
the system it doesn’t mean the system
received any damage, as the actual
payload can be downloaded much later.
And in this stage it will be detected.

AS YOU CAN SEE, ACRONISSOLUTIONS WITH THEIRINTEGRATIONS AND MULTILAYEREDSECURITY STACK CAN DEFEAT ALL
OF THESE TECHNIQUES AND KEEP
YOUR SYSTEMS AND DATA SAFE.

Learn more atwww.acronis.com

Copyright © 2002-2021 Acronis International GmbH. All rights reserved. Acronis and the Acronis logo aretrademarks of Acronis International GmbH in the United States and/or other countries. All other trademarks
or registered trademarks are the property of their respective owners. Technical changes and Differencesfrom the illustrations are reserved; errors are excepted. 2021-04