Threat Vectors: Files, Networks and Endpoints

Glossary

220 terms from Threat Vectors: Files, Networks and Endpoints, in plain words, each with the chapter that teaches it.

Search the glossary

#

.docm / .xlsm: Word and Excel file extensions where the 'm' means the file can contain macros. A plain .xlsx file cannot hold macros, which is why Alex asked the importer for one instead of Price_List_2027.xlsm.
.example: A top-level domain name reserved for documentation and examples, so it can never belong to a real website. It is used for made-up attacker sites, such as `kettleandcrane-pay.example`, so readers can't visit a real malicious address by mistake.

A

Adversary-in-the-middle (AiTM) phishing: A fake sign-in page sits between the person and the real site and passes everything through, so the person completes real MFA and the attacker keeps the session cookie that comes back. MFA is not broken; the attacker simply takes the result of a finished sign-in.
AI (artificial intelligence): Computer systems that can produce things like realistic audio and video. Attackers use AI to make deepfakes and to clone voices, which can fool voice ID.
allow list: A list of approved items, where anything not on the list is blocked. Alex used one so Kettle & Crane staff can install only approved browser extensions, and one can also block every remote support tool except the approved one.
antivirus: Security software that looks for known bad files. It often misses living-off-the-land attacks because trusted tools like certutil are not bad files.
API (application programming interface): A way for two programs to exchange data automatically. Kettle & Crane's shop sends each order's name and address to the carrier through one.
API key: A secret string that works like a password for an API connection. If someone steals the shipping API key, they can create labels, read addresses or redirect parcels, so Alex replaced the one that had been left in a shared spreadsheet.
app token: A token that lets one SaaS app act on another's data. Tokens stolen from Salesloft's Drift app were used to copy data from hundreds of companies' Salesforce systems without any password.
APT (advanced persistent threat): A skilled, well-funded attacker group, often state-backed, that goes after chosen victims and stays hidden in their systems for a long time. One example is APT19, which compromised the forbes.com website in 2014 to attack its readers in a watering hole attack.
APT19: An attacker group that compromised the forbes.com website in 2014 to reach its readers. MITRE ATT&CK lists the attack as an example of drive-by compromise.
attachment-based vector: An attack carried by a file attached to a message, such as a macro document, an RTF file or a PDF, that the person opens in another program.
autofill: A password manager feature that fills saved details into a site for you. A malicious page can trick automatic autofill, so Alex set it to 'on click' only.
AutoRun: An old Windows feature that automatically ran programs from inserted media such as USB sticks. It should be turned off.

B

backdoor: A secret way into a system that the attacker hides there, for example inside a SolarWinds Orion update or XZ Utils.
BadUSB: A USB device that tells the computer it is a keyboard, then types commands faster than a person could. The stick mailed to Jo was one: a command window flashed open and closed when Jo plugged it in.
baseline: A record of what normal activity looks like on a system. If Alex never uses certutil to download files, any such download stands out against the baseline.
bash: Command shells built into Linux and macOS (zsh is another). Like PowerShell on Windows, attackers can misuse them as living-off-the-land tools.
binary: A program file. LOLBin is short for living-off-the-land binary.
biometric: A measurement of the body used to prove who you are, such as a fingerprint, face, iris, voice or palm. A biometric can be copied and can never be changed, so Alex would not rely on the bank's voice ID alone.
BlueKeep (CVE-2019-0708): A 2019 flaw in RDP on older Windows versions that let an attacker run code before logging in. Because no login was needed, it could spread from computer to computer by itself.
browser extension: A small program installed into the browser to add a feature, whose permissions can let it read and change every page. It becomes a vector when it is malicious from the start, turned bad through an automatic update, or has a flaw.
browser isolation: A defense that runs untrusted web pages somewhere other than the user's computer, so exploit scripts cannot reach it.
browser-based vector: Any part of the browser an attacker can use, such as extensions, JavaScript, password managers, cookies and session tokens, to reach the sessions and passwords the browser holds.
built-in tools: Management tools that ship with the operating system, such as PowerShell, WMI, certutil and schtasks. They are signed and trusted, so they can do an attacker's work without anything new being installed.

C

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart): A small web test that a person should pass and a program should fail, such as 'I'm not a robot'. Attackers fake it to make people run commands, or place a real one in front of a phishing page to block security scanners.
certificate: A digital ID that lets a device or server prove who it is. A copied device certificate lets another machine pretend to be the trusted one, so Alex revoked the certificate on Priya's stolen laptop.
certutil: A built-in Windows tool for managing certificates. Attackers misuse it to download files with '-urlcache -f', which is a strong warning sign in a log, as on the quiet order server.
CISA (Cybersecurity and Infrastructure Security Agency): The US government agency that leads national cybersecurity defense and protects critical infrastructure. It orders federal agencies to fix urgent flaws, such as those in edge devices, and it publishes warnings and guidance on threats like exposed RDP, misused RMM tools, living-off-the-land attacks and the Mirai botnet.
ClickFix: A fake 'verify you are human' page that quietly copies a command to the clipboard and tells the person to press Windows+R, Ctrl+V and Enter, so they run the attacker's command themselves. No real CAPTCHA ever asks you to press keys.
Colonial Pipeline: A 2021 ransomware attack that began with one old VPN account. The account was still active and had no MFA, so a single password was enough to get in.
Command Prompt (cmd.exe): The older Windows command shell, shown by the C:\> prompt. It is one of the built-in tools attackers can misuse.
Constrained Language Mode: A PowerShell setting that blocks its riskiest features. It is used for users who are not administrators.
Content Security Policy: A browser security rule that a website sends, listing which domains scripts may load from. Alex set the shop to allow only its own domain and the payment company's, so a planted script from anywhere else will not run.
contractor: An outsider who works on a company's premises or systems for a while and is given some access to do it. That access is often too wide or left active after the job, so each contractor should get a named, limited account with an end date.
cookie: A small piece of text a website asks the browser to store and send back with each request, for example to remember that you are logged in. It is the container that usually holds the session token.
cron: The Linux and macOS tool for running scheduled jobs. It is the counterpart of Windows Task Scheduler.
crossover error rate (CER): The point where a biometric system's false acceptance rate and false rejection rate are equal. The lower it is, the more accurate the system.
curl: A command-line tool that requests a web page; with -si it runs quietly and shows the reply's header lines, such as Set-Cookie. It is also a built-in tool on Linux and macOS that attackers can misuse.
CVE (Common Vulnerabilities and Exposures): A public list of known flaws, where each flaw gets an ID such as CVE-2017-11882.
CVE-2017-11882: A flaw in Microsoft's old Equation Editor. A booby-trapped equation object inside an RTF file could run code when opened on an unpatched computer, with no macro and no Enable Content click.
Cyberhaven: A company whose Chrome extension was taken over in December 2024 after an employee fell for phishing. A malicious update pushed to users stole cookies and session tokens.

D

data-blocking adapter: A small adapter that passes power but not data. It protects a phone charged at a public port against juice jacking.
deepfake: AI-made audio or video of a real person. Impersonators use it to make a call sound or look like a known manager.
default password: A factory-set password that owners often never change, sometimes the same on every unit of a model. Mirai used such passwords, and so did the attacker who took over Kettle & Crane's warehouse camera.
DES (Data Encryption Standard): An old encryption algorithm, long considered broken. Classic VNC turns its eight-character password into a DES key.
device control: A policy that allows only approved USB device types and models. Unlike a simple storage block, it can also stop fake keyboards.
disk encryption: Encrypting a laptop's storage so that a thief cannot read its files. Alex turned it on for Jo's laptop.
drive-by compromise: MITRE ATT&CK technique T1189: infecting people just because they browse to a site. Watering hole attacks are listed under it.

E

edge device: A network device at the boundary between the office and the internet, such as a firewall or VPN gateway. Many intrusions start at these devices because they face the internet and often go unpatched.
email filter: A service that checks incoming email for spam, malicious links and attachments, and can quarantine messages, decode QR images or open PDFs in a sandbox. Attackers try to slip past it with text hidden in images or links hidden in QR codes.
embedded content: Something placed inside a message or page that the reader did not ask for separately, such as an image or another page. Attackers abuse it to report opens, hide words from filters, or run scripts, as in the image-only 'invoice' Priya received.
embedded macro: An attack where a document's macro downloads and runs malware once the person clicks Enable Content.
embedded object: Another file or program piece placed inside a document, marked in RTF with the \object code. It can exploit a flaw in the part of Office that displays it.
Enable Content: The Office button that lets a document's macros run. 'Enable Content to view' is a warning sign, not an instruction.
endpoint: Any device at the end of a network connection: a phone, laptop, desktop, server or tablet. Almost every attack ends on an endpoint.
endpoint protection: Security software installed on a device to detect and block threats. Alex installed it on Jo's laptop; IoT devices usually cannot run it.
endpoint-based vector: A way in through the device itself: what it is, how it is used, how much it is trusted and what tools it already contains.
Equation Editor: An old Microsoft Office tool for displaying math formulas. Its flaw, CVE-2017-11882, was exploited through RTF files, and Microsoft later removed it.
external media: Storage you plug in from outside, such as a USB stick or external drive. An external media-based vector uses a plugged-in device to attack.

F

factory reset: Returning a device to its original state, which removes whatever an attacker put on it. Alex did this to the taken-over warehouse camera.
false acceptance rate (FAR): The share of wrong people that a biometric system lets in. It goes up when the system is tuned for convenience.
false rejection rate (FRR): The share of right people that a biometric system turns away. It goes up when matching is made stricter.
FBI (Federal Bureau of Investigation): The US federal law enforcement agency that investigates crimes, including cybercrime, and warns the public about current scams. It has warned about tampered QR codes used to steal logins and money, and about the FIN7 group mailing malicious BadUSB devices.
fileless malware: Malicious code that lives only in memory, often launched through LOTL tools such as PowerShell. LOTL itself is the misuse of existing tools, whether or not files are written.
FIN7: A criminal group that, according to the FBI, mailed keystroke injection USB devices to US companies in packages dressed up as coming from Amazon or a US government department.
firewall: A device that allows or blocks network traffic. Kettle & Crane's firewall had its management page exposed to the internet until Alex moved it to the inside network.
firmware: The software built into a device such as a firewall, camera or printer. It needs updates like any other software.
first foothold: The first device an attacker controls in a network, usually a workstation. An IoT sensor can be one too.
Follina (CVE-2022-30190): A 2022 Windows flaw (in the Microsoft Support Diagnostic Tool) that could be triggered just by showing an RTF file in File Explorer's preview pane, without the file being opened.
forward secrecy: A property where each session key is made fresh from temporary keys, so it cannot be rebuilt later from the server's long-term private key, and recorded traffic stays locked even if that key is stolen. TLS 1.3 has it built in.
full tunneling: A VPN setup that sends all of a device's traffic through the tunnel. It is the opposite of split tunneling.

G

grep: A command-line tool that searches text and keeps only the lines that match a pattern. It is often used to filter long tool output, for example `grep -E "JS|Java|Open|Launch|Embedded"` shows only the script and action lines from pdfid's report on a PDF.
guest network: A separate network for visitors and outside devices that cannot reach the office's own systems. Alex put the espresso company's 'smart' machine on it, away from the order server.

H

Heartbleed (CVE-2014-0160): A 2014 flaw in the OpenSSL encryption library that leaked server memory, including keys.
HTTP (Hypertext Transfer Protocol): The web's basic protocol. It forgets you between page loads, which is why websites use cookies to remember you.
HttpOnly: A cookie setting that stops page scripts from reading the cookie, so injected JavaScript cannot copy the session token.
HTTPS: HTTP sent inside an encrypted TLS connection.
human-based vector: A path in that uses people rather than code: impersonation, contractors, visitors, biometrics and watering holes.
hypervisor: The software that creates and runs virtual machines. Whoever controls it controls every VM on it, which is why ransomware groups target hypervisors such as VMware ESXi.

I

image (VM): A saved copy that new virtual machines are created from. An old image brings its old, unpatched flaws into every VM made from it.
image-based vector: An attack that uses a picture to carry or hide the attack, such as a QR code, embedded content or a fake CAPTCHA.
impersonation: Pretending to be someone the victim trusts, such as IT support or a supplier, so the victim does what the attacker asks. The fake printer technician who asked to be left alone in the server cupboard was an impersonator.
infostealer: Malware that copies saved passwords, unlocked vaults and cookies from an infected computer. Passwords stolen this way were behind the Snowflake customer breaches.
infrastructure devices: The boxes that make a network work: routers, switches, firewalls, wireless access points and VPN gateways. They are prized targets because they see all traffic and often go unpatched.
initial access broker: A criminal who sells working logins, such as RDP accounts, to ransomware gangs.
insider threat: Someone with legitimate access who misuses it, on purpose or by accident. A contractor can become one.
Internet of Things (IoT): Everyday devices with a network connection and a small computer inside, such as cameras, sensors and printers. They usually have default passwords, get few updates and are forgotten on the network.
IPsec (Internet Protocol Security): A family of protocols for building VPNs that encrypt network traffic. It uses UDP port 500 for its key exchange, and UDP 4500 when traffic passes through a router that shares one public address.
Ivanti Connect Secure: A VPN gateway product. In January 2024 two flaws in it let attackers run commands on the gateway without logging in.

J

jailbreaking: Removing an iPhone's built-in protections so the owner can change anything, which makes malware much easier to install.
JavaScript: The programming language that runs inside web pages, and also inside PDF readers. Attackers plant it on real sites, for example to skim card numbers, attack the browser or trick the person.
juice jacking: An attack in which a public charging port that also carries data tries to reach a plugged-in phone.

K

Kaseya VSA: An RMM tool used by many MSPs. In July 2021 REvil exploited it to push ransomware to about 60 MSPs and, through them, to an estimated 1,000 to 1,500 businesses.
key exchange: The step where two sides of a connection agree on a shared session key without anyone watching being able to work it out.
keystroke injection: An attack where a USB device poses as a keyboard and types commands, such as opening PowerShell to download malware. A storage block does not stop it.
kiosk mode: A setting that makes a device run only one app. Alex set the warehouse tablet so it runs only the shipping app.

L

least privilege: Giving each user, vendor or device only the access it needs. Examples include removing Jo's local admin rights and limiting the roaster maker's VPN account to one computer.
liveness detection: A biometric sensor feature that checks a real, living person is present, for example by detecting blood flow, depth or blinking. It stops presentation attacks.
living off the land (LOTL): An attacker using tools already on the target system, such as built-in tools or installed admin software, instead of bringing their own malware. It is caught with command-line logs and baselines, not antivirus.
local administrator: A user allowed to install anything and change any setting on a computer. Any malware that user runs gets the same power.
logistic provider: A company that moves or stores goods, such as a carrier, freight firm or warehouse. Its risks include API keys and customer data, fake delivery lures and tampered goods.
LOLBAS (Living Off The Land Binaries, Scripts and Libraries): A public project that documents how each Windows tool can be misused, for example certutil downloading a file.
LOLBin (living-off-the-land binary): A Windows program file, such as certutil, that attackers misuse for living-off-the-land attacks.
lookalike domain: A web address made to resemble a real one, such as kettleandcrane-pay.example instead of kettleandcrane.com, used to host fake payment or sign-in pages. It is a new, fake site, unlike a watering hole, which is a real site compromised.

M

macro: A small program saved inside a document such as a Word or Excel file, written in VBA. Office now blocks macros in files from the internet by default.
malicious cable: A USB cable or charger that hides a tiny computer, sometimes with a wireless link back to the attacker. A storage block does nothing against it.
malware: Malicious software, such as ransomware or password stealers.
Mark of the Web: A hidden label Windows puts on every file downloaded from the internet. When Office sees it on a file with macros, it blocks the macros and offers no Enable Content button.
master password: The one strong password that unlocks a password manager's vault. If it is stolen and nothing else protects the vault, every saved password is exposed, so Alex required MFA as well.
MDM (mobile device management): A service that sets rules on phones and tablets, such as requiring a lock code, blocking sideloading and wiping a lost device.
MFA (multifactor authentication): Requiring a second proof besides the password, such as a code or a security key. Missing MFA let attackers in at Colonial Pipeline and Snowflake's customers, and would likely have stopped the Target breach.
MFA fatigue: An attacker who already has the password sends MFA prompt after prompt, hoping the person taps Approve to make it stop, as happened to Sam on a Saturday morning. The fix is a password reset plus number matching.
Mirai: 2016 malware that took over hundreds of thousands of cameras, video recorders and routers using a list of 62 common default logins. It then used them to flood targets with traffic.
MITRE ATT&CK: A public catalog of attacker techniques, each with an ID such as T1189 (drive-by compromise).
mobile device: A smartphone: a small, always-connected computer that receives MFA codes and work email beside personal apps. It is a vector through theft, unsafe networks, sideloaded apps, jailbreaking or rooting, and missing updates.
MSP (managed service provider): A company that runs IT for other companies, usually with administrator access to every customer through an RMM tool. Breaking into one MSP lets an attacker push an attack to all of its customers.

N

net, reg and sc: Built-in Windows commands for managing users and shares (net), the registry (reg) and services (sc). Attackers use net to list accounts or add an administrator.
network camera: A camera that streams and stores video over the network (IP is the Internet Protocol). It may see codes and screens, be reachable from the internet, or rely on a weak cloud account.
Network Level Authentication (NLA): An RDP setting that makes users log in before a remote session is even created. It is only a partial defense against BlueKeep, because it does not stop attackers who have a valid login.
network segment: A separate part of the network with firewall rules limiting what it can reach. Alex put cameras, sensors and printers on their own segment, replacing the flat network, so the warehouse camera can reach the recorder and nothing else.
network-based vector: An attack through the devices and keys that carry everyone's traffic: infrastructure devices, virtualized devices and session keys.
Nmap: A free port-scanning tool that reports which ports answer, such as 3389 for RDP or 5900 for VNC (-sT makes a normal TCP connection and -p lists the ports). Only scan computers you are allowed to scan.
npm and PyPI: Public repositories of software packages. Malicious packages there are a supply chain vector.
number matching: A type of MFA where the sign-in screen shows a number that must be typed on the phone to approve. Someone who is not signing in has no number to type, which defeats MFA fatigue.

P

password manager: A tool that stores passwords in an encrypted vault and fills them in for you. It is a vector through a stolen master password, infostealers, tricked autofill or a breached vendor.
PDF (Portable Document Format): The standard format for documents that look the same everywhere. A PDF can carry JavaScript, automatic actions, hidden files or a link to a fake page.
PDF action entries (/JS, /JavaScript, /OpenAction, /AA, /Launch, /EmbeddedFile): Named entries inside a PDF that pdfid counts: /JS and /JavaScript mark script code and script actions, /OpenAction runs something the moment the file opens, /AA (additional actions) runs actions on events such as turning a page, /Launch asks the reader to start another program, and /EmbeddedFile hides a whole other file inside. A normal invoice shows 0 for all of them, so when the fake Statement_Oct.pdf showed /JavaScript 1 and /OpenAction 1, Alex knew it was not genuine.
pdfid: A free tool by Didier Stevens that counts risky PDF entries such as /JS, /OpenAction and /Launch without opening the file. A clean result does not prove that a link inside the PDF is safe.
permissions (extension): The rights a browser extension asks for when installed, such as 'Read and change all your data on all websites'. The Shipping label helper's permissions were far wider than a label tool needs.
phishing: Sending a victim a message with a lure, such as a link to a fake sign-in page.
phishing-resistant MFA: MFA, such as a security key, that will not complete a sign-in on a fake site. It defends against AiTM token theft.
PIN (personal identification number): A short numeric code. It is used as a second factor with a biometric, or required at a printer before a job prints.
port: The number that picks one service on a computer, for example 3389 for RDP or 22 for SSH; each open port is a door. A network wall port is the physical socket a visitor could plug into.
PowerShell: A Windows command shell and scripting language that can manage almost anything, locally or remotely. Attackers misuse it to download and run code and to explore the network.
presentation attack: Holding a fake up to a biometric sensor, such as a molded fingerprint, a printed photo, a mask or a cloned voice.
pretext: The cover story that goes with an impersonator's role, such as 'Alex booked me to check the printer'.
Print Spooler: The Windows service that handles printing on computers and servers. PrintNightmare was a flaw in it.
printer: A networked computer that prints, scans, copies and emails. It may store documents and scan-to-email passwords, and it often has an admin page with a default password.
PrintNightmare (CVE-2021-34527): A 2021 flaw in the Windows Print Spooler service that let attackers run code with full system rights.
private key: The secret half of a key pair; a server's long-term private key proves it is the real server. With forward secrecy, stealing it does not reveal past session keys.

Q

QR code (quick response code): A square pattern of blocks that stores short text, usually a web address. People cannot read it by eye, so a fake sticker, like the one at Bloom Café, can send them to a fake page.
quarantine: A holding area where a mail filter puts suspicious messages or files so that staff never receive them, like Shipping_Claim.rtf.
quishing: Phishing that puts a QR code in an email, for example 'Scan to keep your mailbox'. Filters struggle to read a link inside a picture.

R

ransomware: Malware that locks files until a ransom is paid. It often arrives through macros, RDP logins, VPN accounts or MSP tools.
RDP (Remote Desktop Protocol): Microsoft's remote desktop protocol, listening on TCP port 3389 (named ms-wbt-server in Nmap). It shows another computer's screen and should never face the internet directly.
registry: Windows' settings database, managed with the reg command.
rekeying: Replacing a session key during a long connection, so a leaked key exposes less data.
remote access: Using a computer or network from somewhere else. By design it is a way in from outside, so attackers find the service, then get past the login or exploit a flaw.
remote-access VPN: A VPN that lets one worker's device join the office network from elsewhere.
REvil: The ransomware group that exploited Kaseya VSA in July 2021 to push ransomware through MSPs.
RFB (Remote Framebuffer) protocol: The protocol that VNC uses, described in RFC 6143.
RFC (Request for Comments): A published internet standard or description. RFC 6143 describes the RFB protocol.
RMM (remote monitoring and management): Legitimate software, used by MSPs and support desks, that gives full control of computers from one console through a small agent on each machine. Because it is signed and trusted, attackers abuse it, as in the Kaseya attack and the MSP alert at Kettle & Crane.
rooting: Removing an Android phone's built-in protections. It is the Android version of jailbreaking.
router: A device that connects networks to each other and to the internet. Whoever controls it can watch or redirect all traffic.
RTF (Rich Text Format): An old Microsoft document format: plain text with codes, starting with {\rtf1. It cannot hold macros but can hold embedded objects that exploit flaws when the file is simply opened or previewed.
Run box: The Windows box, opened with the Windows key plus R, that runs any command typed into it. ClickFix pages tell victims to open it.

S

SaaS (software as a service): Applications a provider runs in the cloud and you use through a browser or app, such as Kettle & Crane's shop platform. They become a vector through a provider breach, weak customer accounts or stolen app tokens.
SameSite: A cookie setting that stops the cookie being sent with most requests started by other websites.
sandbox: A closed area where code runs without reaching the rest of the system. Browsers run page scripts in one, and mail filters can open PDFs in one before staff receive them.
SBOM (software bill of materials): A list of every component in a software product, so you know when one of them is reported bad.
schtasks: The Windows Task Scheduler command, which runs programs at set times or on startup. On the order server, attackers used it to create a misleadingly named 'OfficeUpdate' task that restarted their tool.
Secure (cookie attribute): A cookie setting that means the cookie is sent only over HTTPS, so it cannot be read in transit.
sensor: A small networked device that measures and reports things like temperature or motion. It can be an attacker's foothold, or be made to send false readings.
server: A computer that provides a service to many users, such as Kettle & Crane's order server. Servers are reached through exposed services, slow patching or an already compromised workstation.
session hijacking: Using a stolen session token to act as a logged-in user without the password or MFA. That is how Sam's account issued a refund at 3 a.m.
session key: A symmetric key agreed through key exchange that encrypts one TLS connection; an attacker who gets it can read or change the traffic. Do not confuse it with a session token.
session revocation: Ending every active session for an account, forcing every browser to log in again. After token theft it is the key step, because resetting only the password may leave the attacker's session alive.
session token: A long random value, usually inside a cookie, that means 'this browser already logged in'. A stolen token skips the password and MFA, so you must revoke sessions, not just reset the password.
Set-Cookie: The line in a web server's reply that asks the browser to store a cookie, along with settings such as Secure and HttpOnly.
shared responsibility model: In SaaS, the provider secures the platform, and the customer secures its own accounts, settings and data.
sideloading: Installing an app from outside the official app store, which skips the store's checks. Sam did this with a 'free premium' music app.
site-to-site VPN: A VPN that permanently joins two offices' networks.
Snowflake: A cloud data company whose customers' accounts were broken into in 2024 using passwords stolen by infostealers. The affected accounts had no MFA, and Snowflake's own systems were not breached.
SolarWinds Orion: Network management software whose 2020 update was poisoned with a backdoor. Customers who installed the signed update were compromised.
split tunneling: A VPN setup that sends only office traffic through the tunnel and everything else straight to the internet, so the laptop is on both at once.
SSH (Secure Shell): An encrypted remote command-line protocol on TCP port 22, which can also tunnel VNC safely. The hijacked camera tried to guess SSH logins on the order server.
SSLKEYLOGFILE: A debugging setting that makes browsers write session keys to a file. Malware can switch it on.
Stuxnet: Malware believed to have reached Iranian nuclear equipment, which was not connected to the internet, in 2010 by crossing on USB sticks.
supply chain-based vector: An attack that reaches you through an outside organization you depend on, such as a third party, MSP, logistic provider or SaaS provider. One break-in can reach many victims.
SVG (Scalable Vector Graphics): An image format written as text that can hold scripts. An SVG opened in a browser can run code, for example to show a fake sign-in page.
switch: A device that connects the devices inside the office network.
symmetric key: A single key that both sides use to encrypt and decrypt. A TLS session key is one.

T

tablet: A large-screen mobile device that organizations often share and fix in place, as a kiosk, counter or warehouse screen. Its risks are shared logins, being left unlocked and unattended, old single-purpose apps and theft.
tailgating: Following a staff member through a locked door without using your own access.
Target breach: A 2013 breach in which attackers used a heating contractor's stolen network login to reach the US retailer Target's payment systems. MFA for vendor access would likely have stopped it.
TCP (Transmission Control Protocol): The protocol that carries most internet connections. Services listen on TCP ports such as 3389 for RDP, 5900 for VNC and 22 for SSH.
Telnet: A remote command-line protocol on TCP port 23 that sends everything, including passwords, in readable cleartext. Replace it with SSH.
third-party provider: Any outside company that supplies products, services or people and so gets some access to your systems. Its access or its product, such as a poisoned update, can carry an attack.
threat source: Where a threat comes from: a person, group or thing, such as a criminal gang or a careless insider.
threat vector: The path an attacker uses to reach a target, such as an email, a website or a USB stick.
TLS (Transport Layer Security): The protocol that encrypts HTTPS connections, using a key exchange to agree on a session key. Alex limited the shop to TLS 1.2 and 1.3 with forward-secret key exchanges only.
TLS VPN: A family of VPN built on TLS, usually running over TCP port 443.
tracking pixel: A tiny image in an email that loads from the sender's server, telling them you opened it, when you opened it and your internet address. Turning off remote images stops it.
trusted device: A device a system trusts more than an unknown one, such as a 'remembered' browser, a managed laptop or an MFA approver phone. Whoever holds it inherits that trust, so trust must be revoked when the device is lost.

U

UDP (User Datagram Protocol): A network protocol that sends data without first setting up a connection. IPsec uses it on ports 500 and 4500.
USB (Universal Serial Bus): The standard port and cable for connecting things to a computer. Malicious USB devices carry infected files, pose as keyboards or hide inside cables.
USB drop attack: Leaving malware-loaded USB sticks in places like parking lots and lobbies, counting on someone's curiosity to plug one in.

V

vault: The encrypted store inside a password manager, unlocked by the master password.
VBA (Visual Basic for Applications): The programming language of Office macros. It can open files, start programs and download from the internet.
virtual appliance: A firewall, router or other network device delivered as a virtual machine.
virtual machine (VM): A complete computer made of software, running on a real computer through a hypervisor. Kettle & Crane's order server and an old test server ran as VMs on one host.
visitor: Anyone in the building who is not staff or a contractor. A visitor has no granted access but can plug in devices, read screens or tailgate.
VM escape: A flaw that lets code inside one VM break out to the hypervisor, and from there reach every other VM. CVE-2025-22224 in VMware ESXi is an example.
VM sprawl: So many easily created VMs that some are forgotten, never patched and never watched.
VMware ESXi: A hypervisor that ransomware groups target. CVE-2025-22224 in it allowed VM escape.
VNC (Virtual Network Computing): A cross-platform remote screen-sharing system using RFB on TCP port 5900 and up. Classic VNC uses only eight password characters and leaves sessions unencrypted.
Volt Typhoon: A state-sponsored group that used living-off-the-land techniques to stay hidden in US critical infrastructure networks for years.
VPN (virtual private network): An encrypted tunnel across the internet into the office network, recommended for protecting RDP and VNC. It moves the door rather than removing it: whoever gets through the gateway lands inside the whole network.
VPN gateway: The office-side device at the network edge that remote users' VPN tunnels connect to. It is a prized target, as the Ivanti flaws showed.

W

watering hole: An attacker compromises a real website the targets already visit, such as a coffee roasters' association site, and waits. Unlike phishing, no message is sent.
web skimming: Malicious JavaScript planted on a real shop's payment page that copies card numbers as customers type them.
Windows event IDs (4688, 4104): Windows log events used to catch living-off-the-land activity: 4688 'A new process has been created' records each new program (and its full command line when command-line logging is on), and 4104 records each PowerShell script block that runs.
wireless access point: A device that provides Wi-Fi to a network.
WMI (Windows Management Instrumentation): A built-in Windows system for querying and controlling computers, including remote ones. Attackers use it to start programs on other machines.
workstation: A desktop or laptop one person uses for daily work. It is usually the attacker's first foothold, through email, browsing and admin rights.

X

XZ Utils (CVE-2024-3094): A Linux compression library whose versions 5.6.0 and 5.6.1 contained a backdoor. A contributor added it after spending about two years earning trust.

Z

zbarimg: A tool that decodes a QR code from a picture file, the way a phone camera does. It revealed the fake kettleandcrane-pay.example address.
Zero Trust: The idea of never trusting once and forever. A device's health is re-checked each time it connects.