Threat Database — CyberShield

🎣

Phishing & Spear Phishing

Critical Social Attack

91%

OF BREACHES

Phishing is a cyber attack that uses disguised email, SMS, or websites as a weapon. The goal is to trick the recipient into revealing sensitive information—passwords, credit card numbers, or social security numbers. Attackers impersonate banks, government agencies, tech companies, or even colleagues.

Spear phishing is a highly targeted version that uses personal information (from social media or data breaches) to make the deception more convincing and harder to detect.

🚩 Urgency or panic language — "Your account will be suspended in 24 hours!"
🚩 Mismatched sender email — From "support@paypa1-secure.com" not paypal.com
🚩 Generic greeting — "Dear Customer" instead of your real name
🚩 Suspicious links — Hover reveals a different URL than displayed
🚩 Unexpected attachments — .exe, .zip, or Office docs requesting to enable macros
🚩 Too good to be true — Prize winnings, inheritances, or jobs you never applied for

✅ Verify before clicking — Go directly to official sites by typing the URL
✅ Enable MFA — Even if your password is phished, MFA blocks access
✅ Use anti-phishing tools — Browser extensions and email filters catch many attempts
✅ Report suspicious emails — Most email clients have a "Report Phishing" button
✅ Train regularly — Organizations should run simulated phishing exercises

🔒

Ransomware

Critical Malware

$4.5M

AVG RANSOM COST

How It Works

1. Delivered via phishing email, malicious download, or unpatched vulnerability
2. Silently encrypts files on your system and network drives
3. Displays a ransom note demanding payment (usually cryptocurrency)
4. Threatens to publish stolen data if payment isn't made
5. May or may not provide a decryption key after payment

Defense Strategy

✅ Regular backups using the 3-2-1 rule (3 copies, 2 media, 1 offsite)
✅ Keep software patched — most ransomware exploits known vulnerabilities
✅ Least privilege access — limit what accounts can access
✅ Network segmentation — prevent lateral movement
✅ Endpoint detection — modern security tools catch ransomware behavior

🎭

Social Engineering

High Human Exploit

📞

Vishing

Voice phishing via phone calls. Attackers impersonate bank fraud departments, government agencies, or tech support to extract information or payments.

💬

Smishing

SMS phishing. Fake texts about package deliveries, bank alerts, or prize winnings containing malicious links designed to steal credentials.

🎁

Baiting

Attackers leave infected USB drives in public places. Curiosity leads victims to plug them in, automatically installing malware on their computers.

// Additional Threats

Threat Quick Reference

DDoS Attacks

High

Distributed Denial of Service floods servers with traffic, making websites and services unavailable. Often used for extortion or as a distraction.

SQL Injection

High

Attackers insert malicious SQL code into web forms, potentially accessing, modifying, or deleting entire databases containing user records.

Insider Threats

Medium

Malicious or negligent employees, contractors, or partners who misuse their access. Accounts for 34% of all data breaches globally.

Cryptojacking

Low-Med

Hijacks your device's CPU/GPU to mine cryptocurrency without your knowledge, drastically slowing performance and increasing electricity costs.

Supply Chain Attacks

Critical

Compromise legitimate software updates or third-party libraries to distribute malware to thousands of organizations at once (e.g., SolarWinds).

Deepfake Attacks

Emerging

AI-generated audio and video convincingly impersonate executives or loved ones to authorize fraudulent wire transfers or extract sensitive data.

Cyber Threat Database

Phishing & Spear Phishing

Ransomware

Social Engineering

Threat Quick Reference

Now You Know the Threats

Cyber Threat Database

Phishing & Spear Phishing

What is Phishing?

Warning Signs

How to Protect Yourself

Ransomware

Social Engineering

Threat Quick Reference

Now You Know the Threats