Adversary Threats & Attack Vectors
Adversary Threats & Attack Vectors
Section titled “Adversary Threats & Attack Vectors”This section catalogs how adversaries actually attack people — phishing campaigns, account takeovers, malware deliveries, network attacks, and the rest. Each page documents one vector or campaign with the same structure:
Attribution → How It Works → Phishing Lures or Payloads → Indicators of Compromise → Prevention (→ DFP) → If Compromised (→ IR Guide) → Detection / Purple Team → Sources
The goal is a working defender’s reference: when something feels off, you should be able to land on a page that names the technique, shows you what it looks like, and tells you what to do next.
Why this exists
Section titled “Why this exists”The community (DFP Guide, IR Guide, Red Team) covers prevention, response, and offensive testing. This section fills the gap in the middle: what are the actual threats? Without that grounding, prevention reads as a generic checklist and response reads as a panic playbook.
Categories
Section titled “Categories”| Category | What’s covered | Examples |
|---|---|---|
| Social Engineering | Manipulation of people, not systems | Phishing, smishing, vishing, impersonation, verification-code theft |
| Account Takeover | Adversary gains control of an existing account | SIM swap, linked-device abuse, OAuth consent phishing, session-token theft |
| Credential Theft | Stealing passwords/tokens directly | Infostealer malware, credential dumps, password-reuse exploitation, AitM proxies |
| Malware | Hostile code on a device | Spyware (Pegasus, Predator), commodity infostealers, mobile RATs |
| Network MitM | Adversary positions between you and a service | Rogue WiFi, IMSI catchers, ARP poisoning, evil twin APs |
| Physical Proximity | Adversary needs to be physically near you | Juice jacking, evil maid, BLE/UWB tracking, shoulder surfing |
| Supply Chain | Compromise of something you trust | Hijacked software updates, malicious npm packages, hardware implants, compromised CMA forks |
Active campaigns
Section titled “Active campaigns”Recent threat activity affecting community-relevant populations:
- Signal/CMA Account Takeover — Russian Intelligence Services (FBI/CISA PSA, March 2026) — RIS actors phishing high-value individuals (USG/military/political/journalists) via linked-device QR abuse and 2FA code theft. Thousands of accounts compromised.
How to use this section
Section titled “How to use this section”- Hit by something now? → Find the matching vector page, then jump to its “If Compromised” section, then to the IR Guide.
- Hardening your setup? → Read the prevention sections of vectors relevant to your threat model, then apply the DFP Guide.
- Training your team? → The phishing-lure samples on each page are real and attributed — use them for awareness training.
- Running a red/purple team exercise? → Each page maps to MITRE ATT&CK where relevant; pair with Cyber Red Teaming.
Contributing a new vector page
Section titled “Contributing a new vector page”Use the same structure as the Signal/RIS page. Required sections: At a Glance, How It Works, Indicators, Prevention, If Compromised, Sources. Optional but encouraged: MITRE ATT&CK mapping, Detection/Purple Team, phishing-lure samples. Cite primary sources (CISA, FBI, vendor advisories, original research) over secondary reporting.