Security+ SY0-801 Threat Vectors and Attack Sources

A threat vector is the path or channel an attacker uses to reach a target, and a threat source is where the threat originates: the actor or party behind it, or whose access it rides on, such as an APT group, a contractor or a compromised supplier. The vector is the channel (an email, a USB stick, an update server, a radio signal); the source is who or what is using it. Security+ objective 2.3 asks you to describe these paths, grouped by the channel they travel through, plus one named source, the advanced persistent threat. Who the attacker is and why they attack belongs to objective 2.2, the weakness they exploit to 2.4 and the evidence they leave behind to 2.5; 2.3 is about how the attack arrives.

Classifying a scenario by vector matters because each channel has its own controls. A lure that the email gateway catches can still arrive through a chat platform, a QR code or a text message, and a defence aimed at the wrong channel does nothing. When you read a scenario, ask: what did the malicious content or access actually travel through to reach the victim?

Advanced persistent threat (APT)

An advanced persistent threat is a well-resourced source (typically state-sponsored or a skilled criminal group) that gains access quietly and stays, often for months, to steal valuable data over time. Its signature is the combination of long dwell time, stealth (rotating command-and-control domains, low-and-slow exfiltration, use of valid accounts) and a strategic target such as design data or government secrets. Short-lived, opportunistic activity lacks the persistence and targeting that define an APT, and any delivery method, however sophisticated, is a vector rather than a source.

Because an APT changes its infrastructure whenever it is exposed, blocking the IP addresses and domains from a threat report only removes yesterday's servers. What it cannot easily hide is behaviour: valid accounts used at odd hours or from odd places, unusual administrative activity, slow data movement. Proactive threat hunting for that anomalous use of legitimate access is the most likely way to find it, because tools that match known-bad patterns are looking for exactly the things an APT keeps changing.

Message-based vectors deliver a lure (a link, an attachment, a request) directly to a person through a messaging channel. The channels look similar from the victim's side, but they are filtered by completely different controls, which is why attackers move between them.

Two details decide many scenarios. First, SMS vs RCS: SMS carries only plain text and works on any handset, so rich features (branded sender cards, suggested-reply buttons, read receipts) tell you a message arrived over RCS. Controls aimed at downloadable chat apps do not govern RCS, because RCS is part of the phone's native messaging app. RCS lures can look far more convincing than a plain text.

Second, collaboration tools bypass email controls entirely. Content the mail filters would catch is not inspected when it is posted in a chat channel instead, because SPF, DKIM, DMARC and gateway sandboxing only act on email. Many work-chat platforms allow external access (federation), so an outside organization can create an account with a trustworthy-sounding display name and message staff directly, for example to persuade them to install a remote-support tool. The control that removes that path is limiting federation to an allowlist of approved partner domains (or disabling external chat), plus link protection inside the platform. The social engineering techniques themselves (phishing, smishing, vishing) are covered in objective 2.5.

Image-based and attachment-based vectors deliver something the victim opens or looks at, an image, a code or a file, that hides a link or runs code.

Image-based vectors

Image-based vectors hide a malicious link or instruction inside something the victim looks at or scans, so the danger is not visible until it is too late.

• QR codes encode a URL that the victim cannot read before the phone camera opens it. A printed code on a flyer, a public sign or a sticker covering a genuine code can send people to a lookalike site, and QR codes in emails move the link off a filtered desktop onto a personal phone. Scanning happens on a phone, so the vector is image-based, not signal-based (that would need a wireless link such as NFC). Phishing that uses QR codes is often called quishing (see objective 2.5).
• Embedded content is material inside a page, message or file that the viewer renders automatically: remote images that track opens, frames, and active image formats. The key example is SVG (Scalable Vector Graphics). An SVG looks like an image to filters that allow pictures, but it is XML that browsers render, and it can carry embedded script and links. So an SVG file can behave like a small web page, running script or opening a phishing site, and it may pass filters that are tuned to stop executables and Office documents. The danger is a feature of the format itself, so a fully patched viewer will still render it.
• CAPTCHA checks are a familiar, trusted step, which makes fake ones an effective lure. A "verify you are human" page that tells the visitor to press Windows+R, paste and press Enter is not a CAPTCHA at all: the page has placed a command on the clipboard and is getting the user to run it themselves (the technique is widely known as ClickFix). The command usually calls a built-in Windows binary such as mshta.exe or PowerShell to fetch a remote script, which is living-off-the-land execution. A real CAPTCHA never asks you to run anything.

Controls include user awareness (never run commands a web page gives you, check the URL a QR code opens), blocking or sanitising SVG and other active formats at the gateway, restricting the Run dialog and script hosts through policy, and EDR rules for script engines launched from the Run box.

Attachment-based vectors

Attachment-based vectors are files that run attacker code when opened. Each file type has its own mechanism, and a control for one type does not cover the others.

The macro lure is easy to spot: a document that shows a blurred image or a notice claiming it was "created in a newer version" and must be enabled before you can read it is trying to get a macro run. Current versions of Microsoft Office on Windows block macros by default in files that carry the Mark of the Web (downloaded or received from the internet) and shows a security-risk bar instead of an Enable button, but files without that mark can still offer it, and the lure text inside the document is the attacker's.

The RTF distinction is a classic two-fact scenario. Because RTF has no macro support, an organization that blocks all macros is not protected from RTF documents: a malicious embedded object that exploits a vulnerable component (a well-known example was the old Office Equation Editor) runs code when the file is opened.

For PDFs, match the control to the file's own mechanism and to the business constraint. When a file type has to stay in use, remove the dangerous capability rather than the file: disabling JavaScript in the PDF reader removes the scripted path, and reader trust settings restrict launching embedded non-PDF files. A control only helps if it acts on what the reader actually executes.

Browser-based vectors use the browser itself as the way in: code that runs inside it, and the credentials it holds.

Extensions

Extensions often request broad permissions such as reading and changing data on every site, and they update silently and automatically. Because an extension's code can change after it was approved (a hijacked developer account or a change of ownership), a once-safe extension can turn malicious for every user at the same time. The organizational control is central extension management: an allowlist of approved extensions enforced by browser policy, with re-review when an extension changes ownership or requests new permissions.

JavaScript

JavaScript runs in every visitor's browser, so changing a script changes what every visitor runs. When attackers alter a third-party script that a site includes, such as an analytics tag or a chat widget, so that it sends form input to their own server, the connection is still valid HTTPS from a trusted source, so controls that validate the connection or filter requests to your own servers see nothing wrong. Subresource Integrity (SRI) pins a hash of the expected script in the script tag; a modified copy fails the check and the browser refuses to run it. A Content Security Policy that limits which sources may supply scripts adds a second layer.

Password managers

Password managers are both a defence and a target. As a defence, autofill is bound to the site's origin (its domain), not to how the page looks: if the manager does not recognise a page as the site it saved, the page is not on that site, however convincing it looks. As a target, attackers can steal the vault itself. Reputable managers encrypt vaults on the user's device with a key derived from the master password, so the provider never holds the key. If encrypted vault data is stolen from the provider, the attacker attacks each master password offline, away from every protection the provider's login page applies. The strength of the master password (and how many key-derivation iterations the vault uses) decides how exposed a user is, and users with weak master passwords should change the credentials stored in the vault. Autofill into forms injected into a legitimate page is another risk, which is why many managers require a click before filling.

Cookies and session tokens

After a user signs in, the application issues a session token, usually stored in a cookie, that proves the session has already passed the password and MFA checks. An attacker who steals it (infostealer malware copying browser data is the common route) can replay the already-authenticated session from another machine and is never asked for a password or MFA, because those are checked only at sign-in. Two consequences follow:

• If the account is active from a new location but the logs show no matching sign-in or MFA challenge, a replayed token is more likely than a stolen password, which would still have to pass MFA.
• Changing a credential protects future sign-ins only; sessions that were already issued stay valid until they expire or are revoked. To cut off the attacker you must revoke the user's active sessions and refresh tokens, forcing a new sign-in the attacker cannot pass, and then clean the infected device.

Cookie attributes such as HttpOnly stop page scripts from reading a cookie, which helps against cross-site scripting, but they do not stop malware on the device from copying the browser's cookie store.

Network-based vectors target the equipment and keys that carry traffic, and remote access vectors are services built specifically to let people in from outside. Both are attractive because they sit where endpoint security usually cannot see.

Network-based: infrastructure devices, virtualized devices and session keys

• Infrastructure devices such as routers, firewalls, switches and VPN appliances run their own firmware and cannot host an EDR agent. Endpoint tools never see inside them, so a compromised edge device can persist unnoticed in a network whose computers are otherwise well instrumented. Visibility has to come from the devices themselves: collect their own logs centrally, compare running firmware and configuration with a known-good baseline, and keep their software current.
• Virtualized devices are protected by the hypervisor beneath them, and the hypervisor can read every guest's memory and disks directly. An attacker who reaches the virtualization management console (the control plane), for example because its web interface was left reachable from the user network with a weak password, can snapshot, clone or export virtual machines. Security software running inside a guest works from above the hypervisor, so it cannot see or block access from beneath it. That is different from VM escape, where code inside a guest breaks out to the hypervisor; the giveaway is whether the attacker came in through a guest or through the management interface. Protect management consoles with strong MFA, a separate management network and tight role-based access.
• Session keys encrypt the actual traffic. With static RSA key exchange, the client encrypts the session secret with the server's long-term public key, so anyone who recorded the traffic and later steals the matching private key can decrypt every past session. Ephemeral (Diffie-Hellman) key exchange generates a fresh secret per session that is never stored, which gives forward secrecy: a stolen private key does not unlock recorded sessions. TLS 1.3 removed static RSA key exchange, so its full handshakes always use ephemeral (EC)DHE. Controls that strengthen keys or certificates going forward do not protect traffic that was already recorded under the old key.

Remote access: remote desktop, VNC and VPN

The fix for RDP and VNC is to keep them off the internet: reach them only through a VPN or remote access gateway, with MFA and account lockout. But the VPN gateway is itself an exposed edge appliance. A pre-authentication vulnerability is reachable before the login page and before MFA, so strong authentication does not help: the attacker never needs a valid account at all. Patching edge appliances quickly (and watching their logs) is therefore as important as strong authentication.

Endpoint-based vectors are the computing devices people and services use (mobile devices, workstations, servers and tablets), the trust those devices are given, and the tools already installed on them.

• Mobile devices and tablets carry company data out of the building and are easily lost. A lost phone or tablet with no passcode exposes everything synced to it to whoever picks it up. The direct control is mobile device management (MDM): enforce a screen lock and encryption, and remotely wipe the device when it goes missing.
• Workstations and servers are the usual landing point for phishing payloads and the usual target for lateral movement.
• Trusted devices are endpoints other systems trust because of what they are, such as a jump host, a management server or an allowlisted device that is exempt from checks other machines must pass. Once an attacker controls a trusted device, that trust works for them: everything that trusts the device now trusts the attacker. Protect them as the high-value assets they are (hardened builds, no email or web browsing, strong authentication).

Built-in tools and living-off-the-land tools

Living off the land means attacking with programs that already ship with the operating system instead of bringing new malware. On Windows the usual examples are PowerShell, WMI, certutil.exe, mshta.exe and net.exe. Because they are legitimate and signed by Microsoft:

• allowlisting rules that trust vendor-signed programs permit them, so the same tool an administrator uses for routine work can fetch, unpack or launch an attacker's code (for example WMI starting a process on a remote host, or rundll32 loading a DLL from a scheduled task);
• nothing new may be written to disk, which defeats file-based antivirus;
• the operating system and administrators depend on them, so they cannot simply be removed.

Detection therefore has to look at behaviour: unusual command lines, odd parent-child process chains (a browser or the Run dialog launching a script host), PowerShell script block logging and EDR behavioural rules. Restricting which users can run administrative tools and putting PowerShell into constrained modes reduce the opportunity.

A supply chain vector uses the access, products or services of an organization you trust to reach you, so the attack arrives through a channel you deliberately left open. Objective 2.3 lists four kinds of provider:

The MSP case is the textbook one: compromising one outsourced IT firm turns its legitimate administrative access into a delivery channel, so the attacker's tooling reaches client systems through the same agent the provider uses for routine maintenance. For physical goods, the clue is where the tampering appears: alterations found only on goods that passed through one shipping route or intermediary, or seals and packaging that do not match the manufacturer's, point to interference in transit. Buyers counter this by buying through authorized channels and verifying seals and firmware hashes on arrival. (A malicious update delivered through a vendor's own software update is listed as an application vulnerability in objective 2.4.)

External media: malicious USB

Malicious USB attacks take two forms. The first relies on curiosity: drives labelled with something tempting, such as hints of confidential or personal content, are dropped in a car park or reception area so that someone plugs one into a work computer. The second relies on how USB works: a stick or "charging cable" can identify itself as a keyboard (a human interface device, HID) and type commands at machine speed the moment it is connected. Disabling autorun and blocking USB mass storage stops the first kind of payload but not the second, because a keyboard is not storage and is accepted automatically. Defences combine awareness (never plug in found media), device control that allowlists USB devices by type and ID, and EDR rules for rapid scripted keystrokes.

Human-based vectors use people (and their bodies) as the way in. The official items are impersonation, contractors, visitors, biometrics and watering holes.

• Impersonation: posing as someone the target trusts, such as a help desk technician, an executive or a supplier, in person, on the phone or over chat. Techniques that rely on it, such as vishing, spear phishing, whaling and deepfakes, are analysed as indicators of malicious activity in objective 2.5.
• Contractor: a person with an ongoing working relationship and granted access who is not an employee. The exposure is that access, which is often broader or longer-lived than the work needs; scope it tightly and remove it when the contract ends.
• Visitor: a non-employee who is on site temporarily, such as a delivery driver or guest. The exposure is unsupervised movement. Visitor controls are sign-in, a visibly different temporary badge, escorting at all times and sign-out with badge return. A visitor who walks the office unescorted is the weakness, even if they signed in.
• Biometric: fingerprints, faces and voices can be copied. A latent fingerprint can be cast into an artificial copy, a photo can be held up to a face camera and a recorded or synthesised voice can fool voice recognition; a sensor that does not check for a living person accepts the copy. Liveness detection and a second factor reduce this risk.

Watering hole

A watering hole attack compromises a website that a specific group already visits (an industry association, a supplier portal, a local news site) and plants an exploit or malicious download there, then waits for the targets to arrive. The defining feature is that the attacker never contacts the victims directly. It differs from typosquatting (a lookalike domain the victim mistypes), malvertising (malicious ads served through ad networks) and impersonation (posing as a trusted person). Patching browsers and plug-ins, browser isolation and web filtering are the main defences, because the site itself is legitimate.

These vectors involve devices and places that sit outside normal IT management: connected gadgets, industrial control equipment and the building itself.

IoT: cameras, sensors and printers

Internet of Things devices often ship with default credentials, are rarely patched and are placed on the same flat network as everything else. Cameras and environmental sensors run small embedded systems that are seldom updated, and printers and multifunction devices keep copies of the jobs they process and run embedded web servers for administration. A storage appliance or meeting-room smart TV with a factory login on the corporate network is the same problem: a computer that no endpoint agent watches. The fixes work from outside the device: replace default credentials, apply firmware updates where the vendor provides them, and segment these devices so one that is compromised cannot reach the rest of the network.

OT: operational technology

Operational technology controls physical processes: PLCs (programmable logic controllers), HMIs (human-machine interfaces) and SCADA/ICS systems in plants, utilities and factories. Its constraints differ from IT:

• Availability comes first: stopping the process may be unsafe or very costly, so changes wait for planned maintenance windows that can be months apart.
• Legacy design: industrial protocols (Modbus, for example) were built without authentication or encryption, and controllers are embedded devices with little room for added security software. Even IT-style servers inside the control network, such as a SCADA historian, often run old, vendor-certified builds that cannot be changed freely.
• Controllers are fragile: active vulnerability scans built for IT networks can crash or disrupt them, which is the outage OT security exists to prevent. OT teams prefer passive network monitoring and carefully scheduled, vendor-approved testing.

When a controller cannot be patched or secured from the inside, the compensating control is to limit who can reach it: segment the control network from the corporate network and tightly restrict and monitor the few connections that must cross the boundary.

Physical: lock and key, access vestibules and access passes

The fix for a cloneable badge is a better credential, not a better door: encrypted smart cards that use cryptographic challenge-response, ideally combined with a PIN so a copied or stolen card alone is not enough.

Signal-based vectors attack wireless links, and the deciding fact is usually range and how the protocol authenticates.

• Bluetooth works over metres (roughly the distance across a room or café). A device left discoverable can be targeted by anyone within that range: bluesnarfing steals data such as contacts and calendar entries, and bluejacking sends unsolicited messages. Turn discoverability off, refuse unknown pairing requests and patch the Bluetooth stack.
• RF (radio frequency) covers key fobs, garage and gate openers, wireless sensors and alarms. Attackers can replay a recorded fixed-code signal later, or jam the frequency to block a signal (for example to stop a wireless alarm sensor reporting). Rolling codes defeat simple replay.
• NFC (near-field communication) works only within a few centimetres and is used for tap-to-pay, phone wallets and modern badges. Its short range makes casual skimming hard, but not relaying.

The relay is the near-twin to watch for. A relay works in real time: the genuine credential is still answering, just at a distance, because the attacker's equipment carries the live challenge and answer across the gap as they happen. Challenge-response stops replay and cloning, because a recorded or copied answer is useless next time, but a relay never reuses anything, so it still works.