ArticlesJuly 18, 2021, updated October 15, 202614 min read

Types of Cyber Attacks: 12 Threats and How to Prevent Them

By UTMStack Team

Most cyber attacks are not new. They are a short list of familiar tricks, run faster and at a larger scale every year. If you know the common types, what each one looks like in your inbox and your logs, and which controls stop it, a handful of measures covers most of the risk.

This guide explains what a cyber attack is, the 12 types organizations run into most in 2026, and how to prevent and detect each one. The numbers come from the latest Verizon Data Breach Investigations Report (DBIR) and the FBI’s Internet Crime Complaint Center (IC3) report. The defenses follow guidance from CISA, the U.S. Cybersecurity and Infrastructure Security Agency.

The short answer: a cyber attack is any attempt to get into systems or data without permission, or to disrupt, damage or take control of them. The most common types are phishing, business email compromise, ransomware, malware, exploitation of software vulnerabilities, password attacks, man-in-the-middle attacks, denial of service, web application attacks such as SQL injection, supply chain attacks, insider threats and AI-assisted scams. In Verizon’s 2026 report, exploited vulnerabilities started 31% of breaches and ransomware was present in 48%. Fast patching, phishing-resistant multi-factor authentication (MFA), offline backups and continuous log monitoring prevent or catch most of them.

What is a cyber attack?

NIST, the U.S. National Institute of Standards and Technology, defines a cyber attack as an attack through cyberspace that aims to disrupt, disable, destroy or maliciously control a computing environment, or to destroy the integrity of data or steal controlled information.

In plain terms, every attack wants one of three things:

To steal: data, money, passwords or access that can be sold.
To lock or break: encrypt files for ransom, wipe systems or knock a service offline.
To use your systems: send spam, mine cryptocurrency or attack someone else from your network.

Older guides split attacks into cybercrime, cyber warfare and cyberterrorism. That split describes who attacks: criminals after money, who cause most incidents, state-sponsored groups, hacktivists and insiders. They all use the same techniques, so defenses are organized by attack type, not by attacker.

What the 2026 numbers say

The 2026 Verizon DBIR analyzed more than 31,000 security incidents and 22,000 confirmed breaches in 145 countries. Its headline finding: exploiting software vulnerabilities has overtaken stolen credentials as the most common way in.

How breaches started, and what they involved

Share of confirmed breaches in the 2026 Verizon Data Breach Investigations Report

How the attacker got inWhat the breach involved

Exploited a software vulnerability31%

Phishing16%

Stolen or guessed credentials13%

A human action or mistake62%

Ransomware48%

A third party, such as a supplier48%

A breach can involve several of these at once, so the involvement figures do not add up to 100%. Source: Verizon 2026 DBIR executive summary.

Other findings worth knowing:

Only 26% of the vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalog were fully fixed by organizations in 2025, and the median time to a full fix grew to 43 days.
69% of ransomware victims did not pay. The median payment fell to $139,875.
In phishing simulations, people clicked text-message and voice lures at a 40% higher median rate than email.

The FBI’s 2025 IC3 report, published in April 2026, received 1,008,597 complaints and $20.877 billion in reported losses, 26% more than in 2024. Phishing and spoofing was the most reported crime type, with 191,561 complaints. Business email compromise caused $3.05 billion in losses, second only to investment fraud.

Where the 12 attack types fit in an attack

Most incidents chain several types together. Codes are related MITRE ATT&CK techniques.

Works mainly by fooling peopleWorks mainly against systems

Get inWin a first foothold
Exploited vulnerabilityT1190PhishingT1566Password attacksT1110Supply chainT1195Man-in-the-middleT1557Deepfakes and pretexting
Take controlRun code, gain rights, reach data
MalwareT1204Web application attacksT1190Insider misuseT1078
Cash out or disruptThe goal of the attack
RansomwareT1486Business email compromiseT1657Denial of serviceT1498

Stopping an attacker at the first stage is cheapest. By the last stage, the damage is already being done.

The 12 most common types of cyber attacks

1. Phishing

Messages that pretend to come from someone you trust, to make you click a link, open a file, type a password or approve a sign-in. Variants include spear phishing (aimed at one person), smishing (text messages), vishing (voice calls) and QR code phishing.

How it shows up: an urgent email from “IT”, a bank or a delivery company, or a sign-in page that looks exactly like Microsoft 365. Verizon found phishing started 16% of breaches.
Prevent it: phishing-resistant MFA such as passkeys or FIDO2 security keys, so a stolen password is not enough; SPF, DKIM and DMARC on your email domains; link and attachment filtering; short, regular training and a one-click “report phishing” button.
Detect it: sign-ins from a new country or device soon after a suspicious email arrives, new inbox rules, and several users clicking the same link.

2. Business email compromise and pretexting

A criminal takes over, or imitates, the mailbox of an executive, supplier or employee and asks for a payment, a change of bank details or a payroll redirect. Pretexting is the invented story behind the request, often told by phone.

How it shows up: “please wire this before end of day”, “we changed banks”, or a reply inside a real email thread from a look-alike domain. The FBI received 24,768 complaints in 2025, with $3.05 billion lost.
Prevent it: confirm every payment change by calling a number you already have, require two people to approve transfers, turn on MFA for every mailbox and block automatic forwarding to outside addresses.
Detect it: new forwarding or hiding rules in a mailbox, sign-ins from unusual places, and mailbox access by unknown apps.

3. Ransomware and data extortion

Malware that encrypts files and servers so the attacker can demand payment. Most groups now steal data first and threaten to publish it, and some skip encryption and only extort.

How it shows up: usually the last step of an intrusion that began days or weeks earlier, through a stolen password or an unpatched VPN. Backups get deleted, security tools are switched off, then files are renamed and ransom notes appear. Akira and Qilin were the variants most reported to the FBI in 2025.
Prevent it: CISA’s #StopRansomware Guide recommends offline, encrypted and tested backups, phishing-resistant MFA, patching internet-facing systems first, keeping Remote Desktop Protocol (RDP) off the internet, and network segmentation.
Detect it: deletion of Windows shadow copies, disabled backups or antivirus, new administrator accounts, large outbound transfers, and many file changes within minutes. Our guide to ransomware detection goes deeper.

4. Malware

Any malicious software. A virus attaches to files; a worm spreads across networks by itself; a trojan hides inside software that looks legitimate; spyware and keyloggers record what you do; information stealers grab saved browser passwords and session cookies; rootkits hide deep in the operating system. Verizon reports that malware built with help from generative AI is now common.

How it shows up: fake software downloads, cracked programs, malicious ads, “update your browser” pages and email attachments.
Prevent it: endpoint detection and response (EDR) on every device, allow only approved software, remove local administrator rights and block macros in files from the internet.
Detect it: EDR alerts, new scheduled tasks or services, security tools being disabled and connections to newly registered domains.

5. Exploitation of software vulnerabilities

Attackers use a known flaw in internet-facing software, such as a VPN, firewall, file transfer tool or email server, to get in without anyone clicking anything. A zero-day is a flaw that has no fix yet.

How it shows up: this is now the top entry point, at 31% of breaches, and users see nothing at all.
Prevent it: keep an inventory of everything exposed to the internet, patch entries in the CISA KEV catalog first, keep management interfaces off the internet, scan for vulnerabilities and replace devices that no longer receive updates.
Detect it: web servers or appliances starting unexpected processes, new administrator logins on edge devices, web shells and intrusion detection alerts.

6. Password attacks

Brute force guesses many passwords for one account. Password spraying tries a few common passwords across many accounts to avoid lockouts. Credential stuffing reuses usernames and passwords leaked from other sites. MFA fatigue floods a user with sign-in prompts until they approve one.

How it shows up: credential abuse started 13% of breaches in the 2026 DBIR, down from the top spot a year earlier.
Prevent it: MFA everywhere, phishing-resistant for administrators; number matching on push prompts; a password manager and a unique password per account; blocking passwords found in known breaches, as NIST SP 800-63B-4 requires; and switching off legacy sign-in methods that skip MFA.
Detect it: many failures followed by a success, failures across many accounts from one address, and repeated MFA prompts for one user.

7. Man-in-the-middle, session hijacking and DNS spoofing

The attacker sits between a user and a service to read or change the traffic. Methods include rogue Wi-Fi, forged Domain Name System (DNS) answers that send users to a fake site, and phishing kits that relay the real sign-in page and steal the session cookie after MFA succeeds. Eavesdropping is the passive version.

Prevent it: encrypted connections (TLS) everywhere; phishing-resistant MFA, which is tied to the real website and fails on a relay page; DNS security extensions (DNSSEC) and trusted DNS resolvers; and a VPN on networks you do not control.
Detect it: one session used from two places at once, a sign-in from a hosting provider right after the user’s own sign-in, changes to DNS records and certificate warnings.

8. Denial of service (DoS and DDoS)

Flooding a website, network or application until real users cannot reach it. A distributed denial of service (DDoS) attack uses thousands of hijacked devices. A 2024 guide from CISA, the FBI and the Multi-State Information Sharing and Analysis Center groups attacks into volumetric (filling bandwidth), protocol (abusing network protocols) and application-layer (exhausting an application).

Prevent it: DDoS protection from your internet provider or content delivery network, rate limiting, a web application firewall, spare capacity and a plan with your providers’ emergency contacts.
Detect it: sudden traffic spikes from many sources, floods of half-open connections and response times climbing. More in how to stop DDoS attacks.

9. Web application attacks: SQL injection and cross-site scripting

SQL injection hides database commands in a form field or web address so the application runs them, exposing or changing data. Cross-site scripting (XSS) plants a script in a page that then runs in other visitors’ browsers, often to steal their sessions. The OWASP Top 10:2025 lists injection as A05 and counts more than 14,000 known vulnerabilities (CVEs) for SQL injection and more than 30,000 for XSS.

Prevent it: parameterized queries, output encoding, a content security policy, safe framework defaults, code review and testing, and a web application firewall in front.
Detect it: firewall alerts, spikes in database errors and odd strings such as ' OR 1=1 or <script> in web logs.

10. Supply chain and third-party attacks

Attackers reach you through someone you trust: a poisoned software update, a malicious open source package, a service provider’s remote access tool or a software-as-a-service (SaaS) vendor’s stolen tokens.

How it shows up: Verizon found a third party involved in 48% of breaches, up 60% in a year, and only 23% of third parties fully fixed missing or weak MFA on their cloud accounts.
Prevent it: list every vendor and what it can reach, give vendors the least access for the shortest time, require MFA from them and write breach notice terms into contracts.
Detect it: vendor accounts active at odd hours, apps granted broad permissions, new access tokens and unexpected outbound connections from update services.

11. Insider threats

People with legitimate access who misuse it, on purpose (copying customer lists before leaving) or by mistake (misdirected email, storage left open). A newer version is “shadow AI”: Verizon found 45% of employees now use AI tools regularly on work devices, and source code was the data type most often sent to outside AI services.

Prevent it: least privilege, a strict offboarding checklist, data loss prevention, and approved AI tools with a clear policy.
Detect it: mass downloads, access outside someone’s role, uploads to personal cloud or AI services and unusual activity after a resignation.

12. Deepfakes and AI-assisted scams

Cloned voices and video of executives, flawless AI-written phishing and fake job candidates. The 2025 IC3 report counted 22,364 complaints with an AI element and $893 million in losses, and the FBI says the real figures are likely higher.

Prevent it: never approve a payment, password reset or new MFA device on the strength of a call or video alone; call back on a known number; use code words for high-value approvals.
Detect it: watch for help-desk resets followed by a new MFA device and a sign-in from a new location.

Quick reference: first defense and first warning sign

Attack	First thing to put in place	Warning sign to monitor
Phishing	Phishing-resistant MFA	Sign-in from a new place after a reported email
Business email compromise	Call-back check on payment changes	New mailbox forwarding rule
Ransomware	Offline, tested backups	Shadow copies deleted
Malware	Endpoint detection and response	Security tool disabled
Exploited vulnerability	Patch KEV entries first	Appliance starts a new process
Password attacks	MFA and breached-password blocking	Many failures, then a success
Man-in-the-middle	TLS and phishing-resistant MFA	One session in two places
Denial of service	Provider DDoS protection	Traffic spike from many sources
SQL injection and XSS	Parameterized queries	Injection strings in web logs
Supply chain	Least-privilege vendor access	Vendor account at odd hours
Insider threats	Least privilege, offboarding	Mass downloads
Deepfakes	Out-of-band verification	Reset followed by a new MFA device

Most of these warning signs live in different places: the identity provider, the mailbox, the endpoint, the firewall and the web server. Nobody watches all of those by hand. That is the job of a security information and event management (SIEM) system.

How UTMStack helps

UTMStack is an open source SIEM. It does not replace email filtering, endpoint protection or backups; it watches all of them together and tells you when something is wrong. It collects logs from Windows and Linux agents, firewalls, Microsoft 365, AWS, Azure, Google Cloud and the main EDR tools, and checks every event against more than 600 detection rules mapped to MITRE ATT&CK as it arrives, before storage.

Those rules cover many of the attacks above: brute force and password spraying, MFA push fatigue, suspicious inbox and forwarding rules, shadow copy deletion and ransom notes, SQL injection reported by web application firewalls, DDoS patterns in network flow data and DNS tunneling. Automated response can block an attacking address, disable a compromised account or isolate a host through the agent, and agent-based vulnerability scans on Windows and Linux help you decide what to patch first. See how detection works on the threat detection page.

The Community edition is free. Install it on your own server, or explore the live demo with no sign-up.

Frequently asked questions

What are the most common types of cyber attacks? Phishing, business email compromise, ransomware, malware, exploitation of software vulnerabilities and password attacks. In the 2026 Verizon DBIR, exploited vulnerabilities started 31% of breaches, phishing 16% and stolen credentials 13%.

What is the difference between a cyber threat and a cyber attack? A threat is something that could cause harm, such as a ransomware group or an unpatched server. An attack is a threat being carried out.

Which type of cyber attack costs the most? In FBI complaint data for 2025, business email compromise caused $3.05 billion in reported losses, second only to investment fraud, which mostly targets individuals. Ransomware’s reported losses look small because victims rarely report downtime and recovery costs, which the FBI says makes the figure artificially low.

How can small businesses prevent cyber attacks? Start with five things: MFA on email and remote access, automatic updates, offline backups you have test-restored, a call-back rule for payment changes, and someone, in-house or outsourced, who reviews security alerts.

Can you detect an attack that has already started? Yes. Ransomware and data theft are usually the last step of an intrusion that took days. Alerts on warning signs, such as new administrator accounts or deleted backups, give you time to act. The MITRE ATT&CK framework is a good map of what to watch.

How do I report a cyber attack in the United States? Report fraud and cybercrime to the FBI at ic3.gov, and incidents affecting critical infrastructure to CISA. Contact your cyber insurer early, because many policies require prompt notice.