Terminology

This glossary provides definitions and explanations of cybersecurity terms related to vulnerabilities, attacks, and exploitation techniques.

Zero Day

A zero-day vulnerability is a software flaw which is unknown by the vendor and where no fix is available, this allows successfully infecting a target even with a fully patched and updated device.

Zero Click

A zero-click attack is a term used for an exploit that can infect a device without requiring any user interaction. An example would be like receiving an iMessage or missing a phone call on WhatsApp.

One Click

A one-click attack requires only a single action from the intended target. Typically, various social engineering techniques are employed to trick the intended target into opening a malicious link.

Tactical Infections

Non-remote attacks also referred to as a tactical infection allows an attacker to exploit devices in physical proximity. Malicious Wi-Fi networks and mobile base stations can be used to silently deploy a zero click or one click exploit. Attackers can also exploit vulnerabilities in cellular baseband software and Bluetooth. Some leaked documents specifically show exploits targeting Voice over LTE and W-Fi Calling

Strategic ISP Infections

A Strategic ISP infection allows for network injection attacks deployed at an Internet Service Provider or national internet gateway. This differs from standard Mass IP/ Internet traffic monitoring as it is used to silently deliver spyware to a target.

Man-in-the-middle attack

A man-in-the-middle attack is where an attacker can read, modify, block and manipulate network requests. Man-in-the-middle attacks can be used in a variety of ways, most notably for network injection and bypassing encryption.

Command and Control (C2) Server

A command-and-control server has multiple uses, they can be used to send commands to the spyware agent and to distribute malicious payloads, they can also be used to receive stolen data exfiltrated from target devices.

Spear phishing

Spear phishing is a serious threat to everyone and can be very difficult to detect. It normally involves sending an email or message to an intended target from a known or trusted sender. In the case of weaponized malware, the message will be perfectly crafted to persuade the target to execute a one-click exploit.

Cyber Kill Chain

A Cyber Kill Chain is a model that explains how cyber attacks happen in stages, from start to finish. It begins with hackers gathering information about a target (reconnaissance), then creating and delivering a malicious attack (weaponization & delivery), exploiting system weaknesses (exploitation), installing malware or spyware (installation), taking control remotely (command & control), and finally carrying out their goal, like stealing data or causing damage (actions on objectives).

Social engineering

Social engineering is a manipulation technique used by attackers to trick people into revealing confidential information or performing actions that compromise security. Instead of hacking systems, they exploit human trust through methods like phishing emails, fake phone calls, or impersonation. For example, an attacker might pose as an IT support agent to steal passwords. Social engineering works because people tend to trust authority, urgency, or familiarity, making it a major cybersecurity threat.