0.2Threat landscape (malware, phishing, ransomware…)
The essentials in 30 seconds
- 5 families cover the essentials: malware, phishing, ransomware, social engineering, data leak — naming them is the start of recognising them.
- Phishing is the No. 1 gateway: most attacks — including ransomware — start with a fraudulent message.
- Threats combine into a chain: one phishing email steals a password, which installs malware, which triggers ransomware — a single open door is enough.
Threaded mini-case — Karim traces the attack chain
Karim, an office employee in Algiers, receives an email imitating a known supplier with an invoice attached. Before clicking, he remembers the 5 families: this message looks like phishing, the attachment could install malware, and malware can trigger ransomware with double extortion. He reports the message instead of opening it. Rereading the typical chain in the evening, he realises a single click would have been enough to unfold the whole attack.
Standalone case for this section: it returns in the lesson, the diagram, the script and the 48h challenge of section 0.2.
1. Know your adversaries
Before defending yourself, you must know your adversaries. Cyber vocabulary is saturated with English terms — malware, ransomware, phishing, DDoS, zero-day. This section demystifies them. Five families cover the essentials: malware (malicious software), phishing (fraudulent messages), ransomware (encryption + ransom, sometimes with double extortion: threat to publish stolen data), social engineering (psychological manipulation) and data leak (disclosure through attack, sending error or bad sharing). Karim learned to name them: that is where vigilance starts.
2. Phishing, the No. 1 gateway
Phishing is the entry vector of most attacks — including ransomware. An email or SMS imitating a trusted third party steals credentials or data, or makes you install malware. And threats combine: one phishing email steals a password, which installs malware, which triggers ransomware. The “supplier” email Karim received follows exactly this pattern: credible invoice, attachment, gentle urgency.
3. An antivirus is not enough
Antivirus catches some known malware, but neither well-crafted phishing, nor CEO fraud, nor leaks through human error. Defense is a whole: tools + reflexes + procedures. Knowing threats by name lets you recognise them at the first signal — and prioritise according to your position: a salesperson is more exposed to phishing, an accountant to transfer fraud. Karim keeps his threat map: levels 1 to 3 give the defense for each family.
Did you know? Double extortion
Encrypting was yesterday: today, ransomware also blackmails you with your data.
🔎 Concrete example — 🔎 Concrete example — The typical attack chain
Phishing → theft of a password →
malware installation → encryption (ransomware) →
ransom demand + threat to publish (double extortion).Takeaway: Karim's email could have unfolded exactly this chain.
Lesson: a single open door is enough — hence vigilance at every link.
Section vocabulary
- Malware
- Generic term for malicious software: viruses, Trojans, spyware, ransomware.
Simple example: The “invoice” attachment Karim received could have installed spyware on his workstation.
What it is not: a simple bug or slowdown with no malicious intent.
Reflex: treat every unexpected attachment as potential malware.
- Phishing
- Fraudulent message (email, SMS…) imitating a trusted third party to steal credentials or data — the No. 1 vector.
Simple example: Karim receives a fake supplier email: known name, urgent invoice, trapped attachment.
What it is not: clumsy advertising spam with no imitation and no data request.
Reflex: faced with an unexpected message, check the sender before any click.
- Ransomware
- Encrypts your files and demands a ransom. Modern variant: double extortion (threat to publish stolen data).
Simple example: Karim pictures the office folders encrypted then the threat of publication: the scenario to avoid.
What it is not: a virus displaying ads without locking data.
Reflex: remember everything leads to ransomware: hence backups and phishing vigilance.
- Social engineering
- Psychological manipulation (urgency, authority, trust) to obtain an action or information.
Simple example: The fake supplier plays on trust and invoice routine to make the attachment opened.
What it is not: a purely technical attack with no human contact (automatic exploit).
Reflex: spot urgency, authority and trust as signals, not proof.
- Data leak
- Disclosure of internal or personal data — through attack, sending error or bad sharing.
Simple example: Karim double-checks the recipient before sending a table with office data.
What it is not: only a spectacular hack by experts.
Reflex: check recipient and sharing before each sensitive send.
In practice — In practice — Map the threats to YOUR position
- Take the 5 threat families from the section and note, for each, where it could reach you (email, web, USB, phone…).
- Rank them by your real exposure: a salesperson is more exposed to phishing, an accountant to transfer fraud.
- Visit the “threats” page of Cybermalveillance.gouv.fr and spot one threat you did not know.
- Keep this map: levels 1 to 3 give the defense for each family.
Ready-to-say script — explain the attack chain to your team (1 min)
“Threats chain together: one phishing email steals a password, it installs malware, and it ends in ransomware with a ransom demand. I almost opened a fake supplier invoice this week. A single open door is enough — so we check every unexpected message before clicking.”
Say it with the real example of the message received; show the chain written on the board.
Copy-paste template — my threat map
MALWARE — where it reaches me: _______________
PHISHING — where it reaches me: _______________
RANSOMWARE — what I risk: _______________
SOCIAL ENGINEERING — my weak lever: _______________
DATA LEAK — my sending risk: _______________
MY No. 1 THREAT + EXPECTED DEFENSE: _______________VSE / tight budget
With no security budget: the threat map on one page displayed in the office — 5 families, 1 example each, and the rule “unexpected message = verification”.
SME in Algeria
Karim adapts his map to the habits of the office in Algiers: fake supplier invoices by email, fake courier SMS, shared USB sticks — each channel has its defense.
Field sales
Often out of the office: maximum exposure to phishing on mobile and public Wi-Fi networks — the map prioritises messaging and nomadic browsing.
Accounting
Transfer-fraud target: the map puts social engineering and IBAN verification first — defense detailed in levels 2 and 5.
✓ Best practices
- Learn threats by name to recognise them fast.
- Prioritise by position (phishing for salespeople, transfer fraud for accountants).
- Treat defense as a whole (tools + reflexes + procedures).
✗ Common pitfalls
- Believing an antivirus protects against everything (neither phishing, nor CEO fraud, nor human error).
- Ignoring that threats combine into a chain.
- Focusing on the rare “zero-day” while neglecting the basics (updates, backups).
Key takeaways
- Five families cover the essentials: malware, phishing, ransomware, social engineering, data leak.
- Phishing is the entry vector of most attacks — including ransomware.
- Threats combine: one phishing email steals a password, which installs malware, which triggers ransomware.
- Knowing threats by name lets you recognise them at the first signal.
48h Challenge - apply tomorrow
Draw your threat map: for each of the 5 families, note where it could reach you, then visit the “threats” page of Cybermalveillance.gouv.fr and add one you did not know.
- I cite the 5 threat families with one example each.
- I have mapped where each family could reach me.
- I can tell the typical attack chain up to double extortion.
Frequently asked questions
Isn't antivirus enough against all this?
No: antivirus catches some known malware, but neither well-crafted phishing, nor CEO fraud, nor leaks through human error. Picture it: no antivirus stops you from dictating a code received by SMS to a fake adviser, or from sending a sensitive file to the wrong recipient. Defense is a whole: tools (antivirus, updates) + reflexes (verify before clicking) + procedures (double validation of transfers). Each layer stops what the others let through — exactly what levels 1 to 5 of this guide install, layer by layer.
What is a “zero-day” attack?
An attack exploiting a flaw unknown to the vendor (so with no patch available). Rare and costly to develop, it mainly targets high-value targets (states, large companies, journalists, dissidents) — not Karim's workstation. For an employee, defense remains fast updates (which close known flaws, massively exploited) and backups (which limit impact). Do not focus on zero-days: attackers prefer the wide-open door (phishing, reused password) to the unbreakable lock.
What is the entry vector of most attacks?