Know the attack.
Defend with context.
A living, defender-first encyclopedia of denial-of-service, malware, identity, application, network, cloud, supply-chain and emerging attacks—organized by the layer and system each technique affects.
Version 1.1 · Reviewed August 15, 2026 · Maintained as threats and standards evolve.
Browse by attack surface
Mirai is classified as botnet infrastructure; the Layer 3, 4 and 7 techniques it delivers are classified separately.
DDoS — Layer 3
Network-layer floods and malformed IP traffic that exhaust paths, routers or packet-processing capacity.
DDoS — Layer 4
Transport-layer attacks against TCP, UDP, state tables and exposed network services.
DDoS — Layer 7
Application and protocol abuse designed to consume web, API, DNS, TLS or game-service resources.
IoT & Mirai Botnets
Compromised cameras, routers, appliances and proxy networks used as distributed attack infrastructure.
Ransomware & Malware
Malicious code used for extortion, persistence, espionage, destruction, theft or unauthorized computing.
Web & API Attacks
Attacks against authorization, input handling, sessions, business logic and server-side application behavior.
Identity & Social Engineering
Account takeover and human-targeted methods that abuse credentials, trust, recovery flows or authentication.
Network & Infrastructure
Traffic interception, routing manipulation, name-service abuse and local-network attacks.
Cloud & Supply Chain
Compromise through cloud control planes, dependencies, build systems, containers and trusted vendors.
Data, Insider & Impact
Theft, manipulation, destruction, extortion and misuse of privileged access.
AI & Emerging Attacks
Attacks against models, agents, training data and AI-connected tools, plus fast-evolving abuse patterns.
Attack library
Search by attack name, alias, protocol or framework reference.
3 results
Filtered catalog
Cloud & Supply Chain
3 topicsCloud Credentials, Storage and IAM Escalation
Cloud compromise is usually an identity event: a key leaves the trust boundary, a policy exposes data, or a modest permission turns out to grant far more than it appears to.
Open defensive briefContainer and Orchestration Attacks
Containers are process isolation, not a security boundary — and the orchestrator that schedules them is a powerful API that can run code anywhere in the cluster.
Open defensive briefSoftware Supply Chain Compromise
Attacking what you trust rather than what you expose — the build system, the dependency graph, or the update channel that delivers signed code to every customer.
Open defensive brief