Know the attack.
Defend with context.
A living, defender-first encyclopedia of denial-of-service, malware, identity, application, network, cloud, supply-chain and emerging attacks—organized by the layer and system each technique affects.
Version 1.1 · Reviewed August 15, 2026 · Maintained as threats and standards evolve.
Browse by attack surface
Mirai is classified as botnet infrastructure; the Layer 3, 4 and 7 techniques it delivers are classified separately.
DDoS — Layer 3
Network-layer floods and malformed IP traffic that exhaust paths, routers or packet-processing capacity.
DDoS — Layer 4
Transport-layer attacks against TCP, UDP, state tables and exposed network services.
DDoS — Layer 7
Application and protocol abuse designed to consume web, API, DNS, TLS or game-service resources.
IoT & Mirai Botnets
Compromised cameras, routers, appliances and proxy networks used as distributed attack infrastructure.
Ransomware & Malware
Malicious code used for extortion, persistence, espionage, destruction, theft or unauthorized computing.
Web & API Attacks
Attacks against authorization, input handling, sessions, business logic and server-side application behavior.
Identity & Social Engineering
Account takeover and human-targeted methods that abuse credentials, trust, recovery flows or authentication.
Network & Infrastructure
Traffic interception, routing manipulation, name-service abuse and local-network attacks.
Cloud & Supply Chain
Compromise through cloud control planes, dependencies, build systems, containers and trusted vendors.
Data, Insider & Impact
Theft, manipulation, destruction, extortion and misuse of privileged access.
AI & Emerging Attacks
Attacks against models, agents, training data and AI-connected tools, plus fast-evolving abuse patterns.
Attack library
Search by attack name, alias, protocol or framework reference.
4 results
Filtered catalog
Ransomware & Malware
4 topicsBackdoors, Rootkits and Living-Off-the-Land
Techniques for staying on a system and remaining unseen — from ordinary persistence entries, through firmware-level implants, to attacks that install nothing at all.
Open defensive briefCryptojacking and Self-Propagating Malware
Two consequences of the same access: quietly spending your compute for the operator's benefit, or spreading automatically to everything reachable.
Open defensive briefInfostealers and Spyware
Malware that takes credentials, session tokens and keystrokes rather than files — turning one infected machine into access everywhere that machine was signed in.
Open defensive briefRansomware, Extortion and Destructive Malware
Encryption, data theft and outright destruction are three endings to the same intrusion — the damage is decided long before the payload runs.
Open defensive brief