Computer network exploitation definition
Computer network exploitation is the act of infiltrating and compromising computer networks, systems, or devices for espionage or cyberattacks.
Various entities conduct CNE, including nation-states, cybercriminals, or advanced persistent threat (APT) groups. Except for cases where authorized entities perform it for legitimate cybersecurity or law enforcement purposes, it’s considered an illegal activity.
See also: keylogger, zero day, remote access trojan, watering hole attack
Examples of computer network exploitation
- Data breach. An attacker exploits vulnerabilities in a target organization's network or systems to gain unauthorized access and steal sensitive data (e.g., classified documents, financial records, intellectual property, etc.)
- Advanced persistent threat (APT). A nation-state or organized cybercriminal group conducts a long-term and stealthy campaign to infiltrate a specific organization or government entity.
- Keyloggers. An attacker sends a phishing email with an infected attachment. The victim downloads it, which installs a keylogger on their system, allowing the attacker to capture keystrokes and gain access to login credentials.
- Zero-day exploitation. An attacker identifies and exploits previously unknown software vulnerabilities (known as zero-days) to compromise a target system or network.
- Remote access trojans (RATs). The attacker plants malicious software on a victim's system, gaining remote control over the device.
- Man-in-the-middle (MitM) attack. Attackers intercept and eavesdrop on communications between two parties and may even alter the communications to extract sensitive data or money.
- Packet sniffing. Attackers gain access to network infrastructure to capture network traffic.
- Steganography. Attackers hide malicious code or data within seemingly innocuous files or images. When the victim opens these, the hidden payload compromises their system.
- Watering hole attacks. Attackers compromise an online resource that their intended victims frequently visit. Users who enter the compromised site infect their devices with malware.
