An opportunistic attack is an operation that is not directed at a specific target and does not require any special investments or resources to carry out.

The category of opportunistic attacks includes all attacks that are not directed at a specific entity and do not require significant investment or resources to carry out. This type of attack is often carried out by threat actors whose primary goal is to extort money from organizations. The most common consequences of this type of attack include: data exfiltration (data leaks), file encryption for ransom (ransomware), and the establishment of a persistent channel to intercept a company’s financial or operational information (APT).

The scenarios that the Service considers are:

• Unfaithful employee who uses his technical capabilities to cause harm to the organization (exfiltrate data, compromise systems) or who in turn allows an external Threat Actor to exploit his device as an attack vector (bridge);
• Compromising a workstation through a phishing campaign or malicious file operated without the employee’s explicit consent;
• Use of illegally obtained corporate access credentials;
• Exploitation of a critical vulnerability, allowing access to the corporate perimeter;
• Supply chain compromise (ex. VPN site-to-site with partner or supplier).

In the context of 24Hack Express, the scope of activities, the objective (to compromise the systems as deeply and extensively as possible), and the vectors (the starting point of the scenarios to be simulated) are defined.