Threat Actors, Attack Vectors, and Social Engineering on SY0-701

Finance receives an email from "the CFO" approving a wire to a new vendor account. The mailbox looks right; the phone callback goes to a mobile number in the signature, not the corporate directory. Meanwhile, an engineer spins up an unsanctioned file-sharing app because the official tools are slow—and exports customer lists to "test a script." Two incidents, one week: the first is business email compromise from an organized crime playbook; the second is shadow IT creating insider-scale data exposure without malice or technical sophistication. Domain 2 carries 22% of SY0-701 and tests whether you can map actor to motivation to vector to mitigation faster than you can recite CVE numbers. This post owns that chain. Vulnerabilities, malware classifications, and indicators of compromise travel with the next post—they live in Domain 2 too, but they deserve their own treatment.

Fix the vocabulary before the exam fixes it for you

A threat actor is the who—capabilities, resources, and whether access is internal or external. A threat is the potential for harm: actor plus intent plus capability directed at assets. A vulnerability is the weakness that makes exploitation possible—a misconfigured service, an unpatched system, a process with no enforcer. Risk is likelihood and impact in conversation with each other. The exam catches candidates who call the nation-state the vulnerability. The nation-state is the actor. The unpatched VPN is the vulnerability. Risk rises when high-capability actors encounter easy vulnerabilities. Keeping those terms separate is not pedantry—every wrong answer on a Domain 2 scenario question traces back to conflating them.

Who attacks and why

Nation-states sit at the top of the capability stack. They have patience, custom tooling, sustained funding, and the operational discipline to maintain undetected presence for months or years while they achieve an objective. Their motivation is typically espionage—merger documents, defense research, policy-relevant communications—or geopolitical disruption when public attribution serves a strategic message. Detecting nation-state activity demands threat hunting, network segmentation, egress filtering, and an assumption that an attacker may already be inside. Perimeter success does not mean clean. Depth of defense and monitoring of the interior matter more than border strength alone.

Organized crime operates as a business. Ransomware affiliate groups, BEC playbooks, and carding operations are profit-driven and efficient about it. They invest in tooling that pays back at scale and retire techniques that stop converting. A mass phishing campaign with an off-the-shelf credential stealer and no targeting is organized crime working commodity volume. A BEC operation targeting finance leadership at mid-size companies with $50,000 wire requests is the specialized tier of the same motivation. Controls for both emphasize email authentication standards, financial dual-control procedures, phishing-resistant MFA, and endpoint detection—because compromised credentials fund everything that follows.

Hacktivists carry ideological motivation and want their attack to be seen. They strike for visibility—defacement, timed data leaks, distributed denial of service during a controversy. Capability varies widely; some groups use commodity tools available to anyone, while others include members with advanced skills. The distinguishing characteristic is that attribution is loudly claimed rather than carefully hidden. The mitigation mindset shifts toward reputation monitoring, DDoS preparedness, and having a public communications plan ready alongside the technical controls.

The insider threat is the actor with existing access and organizational knowledge of where the crown jewels live. Insiders can be malicious—the disgruntled employee staging a bulk download in the days before resignation—or negligent, the user who misconfigures a storage bucket because no one told them the default setting was public. Either path bypasses perimeter defenses by design. Detection requires least privilege that limits what the insider can reach, DLP watching what moves and where, user and entity behavior analytics building a behavioral baseline so that a 3 a.m. export of the full customer database produces an alert rather than a monthly report, and exit procedures that revoke access on the same day employment ends.

Unskilled attackers, sometimes called script kiddies, run commodity toolkits without deep understanding of the underlying techniques. They are opportunistic and numerous. Patching, disabling default credentials, and blocking known-bad infrastructure defeats most of their attempts before they succeed. Shadow IT users are not attackers by intent, but they create attacker-scale exposure through convenience. An unsanctioned file-sharing application without DLP controls, without MFA enforcement, and without a retention policy creates the same data-exfiltration risk as an external threat actor—the difference is motivation, not outcome. Controls here are discovery (CASB, DNS inspection for unauthorized SaaS) and sanctioned alternatives that actually meet the business need rather than forcing users to work around them.

Attack vectors and the attack surface

A vector describes how delivery happens—not what the attacker does after gaining a foothold. Message-based vectors use email, SMS, and collaboration platform links to reach human decision points at high volume. Voice vectors bypass email filters entirely and reach the phone in someone's pocket. Removable media—USB drives left in parking lots or shared at conferences—skip network monitoring and reach endpoints directly. Wireless vectors, particularly evil-twin access points and rogue hotspots, capture credentials before a VPN can protect them. Network vectors exploit open ports, default credentials, and flat network architectures that let a foothold in one segment reach the segment where sensitive data lives. Supply chain vectors inherit trust: a compromised software update or a malicious package in a dependency hits every downstream consumer with the organization's own update infrastructure doing the delivery. Human and social engineering vectors exploit process gaps and authority expectations rather than technical weaknesses, which means they remain effective long after patches close the CVEs.

Attack surface is the aggregate of everything an attacker can reach: APIs, VPN endpoints, SaaS tenants, physical reception desks, IoT on the network, end-of-life systems still in service. Shrinking the surface—retiring unsupported systems, closing unused ports, governing SaaS proliferation, segmenting IoT onto isolated VLANs—reduces the vectors available before the question of which phishing template arrives becomes relevant.

MITRE ATT&CK organizes adversary behavior into tactics and techniques. Under the Initial Access tactic, Phishing (T1566), Valid Accounts (T1078), and Supply Chain Compromise (T1195) describe the front-door methods. The exam does not require technique numbers, but the framing helps: initial access is how an attacker gets inside; execution, persistence, and lateral movement follow and belong to a different conversation. Domain 2 owns the front door.

Social engineering as a discipline, told in full

Social engineering manipulates people into breaking security policy without a single CVE. The exam expects the full catalog. Here it is told as a practitioner encounters it rather than as a flashcard list.

Phishing is the broadest category: bulk email using urgency, authority, or fear as emotional levers. The attacker casts wide and accepts that most recipients will delete the message. The ROI is in the small percentage who do not. Spear phishing narrows the target list to specific individuals or roles, using personal context—a name, department, a project mentioned on LinkedIn or in a press release—to make the message feel internally generated. When the target is an executive specifically, the same technique with higher financial stakes attached is called whaling, and the BEC scenario below is its most common exam manifestation.

Smishing delivers the same manipulation mechanics through SMS. The shorter format and the informal expectations of text messaging reduce the scrutiny a recipient applies before clicking a link or entering a code. Smishing frequently pairs with MFA-fatigue attacks: the text claims the recipient must approve a suspicious login, time pressure does the rest, and the attacker has already positioned a login attempt to match the moment. Vishing works over live voice calls, where real-time conversation creates pressure that email cannot replicate. An attacker can respond to objections, invoke seniority, claim escalating urgency, and close the call before the target has time to consult policy. Caller ID spoofing makes the originating number appear as IT support, the bank fraud line, or HR—trust is constructed in the first three seconds.

Pretexting is the fabrication of a scenario, a fictional identity, or a fabricated role to establish credibility before the actual request arrives. An attacker who calls IT support claiming to be a traveling VP whose credentials have expired is pretexting. Pretexting underpins most vishing campaigns and the BEC technique at the operational level—the pretext is established in the email thread before the wire request appears. Impersonation is the simpler form: presenting as a delivery driver, a vendor technician, or a regulatory auditor to create authority without an elaborate backstory. The uniform or the clipboard does the work.

Baiting places something desirable in the victim's path and lets curiosity override policy. A USB drive in a parking lot labeled "Q3 Salary Review" requires only human nature to execute. Tailgating and piggybacking are the physical-entry variants: following an authorized person through a badge-controlled door either without their awareness or with their complicit politeness. Culture reduces both, but without physical controls—mantraps and turnstiles—culture alone is a speech.

Quid pro quo offers something of value in exchange for access: "I'll fix your slow computer if you give me your login." The value transfer makes the request feel transactional rather than suspicious. Dumpster diving recovers discarded documents, hardware, or credentials from physical waste—cross-cut shredding and secure disposal policies exist to defeat it. Shoulder surfing harvests credentials through direct observation in open-plan offices, coffee shops, or airports. Privacy screens and a clean-desk policy address the physical layer; awareness that the risk exists in public completes it.

BEC: the attack that needs no zero-days

Business email compromise sits at the intersection of pretexting, impersonation, and financial process exploitation. It rarely needs malware. The attacker researches public-facing information—LinkedIn for the CFO's name, press releases for current vendor relationships, job postings for the accounts payable team structure. A spoofed or compromised mailbox—sometimes the actual vendor's account after a prior breach—sends an invoice change or urgent wire transfer request. The urgency is manufactured: the CEO is traveling, the deal closes today, legal is watching the transaction. Finance skips the callback policy because challenging the CFO's email mid-trip feels worse than processing it.

Weak: accounts payable receives a PDF with new routing numbers and processes it because the email thread looks authentic, the sender domain matches the vendor, and the person is busy. Strong: the payment workflow requires out-of-band voice verification to a phone number pulled from the internal vendor directory—never from the email—plus dual approval from two independent roles before any routing or banking change takes effect. DMARC, DKIM, and SPF alignment monitoring flags the spoofed or lookalike domain before the wire request reaches a human. The detective layer watches for impossible-travel events on the CFO's mail account and finance mailbox rules that silently forward to external addresses—both common attacker persistence moves after initial account compromise.

Deepfake-adjacent pretexting—a voice-cloned CEO call requesting emergency wire approval—is the current evolution. The out-of-band verification principle and dual-control requirement defeat it by the same logic: verify identity through a trusted channel, not the channel the request arrived on.

The exam trap for BEC is antivirus as the primary control. BEC does not require malware. The vulnerability is a process gap; the fix is a process control enforced by dual authorization.

Matching mitigations to the actual vector

When a stem asks for the best control, the diagnostic question is whether the proposed answer interrupts the described attack path. A smishing attack harvesting OTP codes is not defeated by blocking SMS—the fix is phishing-resistant MFA like FIDO2 that cannot be replayed regardless of what the user types into a fraudulent page. A USB drive in the parking lot is not addressed by stronger wireless encryption—endpoint policy restricting USB mass storage and disabling autorun is the relevant layer. Default credentials on a networked camera are not remediated by a SIEM rule as the first action—change the credentials, isolate the device on an IoT VLAN, then use the SIEM for ongoing detection. Credential hygiene is primary; correlation is the follow-on.

Exam traps summary

Closing frame

Social engineering succeeds where policy has no enforcer and authority feels too awkward to challenge. Actors range from nation-states burning months on a single target to opportunists who found a phishing kit on a forum last week. When the stem says patient, targeted, low-and-slow with custom tooling, hear nation-state and adjust detection depth. When it says urgent wire from a traveling executive, hear organized crime BEC and move to dual-control authorization and out-of-band verification. Build those reflexes before the exam wraps the same skeleton in a longer story.

Companion reading: the vulnerabilities, malware, and indicators post for what happens after initial access establishes a foothold, and the IAM, monitoring, and hardening post for the operational controls that detect and contain what social engineering enables.