Getting inside a secure network is the first major hurdle for any attacker. The cybersecurity community tracks these methods using the MITRE ATT&CK framework, where this initial step is known as Initial Access (TA0001). While many are familiar with basic phishing emails, modern attackers employ far more subtle and effective techniques to breach the perimeter. These methods often exploit trust, unpatched systems, and even physical devices to gain their first crucial entry point.

One of the most insidious entry methods is the drive-by compromise. Instead of sending a suspicious link to a target, an attacker infects a legitimate website they know the target frequently visits. This is called a 'watering hole' attack. The victim goes to a site they trust—a news outlet, a professional forum, or a software repository—and unknowingly downloads a malicious payload. The site itself delivers the malware. From the user's perspective, they did nothing wrong. They simply browsed the web as usual.

This technique is effective because it bypasses the user's natural suspicion of unsolicited emails or strange websites. Attackers invest significant effort in compromising high-traffic sites relevant to their target industry, whether it's finance, energy, or technology. Once the site is compromised, the attacker can be selective, delivering malware only to visitors from a specific organisation or geographic region to avoid detection.

Many organisations must expose services to the internet to function. Web servers, VPN gateways, and remote desktop portals are all examples of public-facing applications. While necessary, each one is a potential door for an attacker. The technique 'Exploit Public-Facing Application' (T1190) involves scanning these services for known vulnerabilities and exploiting them to gain access. This is a constant race. Security teams rush to apply patches for newly discovered flaws, while attackers rush to exploit them before they're fixed.

This vector is particularly dangerous because it often requires no user interaction. An automated script can scan millions of IP addresses for a specific vulnerability, such as an outdated web server or an unpatched VPN concentrator, and launch an attack the moment it finds a match. These attacks can be opportunistic, hitting any vulnerable system, or highly targeted as part of a larger campaign.

Physical media can also serve as a potent delivery mechanism. The FIN7 cybercrime group, known for targeting the restaurant and hospitality industries, famously mailed malicious USB drives to companies. The packages were made to look like legitimate gifts or important deliveries, sometimes including gift cards or letters. An employee who plugged the drive into their computer would unknowingly install malware, giving FIN7 an initial foothold inside the network.

Multi-Factor Authentication (MFA) is a critical security layer, but determined attackers have developed ways to circumvent it. One common method is session hijacking. When you log into a web service, the server gives your browser a session cookie, which is a small piece of data that keeps you logged in without having to re-enter your password on every page.

Attackers steal these cookies in several ways. They might use malware on your computer to grab it from your browser's storage, or they could exploit a cross-site scripting (XSS) vulnerability on the website itself to trick your browser into sending them the cookie. Another technique is MFA fatigue, where an attacker who has already stolen a password repeatedly spams the user with push notifications until they finally accept one by mistake, granting the attacker access.

Understanding these initial access vectors is the first step in building a robust defence. By recognising how attackers operate, organisations can better protect their digital front doors.