How Cybercriminals Operate and How to Protect Yourself
By DeadSwitch | The Cyber Ghost
“In silence, we rise. In the switch, we fade.”
They don’t break in. They fade in.
A true hacker doesn’t knock.
They whisper into open ports, blend into logs, mimic trusted flows.
No smash. No grab. Just presence. Subtle, slow, certain.
Below the surface, they live in TTPs —
Tools, Tactics, Procedures.
But deeper still, they breathe in shadows cast by your misconfigurations.
Tactic I: Reconnaissance
“The ghost maps the fortress before striking the gate.”
- Passive: WHOIS, Shodan, LinkedIn mining, Git leaks.
- Active: DNS enumeration, port scans, subdomain brute-forcing.
🛡 Defense:
- Scrub metadata.
- Monitor for outbound probes.
- Limit external exposure.
- Don’t overshare. OpSec is your silent firewall.
Tactic II: Initial Access
“The lock is not picked. It is mimicked.”
- Phishing, spoofed portals, poisoned attachments.
- Exploiting weak perimeter services (e.g., outdated VPNs, RDP, CMS exploits).
- Credential stuffing. Because humans reuse like clockwork.
🛡 Defense:
- MFA is the digital moat.
- Email filters are your archers.
- Train your humans — they are your most brittle vector.
Tactic III: Persistence
“The ghost doesn’t visit. It settles.”
- Scheduled tasks. Registry tweaks. Startup scripts.
- Web shells, rogue admin accounts, token theft.
🛡 Defense:
- Audit your autostarts.
- Monitor identity access baselines.
- Rotate keys like seasons.
Tactic IV: Privilege Escalation
“They wear your crown before you notice the throne is cold.”
- Kernel exploits.
- Unquoted paths.
- SUID binaries.
- LSASS dumping on Windows.
🛡 Defense:
- Principle of least privilege.
- Patch fast, patch deep.
- Harden endpoints like they’re battlegrounds — because they are.
Tactic V: Lateral Movement
“They don’t cross your network. They become it.”
- PSExec. WMI. RDP. Pass-the-Hash.
- Living off the land — using your tools against you.
🛡 Defense:
- Segment. Isolate. Monitor.
- Disable what you don’t need.
- Detect abnormal behavior, not just known signatures.
Tactic VI: Exfiltration & Impact
“They don’t steal data. They harvest your soul.”
- Data compressed, encrypted, shipped through DNS, HTTP, or disguised C2.
- Ransomware is the finale, not the start.
🛡 Defense:
- Egress monitoring.
- Immutable backups offline.
- Response playbooks written in peacetime.
The Hacker’s Mind
They don’t “hack.”
They listen.
They wait.
They understand you better than you understand your own systems.
Final Whisper:
You will not win by building taller walls.
You win by knowing what draws the wolves to your gates.
Understand their patterns. Anticipate the silence before the breach.
Because…
The moment you hear them, they’re already gone.
– DeadSwitch
“Fear the silence. Fear the switch.”
Tom's IT Cafe 