# Cybersecurity Lexicon A **short-definition glossary** of the cybersecurity vocabulary that recurs across this knowledge base — the attack-and-intrusion terms, the social-engineering techniques, and the defensive concepts that show up wherever disinformation, surveillance, election security, and influence operations intersect with computer security. Full pages live in `/Terminology/Cybersecurity/`; closely-related entries already sit under `/Terminology/Surveillance/` and `/Concepts/` and are cross-referenced below. This is the **alphabetical dictionary view**, mirroring the pattern of the [[Surveillance Lexicon]] and adjacent Lexicon MOCs. ## Why a cybersecurity lexicon here? This is not an infosec textbook. The terms collected here are the ones that matter for understanding the *political* uses of cyber technique: how credentials get stolen in influence operations, how malicious infrastructure spoofs legitimate institutions, how state actors blend hacking with disinformation, and how the surveillance-and-security vocabulary gets deployed and contested in public argument. For the surveillance-capitalism and surveillance-state framing, see [[Surveillance Lexicon]]. ## A — Z (short definitions) - **APT (Advanced Persistent Threat)** — A well-resourced, usually state-sponsored intruder that maintains long-term, stealthy access to a target network. The umbrella label behind the [[Russian State Hacking Groups]] (Fancy Bear / Cozy Bear / Sandworm) and [[Chinese State Hacking Groups]] (Volt Typhoon / Salt Typhoon). - **Botnet** — A network of compromised devices controlled remotely to send spam, run DDoS attacks, or mine credentials at scale. - **[[Bulletproof Hosting]]** — Hosting deliberately built to ignore abuse complaints and takedown orders; the takedown-resistant infrastructure layer under most cybercrime, disinformation, and dark-web activity. [[Russian Business Network]] and [[CyberBunker]] are canonical cases. - **[[Commercial Spyware]]** — The mercenary industry (NSO Group's Pegasus, Intellexa's Predator) selling military-grade, often zero-click phone-intrusion tools to governments; used against journalists, dissidents, and opposition. *(in /Concepts/)* - **Credential stuffing** — Automated injection of username/password pairs leaked from one breach into other sites, exploiting password reuse. - **[[Cyberweapon]]** — State-built code engineered for physical destruction or sabotage; Stuxnet was the threshold case. The proliferation hazard: a leaked NSA exploit (EternalBlue) became NotPetya. *(in /Concepts/)* - **DDoS (Distributed Denial of Service)** — Flooding a server or site with traffic from many sources to knock it offline. - **[[Deep Fakes]]** — AI-synthesized audio/video impersonating real people; a synthesis-and-deception vector with direct disinformation uses. *(in /Terminology/Disinformation/)* - **Doxxing** — Publishing a target's private identifying information to enable downstream harassment. *(in /Terminology/Disinformation/)* - **[[Facial Recognition]]** — Biometric matching of faces against reference databases; a surveillance-and-identification technology. *(in /Terminology/Surveillance/)* - **[[Great Firewall]]** — China's national system of internet censorship, filtering, and surveillance (Golden Shield Project); the working model for digital authoritarianism, now exported abroad. *(in /Concepts/)* - **[[Hack-and-Leak Operation]]** — Fusing a cyber intrusion (the hack) with a strategically-timed, selective release of stolen documents (the leak) to drive a political scandal; the 2016 DNC/Podesta playbook. - **[[Harvest Now Decrypt Later]]** — The intelligence strategy of intercepting and storing encrypted communications now, planning to decrypt them once quantum computers exist. The long-term threat that makes [[Post-Quantum Cryptography]] urgent. - **Homograph attack** — Using look-alike Unicode characters to build a deceptive domain that is visually identical to a real one; a specialized form of [[Typosquatting]]. - **Malware** — Umbrella term for hostile software: viruses, worms, trojans, ransomware, spyware, keyloggers. - **[[Open-Source Intelligence]] (OSINT)** — Collecting intelligence from publicly available sources; deeply dual-use — the engine of accountability journalism (Bellingcat) and of doxxing and attack reconnaissance alike. *(in /Concepts/)* - **Phishing** — Fraudulent messages impersonating a trusted sender to trick a victim into surrendering credentials or installing malware. See the targeted variant [[Spearphishing]]. - **[[Post-Quantum Cryptography]]** — Next-generation encryption algorithms designed to resist quantum computing attacks; the defensive response to the [[Harvest Now Decrypt Later]] threat. - **[[Public-Key Cryptography]]** — Encryption using mathematically linked key pairs (public and private); the foundational technology of internet security and the subject of the 1990s Crypto Wars, in which the U.S. government classified encryption as a munition before courts ruled code is protected speech. - **Ransomware** — Malware that encrypts a victim's data and demands payment for the key; a dominant criminal and geopolitical threat. See the franchise model, [[Ransomware-as-a-Service]]. - **[[Ransomware-as-a-Service]]** — The franchise model (operator builds the malware, affiliates do the break-ins, split the take) plus double extortion (steal-and-leak); the 2021 Colonial Pipeline attack. Dominant gangs harbored in Russia. Has professionalized cybercrime into a subscription business. - **[[Shadow Profiles]]** — Data profiles built on people who never signed up, assembled from others' contacts and tracking. *(in /Terminology/Surveillance/)* - **[[SIM Swapping]]** — Hijacking a victim's phone number via the carrier to intercept SMS 2FA codes and seize email, crypto, and even official accounts; the January 2024 SEC X-account fake-Bitcoin-ETF post. - **[[Smishing and Vishing]]** — Phishing moved to SMS (smishing) and voice calls (vishing); AI voice-cloning now makes vishing impersonate a specific real person. Increasingly AI-generated voice cloning makes vishing nearly indistinguishable from legitimate calls. - **[[Spearphishing]]** — Phishing tailored to a specific high-value individual using personal detail to raise credibility; the standard entry point for targeted intrusions and influence-op breaches. - **Social engineering** — Manipulating people (rather than machines) into breaking security — the human-factor layer beneath phishing, pretexting, and baiting. - **[[Splinternet]]** — The fragmentation of the global internet into nationally-controlled networks, driven by the authoritarian "cyber sovereignty" doctrine (China, Russia); the governance frame behind the [[Great Firewall]]. *(in /Concepts/)* - **Spoofing** — Faking the origin of a message, site, caller ID, or address to impersonate a trusted source. - **[[Supply-Chain Attack]]** — Compromising a trusted upstream supplier (software vendor, update server, code library) so malicious code rides into thousands of victims inside legitimate, signed products; the 2020 SolarWinds compromise. - **[[Typosquatting]]** — Registering misspelled or look-alike domains to capture mistyped traffic for ads, scams, malware, or credential theft (a.k.a. URL hijacking). - **[[Watering Hole]]** — Compromising a website a target group habitually visits, so the trusted site delivers the payload. Used by state actors against journalists, activists, and diaspora communities. *(in /Terminology/Surveillance/)* - **[[Wiper Malware]]** — Malware built to destroy data rather than steal or ransom it; a state sabotage weapon. NotPetya (2017, Russian Sandworm) was the most destructive cyberattack in history, masquerading as ransomware. Russia's primary cyber weapon against Ukraine (NotPetya, WhisperGate, HermeticWiper). - **[[Zero-Day]]** — A software vulnerability unknown to the vendor (and so unpatched) at the time it is exploited; the most valuable and dangerous class of flaw, and the raw ammunition of [[Cyberweapon]]s and [[Commercial Spyware]]. The hoard-or-disclose dilemma (EternalBlue) lives here. Zero-days are bought, sold, and stockpiled by intelligence agencies. ## Cross-reference (related entries elsewhere) The following live outside `/Terminology/Cybersecurity/` but are part of the same vocabulary-and-case infrastructure: **Vocabulary (other Terminology / Concept entries)** - [[Spearphishing]], [[Commercial Spyware]], [[Great Firewall]], [[Splinternet]], [[Cyberweapon]], [[Open-Source Intelligence]], [[Hack-and-Leak Operation]] *(Hack-and-Leak in /Terminology/Cybersecurity/)*, [[Kompromat]] — `/Concepts/` and adjacent - [[Russian State Hacking Groups]] (Fancy Bear / Cozy Bear / Sandworm), [[Chinese State Hacking Groups]] (Volt Typhoon / Salt Typhoon) — the state-actor overview Concepts - [[Watering Hole]], [[Facial Recognition]], [[Shadow Profiles]] — `/Terminology/Surveillance/` - [[Deep Fakes]] — `/Terminology/Disinformation/` - [[Surveillance State]], [[Surveillance Capitalism]] — the framework Concepts - [[Surveillance Lexicon]] — the adjacent dictionary view for surveillance vocabulary **Cryptography and encryption** - [[Public-Key Cryptography]] — the foundational technology of internet security - [[Harvest Now Decrypt Later]] — the intelligence strategy driving post-quantum urgency - [[Post-Quantum Cryptography]] — next-generation encryption algorithms **Adjacent vault concepts** - [[Dual-Use AI]] — AI systems that serve both cybersecurity defense and offensive operations - [[OpenAI Contracts]] — the Pentagon's "proactive cyber defense" use case - [[FISA Section 702]] — the legal authority enabling signals intelligence collection **Cases and actors (where these techniques show up in the vault)** - [[DNC Hack]], [[Guccifer 2.0]], [[WikiLeaks]] — the 2016 hack-and-leak operation and its laundering chain - [[Stuxnet and Cyber Warfare Origins]] — the first major state cyberweapon - [[Crypto Wars and Encryption Policy]] — the "going dark" / encryption-backdoor debate - [[Cambridge Analytica Scandal]] — data-harvesting and psychographic targeting - [[Anonymous]] — hacktivism - [[Swatting]] — weaponized false emergency reports as targeted harassment - [[Russian Business Network]], [[CyberBunker]] — bulletproof-hosting case studies - [[Bellingcat]] — the OSINT accountability collective ## See Also - [[Typosquatting]] - [[Spearphishing]] - [[Surveillance Lexicon]] — the companion lexicon for monitoring and tracking technologies - [[Technology Lexicon]] — hardware and connectivity terms (consumer electronics section) - [[Defense Tech Ecosystem]] — where cyber capabilities meet military procurement - [[Concepts Hub]]