LFCA 100 🐧 Common Security Threats — Overview - KandZ

Security is not a product you install. It is a posture you maintain against a landscape of threats that are constantly evolving. Some threats target the network. Some target the application. Some target the human. Some target the supply chain. The LFCA exam places security threats under Security Fundamentals, which carries 14–16% of the total weight . The competency list includes “Security Best Practices,” “Risk Awareness,” and “Sensitive Data Handling” . This chapter provides an overview of the threats that appear most often in real-world incidents and on the exam.

Key point: Most successful attacks do not exploit a zero-day vulnerability. They exploit a known weakness: an unpatched system, a weak password, a misconfigured service, or a human who was tricked. The 2026 data on Linux attacks shows that 79% of attacks use zero malware — they rely on valid credentials, misconfigurations, and social engineering . The threat is not always a virus. Sometimes it is a password.

Why Threat Awareness Matters

A system administrator who does not know the threat landscape cannot defend against it. The threats are not theoretical. They are active, automated, and targeting every internet-facing system.

The scale problem. Exposed SSH ports are scanned within minutes of coming online. The 2026 Linux threat data reports that 89% of Linux endpoint attacks use SSH credential stuffing . The attacks are not targeted at you specifically. They are automated campaigns that sweep the entire internet.

The patch problem. 5,530 kernel CVEs were filed in 2025 . The number of privilege escalation vulnerabilities is large, and the window between disclosure and exploitation is measured in days. An unpatched system is not a hypothetical risk. It is a target.

The human problem. Technical controls cannot stop a user from clicking a malicious link or revealing a password. Social engineering exploits human psychology — fear, urgency, authority, curiosity — and it bypasses every firewall and every encryption algorithm. The NJCCIC lists social engineering as a core attack type for a reason .

The trade-off. Threat awareness adds vigilance. It requires monitoring, patching, training, and reviewing. The vigilance is the cost. The alternative is discovering the threat after the breach.

a. Network and System Threats

These threats target the infrastructure: the servers, the network, the operating system.

SSH Brute Force and Credential Stuffing. The attacker attempts to log in to exposed SSH services by trying common passwords or credentials stolen from other breaches. It is the single most common attack against Linux endpoints . The defense is to disable password authentication, use key-based authentication, and restrict SSH access to trusted networks.

Privilege Escalation. The attacker has a foothold with limited privileges and exploits a vulnerability in the kernel, a misconfigured sudo rule, or a setuid binary to gain root access. The 2025 kernel CVE count shows the scale of the problem . The defense is prompt patching and auditing privilege configurations.

Cryptojacking. The attacker compromises a server or IoT device and uses it to mine cryptocurrency. The victim notices increased CPU usage, higher electricity costs, and degraded performance. XMRig is a commonly deployed miner . The defense is monitoring for unusual resource consumption and restricting outbound network access.

Kernel Rootkits. A rootkit is malware that hides its own presence and the presence of other malware. It operates at the kernel level, making it difficult to detect from within the infected system . The defense is integrity monitoring, secure boot, and rebuilding the system from a known-good state if a rootkit is suspected.

Denial of Service (DoS/DDoS). The attacker overwhelms a service with requests until legitimate users cannot access it. A distributed denial-of-service attack uses a botnet — a network of compromised devices — to amplify the traffic . The defense is DDoS mitigation services, rate limiting, and network segmentation.

b. Application and Web Threats

These threats target the software: the web application, the API, the code.

Injection. The attacker inserts malicious code or commands into input fields, and the application executes them. SQL injection manipulates database queries. Cross-site scripting (XSS) injects JavaScript into a page viewed by other users . The OWASP Top 10 lists injection as a persistent category, with the largest number of associated CVEs .

Broken Access Control. The application fails to enforce authorization, allowing the attacker to access resources or perform actions they should not be permitted to. It has held the top position in the OWASP Top 10 . The defense is to enforce authorization on every request at the server side.

Security Misconfiguration. The system is configured insecurely: default credentials, unnecessary services running, verbose error messages revealing internal details, or overly permissive file permissions. It rose to the second position in the 2025 OWASP Top 10 .

Software Supply Chain Failures. The attacker compromises a third-party library, a build tool, or a distribution channel, injecting malicious code into software that the victim trusts and installs. The XZ Utils backdoor is a real-world example . It is a new top-three category in the 2025 OWASP Top 10 .

c. Human and Organizational Threats

These threats target the person and the process.

Phishing. The attacker sends a fraudulent message that appears to come from a trusted source, aiming to trick the recipient into revealing credentials or clicking a malicious link. Variants include spear-phishing (targeted at specific individuals), smishing (via SMS), and vishing (via voice call) . Phishing is the most common entry point for ransomware and other malware .

Social Engineering. A broader category that includes phishing and other manipulation techniques. The attacker exploits human psychology — authority, urgency, helpfulness — to gain access or information . Technical controls cannot fully stop it. Training and skepticism are the defense.

Insider Threats. A current or former employee, contractor, or partner misuses their legitimate access. The threat can be intentional (malicious) or unintentional (negligent) . The defense is least privilege, access reviews, and monitoring for anomalous behavior.

Ransomware. Malware that encrypts files and demands payment for the decryption key. It is often delivered through phishing or unpatched vulnerabilities. The attacker may also threaten to leak the data (double extortion) . The defense is offline backups, patching, and user training.

Complete Example Session

This session demonstrates how to identify and respond to common threats on a Linux system.

# ============================================
# PART 1: DETECT SSH BRUTE FORCE
# ============================================

# Check the authentication log for failed login attempts
sudo grep "Failed password" /var/log/auth.log | tail -20

# Output:
# Oct  2 03:12:01 host sshd[1234]: Failed password for root from 192.168.1.100 port 54321 ssh2
# Oct  2 03:12:03 host sshd[1235]: Failed password for admin from 192.168.1.100 port 54322 ssh2

# A high volume of failures from the same IP indicates a brute-force attack.
# The defense: disable password authentication, use keys, restrict SSH.

# ============================================
# PART 2: CHECK FOR UNUSUAL CPU USAGE (CRYPTOJACKING)
# ============================================

top -bn1 | head -20

# Output:
# %Cpu(s): 95.2 us,  4.1 sy,  0.0 ni,  0.0 id, ...
#   PID USER      PR  NI    VIRT    RES  %CPU  COMMAND
#  4321 www-data  20   0  1024m  512m  98.5  xmrig

# xmrig is a cryptocurrency miner.
# The defense: kill the process, audit cron jobs, restrict outbound connections.

# ============================================
# PART 3: CHECK FOR UNAUTHORIZED SUDO RULES
# ============================================

sudo cat /etc/sudoers

# Look for unexpected entries like:
# user ALL=(ALL) NOPASSWD: ALL

# An overly permissive sudo rule is a privilege escalation risk.
# The defense: audit sudoers, remove unnecessary rules.

# ============================================
# PART 4: CHECK FOR SUSPICIOUS CRON JOBS
# ============================================

sudo crontab -l
sudo ls -la /etc/cron.d/
sudo cat /etc/cron.d/*

# Look for entries that download and execute scripts from the internet.
# The defense: remove the cron job, investigate the source.

# ============================================
# PART 5: CHECK FOR UNPATCHED KERNEL
# ============================================

uname -r
# Output: 5.15.0-100-generic

apt list --upgradable 2>/dev/null | grep linux-image

# If a newer kernel is available, the system is unpatched.
# The defense: apply updates, reboot if required.

# ============================================
# PART 6: CHECK FOR SUSPICIOUS NETWORK CONNECTIONS
# ============================================

ss -tunap

# Look for established connections to unknown IP addresses.
# The defense: identify the process, investigate, block if malicious.

# ============================================
# PART 7: CHECK FOR MODIFIED SYSTEM BINARIES
# ============================================

sudo debsums -c

# debsums verifies installed packages against their checksums.
# Modified files indicate possible tampering.

# ============================================
# PART 8: THE RANSOMWARE INDICATOR
# ============================================

# Check for encrypted files with unusual extensions.
find /home -name "*.encrypted" -o -name "*.locked" 2>/dev/null

# The defense: restore from offline backup, do not pay the ransom.

# ============================================
# PART 9: THE PHISHING REPORT
# ============================================

# A user reports a suspicious email.
# Check the email headers for spoofing.
# Check the link destination before clicking.

# The defense: report to the security team, delete the email.

# ============================================
# PART 10: THE THREAT SUMMARY
# ============================================

# SSH brute force → disable password auth, use keys
# Privilege escalation → patch, audit sudoers
# Cryptojacking → monitor CPU, audit cron
# Rootkit → integrity monitoring, rebuild if suspected
# Ransomware → offline backups, patch, train users
# Phishing → train users, MFA, email filtering
# Supply chain → verify dependencies, monitor advisories

The ten parts cover detecting SSH brute force, checking for cryptojacking, checking sudo rules, checking cron jobs, checking the kernel version, checking network connections, checking system binaries, the ransomware indicator, the phishing report, and the threat summary.

Quick Reference

The Threat Categories

Category	Examples
Network/System	SSH brute force, privilege escalation, cryptojacking, rootkits, DDoS
Application/Web	Injection, broken access control, misconfiguration, supply chain
Human/Organizational	Phishing, social engineering, insider threats, ransomware

The Linux-Specific Threats (2026)

Threat	Prevalence
SSH brute force / credential stuffing	89% of Linux endpoint attacks
Kernel privilege escalation	5,530 kernel CVEs in 2025
Cryptojacking	Common on unmonitored servers and IoT
Supply chain attacks	Poisoned packages, compromised images
Kernel rootkits	Hides its own presence

The OWASP Top 10 (2025)

Rank	Category
A01	Broken Access Control
A02	Security Misconfiguration
A03	Software Supply Chain Failures
A04	Cryptographic Failures
A05	Injection
A06	Insecure Design
A07	Authentication Failures
A08	Software or Data Integrity Failures
A09	Logging & Alerting Failures
A10	Mishandling of Exceptional Conditions

The Defenses

Threat	Defense
SSH brute force	Key-based auth, disable passwords, restrict access
Privilege escalation	Patch, audit sudo, least privilege
Cryptojacking	Monitor CPU, audit cron, restrict outbound
Rootkit	Integrity monitoring, secure boot
Ransomware	Offline backups, patch, train users
Phishing	MFA, user training, email filtering
Supply chain	Verify dependencies, monitor advisories

Best Practices

✅ Do This:

# Disable SSH password authentication
PasswordAuthentication no                                          # ✅

# Apply security patches promptly
sudo apt update && sudo apt upgrade                                # ✅

# Use MFA for privileged access
# Protect against credential theft                                  # ✅

# Maintain offline backups
# Protect against ransomware                                        # ✅

# Train users to recognize phishing
# The human layer is the most targeted                              # ✅

❌ Don’t Do This:

# Don't expose SSH to the internet with password auth
# 89% of attacks use credential stuffing                            # ❌

# Don't ignore kernel updates
# 5,530 CVEs in 2025                                                # ❌

# Don't assume Linux is immune to malware
# Cryptojacking and rootkits are real                               # ❌

# Don't pay the ransom
# Payment does not guarantee recovery                               # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
SSH compromised	Weak password, exposed port	Key-based auth, restrict
System cryptojacked	Unmonitored resources	Monitor CPU, audit cron
Ransomware	Phishing, unpatched	Offline backups, patch
Supply chain breach	Trusted dependency	Verify, monitor advisories

Real-World Examples

1. SSH Brute Force Detection

grep "Failed password" /var/log/auth.log | tail

2. Cryptojacking Detection

top -bn1 | head -20

3. Sudo Audit

sudo cat /etc/sudoers

4. Cron Audit

sudo crontab -l

5. Kernel Patch Check

apt list --upgradable | grep linux-image

6. Network Connections

ss -tunap

7. Binary Integrity

sudo debsums -c

8. Ransomware Indicator

find /home -name "*.encrypted"

9. Phishing Report

# Report suspicious email

10. Backup Verification

# Test restore from offline backup

Visual

The Threat Landscape

┌──────────────────────────────────────────────┐
│  NETWORK / SYSTEM                            │
│    SSH brute force, privilege escalation,    │
│    cryptojacking, rootkits, DDoS             │
│                                              │
│  APPLICATION / WEB                           │
│    Injection, access control, misconfig,     │
│    supply chain                              │
│                                              │
│  HUMAN / ORGANIZATIONAL                      │
│    Phishing, social engineering, insiders,   │
│    ransomware                                │
│                                              │
└──────────────────────────────────────────────┘

The Linux Attack Statistics (2026)

┌──────────────────────────────────────────────┐
│  LINUX ATTACK STATISTICS                     │
│                                              │
│  Zero malware attacks: 79%                   │
│  SSH credential stuffing: 89%                │
│  Kernel CVEs in 2025: 5,530                  │
│  Web servers running Linux: 96%              │
│                                              │
│  The threat is not a virus.                  │
│  The threat is a valid credential.           │
│                                              │
└──────────────────────────────────────────────┘

The OWASP Top 10 (2025)

┌──────────────────────────────────────────────┐
│  OWASP TOP 10 2025                           │
│                                              │
│  A01 Broken Access Control                   │
│  A02 Security Misconfiguration               │
│  A03 Software Supply Chain Failures          │
│  A04 Cryptographic Failures                  │
│  A05 Injection                               │
│  A06 Insecure Design                         │
│  A07 Authentication Failures                 │
│  A08 Software/Data Integrity Failures        │
│  A09 Logging & Alerting Failures             │
│  A10 Mishandling Exceptional Conditions      │
│                                              │
└──────────────────────────────────────────────┘

The Defense Layers

┌──────────────────────────────────────────────┐
│  DEFENSE IN DEPTH                            │
│                                              │
│  Network: Firewall, segmentation, DDoS       │
│  System: Patching, hardening, integrity      │
│  Application: Validation, authz, logging     │
│  Human: Training, MFA, awareness             │
│                                              │
│  No single layer is sufficient.              │
│                                              │
└──────────────────────────────────────────────┘

Summary

Item	Value
SSH brute force	89% of Linux endpoint attacks
Kernel CVEs	5,530 in 2025
Zero malware attacks	79%
OWASP #1	Broken Access Control
OWASP #3	Software Supply Chain Failures
Ransomware defense	Offline backups
Phishing defense	MFA + training
Cryptojacking	Monitor CPU, audit cron
Rootkit	Integrity monitoring
LFCA weight	Security Fundamentals, 14–16%

Key takeaways:

Most attacks do not use malware. The 2026 Linux data shows that 79% of attacks use zero malware. They rely on valid credentials, misconfigurations, and social engineering .
SSH brute force is the most common Linux attack. 89% of Linux endpoint attacks use credential stuffing against exposed SSH services. The defense is key-based authentication and restricting access .
Unpatched vulnerabilities are a primary entry point. 5,530 kernel CVEs were filed in 2025. Prompt patching is one of the most effective defenses .
Cryptojacking and rootkits are real Linux threats. Cryptojacking uses compromised servers to mine cryptocurrency. Rootkits hide at the kernel level. Both require monitoring and integrity verification .
The OWASP Top 10 lists the most critical web application risks. Broken Access Control, Security Misconfiguration, and Software Supply Chain Failures are the top three in 2025 .
Phishing and social engineering bypass technical controls. The human layer is the most targeted. MFA and user training are the defenses .
Ransomware is a top threat across all platforms. It encrypts data and demands payment. Offline backups are the most reliable defense. Payment does not guarantee recovery .

Remember: The threat landscape is not a list of viruses. It is a collection of attack patterns that target the network, the application, and the human. SSH brute force targets the network. Injection targets the application. Phishing targets the human. Supply chain attacks target the trust. The defenses are layered: patch, harden, monitor, train, and back up. No single control is sufficient. The goal is to make the attack expensive enough that the attacker moves on.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!