An opportunistic attack is an operation that is not targeted toward a specific reality and does not require special investment/resources to be put into practice.
Belonging to the category of opportunistic attacks are all those attacks that are not targeted toward a specific reality and do not require particular investment/resources to be put into practice.
This type of attacks is often practiced by Threat Actors whose main purpose is to extort money from organizations.
The most common consequences of this type of attack can be: exfiltration of data (data leak), encryption of files for ransom (ransomware), establishment of a persistent channel to intercept financial/operational information of the company (APT).

The scenarios that the Service considers are:

• Unfaithful employee who uses his technical capabilities to do harm to the organization (exfiltrate data, compromise systems) or who in turn allows an external Threat Actor to exploit his device as an attack vector (bridge);
• Compromising a workstation through a phishing campaign or malicious file operated without the employee’s explicit consent;
• Use of illegally obtained corporate access credentials;
• Exploitation of a critical vulnerability, allowing access to the corporate perimeter;
• Supply chain compromise (ex. VPN site-to-site with partner or supplier).

In the context of the 24Hack Express, perimeter of activities, objective (as deep and extensive compromise of systems as possible) and vectors (starting point of the scenarios to be emulated) are defined.