Reference · Attack pattern dashboard

Attack Pattern Reference

Living reference dashboard of the recurring attack patterns, credential-exposure vectors, and infrastructure vulnerabilities the LeakTrace Intelligence Team observes across the North American small-business and mid-market landscape we monitor. Grouped by category. Filterable by vertical.

Prevalence framing is deliberately qualitative. Institutional intel publications (IBM X-Force, Mandiant M-Trends, CrowdStrike Global Threat Report) use the same convention: real prevalence is stated as a band, not a made-up percentage. Where quantitative context matters to a specific engagement, LeakTrace reports it privately in the client dashboard, not on the public reference page.

All verticals Familyoffice Financial Healthcare Legal Sports Wealthmanagement

Credential exposure

Credential exposure Critical

Credentials in monitored breach databases reused on production login

Employee credentials appearing in monitored breach databases are still active on the corporate SSO or VPN, giving attackers a direct password-spray path.

Present in a majority of firms that have never run a credential-hygiene sweep.

Infrastructure

Infrastructure High

Application admin panel exposed to the public internet

A CMS or application admin login page (WordPress, Django, phpMyAdmin, GitLab, custom SaaS) is reachable from any IP without authentication gating, IP allowlisting, or VPN.

Widespread across firms that treat "hidden URL" as an access control.

Infrastructure Medium

Public TLS certificate approaching expiry without automated renewal

A production-facing TLS certificate is within the browser warning window and shows no evidence of ACME/auto-renewal, risking a hard outage and browser trust warnings.

Common on legacy infrastructure and manually-provisioned edge appliances.

Infrastructure High

Subdomain takeover risk on abandoned CNAME

A DNS CNAME record points to a third-party service (Heroku, S3, GitHub Pages, Zendesk, etc.) that no longer claims the subdomain, allowing anyone to register it and impersonate the parent domain.

Frequently observed post-M&A and after marketing-tool decommissioning.

Email authentication

Email authentication Medium

DKIM signing absent on the primary mail sender

A domain's outbound mail is not cryptographically signed, so receivers cannot verify integrity or authenticity beyond IP-based SPF.

Common in firms that migrated mail providers without re-checking DNS.

Email authentication High

SPF configured without DMARC alignment

A domain publishes an SPF record but no DMARC policy, leaving receivers with no instruction on how to handle unauthenticated mail.

Widespread across small and mid-market firms that have never audited their DNS.

Supply chain

Supply chain Medium

Unmaintained marketing vendor with historical corporate data access

A marketing, analytics, or engagement vendor that once had customer or employee data access remains contracted (paying) or connected (integration live), despite no active use, extending the exposure surface.

Common across firms with tenure-driven vendor sprawl.

Cloud misconfiguration

Cloud misconfiguration High

S3 bucket permissions allowing anonymous list

A production or backup S3 bucket is configured to allow anonymous LIST operations, exposing the object inventory (and often the object contents) to any unauthenticated caller.

Present in a majority of firms without a formal cloud-security review cadence.

Insider threat

Insider threat High

Departed employee retains SSO or SaaS access post-departure

A former employee's corporate SSO, individual SaaS accounts, or personal-device-linked corporate app access remains active after their departure date.

Common in firms without a formal offboarding checklist tied to the identity provider.

Phishing infrastructure

Phishing infrastructure High

Lookalike domain registered against the corporate brand

A recently-registered domain uses a visual or typographical variation of the corporate name (typo-squat, IDN homograph, tenant-suffix squat) and is likely being staged for wire-fraud pretext.

Frequently observed against firms with wire-authority workflows and public principal exposure.

Paste site leak

Paste site leak High

Executive email addresses harvested from paste sites

Public paste-site archives contain executive email addresses paired with breached passwords, providing an off-the-shelf target list for BEC.

Common across founder-led firms and family office principals with long email tenure.

Code / repository leak

Code / repository leak Critical

API keys committed to public GitHub repositories

Employee or contractor GitHub accounts host public repositories containing plaintext API keys, cloud credentials, or database connection strings for the corporate tenant.

Common in firms with permissive BYOD policies and contractor sprawl.

Code / repository leak Critical

Exposed .git directory on a production web server

A production web server exposes its `.git/` directory over HTTP, allowing anyone to reconstruct the full source tree, including secrets committed to history.

Frequently observed in firms that deploy by rsync or manual git pull without excluding hidden directories.

Third-party / vendor risk

Third-party / vendor risk Critical

Advisor tenant firm with no DMARC on the sending domain

A principal's accountant, wealth manager, law firm, or business affairs manager sends mail from a domain with no DMARC policy, making that domain trivially spoofable for wire-fraud pretext against the principal.

Present in a majority of boutique advisor firms serving founder-led households.

Engagement

Want your own exposure surface assessed against these patterns?

LeakTrace runs continuous intelligence on principals, households, and advisor tenants across every observable public exposure surface. Discovery call under mutual NDA, first-touch reply within one business day. Reply to [email protected].