Primary Attack Research Articles

MPSD: A Robust Defense Mechanism against Malicious PowerShell Scripts in Windows Systems

This manuscript introduces MPSD (Malicious PowerShell Script Detector), an advanced tool to protect Windows systems from malicious PowerShell commands and scripts commonly used in fileless malware attacks. These scripts are often hidden in Office document macros or downloaded remotely via PowerShell, posing significant threats to corporate networks. A 2018 report revealed that 77% of successful cyberattacks involved fileless malware, with PowerShell being the primary attack method, as highlighted in Red Canary’s 2022 report. To counter these threats, MPSD leverages the Antimalware Scan Interface (AMSI) to intercept and analyze real-time PowerShell scripts, preventing their execution. It further utilizes VirusTotal to filter out malicious scripts. Unlike traditional methods that rely on direct access to scripts, MPSD detects them before execution, addressing the challenge of hidden or obfuscated scripts. Experimental results show that MPSD outperforms well-known antivirus engines, with a low false-negative rate of 1.83%. MPSD is highly effective against evasion techniques like concatenation, encoding, and reordering, making it a robust tool in the cybersecurity landscape.

Mapping Study of Intrusion Detection System

The Network Security Monitoring System has been widely used to check many systems that supply services. A lot of monitoring tools have been developed to facilitate the monitoring of the network security. Since there are a lot of options to cater to our needs, this will cause a lot of time and resources to try each tool that is suitable with the system. In this research, we conducted a comparative analysis to analyse each tool presenting their advantages, disadvantages and the method used. The main objective of this research is to perform a systematic mapping study for the purpose to identify research topics related to network intrusion detection system, to assess the most frequently applied method of intrusion detection system, and to verify the types of cyber-attack that currently exist. Based on the 30 primary studies included in this mapping study, the findings indicated that the most intrusion detection system commonly used is the hybrid method and Data Injection has been the primary attack type in the existing system.

A review of privacy-preserving research on federated graph neural networks

Graph neural networks are widely employed in diverse domains; however, they confront the peril of privacy infringement. To address this concern, federated learning emerges as a privacy-preserving approach that avoids sharing data for model training, effectively resolving the issue of privacy leakage in graph neural networks. The rapid advancement of federated neural networks has spurred the demand for more potent tools to enhance model performance owing to the concealed correlation information amongst federated learning participants. However, the structural attributes of federated graph neural networks render them vulnerable to inference attacks, reconstruction attacks, inversion attacks, and the like, potentially endangering privacy. This study delves into the intricacies of privacy-preserving within federated graph neural networks. Firstly, it introduces the architecture and variants of federated graph neural networks, analyzes the privacy risks encountered by these networks from four perspectives, and elucidates three primary attack methods. In accordance with the privacy-preserving mechanism of federated graph neural networks, it summarizes the privacy-preserving techniques and synthesizes the existing strategies from four perspectives: encryption methods, perturbation methods, anonymization, and hybrid methods. Furthermore, it summarily presents the prevailing framework for preserving privacy in neural networks. Ultimately, this paper examines the challenges and outlines future research directions pertaining to federated graph neural network technology.

CgSSR marker based trait associations for Sitotroga cerealella (Olivier) resistance in stored paddy rice

Rice is stored for a longer time and many primary and secondary insect pests attack grains, causing both quantitative and qualitative losses. Physicochemical characteristics of grain influence stored grain insect susceptibility and resistance. Identification of gene/Quantitative Trait Loci (QTLs) and introgression in the cultivars would provide the desired solution for varietal resistance against S. cerealella. A group of 80 rice varieties was used for genetic analysis for the identification of candidate genes responsible for Sitotroga cerealella resistance. Heat maps derived from values in the kinship matrix were used to group the varieties into three subpopulations. The largest subpopulation has 34 varieties, while the lowest had 19. The first three principal components (PCs) explained 16, 9, and 6 percent of total variation, respectively, as indicated by the Principal Component Analysis (PCA). The PCA results complemented the heat map results in defining population structure. Genome-wide association mapping can detect marker-trait associations/QTLs in a heterogeneous population of breeding lines, despite population structure and unequal family relatedness. As shown by the Genomic Association and Prediction Integrated Tool (GAPIT) heat map, there are three subpopulations in the association mapping panel. Two cgSSR markers, related to gene SDG725 and FLO2, were linked to the attributes and responsible for conferring resistance against S. cerealella infestation. This is the first report of association and that would help in the development of cultivar with S. cerealella resistance.

A Vulnerability Scanning Method for Web Services in Embedded Firmware

As the Internet of Things (IoT) era arrives, the proliferation of IoT devices exposed to the Internet presents a significant challenge to device security. Firmware is software that operates within Internet of Things (IoT) devices, directly governing their behaviors and functionalities. Consequently, the security of firmware is critical to shielding IoT devices from potential threats. In order to enable users to operate a device intuitively, firmware commonly provides a web interface. Consequently, this interface frequently serves as the primary attack goal in Internet of Things (IoT) devices, rendering them susceptible to numerous cyber-attacks. Unfortunately, web services have complex data interactions and implicit dependencies, and it is not easy to balance efficiency and accuracy during the analysis process, leading to heavy overhead. This paper proposes a lightweight vulnerability scanning approach, WFinder, designed explicitly for embedded firmware web services to perform vulnerability checks on backend binary files in firmware. WFinder uses static analysis to focus on identifying vulnerabilities in boundary binary files related to web services in firmware. Initially, the approach identifies boundary binary files and external data entry points based on front-end and back-end associativity features. Subsequently, rules are formulated to filter hazardous functions to narrow the analysis targets. Finally, the method generates sensitive call paths from the external data input points to the hazardous functions and conducts a lightweight taint analysis along these paths to uncover potential vulnerabilities. We implemented a prototype of WFinder and evaluated it on the firmware of ten devices from five well-known manufacturers. We discovered thirteen potential vulnerabilities, eight of which were confirmed by the CNVD, and assigned them CNVD identification numbers. Compared with the most advanced tool, SATC, WFinder was more efficient at discovering more bugs on the test set. These results indicate that WFinder is effective at detecting bugs in embedded web services.

Primary Care Asthma Attack Prediction Models for Adults: A Systematic Review of Reported Methodologies and Outcomes.

Prognostic models hold great potential for predicting asthma exacerbations, providing opportunities for early intervention, and are a popular area of current research. However, it is unclear how models should be compared and contrasted, given their differences in both design and performance, particularly with a view to potential implementation in routine practice. This systematic review aimed to identify novel predictive models of asthma attacks in adults and compare differences in construction related to populations, outcome definitions, prediction time horizons, algorithms, validation, and performance estimation. Twenty-five studies were identified for comparison, with varying definitions of asthma attacks and prediction event time horizons ranging from 15 days to 30 months. The most commonly used algorithm was logistic regression (20/25 studies); however, none of the six which tested multiple algorithms identified it as highest performing algorithm. The effect of various study design characteristics on performance was evaluated in order to provide context to the limitations of highly performing models. Models used a variety of constructs, which affected both their performance and their viability for implementation in routine practice. Consultation with stakeholders is necessary to identify priorities for model refinement and to create a benchmark of acceptable performance for implementation in clinical practice.

Bilateral acute angle closure attack in Weill–Marchesani syndrome: A case report

Bilateral acute primary angle closure attack, though possible, is a rare condition. Secondary causes such as psychotropic drugs (topiramate), snake bite, and general anesthesia have been implicated in various case reports. We hereby describe a rare case of bilateral simultaneous acute angle closure attack secondary to microspherophakia and lens subluxation in a young lady with Weill–Marchesani syndrome, which was initially misdiagnosed as acute primary angle closure glaucoma. This case highlights the importance of eliciting proper history and paying attention to general examination findings to rule out secondary causes in a young patient with bilateral acute angle closure glaucoma.

Atraumatic rupture of the spleen caused by Plasmodium falciparum, challenge in UN peacekeeping operations - a case report

Introduction. Unlike traumatic rupture of the spleen, which is the most common consequence of blunt abdominal trauma and is well documented in the literature, and unlike the atraumatic rupture of the spleen, which is less common but al-so well described, spontaneous rupture of the spleen in a patient with malaria is a rare complication, with a potentially fatal outcome. Case report. A soldier aged 46 years, was hospitalized, with the clinical picture of abdominal colic and diarrhea, previously treated for a primary attack of acute malaria. During hospitalization, deterioration of health condition occurred, with the development of a clinical picture of an acute abdomen due to spontaneous rupture of the spleen which was successfully resolved by splenectomy. Conclusion. Splenectomy is the method of choice for patients with unstable clinical presentation due to atraumatic rupture of the spleen.

Oxidation of the 1‐naphthyl radical C10H7• with oxygen: Thermochemistry, kinetics, and possible reaction pathways

AbstractThe reaction of the 1‐naphthyl radical C10H7• (A2•) with molecular (3O2) and atomic oxygen, as part of the oxidation reactions of naphthalene, is examined using ab‐initio and DFT quantum chemistry calculations. The study focuses on pathways that produce the intermediate final products CO, phenyl and C2H2, which may constitute a repetitive reaction sequence for the successive diminution of six‐membered rings also in larger polycyclic aromatic hydrocarbons. The primary attack of 3O2 on the 1‐naphthyl radical leads to a peroxy radical C10H7OO• (A2OO•), which undergoes further propagation and/or chain branching reactions. The thermochemistry of intermediates and transition state structures is investigated as well as the identification of all plausible reaction pathways for the A2• + O2 / A2• + O systems. Structures and enthalpies of formation for the involved species are reported along with transition state barriers and reaction pathways. Standard enthalpies of formation are calculated using ab initio (CBS‐QB3) and DFT calculations (B3LYP, M06, APFD). The reaction of A2• with 3O2 opens six main consecutive reaction channels with new ones not currently considered in oxidation mechanisms. The reaction paths comprise important exothermic chain branching reactions and the formation of unsaturated oxygenated hydrocarbon intermediates. The primary attack of 3O2 at the A2• radical has a well depth of some 50 kcal mol−1 while the six consecutive channels exhibit energy barriers below the energy of the A2• radical. The kinetic parameters of each path are determined using chemical activation analysis based on the canonical transition state theory calculations. The investigated reactions could serve as part of a comprehensive mechanism for the oxidation of naphthalene. The principal result from this study is that the consecutive reactions of the A2• radical, viz. the channels conducting to a phenyl radical C6H5•, CO2, CO (which oxidized to CO2) and C2H2 are by orders of magnitude faster than the activation of naphthalene by oxygen (A2 + O2 → A2• + HO2).

Comparison of intraocular lens power calculation formulas in patients with a history of acute primary angle-closure attack

BackgroundTo compare the accuracy of nine intraocular lens (IOL) power calculation formulas, including three traditional formulas (SRK/T, Haigis, and Hoffer Q) and six new-generation formulas (Barrett Universal II [BUII], Hill-Radial Basis Function [RBF] 3.0, Kane, Emmetropia verifying optical [EVO], Ladas Super, and Pearl-DGS) in patients who underwent cataract surgery after acute primary angle closure (APAC).MethodsIn this retrospective cross-sectional study, 44 eyes of 44 patients (APAC) and 60 eyes of 60 patients (control) were included. We compared the mean absolute error, median absolute error (MedAE), and prediction error after surgery. Subgroup analyses were performed on whether axial length (AL) or preoperative laser peripheral iridotomy affected the postoperative refractive outcomes.ResultsIn the APAC group, all formulas showed higher MedAE and more myopic shift than the control group (all P < 0.05). In APAC eyes with AL ≥ 22 mm, there were no differences in MedAEs according to the IOL formulas; however, in APAC eyes with AL < 22 mm, Haigis (0.49 D) showed lower MedAE than SRK/T (0.82 D) (P = 0.036) and Hill-RBF 3.0 (0.54 D) showed lower MedAE than SRK/T (0.82 D), Hoffer Q (0.75 D) or Kane (0.83 D) (P = 0.045, 0.036 and 0.027, respectively). Pearl-DGS (0.63 D) showed lower MedAE than Hoffer Q (0.75 D) and Kane (0.83 D) (P = 0.045 and 0.036, respectively). Haigis and Hill-RBF 3.0 showed the highest percentage (46.7%) of eyes with PE within ± 0.5 D in APAC eyes with AL < 22 mm. Iridectomized eyes did not show superior precision than the non-iridotomized eyes in the APAC group.ConclusionsRefractive errors in the APAC group were more myopic than those in the control group. Haigis and Hill-RBF 3.0 showed high precision in the eyes with AL < 22 mm in the APAC group.

Malicious Office Macro Detection: Combined Features with Obfuscation and Suspicious Keywords

Microsoft has implemented several measures to defend against macro viruses, including the use of the Antimalware Scan Interface (AMSI) and automatic macro blocking. Nevertheless, evidence shows that threat actors have found ways to bypass these mechanisms. As a result, phishing emails continue to utilize malicious macros as their primary attack method. In this paper, we analyze 77 obfuscation features from the attacker’s perspective and extract 46 suspicious keywords in macros. We first combine the aforementioned two types of features to train machine learning models on a public dataset. Then, we conduct the same experiment on a self-constructed dataset consisting of newly discovered samples, in order to verify if our proposed method can identify previously unseen malicious macros. Experimental results demonstrate that, compared to existing methods, our proposed method has a higher detection rate and better consistency. Furthermore, ensemble multi-classifiers with distinct feature selection can further enhance the detection performance.

Mechanistic insight into the role of typical microplastics in chlorination disinfection: Precursors and adsorbents of both MP-DOM and DBPs

Microplastics (MPs) in drinking water are predominantly < 10 µm. The leaching of MPs derived dissolved organic matters (MP-DOM) from 5 µm polypropylene MPs (PP-MPs) and polystyrene MPs (PS-MPs) and the formation of MP-DOM derived disinfection byproducts during chlorination disinfection were first investigated. Comparably, PS-MPs are more vulnerable to chlorination and the primary attacks are on para C in aromatic side-chains via electrophilic Cl-substitution and oxidation by two-electron transfer. The O/C and Cl/C ratio of polystyrene MPs was linear and exponential versus initial available Cl2 concentrations, respectively. The significant PS-DOM leaching was observed with initial available Cl2 of 4.0 mg/L (USEPA recommended upper dose). As the initial available Cl2 concentration increased to 8.0 mg/L, the adsorption of chloro-phenolic-components of 200 Daltons in PS-DOM by 5 µm PS-MPs was observed for the first time. Trichloromethane (TCM) was identified as the dominant disinfection byproduct with a formation potential of 60.3 ± 7.8 and 73.7 ± 9.8 μg/mg for PS-DOM and PP-DOM, respectively. The derived TCM could adsorb onto PS-MPs followed the pseudo-second-order kinetic and Langmuir isotherm models. Extreme chlorination could reduce the maximal adsorption capacity of TCM on 5 µm PS-MPs from 196.68 ± 48.66 to 146.02 ± 32.98 μg/g. Thus, PS-MPs act as precursors and carriers of TCM in chlorination.

Information theory and headache triggers.

This secondary analysis evaluated the information content exhibited by various measurement strategies of commonly perceived causes, or "triggers," of headache attacks. When evaluating triggers of primary headache attacks, the variation observed in trigger candidates must be measured to compare against the covariation in headache activity. Given the numerous strategies that could be used to measure and record headache trigger variables, it is useful to consider the information contained in these measurements. Using previously collected data from cohort and cross-sectional studies, online data sources, and simulations, the Shannon information entropy exhibited by many common triggers was evaluated by analyzing available time-series or theoretical distributions of headache triggers. The degree of information, reported in bits, was compared across trigger variables, measurement strategies, and settings. A wide range of information content was observed across headache triggers. Due to lack of variation, there was little information, near 0.00 bits, in triggers like red wine and air conditioning. Most headache triggers exhibited more information when measured using an ordinal scale of presence/degree (e.g., absent, mild, moderate, severe) versus a present/absent binary coding. For example, the trigger "joy" exhibited 0.03 bits when assessed using binary coding but 1.81 bits when coded using an ordinal scale. More information was observed with the use of count data (0.86 to 1.75 bits), Likert rating scales (1.50 to 2.76 bits), validated questionnaires (3.57 to 6.04 bits), weather variables (0.10 to 8.00 bits), and ambulatory monitoring devices (9.19 to 12.61 bits). Although commonly used, all binary-coded measurements contain ≤1.00 bit of information. Low levels of information in trigger variables make associations with headache activity more difficult to detect. Assessments that balance information-rich measurements with reasonable participant burden using efficient formats (e.g., Likert scales) are recommended to enhance the evaluation of the association with headache activity.

Nuance: Near Ultrasound Attack on Networked Communication Environments

This study investigates a primary inaudible attack vector on Amazon Alexa voice services using near ultrasound trojans and focuses on characterizing the attack surface and examining the practical implications of issuing inaudible voice commands. The research maps each attack vector to a tactic or technique from the MITRE ATT&amp;CK matrix, covering enterprise, mobile, and Industrial Control System (ICS) frameworks. The experiment involved generating and surveying fifty near-ultrasonic audios to assess the attacks' effectiveness, with unprocessed commands having a 100% success rate and processed ones achieving a 58% overall success rate. This systematic approach stimulates previously unaddressed attack surfaces, ensuring comprehensive detection and attack design while pairing each ATT&amp;CK Identifier with a tested defensive method, providing attack and defense tactics for prompt-response options. The main findings reveal that the attack method employs Single Upper Sideband Amplitude Modulation (SUSBAM) to generate near-ultrasonic audio from audible sources, transforming spoken commands into a frequency range beyond human-adult hearing. By eliminating the lower sideband, the design achieves a 6 kHz minimum from 16-22 kHz while remaining inaudible after transformation. The research investigates the one-to-many attack surface where a single device simultaneously triggers multiple actions or devices. Additionally, the study demonstrates the reversibility or demodulation of the inaudible signal, suggesting potential alerting methods and the possibility of embedding secret messages like audio steganography.

Implementation of Machine Learning and Deep Learning for Securing the Devices in IOT Systems

Objectives: To fix the security issues of devices in internet of things (IOT) systems that arise when Machine learning (ML) and Deep Learning algorithm (DLA) are implemented in the IOT systems. Methods: Each packet of IoT threats has been filtered by using suitable attack model for primary attack detection. In deep learning, network traffic field’s information is extracted from of packet and is used as the training features. Attack is proposed to be detected by the use of database-based features of attack. If attack is found then packet will be discarded along with update feedback to filtering stage for primary attack detection. Knowledge Discovery and Data Mining (KDD) dataset is used in this study. Different types of Mirai attack are considered for classification. The performance of the proposed method has been compared in terms of accuracy and execution time with earlier work using traditional ML-DL methods. Findings: The proposed technique is seen to achieve high accuracy level at the least computational time, concurrently with much higher recall and G-mean values Several algorithms are used to secure the IOT devices from various types of threats and a comparison is depicted with their accuracy and execution time. Results show that the proposed methodology using Convolution neural network (CNN) for classification, can achieve the accuracy ~0.9976 with execution time1.30 sec and G-mean 0.7865 only. Novelty: The proposed method is essentially a judiciously configured ML- DL technique which is novel and exhibits better performance in terms of mitigating IoT threats. Keywords: IOT devices and threats; Machine Learning; Deep Learning; KDD; Security and privacy

Federated Learning based on Homomorphic Encryption and Digital Signatures

Federated learning aims to train a centralized federated model using decentralized data sources and to ensure the security and privacy of user data during system training process. Federal learning still faces four challenges: high communication costs, system heterogeneity, data heterogeneity, and data security, The primary attacks facing federal learning include confidentiality, integrity, and usability attacks. Attackers mainly target confidential attacks, while malicious attackers target integrity attacks and usability attacks. Homomorphism encryption refers to the encryption algorithm that satisfies the nature of the homomorphism operation, that is, to the ciphertext of the data after the homomorphic encryption. This article first introduces the federated learning and its possible attacks in the process of modeling behavior, and then introduces how to use homomorphic encryption and digital signature algorithm to prevent the attack method, finally through the experimental reality of federated learning encryption and digital signature and analyzed the above operation on the performance of the federated learning system.

Evaluation of the Manchester Triage System in Patients with Acute Primary Angle Closure Attack: A Retrospective Study

Acute primary angle closure attack is an ophthalmological emergency. The aim of this study was to describe the cases diagnosed in the Emergency Department, by correlating the initial complaint with the Manchester triage level and ultimately the time needed until ophthalmological evaluation and iridotomy. Retrospective analysis of the electronic medical records of patients with acute primary angle closure attack that attended the Ophthalmology Emergency Department of our tertiary center between January 2010 and December 2020. Overall, 2228 Emergency Department episodes coded with the diagnoses glaucoma or ocular hypertension were retrieved, followed by screening of each episode for correct identification of true acute primary angle closure attacks. Clinical data was gathered, including Manchester triage level, presenting complaint, intraocular pressure at presentation, first medical specialty that observed the patient, time until observation by Ophthalmology and time until laser iridotomy. Among the 120 patients identified, 84 (70%) were female and the mean age was 68 ± 12 years. Mean intraocular pressure at admission was 53.4 ± 12.4 mmHg, and 9.2% of patients presented only non-ocular complaints, while 9.2% presented mixed complaints (ocular and non-ocular). Most patients (68.1%) with only non-ocular or mixed complaints were triaged to a non-ophthalmologist (p < 0.001). Concerning the triage system, at admission, most patients (66.7%) were labelled yellow (urgent), while 9.2% and none were labelled as orange (very urgent) or red (emergent), respectively. Most patients (83.3%) were directly sent to Ophthalmology (properly triaged), while the remaining were incorrectly assigned to a non-ophthalmologist. Median time until observation by Ophthalmology was 49 minutes in the properly triaged group (min. 15, max. 404), while it was 288 minutes (min. 45, max. 871) in those who were incorrectly triaged (p < 0.001). Likewise, median time until treatment with laser iridotomy was 203 minutes in the properly triaged group (min. 22, max. 1440) and 353 minutes in the incorrectly triaged group (min.112, max. 947) (p < 0.001). Most patients with acute primary angle closure attack were not properly triaged according to the level of the Manchester triage system. There was a significant delay in the diagnosis and treatment of those patients who were first assigned to non-ophthalmologists. There is a need to raise awareness regarding the presenting signs and symptoms of an acute primary angle closure attack in order to avoid preventable vision loss.

Trustworthy Users: Using IOTA and IPFS for Attribute Validation in CP-ABE and dCP-ABE Schemes

Attribute spoofing is a major security threat in information exchange solutions based on Ciphertext-Policy Attribute-Based-Encryption (CP-ABE) and distributed CP-ABE (dCP-ABE), which can compromise privacy and security. This threat occurs when an attacker forces the Attribute Authorities to generate keys for attributes they do not possess. This paper analyzes the threat of attribute spoofing and identifies the primary attack vectors, including direct interference with the Attribute Authority and compromise of the shared attribute storage database. The authors propose a solution based on IOTA, a DAG-type DLT, and Interplanetary File System (IPFS) to prevent attribute spoofing. The solution requires distributed attribute storage, validation, and user authentication to counteract the two attack vectors effectively. The proposed solution mitigates the consequences of attribute spoofing, including privilege escalation and reduction, acquisition of private keys, and cutoff of data access. The authors also evaluate their proposal through a value-chain use case and conclude that it effectively mitigates the consequences of attribute spoofing.

Features Engineering to Differentiate between Malware and Legitimate Software

Malware is the primary attack vector against the modern enterprise. Therefore, it is crucial for businesses to exclude malware from their computer systems. The most responsive solution to this issue would operate in real time at the edge of the IT system using artificial intelligence. However, a lightweight solution is crucial at the edge because these options are restricted by the lack of available memory and processing power. The best contender to offer such a solution is application programming interface (API) calls. However, creating API call characteristics that offer a high malware detection rate with quick execution is a significant challenge. This work uses visualisation analysis and Jaccard similarity to uncover the hidden patterns produced by different API calls in order to accomplish this goal. This study also compared neural networks which use long sequences of API calls with shallow machine learning classifiers. Three classifiers are used: support vector machine (SVM), k-nearest neighbourhood (KNN), and random forest (RF). The benchmark data set comprises 43,876 examples of API call sequences, divided into two categories: malware and legitimate. The results showed that RF performed similarly to long short-term memory (LSTM) and deep graph convolutional neural networks (DGCNNs). They also suggest the potential for performing inference on edge devices in a real-time setting.

Terrorist Attacks Against Firefighters, 1970-2019.

Firefighters are a critical component of the emergency response system and therefore a potential target for organizations seeking to disrupt this system. Terrorist organizations may deliberately attack firefighters to both increase the devastation of an attack and impair the affected community's ability to respond to an attack. We performed a focused search of the Global Terrorism Database to identify terrorist attacks against firefighters worldwide. The database includes incidents from 1970 through 2019, with a total of 201,183 entries. These entries were searched for incidents involving firefighters or fire trucks. We analyzed trends in the number of incidents occurring per year, regions of the world impacted, methods employed, and number of casualties inflicted. A total of 42 attacks involving firefighters were identified in the Global Terrorism Database resulting in 26 deaths and 95 wounded. Of the 42 attacks, 12 (28.6%) were secondary attacks, where firefighters responding to an initial attack were themselves targeted. The most common method for both primary and secondary attacks was the use of a bomb or explosive. Although attacks against firefighters are uncommon, they highlight both the strategic value and vulnerability of firefighters to terrorist attacks. Increased efforts must be made to protect firefighters from future terrorist attacks.