and inject messages and signals before the other party receives a legitimate response. Since man-on-the-side attack requires a strong timing advantage, a reason to why people use Man-on-the-side attack may be explained through their psychological behaviour. Faculty Member from the University of Stavanger, Maria Kjaerland, conducted an exploration study to examine the relationship between different cyber offences and psychological behaviours. She concluded that web compromise is a common activity for hackers attacking targets for challenge because it relies on attackers having accurate timing in leaving messages victims. They can be easily caught if the timing is incorrect and will not be able to make up for it. Therefore, this challenge bears higher consequences amongst other types of attacks. Therefore, Similarly, man-on-the-side attack also require attackers to rely on having time advantage in order to retrieving and modifying information from victims without them realising or determining what the hacker has done. Examples Russia In 2019, it was reported that man-on-the-side attack might have been conceived by the Russian Threat Group through installing Malwares. When victim used the internet and requested to download a file at a particular website, man-on-the-side attackers who were present were aware that the victims were attempting to download the file. Since the man-on-the-side attackers were not able to prohibit the victim from downloading the file, what they could do was to intercept the server and send a signal to the victim before the victim received a legitimate response, which was the requested download file. The attacker then intercepted and sent the victims a message that directed them to a 302 error site, which led the victim to think that the file has been removed or it simply cannot be downloaded. However, even though the victim would receive a legitimate response from the website file download, since their servers were already contaminated, they would not have been able to view the legitimate website and file sine they received a so-called proper response from the attacking team. At the 302 error site, the attacking team directed the victims to an alternative website to download the files they wanted to, which the attacking team controlled and ran. When the victim connected to the attacking team's server, not known to their knowledge, they would start downloading the file because on the victim's screen, it shows that this site is working and they can finally download the file. However, the attacking team