Negative SEO is an action taken from an individual (competitor, freelancer paid by a competitor, hacker) with the intent to demote your search engine rankings. The most common practice is building backlinks from spam websites or spam topics. Google has some ways to track and downgrade spam backlinks, but if they are en mass or if the negative SEO campaign is advanced, the damage could be considerable. Google has no resources to spare to save each victim of negative SEO. If the automated algorithms catch the spammy actions, the damage will be lessened, but in most cases, it doesn't work in favor of the victims.
A spike in backlinks numbers could be caused by a new referral source that you need to investigate. The other reason is that someone builds backlinks behind your back. Abrupt changes in numbers can trigger automated or manual penalties, demotion, loss of traffic. It will help if you use backlink monitoring tools in place that alert when the backlink profile changes or in case of spikes within a short timeframe, which are always harmful and suspicious. The monitoring tools don't catch every backlink. There are many cases when they miss considerable numbers for various reasons (crawling budget, blocked by .htaccess). The tools also have flaws e.g., Link Research Tools. Most of the tools report a spam score, which is seldom accurate and, most of the time, computed out of averages. Google Search Console has a backlink reporting tool, but it's not useful as it lags in reporting recent changes and doesn't catch everything. The suggested fix here is to manually clean the site profile from unnatural, unwanted, low-quality backlinks that come in large quantities. Sending removal requests to referral websites will be ignored in most cases. There is a Google tool that disavows backlinks; I suggest you use that.
Websites use your content without permission and affect your rankings negatively. If Google finds the same content on different websites, it has a duplicate content problem. Google needs to decide which content is the original, and importunately it doesn't always use the publishing date. Websites that are stronger than yours may present themselves (in technical terms) as creators of the content they stole from you (Content scraping) if they don't provide a backlink to your page.
A sudden drop in overall organic traffic that does not come as a result of changes that you did on the page/site. Changes in organic traffic stem either from modifications done by the webmaster, changes in the Google classification system, or an external actor. A breach of Google guidelines causes automated or manual action (penalty). If a manual action is taken, you will receive a message in Search Console with little help of what the cause is. The only time they send a clear message is when your site is hacked. In any case, if you didn't do anything, it is a clear indication that something influenced your traffic negatively and you need to fix it.
A sudden drop in specific keyword rankings. If it doesn't come as a result of your changes, there is either a change in the algorithm or if the content in the affected pages is of the same quality, there is an external action.