Phases of a Cyberattack
A cyberattack aims to disrupt, harm, steal, or destroy devices, networks, or data. The adversary behind one works in phases. This lesson names the phases and follows one attack through them.
The report below comes from a regional grocery chain whose loyalty database was stolen. It has one row per event, from the adversary's first research to its cover-up.
| Row | Date and time | Event |
|---|---|---|
| 1 | Mar 2 | A local news story about the chain's new loyalty app names the IT manager and quotes the manager of store 14. |
| 2 | Mar 3 | The IT manager's public profile shows the company's email format: first initial and surname, at example.com. |
| 3 | Mar 9, 2:48 p.m. | The store 14 manager opens an invoice attached to an email from a produce supplier. The supplier never sent it. |
| 4 | Mar 9, 3:02 p.m. | A remote access trojan on that manager's computer contacts sync.example.org, then checks in every hour and runs the commands it receives. |
| 5 | Mar 16, 11:02 a.m. | Through the trojan, the adversary searches the store managers' shared drive and receives a copy of a spreadsheet holding the help-desk account's password. |
| 6 | Mar 17, 2:14 a.m. | The help-desk account signs in to the loyalty database server from the store 14 manager's computer. |
| 7 | Mar 17, 2:20 a.m. | The loyalty database (names, phone numbers, and purchase histories of 84,000 members) is compressed into one file. |
| 8 | Mar 17, 2:47 a.m. | The file is sent to files.example.net, a server the adversary runs. |
| 9 | Mar 17, 3:05 a.m. | The adversary edits its lines out of the server's sign-in log and deletes the compressed file it left there. |
Reconnaissance and initial access
The news story and the profile come a week before anything reaches the chain. Here the adversary is collecting what it can find about the chain. The story gives two names and their jobs. The profile gives the rule that turns any employee's name into an email address.
Both sources are public, and anyone could have read them. Freely available information of this kind is open source intelligence (OSINT).
The fake invoice uses both. The story named the store 14 manager, and the format turned that name into an address. Opening the fake invoice gave the adversary a foothold, a place on one of the chain's computers from which the rest of the attack could start.
The email is social engineering. A weak or compromised password can open the same door with no email at all.
Persistence and command and control
Opening the attachment got the adversary in once. If the manager had closed the file or restarted the computer, getting back in would have taken a second invoice. The trojan removes that need. The attachment installed a remote access trojan (RAT), malware that lets the adversary run commands on the computer from elsewhere, and set it to start every time the computer does.
The chain's firewall recorded each check-in, one line per hour.
Mar 09 15:02 STORE14-MGR to sync.example.org sent 1 KB received 1 KB
Mar 09 16:02 STORE14-MGR to sync.example.org sent 1 KB received 1 KB
Mar 09 17:02 STORE14-MGR to sync.example.org sent 1 KB received 1 KB
(160 hourly lines omitted)
Mar 16 10:02 STORE14-MGR to sync.example.org sent 1 KB received 3 KB
Mar 16 11:02 STORE14-MGR to sync.example.org sent 96 KB received 1 KB
The server at sync.example.org is the adversary's command and control (C2) server. Most check-ins pass 1 KB each way. At 10:02 a.m. on March 16 a larger instruction arrives: the search of the shared drive. At the next check-in 96 KB leaves the store, the result of that search, a copy of the spreadsheet.
Lateral movement
The store manager's account can open the shared drive and the store's files. It can't sign in to the loyalty database server. The help-desk account can, since the help desk signs in to the chain's servers to fix them. The adversary signs in with its password at 2:14 a.m., from the store 14 manager's computer.
The adversary has gone from one computer to another, and from one account to a more powerful one. Gaining accounts with elevated permissions to services and data this way is escalating privileges.
Taking action and evading detection
Six minutes later the attack reaches its objective, the loyalty database. At 2:20 a.m. the data is collected into one compressed file. At 2:47 a.m. the file leaves for the adversary's server. Sending data out of the target this way is exfiltrating it.
Last, the adversary removes its own lines from the sign-in log, so the log no longer shows the help-desk account at 2:14 a.m. It also deletes the compressed file it had left on the server. It never reached two other records, though. The server also sent each sign-in and file event to the chain's central log store, which is where the report's early-morning rows come from, and the firewall's log still holds the hourly check-ins.
Skipped phases
This attack used all six phases, but some attacks skip one. If the loyalty database had been on the store 14 manager's own computer, the help-desk account would've been no use, and the report would show no lateral movement. And an adversary that didn't care about being traced could leave the sign-in log alone. Many adversaries try to evade detection, but not all do.