Exfiltration

This is the phase where the main attack starts. Once an attack has reached this phase, it is considered successful. The Threat Actor normally has unobstructed freedom to move around a victim's network and access all its systems and sensitive data. The Threat Actor will start extracting sensitive data from an organization. This could include trade secrets, usernames, passwords, personally identifiable data, top-secret documents, and other types of data.

There is an ongoing trend of hackers specifically targeting data stored in systems. Once they breach into any corporate network, they move laterally to the data storage locations. They then exfiltrate this data to other storage locations from where they can read, modify, or sell it. In April 2018, SunTrust Bank was breached, and the Threat Actors managed to steal data belonging to 1.5 million people. Another attack happened on Facebook's platform in October the same year, when Threat Actors were able to steal...