Phase 2

After phase 1 is over, attackers proceed with identifying the most valuable assets, moving laterally to them, and performing further reconnaissance in case fine-grained ACLs are in place. It is an iterative process that may need to be repeated multiple times before intruders finally reach their destination (Figure 2.4):

Figure 2.4 – Phase 2 attack steps

Key assets discovery

Here, we should keep in mind that different types of threat actors hunt for various goals.

Ransomware threat actors will most likely identify the most critical servers that serve business processes. Their main goal is to maintain enterprise-wide access; thus, they will most likely target Active Directory servers, backup solution infrastructure, business application servers and virtual environments (VMWare ESXi, Hyper-V infrastructure), and file servers hosting the most critical data.

Case study

We have seen multiple intrusions where attackers successfully...