Phase 3
Phase 2 ends with the attacker compromising all key assets and IT systems required for normal operations (for example, backups and business systems), maximum privileges being obtained, redundant C2 access being provisioned, and having full visibility of the cybersecurity posture. What’s next? Well, depending on the attacker’s goal, they can continuously collect all necessary data, proceed with destructive activities, or start preparing for monetary theft. An overview of these steps is provided in Figure 2.5:
Figure 2.5 – Phase 3 attack steps
