How Cyberattacks Work: The Anatomy of an Attack, Stage by Stage

How Cyberattacks Work?

Every time a cyber attack happens, the headline is always the same: the XXX company has been hacked, an operating system has been hacked, etc. The word “hacked” is the only word focused on here.

If you look at the images, you will see a hidden face, a computer system, and some random codes running in the computer.

The picture is entirely different. The gap between the picture and reality is different.

The real cyberattack is not a moment. It is a process. A sequence of stages unfolded over days, weeks, months, sometimes years.

Once you see the sequence of attack as a chain of steps rather than a single event. The news will make sense to you.

In this post, we will see the lifecycle of an attack, stage by stage, with examples.

Table of Contents

Attacks follow a lifecycle:

You and I are not the first people to notice that the attacks have a structure. The security industry has spent more than a decade formalizing and making frameworks. Among them, two frameworks dominate now.

The first is the Cyber Kill Chain, published by Lockheed Martin in 2011. It breaks an attack into seven phases, from the attacker’s initial research to the final gain of the attacked website or the file. The attacker must complete all tasks in the chain to succeed. So a defender who disrupts a single link breaks the attack.

The second is the MITRE ATT&CK, a far more detailed and continuously updated knowledge base maintained by the non-profit MITRE Corporation.

In simple terms, the Miter Attack is a catalog of tricks and methods that hackers use to break into computer systems and cause damage. It is a playbook that lists every move an attacker would make, from sneaking in the door to stealing and covering their tracks.

The security team uses this catalog to understand how the attacks happen, spot them early, and improve their defense. It’s like knowing a burglar’s technique to protect our house. The tool is free, regularly updated, and used worldwide. It turns a messy, scary cyberattack into a clear map so that the defenders or white hat hackers can stay one step ahead to protect the attack.

The nine stages of attack.

Stage 1 — Reconnaissance: casing the target

The word Reconnaissance might be new for you if you are a noob in cybersecurity. But it is the widely used term in the cybersecurity field. It’s actually a technical term for information gathering. It might be tricky, but get used to it if you are entering cybersecurity.

So, before an actual attack takes place, the attacker will do his/her homework.

Passive Reconnaissance leaves no footprint on your system. It is about open source intelligence. Like using LinkedIn for employee names, job titles, and gathering who reports to whom, read your job adverts, which reveal which software and security tools the company uses. They dig through the old data leaks looking for passwords that people might reuse. So, in this way, no data will be touched or left on your system.

The active Reconnaissance is a bit louder. Here, the attacker checks for the company’s internet ports, such as which ports are open, and gets the software versions.

The attacker patiently gathers all the information, like name, job position, email, and the name of the CFO they are reporting to. This list is the raw material for the next stage of attack.

Stage 2 — Initial Access: getting a foot in the door

This is the moment that most people picture the hack. Here, we will know which doors the attackers actually use. Because the real world ranking is not what the movies show. According to the Verizon 2025 Data Breach Investigations Report, which analyzed more than 22,000 security incidents, the most common entry points are:

Stolen or compromised credentials: Around 22% of overall attacks. This is the most commonly used vector for gaining access. Reused passwords and credentials bought from a previous data breach are the first set of keys for an attack. This is no surprise, since most people use the same password on almost every platform. Also, they are unaware that their credentials are available for sale. We will discuss this in later posts.

Exploiting a vulnerability: About 20% of attacks are due to software vulnerabilities, especially in VPNs and firewalls.

Phishing: Phishing accounts for 15% by tricking a person into clicking a link, entering a password on a fake page, and losing all their data.

Supply-chain compromise : Slipping in through a trusted vendor or a poisoned software update, a category that doubled year over year.

The pattern is the same; the attackers would rather log in than break in. That is why now there are so many tech companies and giants using strong passwords and two-factor authentication.

Future deep-dives: how phishing actually succeeds, credential stuffing explained, and the anatomy of a supply-chain attack.

Stage 3 — Execution: running malicious code

After gaining access to a system, the attacker has to run a command to gain access to important documents without alerting the company’s defenders.

The attacker must execute the malware as a Word or Excel document.

Security programs like antivirus actively monitor systems and detect any vulnerabilities that enter the system, flagging them before they even execute. So the attacker should be careful doing it. Otherwise, the entire effort will be vandalized.

The attacker should first run a command or code to evade this antivirus’s focus on the code, then carefully enter the system. After successfully entering and gaining access, the attacker will run the malicious code. Then downloads the entire files from the system, which will be gigabytes to terabytes of data.

Stage 4 — Persistence: making sure they can get back in

Once an attacker gains control of your network, they don’t want to lose the access if the victim restarts the system or changes the password. So they plant a way to survive this, to ensure they can access it as a backdoor. So they tweak the system’s code while it’s rebooting so they can regain access.

This is the most frustrating stage, because a company spots the suspicious activity, resets the password, and thinks the problem is solved. This password reset doesn’t last long. The attacker is still hiding in the network. To solve this issue, we have to find every foothold in the system and remove them, but it is far harder than it sounds.

Stage 5 — Privilege Escalation: gaining more power

On the first attack, the attacker will try to compromise a low-privilege employee. This employee will not have much access to steal a database or to spread ransomware across the company. So the attacker will try to gain access to the administrator account.

This will be done by exploiting misconfigurations or by finding a vulnerability. It is hard to get access to the administrator. Once it is achieved, the attacker will have access to the entire environment.

Stage 6 — Defense Evasion: staying hidden

Throughout the process, the attacker should be careful, as defenders may be watching. So, it is important to stay invisible.

The attacker uses many techniques to bypass antivirus and endpoint detection tools. They delete or edit logs, make malicious files appear as ordinary ones, and encrypt communications so that no one can read the messages.

This is only to buy time. The longer the attack goes undetected, the longer the attacker can steal data, spread further in the network, and make it harder to fully remove them from the system.

Stage 7 — Credential Access & Lateral Movement: spreading

The first attack will target a non-ordinary employee’s laptop with limited data. So they move from one system to another with the source they have. They will slowly map the entire network. They move further to gain customer information, financial data, usernames, and passwords.

While performing this, the monitoring tools will assume this as normal activity, as this will all be done by legitimate user accounts.

Stage 8 — Command and Control: remote steering

Now, after infecting the devices, the attacker should get access to the files. So the command quietly runs and calls the home server, which is the attacker, to deliver the stolen data and get instructions for the next task.

The sneaky part: if these calls looked obviously suspicious, security tools would catch them instantly. So attackers disguise the traffic to look ordinary. A few common tricks:

Making it look like normal web browsing, as if the computer is just visiting websites.
Hiding it inside encrypted connections, the same kind of scrambling your bank’s website uses, so no one can peek at what’s really being sent.
Routing it through trusted services like popular cloud platforms, so the destination seems harmless.

This is crucial because the attacker can compromise the device, but to trade the information from the network to his/her device is harder. This is the weak point.

Stage 9 — Actions on Objectives: the payoff

There are a few goals for an attacker.

Stealing: An attacker quietly steals sensitive information, your personal details, financial records, and company secrets. This is the classic data breach you hear about on the news. The stolen information might be sold to other criminals, used to commit fraud, and is more vulnerable.

Ransomware: The attacker locks all the files, even the backups, and then demands payment to unlock them. This type of ransomware makes it to the news because corporations are mainly targeted and are demanded millions of dollars to release the files or the data.

Modern ransomware gangs usually pull a double trick, sometimes called “double extortion.” At first, they steal a copy of your data, then they lock you out of it. Now they have two ways to pressure you to pay up, or we’ll both keep your files locked and leak your secrets to the world. Even if you have backups and could restore your files yourself, they can still threaten to publish everything.

Other goals: fraud, spying, or destruction. A common criminal might drain your bank accounts. A nation-state’s spies might steal government or corporate secrets.

One attack, end to end: the Colonial Pipeline shutdown:

In May 2021, a ransomware attack happened that forced the shutdown of the Colonial Pipeline, the largest fuel pipeline in the United States. It triggered fuel shortages and panic-buying along the East Coast and a federal state of emergency.

The attackers, a group of ransomware hackers called DarkSide, got in through stolen credentials (Stage 2)

Investigators from the security firm Mandiant later told Congress that the entry point was a single password for an old, inactive VPN account that was still live and, crucially, was not protected by multi-factor authentication.

The password was later found in a batch of leaked credentials on the dark web, suggesting an employee had reused it elsewhere.

The attack happened exactly as described in the middle stages, where they slowly moved from one authority to another. After about eight days of their intrusion, they reached deeper into the network. Within 2 hours on the day of the attack, they filtered about 100 GB of data,

Then they deployed the ransomware page, encrypted the page by leaving a note demanding payment.

Colonial shut down the pipeline itself as a precaution, as they couldn’t bill. They paid a ransom of 4.4 million dollars in Bitcoin. All this was because of one reused password and a vulnerability.

The reframe, one more time

A cyber attack is a process, not a single event that happens in a few minutes.

Now you should be clear on how a cyber attack happens. When a news item pops up about a cyber attack, you must now have questions like How did they get in? How long they were inside? By which loose cut should they have come in?

In upcoming posts, we will take each stage and discuss each topic in depth.