The Anatomy of a Cyber Attack

March 2, 2022

Topics

Cybersecurity

The rate of cyber-attacks has escalated exponentially in the past year. According to Reuters, cybercrime has risen 500% since the beginning of the pandemic. As a lot of companies are turning to remote work, attackers are finding new ways to exploit this along with the multitude of options already available to them. Although stopping attackers from gaining access may seem like a daunting task, by understanding the entire process, from initial reconnaissance to system compromise, we can be better prepared to stop an attack before it does real damage.

Reconnaissance

The first part of a cyber-attack is reconnaissance. Hackers usually start by researching and gathering information about the target organization. They look for network ranges, IP addresses, and domain names to find possible entry points. Hackers also search for email addresses of employees in the organization such as CFOs, IT professionals, and CTOs for spear phishing campaigns. They will also scan the network to see if any vulnerabilities exist in systems that are facing the public. This could take weeks but will give them a better chance of gaining an initial foothold than phishing.

Persistence

Once they have gained the access to your network, the attacker now looks to spread to as many devices as it can find. This can come in many forms. An attacker could upload a keylogger and wait for users to type in their passwords, or it could become a worm that looks for known system vulnerabilities and begins to spread throughout the network. They intend to keep the attack going for as long as possible to make sure they’ve compromised any backups. The attacker will try to hijack as many of your systems as possible. This will give them the ability to keep spreading but also more options for persistence via backdoors on each compromised device. They can also at this point set up a Command and Control Server (C2 Server) to make sending commands to the compromised devices easier.

Compromise

As they try to spread throughout the network, the attacker is also looking for any data that could be used to extort their ransom. They poke through every file and directory looking for PII, business information, or anything they think will get the victim to pay them and exfiltrate that data to be held for ransom. Once they feel satisfied with the information they’ve stolen, it’s time to cripple the system. This is when attackers will deploy ransomware and leave the victims with a note on what happened and where to find their data.

Protecting Your Organization

Cyber attacks are constantly evolving, making them more difficult to detect and prevent. By understanding the anatomy of a cyber attack your organization can be better prepared to stop attackers throughout the entire process, from reconnaissance to compromise. Attackers may have a growing number of ways in which they gain access but once they are in the next steps follow a pattern and through a combination of advanced technologies and skilled cybersecurity professionals, more attacks are being stopped before they can cause real harm.

The Anatomy of a Cyber Attack

Reconnaissance

Persistence

Compromise

Protecting Your Organization

Up Next

Black Cat Attack on UnitedHealth Group

Chinese Hackers Exploit FortiOS Vulnerability