browse by
Attack phases
Every story about an attack, or a flaw an attacker could use, filed by the phase of an attack it is about: the tactics of MITRE ATT&CK, from first reconnaissance to the final impact. A story can sit in more than one phase. News that is not about attacking anything, such as policy or funding, is not filed here.
- 01 Reconnaissance Scanning, probing and gathering information on targets. 36 stories latest Oct 17
- 02 Resource development Building infrastructure, accounts, tools and capabilities for attacks. 18 stories latest Oct 17
- 03 Initial access Getting in: phishing, exploited edge devices, stolen credentials, poisoned packages. 889 stories latest Oct 19
- 04 Execution Running attacker code on a victim system. 694 stories latest Oct 19
- 05 Persistence Keeping a foothold across restarts and password changes. 165 stories latest Oct 18
- 06 Privilege escalation Gaining higher permissions: root, admin, SYSTEM. 274 stories latest Oct 19
- 07 Defense evasion Avoiding detection: disabling tools, hiding, signed drivers. 160 stories latest Oct 19
- 08 Credential access Stealing passwords, tokens, keys and session cookies. 280 stories latest Oct 18
- 09 Discovery Mapping the environment once inside. 39 stories latest Oct 17
- 10 Lateral movement Moving from one system to the next. 55 stories latest Oct 14
- 11 Collection Gathering the data the attacker came for. 163 stories latest Oct 19
- 12 Command and control Communicating with and steering compromised systems. 112 stories latest Oct 17
- 13 Exfiltration Getting stolen data out. 160 stories latest Oct 19
- 14 Impact Ransomware, wiping, disruption, fraud, extortion. 137 stories latest Oct 15