daily cyber × ai intelligence

browse by

Attack phases

Every story about an attack, or a flaw an attacker could use, filed by the phase of an attack it is about: the tactics of MITRE ATT&CK, from first reconnaissance to the final impact. A story can sit in more than one phase. News that is not about attacking anything, such as policy or funding, is not filed here.

  1. 01 Reconnaissance Scanning, probing and gathering information on targets. 36 stories latest Oct 17
  2. 02 Resource development Building infrastructure, accounts, tools and capabilities for attacks. 18 stories latest Oct 17
  3. 03 Initial access Getting in: phishing, exploited edge devices, stolen credentials, poisoned packages. 889 stories latest Oct 19
  4. 04 Execution Running attacker code on a victim system. 694 stories latest Oct 19
  5. 05 Persistence Keeping a foothold across restarts and password changes. 165 stories latest Oct 18
  6. 06 Privilege escalation Gaining higher permissions: root, admin, SYSTEM. 274 stories latest Oct 19
  7. 07 Defense evasion Avoiding detection: disabling tools, hiding, signed drivers. 160 stories latest Oct 19
  8. 08 Credential access Stealing passwords, tokens, keys and session cookies. 280 stories latest Oct 18
  9. 09 Discovery Mapping the environment once inside. 39 stories latest Oct 17
  10. 10 Lateral movement Moving from one system to the next. 55 stories latest Oct 14
  11. 11 Collection Gathering the data the attacker came for. 163 stories latest Oct 19
  12. 12 Command and control Communicating with and steering compromised systems. 112 stories latest Oct 17
  13. 13 Exfiltration Getting stolen data out. 160 stories latest Oct 19
  14. 14 Impact Ransomware, wiping, disruption, fraud, extortion. 137 stories latest Oct 15