Threats, Adversaries and Attack Lifecycles

Introduction

Cyber security is concerned not only with protecting systems, but also with understanding who may attack them, why attacks occur, how attacks are conducted, and where defensive action can interrupt them. A technical control such as multi-factor authentication or endpoint protection is most effective when it is selected in relation to a realistic threat model. Threat intelligence, incident response, vulnerability management and security monitoring all depend on a common vocabulary for describing adversaries and their behaviour.

This chapter introduces the principal categories of threat actors, their motives, common malware and social-engineering methods, and the stages through which attacks develop. Two important analytical frameworks are examined: the Lockheed Martin Cyber Kill Chain and MITRE ATT&CK. The Kill Chain presents an ordered campaign model, whereas ATT&CK provides a detailed knowledge base of adversary tactics and techniques. Neither framework predicts every attack, but both help defenders recognise patterns, organise evidence and select appropriate controls.

Learning Objectives

By the end of this chapter, you should be able to:

1. Distinguish major threat actors according to capability, access, motivation and resources.
2. Explain common motives, including financial gain, espionage, disruption, ideology and personal revenge.
3. Describe malware categories and common social-engineering techniques.
4. Explain common attack techniques, including exploitation, credential abuse, command and control, lateral movement and exfiltration.
5. Apply the Cyber Kill Chain and MITRE ATT&CK to analyse an incident.
6. Identify defensive opportunities, ethical responsibilities and limitations of attack-lifecycle models.

1. Threats, Vulnerabilities, Risks and Adversaries

A threat is a circumstance or actor capable of causing harm to an information asset. A threat may be intentional, such as a ransomware campaign, or accidental, such as an employee disclosing data to the wrong recipient. A vulnerability is a weakness that can be exploited. Vulnerabilities may exist in software, hardware, configuration, processes or human behaviour. An exploit is a method, code sequence or action that takes advantage of a vulnerability.

A risk is the possibility that a threat will exploit a vulnerability and produce an unwanted consequence. In practical risk analysis, risk is commonly discussed qualitatively as a combination of likelihood and impact. This is not a universal mathematical law: organisations may use different scales and methods. A simple qualitative expression is:

Likelihood expresses how probable or plausible the harmful event is; impact expresses the magnitude of resulting harm. Both must be defined consistently—for example, on a five-point organisational scale. The expression is useful for prioritisation, but it does not capture every factor, such as uncertainty, control effectiveness, interdependence or risk appetite.

A threat actor or adversary is the person, group or organisation that intentionally conducts malicious activity. Adversaries differ in capability, funding, access, persistence, technical skill and willingness to accept detection or legal consequences. Attribution is difficult: attackers may use compromised infrastructure, proxy services, stolen identities or false flags. Analysts should therefore distinguish observed behaviour from confident claims about identity.

A useful threat description answers four questions:

• Who may act?
• Why might they act?
• What assets or outcomes are they seeking?
• How could they obtain them?

2. Threat Actors and Their Motives

Threat-actor categories overlap. A criminal group may use state-developed tools; an insider may be financially motivated; and hacktivists may use criminal techniques. Classification is therefore an analytical aid rather than a perfect label.

Cybercriminals

Cybercrime is increasingly organised. Criminal ecosystems may provide malware-as-a-service, stolen credentials, initial-access brokerage, bulletproof hosting and cryptocurrency laundering. Specialisation lowers the technical barrier to entry. Ransomware operators, for example, may acquire access from another criminal actor rather than discovering the victim independently.

Nation-state and state-sponsored actors

State-linked operations may seek diplomatic, military, economic or technological intelligence. They often invest in reconnaissance, stealth, persistence and operational security. Some campaigns also target critical infrastructure or public information environments to prepare for future crises or influence public confidence. The presence of sophisticated tools alone does not prove state sponsorship; attribution requires multiple forms of evidence and careful confidence statements.

Insiders

An insider may be malicious, coerced, careless or compromised. Excessive privileges, poor separation of duties and weak monitoring increase insider risk. Controls should not assume that all insiders are hostile; they should reduce unnecessary access while supporting legitimate work. User-behaviour analytics can produce useful signals, but privacy and false-positive concerns require governance.

Hacktivists and script users

Hacktivists often select visible targets and seek publicity. Defacement, data disclosure and denial-of-service attacks may be used to communicate a political message. Script users may cause serious harm despite limited expertise because automated tools can scan and exploit large numbers of systems.

Motive does not equal capability

Motive explains why an actor may act, but it does not establish what the actor can do. A highly motivated individual may lack access or skill, while a low-profile criminal service may possess considerable operational capability. Threat assessment should consider capability, opportunity, intent and exposure together.

3. Malware and Malicious Payloads

Malware is software or firmware designed to perform unauthorised or harmful actions. Categories overlap because one program can combine several behaviours.

• Virus: Code that typically attaches to a host file or program and replicates when the host is executed.
• Worm: Malware that self-propagates across systems or networks, often by exploiting vulnerabilities or weak credentials.
• Trojan: Malicious software presented as legitimate or useful software. Unlike a worm, it need not self-replicate.
• Ransomware: Malware that denies access to systems or data, commonly through encryption, and demands payment. Contemporary operations may also steal data and threaten disclosure.
• Spyware: Software that covertly monitors activity or collects information.
• Keylogger: A tool that records keystrokes; it may be software- or hardware-based.
• Remote access trojan: Malware that gives an operator remote control or access to a victim system.
• Rootkit: Components designed to conceal malicious activity or maintain privileged access. Some operate in user mode, while others target deeper system layers.
• Bot or botnet: A compromised device controlled as part of a larger collection, often for denial of service, spam, fraud or credential attacks.
• Wiper: Malware designed primarily to destroy or render data and systems unusable rather than to obtain payment.
• Cryptominer: Unauthorised software that uses a victim’s computing resources to mine digital currency.

Malware may be file-based, script-based, memory-resident or delivered through legitimate administrative tools. Consequently, signature-based antivirus alone is insufficient. Defenders combine signatures with behaviour analysis, application control, patching, least privilege, backups and endpoint detection and response.

A malware infection commonly involves delivery, execution, persistence, privilege use, command and control, and an objective such as theft or disruption. These stages are not always sequential. For example, a compromised account may provide immediate access without a traditional malware payload.

4. Social Engineering

Social engineering manipulates people into revealing information, performing an action or granting access. It exploits trust, urgency, authority, fear, curiosity and helpfulness rather than a purely technical weakness.

Phishing uses deceptive electronic communication to obtain credentials, deliver malware or induce a payment. Spear phishing targets a particular person or organisation using customised information. Whaling targets senior executives or high-value personnel. Business email compromise impersonates or compromises a trusted business account to request payment, alter bank details or obtain sensitive information.

Other techniques include:

• Vishing: Voice-based fraud, often using telephone calls.
• Smishing: Fraudulent SMS or messaging applications.
• Pretexting: Inventing a credible scenario to obtain information or cooperation.
• Baiting: Offering something attractive, such as a free file or device, to induce unsafe behaviour.
• Quid pro quo: Offering a supposed benefit in exchange for information or action.
• Tailgating: Following an authorised person into a restricted area.
• MFA fatigue: Repeatedly sending authentication prompts until a user accepts one or reports the problem incorrectly.
• Deepfake-enabled impersonation: Using synthetic audio, video or imagery to imitate a trusted person.

Effective awareness programmes do not merely tell users to “be careful.” They provide reporting channels, practise realistic scenarios, explain verification procedures and avoid blaming victims. Technical controls such as phishing-resistant authentication, email authentication, transaction approval workflows and external-communication warnings reduce dependence on human judgement.

5. Common Attack Techniques

Reconnaissance and discovery

Attackers collect information about domains, public systems, employees, technologies, suppliers and exposed services. Passive reconnaissance uses public or acquired information; active reconnaissance interacts with target systems and is more likely to be detected. Asset inventories, attack-surface management and removal of unnecessary public information reduce exposure.

Initial access

Common initial-access methods include exploiting internet-facing applications, using stolen credentials, phishing, exploiting remote services, abusing valid accounts and compromising a trusted supplier. Defenders should protect externally exposed services with secure configuration, timely patching, strong authentication, network restrictions and monitoring.

Execution

Execution occurs when malicious code or commands run. Examples include user execution of a malicious attachment, abuse of scripting interpreters, exploitation of an application or use of scheduled tasks. Application allow-listing, macro restrictions, script controls and endpoint monitoring can limit execution.

Persistence and privilege escalation

Persistence allows an adversary to maintain access after logout, reboot or a change of credentials. Examples include unauthorised accounts, scheduled tasks, altered services and modified startup mechanisms. Privilege escalation obtains higher permissions, often by exploiting vulnerable software, misconfiguration or excessive permissions. Least privilege, secure administration and privilege monitoring are central controls.

Credential access

Attackers may steal passwords through phishing, password spraying, malware, credential dumping or abuse of password stores. Password spraying tries a small number of common passwords across many accounts to avoid lockout; brute force attempts many passwords against one or more accounts. Strong unique passwords, password managers, phishing-resistant MFA, rate limiting and detection of unusual authentication reduce this risk.

Defence evasion

Adversaries may disable security tools, rename utilities, encrypt communications, delete logs or use trusted operating-system tools. The use of legitimate tools for malicious purposes is often called living off the land. Centralised, tamper-resistant logging and behavioural detection are important because an attacker may use no obviously malicious file.

Command and control

Command and control (C2) is communication between an intruder and compromised systems. It may use web protocols, DNS, remote services, encrypted channels or compromised infrastructure. Network segmentation, egress filtering, DNS monitoring, proxy logging and detection of unusual encrypted traffic can constrain C2.

Lateral movement

Lateral movement is progression from an initially compromised system to other systems. It may involve stolen credentials, remote services, shared administration tools or exploitation of internal vulnerabilities. Network segmentation, administrative-tier separation, credential protection and restrictions on east-west traffic reduce its scope.

Collection, exfiltration and impact

Attackers may collect files, databases, emails, screenshots or credentials before exfiltrating them. Exfiltration can occur through web services, cloud storage, encrypted channels or removable media. Impact may include data destruction, encryption, service interruption, manipulation of information or safety consequences. Data classification, access control, data-loss prevention, resilient backups and tested recovery plans are essential.

6. The Cyber Kill Chain

The Lockheed Martin Cyber Kill Chain describes seven stages of a targeted intrusion:

1. Reconnaissance: Researching the target and identifying potential victims.
2. Weaponisation: Combining an exploit with a payload, such as malware. This stage may occur away from the target environment.
3. Delivery: Transmitting the weapon through email, web content, removable media or another route.
4. Exploitation: Triggering a vulnerability or persuading a user to execute the payload.
5. Installation: Establishing malware or another persistent capability.
6. Command and control: Creating a channel through which the adversary communicates with the compromised system.
7. Actions on objectives: Achieving the intended result, such as theft, disruption or destruction.

The model is valuable because it encourages layered defence. If delivery is missed, exploitation may still be blocked; if installation succeeds, C2 or action on objectives may still be detected. It also supports incident reporting by giving analysts a shared vocabulary.

However, the Kill Chain has limitations. Real incidents may skip stages, repeat them, run them in parallel or begin with stolen credentials. It was developed for a particular view of targeted intrusions and can oversimplify cloud, identity and supply-chain attacks. It should therefore be used as a communication model, not as a rigid claim that every attack follows seven steps.

7. MITRE ATT&CK

MITRE ATT&CK is a publicly available knowledge base describing adversary tactics and techniques based on observed behaviour. In the enterprise matrix, tactics represent the adversary’s goals, such as Initial Access, Execution, Persistence, Privilege Escalation, Defence Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Techniques describe how those goals may be achieved; sub-techniques provide greater detail.

For example, “Valid Accounts” is a technique associated with several possible tactics, while “Phishing” describes methods of obtaining initial access or causing execution. ATT&CK also includes software, groups, campaigns and data sources. Organisations can use the framework to:

• map observed behaviours during incident response;
• develop detection and threat-hunting hypotheses;
• compare security-control coverage;
• communicate adversary activity to technical and managerial audiences; and
• identify gaps in logging and telemetry.

ATT&CK is not a checklist requiring every technique to be blocked. A technique may be legitimate in normal administration, and not every organisation needs the same controls. Mapping should be based on the organisation’s assets, threats, business processes and available evidence.

Comparing the two frameworks

The frameworks complement each other. An incident may be explained at a high level as reconnaissance through action on objectives, then described precisely using ATT&CK techniques observed at each stage.

8. Applied Scenario: A Ransomware Incident

The following is a fictional illustrative case designed for learning.

Background

Northbridge Manufacturing operates an enterprise resource-planning system, shared file servers and a virtual private network for remote staff. It has endpoint protection but inconsistent MFA coverage. Backups exist, although recovery tests are infrequent.

Problem

A finance employee receives a convincing message appearing to come from a supplier. The message links to a fraudulent sign-in page. The employee enters credentials and approves an unexpected MFA request after several prompts. Two days later, unusual remote access is observed from an unfamiliar location.

Analysis

The security team identifies the following sequence:

• reconnaissance of public employee and supplier information;
• spear phishing and credential theft for initial access;
• use of valid accounts to access the VPN;
• discovery of file servers and privileged accounts;
• lateral movement using remote administration services;
• disabling or evading some endpoint controls;
• staging and exfiltration of sensitive files;
• deployment of ransomware across shared systems.

In Kill Chain terms, delivery and exploitation involved the deceptive message and user action, installation was not necessarily a conventional malware installation because valid-account access was used, and the final objective was data theft and operational disruption. In ATT&CK terms, analysts could map observations to Phishing, Valid Accounts, Account Discovery, Remote Services, Data Staged, Exfiltration and Data Encrypted for Impact. The exact mapping should be confirmed against current ATT&CK definitions and evidence.

Approach and response

The organisation disables affected accounts, revokes active sessions, isolates infected endpoints and blocks known malicious infrastructure. It preserves logs and forensic images before rebuilding systems. Administrators rotate credentials, enforce phishing-resistant MFA for privileged and remote access, review VPN policies and restrict administrative protocols between network segments. Backups are validated in an isolated environment rather than assumed to be usable.

Outcome

Production resumes from clean systems and verified backups. The organisation does not treat payment as a guaranteed recovery method. It reports the incident according to applicable legal and contractual requirements, investigates possible data exposure and informs affected parties where required.

Learning points

The incident was not prevented by a single missing patch. It involved identity, user interaction, remote access, privilege management, monitoring, segmentation and recovery. Attack-lifecycle analysis reveals several intervention points: phishing-resistant authentication could have blocked credential use; unusual login and MFA-prompt patterns could have generated an alert; segmentation could have limited lateral movement; and tested offline or immutable backups could have reduced operational impact.

9. Defence, Governance and Ethical Considerations

Defence should be layered across people, processes and technology. Important practices include maintaining an accurate asset inventory, prioritising vulnerabilities according to exposure and business impact, enforcing least privilege, using strong authentication, segmenting networks, collecting high-quality logs, testing detection and response, and exercising recovery procedures.

Threat intelligence must be handled responsibly. Organisations should respect privacy, protect sensitive indicators and avoid sharing personal information unnecessarily. Penetration testing and adversary emulation require written authorisation, defined scope, safety controls and rules for handling discovered data. Students and professionals must never scan, exploit or access systems without permission.

Legal obligations vary by jurisdiction and sector. They may include data-protection duties, breach notification, critical-infrastructure requirements, computer-misuse offences and contractual reporting terms. A security team should involve legal, privacy, risk and senior-management stakeholders when an incident may affect personal data, safety, finances or regulated services.

Artificial intelligence can assist defenders by summarising alerts, correlating events, generating detection hypotheses and identifying anomalous behaviour. It can also help attackers create convincing phishing content, automate reconnaissance and adapt malware. AI output requires human validation because models can hallucinate, reproduce bias, expose confidential data or miss context. Sensitive logs should not be submitted to an external AI service without appropriate approval and safeguards.

10. Limitations and Contemporary Developments

Modern attacks increasingly centre on identity, cloud services, software supply chains and trusted relationships rather than a single malicious executable. Cloud control-plane abuse, token theft, dependency compromise, remote-management abuse and synthetic social engineering challenge older perimeter-focused assumptions. Ransomware operations increasingly combine encryption with data theft and coercion.

No framework provides complete visibility. Logs may be missing, attackers may manipulate evidence, and legitimate administrative behaviour may resemble malicious activity. Detection quality depends on time synchronisation, retention, coverage, context and analyst skill. ATT&CK mappings can create false confidence if an organisation records a technique without proving that it can detect or prevent it. Similarly, a Kill Chain diagram may look complete while concealing uncertainty.

A mature programme therefore treats frameworks as living analytical aids. It validates controls through exercises, measures detection and response performance, updates threat models as the business changes, and learns from incidents and near misses.

Chapter Summary

Threats arise when capable actors, opportunities and vulnerabilities combine to create potential harm. Threat actors include criminals, state-sponsored groups, insiders, hacktivists, script users and competitors, each with different motives and resources. Malware includes viruses, worms, Trojans, ransomware, spyware, rootkits, bots and wipers, while social engineering manipulates human trust through phishing, pretexting, impersonation and related methods.

Common attack activity includes reconnaissance, initial access, execution, persistence, privilege escalation, credential access, defence evasion, command and control, lateral movement, collection, exfiltration and impact. The Cyber Kill Chain offers a high-level seven-stage view of targeted intrusion. MITRE ATT&CK provides a more detailed, evidence-based vocabulary of tactics and techniques. Used together, they support threat modelling, detection engineering, incident response and control assessment.

Effective security is layered and risk-based. It combines technical safeguards, trained personnel, sound governance, ethical practice, legal compliance, monitoring and tested recovery. Because attacks are adaptive and often identity-led, no model or product is sufficient by itself.

Key Terms

Threat: A circumstance or actor capable of causing harm.

Vulnerability: A weakness that can be exploited.

Exploit: A method or code that takes advantage of a vulnerability.

Risk: The possibility of harm resulting from a threat exploiting a weakness.

Threat actor: A person, group or organisation conducting malicious activity.

Malware: Software or firmware designed to perform unauthorised or harmful actions.

Ransomware: Malware that denies access to data or systems, commonly for extortion.

Trojan: Malicious software disguised as legitimate software.

Social engineering: Manipulation of people to reveal information or perform an unsafe action.

Phishing: Deceptive electronic communication used to obtain information or cause an action.

Credential stuffing: Use of previously stolen username-password pairs against other services.

Persistence: Maintaining access after an initial compromise or system restart.

Privilege escalation: Obtaining permissions greater than those initially available.

Lateral movement: Moving from one compromised system or account to others.

Command and control: Communication between an adversary and compromised systems.

Exfiltration: Unauthorised removal of data from an environment.

Cyber Kill Chain: A seven-stage model of targeted cyber intrusion.

MITRE ATT&CK: A knowledge base of adversary tactics and techniques.

Living off the land: Abuse of legitimate tools already present in an environment.

Threat intelligence: Analysed information about threats, actors, capabilities and activity.

Review Questions

Short Answer Questions

1. Distinguish a threat, vulnerability and exploit.
2. Identify four common threat actors and one motive associated with each.
3. What is the difference between phishing, spear phishing and whaling?
4. State the seven stages of the Cyber Kill Chain.
5. What is the purpose of MITRE ATT&CK tactics and techniques?

Long Answer Questions

1. Explain how cybercriminal ecosystems have reduced the technical barrier to launching attacks.
2. Compare the defensive implications of ransomware, spyware and worms.
3. Explain how least privilege, MFA, network segmentation and tested backups address different stages of an attack.
4. Compare the Cyber Kill Chain and MITRE ATT&CK, including one strength and one limitation of each.
5. Discuss the ethical, privacy and legal considerations involved in threat intelligence and incident response.

Analytical / Application Questions

1. A company observes repeated MFA prompts, an unfamiliar VPN login and access to several file servers. Analyse the likely attack stages and recommend three immediate investigative actions.
2. Map the fictional Northbridge Manufacturing incident to both the Cyber Kill Chain and MITRE ATT&CK. Identify two points where the attack could have been interrupted.
3. An organisation has strong endpoint antivirus but no network segmentation and incomplete identity logging. Evaluate the likely consequences for detecting and containing a valid-account attack, and prioritise improvements.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from an exploit?

A. A vulnerability is a weakness; an exploit is a method that takes advantage of it.

B. A vulnerability is always malware; an exploit is always a password.

C. A vulnerability is the attacker’s motive; an exploit is the victim’s asset.

D. A vulnerability is a security policy; an exploit is a backup.

Correct Answer: A. A vulnerability is a weakness; an exploit is a method that takes advantage of it.

Question 2

Which threat actor most commonly seeks financial gain through extortion, fraud or stolen data?

A. A cybercriminal group

B. A safety regulator

C. A system administrator acting normally

D. A backup operator

Correct Answer: A. A cybercriminal group

Question 3

What is the defining characteristic of a worm?

A. It is disguised as legitimate software.

B. It self-propagates across systems or networks.

C. It only records keystrokes.

D. It is used exclusively for data encryption.

Correct Answer: B. It self-propagates across systems or networks.

Question 4

An attacker repeatedly sends MFA prompts hoping that a user will approve one. What technique is this?

A. Credential stuffing

B. MFA fatigue

C. Tailgating

D. Data staging

Correct Answer: B. MFA fatigue

Question 5

Which Cyber Kill Chain stage concerns establishing communication with a compromised system?

A. Reconnaissance

B. Delivery

C. Command and control

D. Weaponisation

Correct Answer: C. Command and control

Question 6

What is the primary purpose of MITRE ATT&CK?

A. To provide a detailed knowledge base of adversary tactics and techniques

B. To replace all vulnerability scanners

C. To prescribe one mandatory incident-response sequence

D. To encrypt organisational data

Correct Answer: A. To provide a detailed knowledge base of adversary tactics and techniques

Question 7

Which activity is an example of lateral movement?

A. Researching an organisation’s public website

B. Moving from a compromised workstation to an internal file server

C. Writing a security policy

D. Testing a backup in isolation

Correct Answer: B. Moving from a compromised workstation to an internal file server

Question 8

Which control most directly reduces the risk that stolen passwords alone will enable remote access?

A. Phishing-resistant multi-factor authentication

B. A larger monitor

C. Publicly listing employee names

D. Disabling backup testing

Correct Answer: A. Phishing-resistant multi-factor authentication

Question 9

Why should the Cyber Kill Chain not be treated as a rigid sequence for every incident?

A. All attacks require physical access.

B. Modern attacks may skip, repeat or parallelise stages.

C. It contains no stages.

D. It applies only to password creation.

Correct Answer: B. Modern attacks may skip, repeat or parallelise stages.

Question 10

Which measure most directly improves resilience against ransomware impact?

A. Untested backups connected permanently to production

B. Offline or immutable backups that are regularly tested

C. A public list of privileged accounts

D. Disabling all security logging

Correct Answer: B. Offline or immutable backups that are regularly tested