A short chain for infostealers
In the Snowflake incident, the actions on objectives took place not on the device the infostealer infected but in customer environments, with credentials stolen from that device. Google Cloud (Mandiant)
A model that divides an attack into seven stages from reconnaissance to reaching the objective and shows where defense can cut it at each stage.
The model developed by Lockheed Martin has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The attacker has to complete all of them to progress. Lockheed Martin
MITRE ATT&CK turns the same idea into a more detailed matrix of tactics and techniques; the two models are used together. MITRE ATT&CK
The target is chosen; the malware and distribution are prepared. Lockheed Martin
Code is run through email, an ad or a fake page. Lockheed Martin
The malware runs and connects to the server. Lockheed Martin
Data is stolen and accounts are taken over. Lockheed Martin
In the Snowflake incident, the actions on objectives took place not on the device the infostealer infected but in customer environments, with credentials stolen from that device. Google Cloud (Mandiant)
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy