The MITRE ATT&CK Framework, developed by the non-profit MITRE Corporation, is a globally recognised framework for understanding and countering cyber threats (https://attack.mitre.org/). ATT&CK—an acronym for Adversarial Tactics, Techniques, and Common Knowledge- maps out 14 distinct stages of a cyber attack and the tactics used by hackers. This comprehensive framework has become an essential resource for cyber security teams, enabling them to identify, analyse, and mitigate threats across complex digital ecosystems.

The challenge is that the framework is technically complex, making it difficult for many non-technical business leaders to use it effectively to help them prepare for and protect against a cyber attack.

To bridge this gap, Lanware has created simple, real-world examples for each of the 14 stages of a cyber attack. As you review each example, ask yourself: How well protected is your financial services firm against this type of threat?

1. Reconnaissance

Goal: Identify targets and gather information before launching an attack.

Examples:

• An attacker scans LinkedIn or other publicly available sources to identify employees, their roles, and information about the supply chain.
• An attacker searches for any exposed email addresses and credentials or previous data breaches.
• An attacker targets firms which use zero-day or widely used vulnerable software and lazy configuration.
• An attacker contacts or attempts to bribe a former employee to obtain credentials or sensitive internal information.

2. Resource development

Goal: Set up infrastructure and tools needed for the attack.

Examples:

• An attacker registers a domain that closely mimics the target company and sets up a phishing website.
• An attacker acquires services or toolkits to exploit vulnerabilities identified during the reconnaissance phase.
• An attacker compromises the network of your supply chain or a legitimate third party to gain access.

3. Initial access

Goal: Gain entry into the target system or network.

Examples:

• A phishing email tricks an employee into clicking a malicious link.
• An attacker calls the service desk, impersonates a legitimate user and successfully requests a password reset or gains access from a new device.
• An attacker physically connects a hacking device to the network.

4. Execution

Goal: Run malicious code on a system.

Examples:

• A user opens a macro-enabled Excel file, which executes a PowerShell script or links to a website hosting a malicious executable.
• A user is directed to a fake Microsoft 365 Login Webpage designed to steal credentials or MFA tokens.

5. Persistence

Goal: Maintain access across reboots or credential changes.

Examples:

• The attacker’s malware installs itself as a startup program.
• The attacker creates additional user accounts on your network.

6. Privilege Escalation

Goal: Gain higher-level permissions.
Examples
• The attack exploits a vulnerability in unpatched software to gain administrative access.

7. Defence evasion

Goal: Avoid detection by security tools.

Examples:

• The attacker’s Malware disguises itself as a legitimate process.
• The attacker starts changing file permissions within their working area.

8. Credential access

Goal: Steal usernames and passwords.

Examples:

• The attacker uses a keylogger to capture login credentials.
• The attacker finds passwords stored in files or insecure password tools.

9. Discovery

Goal: Learn about the environment (e.g., users, systems, network).

Examples:

• The attacker is running commands to list all devices on the network and scan for further vulnerabilities.
• The attacker is searching through network drives and logs to identify additional potential targets.

10. Lateral movement

Goal: Move through the network to other systems.

Examples:

• The attacker is using stolen credentials to access a file server.
• The attacker is deploying malware to additional computers.
• The attacker is using stolen credentials to further trick staff into granting further access or completing tasks.

11. Collection

Goal: Gather data of interest.

Examples:

• The attacker is copying sensitive documents from a shared drive.
• The attacker is setting up email forwarding rules.

12. Command and control (C2)

Goal: Communicate with compromised systems remotely.

Examples:

• The attacker’s malware connects to a remote server (on the internet) to receive instructions or updates.

13. Exfiltration

Goal: Steal and send data out of the network.

Examples:

• The attacker is uploading files to a cloud storage account.
• The attacker is uploading files to a local USB device.

14. Impact

Goal: Disrupt, destroy, or manipulate systems or data, or achieve financial theft.

Examples:

• The attacker uses ransomware to encrypt files, hold data for ransom and demand payment.
• The attacker impersonates a trusted third party to carry out invoice fraud or financial theft.
•  The attacker exploits the victim’s cloud resources to make money, such as bitcoin mining.
• The attacker deletes data or destroys systems without financial gain.

Invaluable resource tool for financial services

In conclusion, the MITRE ATT&CK Framework is an invaluable tool for understanding and mitigating cyber security threats. By breaking down the complex stages of a cyber attack into simple, relatable examples, Lanware has made this framework more accessible to non-technical business leaders. This approach not only enhances comprehension but also empowers organisations to better prepare for and defend against potential threats. By recognising and addressing each stage of an attack, from reconnaissance to impact, financial services businesses can significantly strengthen their cybersecurity posture and resilience.