Hacking as a Process: The Cyber Kill Chain

Hacking Is Not an Event — It Is a Process

In 2011, defence contractor Lockheed Martin published a landmark paper titled Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. It borrowed from US military targeting doctrine and applied the same "find, fix, track, target, engage, assess" logic to cyber intrusions. The result is the framework this tutorial teaches: the Cyber Kill Chain.

The Seven Phases at a Glance

Before we take each phase apart, here is the whole chain in one view. Every real intrusion — from a script-kiddie defacement to a nation-state supply-chain attack — passes through these seven phases in this order. Understanding this sequence is the single most useful mental model in modern cybersecurity.

Phase 1 — Reconnaissance

Reconnaissance is the pre-attack intelligence phase. No malware has been written, no packets touched. The attacker is building a dossier on the target. Two flavours exist and they matter operationally.

Real Example — How the Target Attackers Cased Their Prey

Defensive Controls at This Phase

Phase 2 — Weaponisation

Weaponisation is the workshop phase. The attacker combines an exploit (a technique for triggering a vulnerability) with a payload (the malicious code that will run once the exploit succeeds). This all happens on the attacker's own infrastructure — the defender cannot see it. This is the phase most invisible to the target, and yet it is where the attacker's strategic choices about your organisation are baked in.

Categories of Weaponised Payloads

Real Example — The BlackPOS Malware

# === BlackPOS — the weapon used against Target ===
# Also known as: Kaptoxa (Russian for "potato")
# Author: Believed to be a Ukrainian teenager, "ree4"
# Sold on Russian-language forums for ~$2,000 in 2013.

CATEGORY:       Point-of-Sale RAM scraper
SIZE:           Roughly 200 KB — small enough to hide easily
TARGET:         Windows POS terminals running Windows Embedded
TECHNIQUE:      Scans memory of the POS process for card data
                that matches Track 1/Track 2 magnetic-stripe format
                before the retailer's software encrypts it.

PATTERNS SOUGHT:
    Track 1:  B[0-9]{13,19}\^[A-Z /]+\^[0-9]{4}...
    Track 2:  [0-9]{13,19}=[0-9]{4}[0-9]*?

EVASION:        Named to look like legitimate Windows services
                (e.g. POSWDS.exe, similar to Windows Defender)
                Only ran during retail business hours to blend with normal load

HANDOFF:        Wrote scraped card data to a hidden text file
                on the same machine, then a second component (called
                "stbotv2" in analyst reports) periodically shipped
                the file to internal Target servers, then out via FTP
                to attacker-controlled infrastructure in Russia.

Phase 3 — Delivery

Delivery is the moment the weapon reaches the target. It is the first phase in which attacker and defender's environments physically interact. Everything the defender does in Phases 1-2 is intelligence work; Delivery is where the intelligence work meets tangible defence.

Anatomy of a Modern Spear-Phishing Email

# === A textbook spear-phishing lure. Compare to what Fazio Mechanical
# Services likely received in late 2013 before the Target breach. ===

FROM:    "Bob Wilson <b.wilson@acme-hvac-supplies.com>"
         # Attacker-registered look-alike domain.
         # Real supplier domain: acmehvacsupplies.com  (no hyphen)

TO:      "Sarah <sarah@fazio-mechanical.example>"
         # Sarah's role is Accounts Receivable — publicly listed on LinkedIn.
         # She routinely opens PDF invoices from unknown vendors.

SUBJ:    Overdue Invoice #48711 — payment due today

BODY:
    Hi Sarah,

    Attached is invoice #48711 for the parts we shipped last month.
    Payment was due yesterday. Please review the attached PDF and
    send confirmation of payment ASAP or we will need to escalate.

    Thanks,
    Bob

ATTACHMENT:
    Invoice_48711.pdf.exe             # Double extension trick.
                                       # Windows hides ".exe" by default.
                                       # Sarah sees "Invoice_48711.pdf".

TECHNIQUE:
    - Sender name and domain crafted to look almost identical to a real supplier
    - Financial urgency ("payment due today") to bypass careful reading
    - Personal-sounding tone rather than a formal template
    - Attachment named to trigger habitual click-through by an AR clerk

Real Case — Fazio Mechanical Services, September 2013

Based on KrebsOnSecurity reporting, an employee at Fazio Mechanical Services opened a phishing email containing malware — a variant of the Citadel banking Trojan — sometime in the two months preceding the Target breach. Fazio was using the free version of Malwarebytes, which offered only on-demand scanning, not real-time protection. The malware was never detected. It quietly harvested Fazio's credentials to Target's supplier portal and shipped them to the attackers.

Phase 4 — Exploitation

Exploitation is the moment the weapon fires. The delivered payload is now executing on a system inside the target's environment. Something — a software vulnerability, a misconfiguration, or a human decision to click — has been successfully abused to run attacker code.

What Actually Happened at Fazio

# === Chain of events after the phishing email landed at Fazio ===

Day 0  →  Fazio employee opens attachment. Citadel trojan installs.
              # Exploitation = user clicked run. No CVE needed.

Day 0-2  →  Citadel silently keylogs the workstation.
                Records credentials as the employee logs in to:
                    ariba.target.com  # Target's vendor portal

Day 3+  →  Attackers now hold Fazio's Ariba credentials.
                They log in to Target's system as Fazio — a legitimate
                partner using legitimate credentials. From Target's
                perspective, it looks like Fazio submitting invoices.

# The attacker's genius was that Phase 4 (Exploitation) happened
# NOT at Target — it happened at a third party. Target's Phase 4
# was a valid login from a trusted partner IP address.

Phase 5 — Installation

Installation is the phase where the attacker makes their access durable. Exploitation gave them a foothold, but that foothold vanishes when the target reboots, patches, changes a password, or shuts down the process. Installation is about surviving all of those events.

Common Persistence Techniques on Windows

The Target Installation Phase — BlackPOS Goes Live

Once the attackers had elevated to Domain Admin inside Target's network (via a Pass-the-Hash attack that leveraged the compromised Ariba credentials as a stepping-stone), they pushed the BlackPOS payload to point-of-sale systems using Microsoft's own PsExec utility. On each POS terminal, BlackPOS installed itself as a Windows service named to mimic a legitimate anti-malware daemon. It would restart on every reboot, run only during trading hours, and quietly scrape memory of the POS payment application.

Phase 6 — Command & Control (C2)

Command & Control is the ongoing communication channel between the attacker and the implant. It is the metaphorical telephone line. Without C2, the attacker has code running on a victim machine but no way to tell it what to do or receive stolen data back.

The Evolution of C2 Channels

Detection at the C2 Phase

# === What a network analyst hunts for to spot C2 beaconing ===

SIGNAL 1 — Periodicity:
    Regular outbound connections at consistent intervals.
    Example: every 60 seconds ± 5 seconds of random jitter.
    Legitimate user browsing is bursty and irregular. Beacons are metronomes.

SIGNAL 2 — Small consistent payload sizes:
    A beacon that has nothing to say still says "I'm alive."
    Repeated POST requests of 34 bytes are suspicious even to HTTPS.

SIGNAL 3 — Newly-registered domains:
    Attacker infrastructure is usually less than 30 days old.
    Enrich DNS logs with domain-age intelligence and any hit is a red flag.

SIGNAL 4 — Unusual user-agents:
    "Mozilla/4.0" without full modern UA string = often malware.
    Python's "python-requests/2.28.1" from a workstation = suspicious.

SIGNAL 5 — Rare destinations:
    Threat hunters look for domains contacted by exactly ONE host
    in the environment. Legitimate services usually get many callers.

SIGNAL 6 — TLS certificate anomalies:
    Self-signed certs, mismatched CN, or well-known "default" Cobalt Strike
    certificate hashes (JA3/JA3S fingerprinting). Free win for hunters.

Phase 7 — Actions on Objectives (Effects)

Phase 7 — variously called Actions on Objectives, Effects, or simply Impact — is what the attacker actually came for. Every phase before was preparation. This is the payoff. And this is where the news headline finally gets written.

The Target Breach — Actions on Objectives Details

Full Case Study — The Target Breach End to End

Now bring it all together. Here is the complete Target 2013 intrusion mapped one-to-one against the Cyber Kill Chain, with sources drawn from the US Senate Committee on Commerce, Science & Transportation report of March 2014, KrebsOnSecurity, Bloomberg BusinessWeek, and the Wall Street Journal.

Defensive Controls — One Table for the Whole Chain

If you were designing a security programme from scratch, this is the "must-have" grid. At every phase, at least one detective control and one preventive control. Redundancy across phases is the whole point.

Modern Extensions — MITRE ATT&CK and the Unified Kill Chain

The Lockheed model is now fifteen years old. It remains foundational, but the industry has extended it in two important ways to cover modern attack patterns.

Limitations — Where the Kill Chain Falls Short

No framework is perfect. The Cyber Kill Chain has genuine blind spots, and understanding them is part of using it well.

Practical Exercise — Map a News Story to the Chain

The single best way to internalise the Kill Chain is to grab any recent breach news story and reconstruct the seven phases from what is publicly reported. Here is a worked walkthrough on a second real case for practice.

Worked Example — Colonial Pipeline (May 2021)

Newspaper & Reference Coverage

Golden Rules