Understanding how attacks unfold helps you detect and respond faster.

Phase 1: Reconnaissance

Attackers research their target:

• Identifying infrastructure (servers, IPs, DNS)
• Finding vulnerabilities
• Mapping security defenses
• Determining peak traffic times

Common techniques: Port scanning, DNS queries, social engineering

Phase 2: Weaponization

Attackers prepare attack tools:

• Building or renting botnets
• Selecting attack vectors (volumetric, protocol, application layer)
• Configuring attack parameters (target IPs, ports, packet types)

Phase 3: Delivery & Exploitation

The actual attack begins:

• Botnet receives attack command
• Malicious traffic floods the target
• Target infrastructure becomes overwhelmed

Attack duration: From minutes to days (some ransom attacks persist for weeks)

Phase 4: Command & Control

During the attack, attackers:

• Monitor effectiveness
• Adjust tactics if mitigation is detected
• Launch multi-vector attacks (switching between attack types)
• May send ransom demands

Phase 5: Actions on Objective

Attackers achieve their goal:

• Service disruption (downtime, slow performance)
• Ransom payment extraction
• Reputation damage
• Diversion while conducting data theft