What Can an Attacker Do After Getting In?

Imagine an attacker has finally found a way into an organization's environment. Perhaps they obtained a stolen password, exploited an exposed application, or compromised an employee's computer.

At first, it may not seem like much. They have access to one account, one device, or one small corner of the network. But that initial foothold can become the beginning of a much larger attack.

An attacker may try to gain higher privileges, discover other systems, move through the network, maintain access, avoid detection, and search for valuable information. Eventually, their activity may lead to stolen data, disrupted services, financial losses, or other serious consequences.

This is why initial access is not the same as control.

A cyberattack is often a chain of connected actions, with each successful step creating new possibilities for the next. Understanding that chain helps ethical hackers recognize how an attacker might progress and where defenders can intervene.

The Big Picture

An attack is better understood as a chain of actions than as a single event.

1. Attack Vector

An attack vector is the path or method an attacker uses to reach a target.

An attacker might use a compromised account, malicious email attachment, vulnerable public-facing application, misconfigured service, or another weakness in the environment.

Think of an office building with several entrances. The front entrance, loading dock, parking garage, and employee entrance are all possible routes into the building. An attacker needs one of those routes to succeed.

2. Initial Access

Initial access is the point at which an attacker successfully gains their first foothold in the target environment.

This might mean obtaining access to an account, compromising a workstation, reaching an application, or otherwise establishing a presence inside the environment.

Initial access does not necessarily provide complete control. A compromised employee account, for example, might provide access to email but nothing else.

This is why a compromised account or device should not be viewed as an isolated incident. It may be the first stage of a larger attack.

3. Payload

A payload is the component delivered or executed as part of an attack to perform an intended action.

The term is often associated with malicious software, but the concept is broader. A payload represents what the attacker wants a compromised system to execute or perform after reaching the target.

Consider a delivery analogy: the attack vector is the method used to get something through the door; the payload is what was delivered.

Depending on the attack, a payload might collect information, establish further access, manipulate a system, or prepare the environment for later stages.

4. Command and Control (C2)

After compromising a system, an attacker may need a way to communicate with it.

Command and Control, commonly abbreviated as C2, refers to the infrastructure and communication mechanisms used to interact with compromised systems.

A compromised computer may communicate with an external system to receive instructions or send information back.

Imagine an intruder inside an office communicating with someone outside the building. The person outside provides instructions while the person inside reports what they discover.

C2 allows an attacker to maintain interaction with compromised systems rather than treating the initial compromise as a one-time event.

5. Privilege Escalation

Initial access often provides only limited permissions. Privilege escalation is the process of obtaining greater privileges than the attacker initially has.

An attacker might gain access to an ordinary user account but seek administrative privileges. Higher privileges can provide access to additional files, applications, configurations, or systems.

Returning to our office example, entering the building does not mean you automatically have a key to every room.

Privilege escalation can therefore greatly increase the potential damage of an attack. Limiting unnecessary privileges can restrict what an attacker can accomplish after an initial compromise.

6. Lateral Movement

Once an attacker has established themselves on one system, they may attempt to move to other systems within the environment. This is known as lateral movement.

A business network may contain hundreds or thousands of connected devices. A compromised workstation might provide access to other systems, accounts, shared resources, or internal applications.

The attacker may use one compromised system as a stepping stone toward another, searching for more valuable information or greater control.

This is one reason network segmentation and strong access controls matter. Even if one machine is compromised, these controls can make it harder to expand that foothold across the environment.

7. Persistence

Persistence refers to techniques that allow an attacker to maintain access to a system or environment over time.

Without persistence, an attacker might lose access when a compromised account is disabled, a machine is restarted, or the original vulnerability is fixed.

Persistence allows the attacker to return or remain active after some changes have been made.

Imagine an intruder finding a way to return to an office after leaving rather than relying entirely on the original entrance.

Removing the initial point of compromise may therefore not be enough. Defenders may also need to identify and eliminate additional mechanisms that could allow the attacker to return.

8. Defense Evasion

Attackers generally prefer not to be discovered.

Defense evasion refers to attempts to avoid detection or bypass security controls.

Modern organizations may use antivirus software, endpoint detection, firewalls, identity monitoring, and logging. An attacker operating in such an environment has an incentive to avoid triggering these defenses.

Defense evasion can involve disguising malicious activity or attempting to blend into normal system behavior.

Attackers are therefore not only trying to accomplish their objective. They are often trying to accomplish it without attracting attention.

9. Data Exfiltration

Data exfiltration is the unauthorized transfer of data out of an environment.

After gaining access and finding valuable information, an attacker may attempt to move that information outside the organization.

The stolen information could include customer records, credentials, financial information, intellectual property, internal documents, or other sensitive data.

Not every attack is primarily about stealing data, but when data theft is the objective, exfiltration represents a critical stage.

Defenders can monitor for unusual transfers, unexpected destinations, abnormal data volumes, and other signs that information may be leaving the environment.

10. Impact

Impact describes the consequences an attacker ultimately causes.

An attack may result in stolen information, financial loss, operational disruption, damaged systems, reputational harm, or loss of availability.

Impact is different from the attacker's individual techniques. Two attackers could use similar methods to enter an environment but produce completely different outcomes.

One attack might quietly steal confidential documents, while another might disrupt business operations by making critical systems unavailable.

Cybersecurity is therefore concerned with more than preventing unauthorized access. The ultimate goal is to reduce the harm that unauthorized activity can cause.

Putting It All Together

These ten concepts provide a useful model for understanding how an attack can develop.

An attacker begins with an attack vector that provides a route toward the target. Successful initial access creates a foothold. A payload can perform actions on the compromised system, while command and control may allow continued communication.

From there, the attacker may seek privilege escalation, move through the environment using lateral movement, establish persistence, and use defense evasion to reduce the chance of detection. If valuable information is the objective, the attacker may eventually perform data exfiltration. The final result is the impact on the organization.

Congratulations. You made it all the way here. 😄