Day 2/10: Turning Intelligence into Weapons — Weaponization

After completing the reconnaissance stage, an attacker moves to phase two of the Cyber Kill Chain: Weaponization. This is where raw intelligence transforms into active attack tools.

What is Weaponization?

Weaponization is the process of pairing an exploit (the tool that breaks through a vulnerability) with a payload (the malicious code intended to execute) inside a deliverable file or platform.

While advanced threat actors (APTs) develop custom, evasive malware from scratch, many attackers rely on automated framework generators or buy pre-built tools off the Dark Web to speed up their operation.

Key Tactics Used in This Phase

1. Malicious Documents: Crafting Microsoft Office documents with hidden VBA macros that run once opened.
2. Physical Droppers: Staging malware or self-propagating worms on USB drives for distribution in public spaces.
3. C2 Infrastructure Setup: Staging Command & Control servers beforehand so that once a victim executes the payload, a reverse connection is immediately established.
4. Targeted Phishing Assets: Designing custom phishing templates or rogue OAuth authorization pages designed to bypass multi-factor authentication and deceive users.

Defensive Insight: Weaponization typically happens on the attacker's home ground, making it hard to detect directly. However, strong email filtering, blocking unauthorized macros, and disabling auto-run features on endpoint devices help neutralize these weapons before execution.