Understanding How Attacks Actually Work

Why You Need to Think Like an Attacker

There is a saying in security: defenders have to be right every time, attackers only have to be right once. That is true, but it is also incomplete. The better you understand how attacks actually work, in practice rather than in theory, the better you can anticipate and prevent them.

Read enough public breach reports and the patterns start to repeat. The same mistakes show up again and again. Once you can recognize these patterns, you are already more effective than many working professionals who have never studied attack chains systematically.

This chapter walks through real-world breaches step by step, introduces you to the MITRE ATT&CK framework, and teaches you to think about attacks as chains of events rather than single moments of failure.

Anatomy of an Attack Chain

Before we look at specific breaches, you need to understand the general structure of how attacks unfold. Almost every significant breach follows a predictable chain:

    TYPICAL ATTACK CHAIN
    =====================

    +----------------+
    | 1. RECON       |  Research target, find employees,
    |                |  discover systems, identify weaknesses
    +-------+--------+
            |
            v
    +----------------+
    | 2. INITIAL     |  Phishing email, exploited vuln,
    |    ACCESS      |  stolen credentials, supply chain
    +-------+--------+
            |
            v
    +----------------+
    | 3. ESTABLISH   |  Install backdoor, create accounts,
    |    FOOTHOLD    |  deploy RAT, persist across reboots
    +-------+--------+
            |
            v
    +----------------+
    | 4. ESCALATE    |  Local admin -> domain admin,
    |    PRIVILEGES  |  exploit misconfigs, steal tokens
    +-------+--------+
            |
            v
    +----------------+
    | 5. LATERAL     |  Move to other systems, map network,
    |    MOVEMENT    |  access file shares, find crown jewels
    +-------+--------+
            |
            v
    +----------------+
    | 6. DATA ACCESS |  Find sensitive data, stage for
    |    & STAGING   |  exfiltration, encrypt for ransom
    +-------+--------+
            |
            v
    +----------------+
    | 7. EXFIL OR    |  Steal data, deploy ransomware,
    |    IMPACT      |  destroy backups, demand payment
    +----------------+

The key insight is that every step in this chain is a potential detection point. If you can catch the attacker at step 2 or 3, you prevent the catastrophic damage that happens at steps 6 and 7. This is why defense in depth matters: you want multiple chances to catch the attacker.

Case Study 1: The AT&T Breach, When the Cloud Is the Target

In July 2024, AT&T disclosed in an SEC filing that attackers had copied call and text records for nearly all of its wireless customers, roughly 109 million accounts. The records covered May 1 to October 31, 2022, plus January 2, 2023. They included phone numbers, interaction counts, call durations and, for some records, cell site IDs. They did not include call content or names.

Here is how the attack chain unfolded:

The Attack Chain

Step	What Happened	Detection Opportunity
Credential theft	Snowflake customer credentials were harvested by infostealer malware on non-Snowflake systems, some years earlier	Rotate credentials; watch for your domains in infostealer logs
Initial Access	Attackers signed in to Snowflake accounts with those credentials; Mandiant found the affected accounts did not require MFA	Enforce MFA on all cloud platform accounts
Privilege Use	Used the valid credentials to access massive datasets through normal Snowflake queries	Monitor for anomalous query patterns and data volumes
Data Access	Queried six months of call/text metadata for about 109M accounts	Data loss prevention controls, query auditing
Exfiltration	Extracted data through Snowflake's normal export functionality	Monitor data export volumes, alert on large transfers

Lessons for Beginners

This breach is instructive because it was not technically sophisticated. AT&T was one of about 165 organizations notified in the same campaign. Google's Mandiant team tracked the attacker as UNC5537 and found that the affected Snowflake accounts did not require MFA. At least 79.7% of the accounts used had credentials exposed earlier, some not rotated for years. There was no zero-day exploit and no brilliant hacking.

The same campaign hit other Snowflake customers, including Ticketmaster and Santander. The common thread was the same: stolen credentials plus no MFA. Snowflake has since been phasing out single-factor password sign-ins across its platform.

Case Study 2: Chrome Extension Supply Chain Attack

Around Christmas 2024, attackers hijacked dozens of Chrome browser extensions. The best known victim was data-security company Cyberhaven: on December 24, an employee fell for a phishing email posing as Chrome Web Store developer support. The email led to a malicious OAuth app that gained publishing rights, and the attacker pushed a poisoned update. Researchers counted at least 36 compromised extensions, potentially exposing about 2.6 million users.

How Supply Chain Attacks Work

    SUPPLY CHAIN ATTACK FLOW
    =========================

    Legitimate Developer
    +-------------------+
    |  Creates useful    |
    |  browser extension |
    |  (e.g., VPN tool,  |
    |   productivity app)|
    +--------+----------+
             |
             | Publishes to Chrome Web Store
             v
    +-------------------+     +-------------------+
    | Chrome Web Store  |     |   ATTACKER         |
    | many installs     |     |                   |
    |                   |     | 1. Phishes the     |
    |                   |     |    developer       |
    |                   | <-- | 2. Steals OAuth    |
    |                   |     |    token for       |
    |                   |     |    Web Store       |
    |                   |     | 3. Pushes          |
    +--------+----------+     |    malicious       |
             |                |    update          |
             | Auto-updates   +-------------------+
             v
    +-------------------+
    | Every user who    |
    | auto-updated is    |
    | Now running        |
    | malicious code     |
    | in their browser   |
    +-------------------+

The Attack Chain

Step	What Happened	Why It Worked
Recon	Attackers identified popular extensions with large install bases	Extension developers are often individuals, not security teams
Initial Access	Phishing emails tricked developers into granting a malicious OAuth app access to their Chrome Web Store account	Developers are human; consent phishing needs no password
Code Injection	Pushed updates with data-stealing code disguised as legitimate functionality	Auto-update mechanism delivered malware silently
Data Theft	Malicious extensions harvested browser cookies, session tokens, and credentials	Extensions have broad access to browser data by design
Persistence	Updates looked legitimate, users had no reason to suspect anything	Trust in the official extension store

What This Teaches You

Supply chain attacks are one of the most important attack categories for aspiring security professionals to understand. They exploit trust relationships rather than technical vulnerabilities. The user did not do anything wrong. The extension store did not do anything wrong. The attacker found the weakest link in the chain (the individual developer) and exploited that trust to reach millions of end users.

This is the same pattern we saw with the SolarWinds attack in 2020 and the MOVEit breach in 2023. Attackers are increasingly targeting the software supply chain because one compromise can cascade to thousands of victims.

Case Study 3: Healthcare Ransomware at Change Healthcare

The February 2024 attack on Change Healthcare by the ALPHV/BlackCat ransomware group was devastating. Change, a UnitedHealth Group subsidiary, is one of the largest processors of medical claims and pharmacy payments in the United States. UnitedHealth's CEO, Andrew Witty, told Congress in May 2024 how it happened.

The Attack Chain

Step	Detail	Time
Initial Access	Compromised credentials for a Citrix remote access portal that did not have MFA	February 12, 2024
Movement and Exfiltration	Moved through the network and stole data (Witty did not give a step-by-step timeline)	Over the next nine days
Ransomware Deployment	Encrypted systems across the network	Nine days after entry
Impact	Claims and pharmacy payments across the U.S. disrupted for weeks	Weeks afterward

The aftermath was catastrophic. Witty confirmed UnitedHealth paid a ransom, reported at $22 million. The outage affected pharmacies, hospitals, and clinics nationwide. Patients could not get prescriptions filled. Providers could not submit insurance claims. Small medical practices faced serious cash flow problems.

The MITRE ATT&CK Framework

Now that you have seen how real attacks unfold, let me introduce you to the framework that the security industry uses to categorize and discuss attack techniques: MITRE ATT&CK.

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is a comprehensive matrix of everything attackers do, organized by tactical objective.

The Tactics (What Attackers Are Trying to Do)

Tactic	Description	Example
Reconnaissance	Gathering information about the target	Scanning for open ports, OSINT research
Resource Development	Setting up infrastructure for the attack	Registering lookalike domains, buying credentials
Initial Access	Getting into the target environment	Phishing, exploiting public-facing applications
Execution	Running malicious code	PowerShell scripts, malicious macros
Persistence	Maintaining access across reboots	Scheduled tasks, registry modifications, implants
Privilege Escalation	Getting higher-level permissions	Exploiting sudo misconfigs, token theft
Defense Evasion	Avoiding detection	Disabling logging, obfuscating malware
Credential Access	Stealing passwords and tokens	Keyloggers, credential dumping, pass-the-hash
Discovery	Learning about the environment	Network scanning, enumerating AD objects
Lateral Movement	Moving to other systems	RDP, SMB, SSH with stolen credentials
Collection	Gathering target data	Screenshots, keylogging, data from shared drives
Exfiltration	Stealing data out of the environment	DNS tunneling, cloud storage uploads
Impact	Damaging or disrupting the target	Ransomware, data destruction, defacement

How to Use ATT&CK as a Beginner

You do not need to memorize the entire framework. Here is how to use it productively:

1. Read breach reports through the ATT&CK lens. When you read about a breach, identify which tactics and techniques were used. This builds your pattern recognition.

2. Use it for study structure. Pick one tactic per week and study the techniques within it. This gives you a systematic way to learn about attacks.

3. Map it to defenses. For each technique, ask "how would I detect this?" and "how would I prevent this?" This is exactly how security teams think about defense.

4. Use the ATT&CK Navigator. MITRE provides a free web-based tool that lets you create heat maps of coverage. As you learn detection techniques, map them on the Navigator to visualize your knowledge gaps.

Common Attack Patterns You Will See Repeatedly

The same patterns repeat across public breach reports with remarkable consistency. Here are the ones you should know:

Pattern 1: Credential Theft to Data Exfiltration

    Phish User --> Steal Creds --> Login (no MFA)
         --> Find Data --> Exfil Data

    Frequency: credential abuse was the top way in
               (22% of breaches) in Verizon DBIR 2025
    Prevention: MFA, phishing-resistant auth, monitoring

This pattern was the most common initial access route in Verizon's 2025 DBIR. The AT&T, Change Healthcare, and Snowflake breaches all followed this pattern. It is also the simplest to prevent with proper identity controls.

Pattern 2: Exploit to Ransomware

    Exploit Vuln --> Gain Access --> Escalate Privs
         --> Disable Backups --> Deploy Ransomware

    Frequency: top way in (31%) in Verizon DBIR 2026
    Prevention: Patch management, network segmentation, offline backups

In the 2026 DBIR, exploitation of vulnerabilities overtook stolen credentials as the top entry point for the first time in the report's history. Ransomware groups scan the internet for known vulnerabilities, often ones that have had patches available for months. They exploit the vulnerability, gain a foothold, then work their way through the network until they can deploy ransomware to as many systems as possible.

Pattern 3: Supply Chain Compromise

    Compromise Vendor --> Inject Malicious Code
         --> Distributed via Update --> Thousands of Victims

    Frequency: third party involved in 48% of
               breaches (Verizon DBIR 2026)
    Prevention: Vendor assessment, software composition analysis, monitoring

This is the pattern from the Chrome extension attack, SolarWinds, and MOVEit. It is particularly dangerous because the malicious code arrives through trusted channels.

Pattern 4: Insider Threat

    Disgruntled Employee --> Abuses Existing Access
         --> Exfil Data --> Sells or Leaks

    Frequency: a minority of breaches, but costly
    Prevention: Least privilege, monitoring, behavioral analytics

Not all threats come from outside. Employees with legitimate access can cause tremendous damage. This is why the zero trust principle of least privilege is so important. Chapter 6 covers it.

Building Your Attack Analysis Skills

Here is how to develop the skill of analyzing attacks, which is valuable in virtually every security role:

Exercise 1: Breach Report Analysis

Pick any major breach from the last two years. Read at least three different accounts of the breach (the company's disclosure, a security vendor's analysis, and a journalist's report). Then answer:

1. What was the initial access vector?
2. What was the attacker's ultimate objective?
3. How long was the attacker in the environment before detection (dwell time)?
4. Which MITRE ATT&CK tactics were used?
5. What single control would have most likely prevented the breach?

Exercise 2: Kill Chain Diagramming

For the same breach, draw an attack chain diagram like the ones in this chapter. This forces you to think about the sequence of events and the dependencies between steps.

Exercise 3: Defense Mapping

For each step in your attack chain, identify:

• What would a defender see in the logs at this step?
• What detection rule could catch this?
• What preventive control could block this step?

Resources for Staying Current

Attack techniques evolve constantly. Here are the best resources for keeping up:

Resource	Type	What You Get
MITRE ATT&CK (attack.mitre.org)	Framework	Comprehensive catalog of attack techniques
Mandiant Threat Intelligence Blog	Blog	Detailed analysis of real-world campaigns
Krebs on Security	Blog	Investigative journalism on breaches
CISA Advisories (cisa.gov)	Government	Vulnerability and threat alerts
The DFIR Report (thedfirreport.com)	Blog	Step-by-step intrusion analysis
Darknet Diaries (podcast)	Podcast	True stories of hacking and cybercrime
SANS Internet Storm Center	Blog	Daily threat analysis and commentary

The Defender's Advantage

I want to end this chapter on an empowering note. While attackers only need to be right once, defenders have an advantage that is often overlooked: we have context.

Attackers are operating in an unfamiliar environment. They do not know the network topology, the normal patterns of behavior, or the detection capabilities deployed against them. Every step they take risks making noise. Every query they run could trigger an alert. Every lateral movement could be their last.

As a defender, you know what normal looks like. You know the network. You know the users. You know where the crown jewels are. That context, combined with understanding of how attacks actually work, is what makes effective security professionals so valuable.

The breaches we studied in this chapter all had something in common: the attackers were not geniuses. They exploited basic failures: missing MFA, unpatched systems, phished developers. Understanding how attacks work is not about matching wits with brilliant adversaries. It is about understanding the predictable patterns of exploitation and building defenses that address them systematically.

That understanding starts with identity, which shows up somewhere in a large share of breaches. That is where we are going next.