The attack chain, step by step

In Thinking like an attacker you listed what Mangrove Market has worth protecting and who might come for it. This lesson follows a threat as it moves. Security people call that sequence an attack chain. The idea was popularised as the "cyber kill chain" in a 2011 paper by researchers at Lockheed Martin. Many versions exist; this five-stage one is enough to reason with:

• Initial access. The first way in: a phishing message, a stolen or reused password, an internet-facing server with a known flaw that was never patched, or a supplier who already has a connection into your network.
• Foothold. Staying in. The attacker makes sure their access survives a reboot or a password change: a program that starts with the computer, a new account, a hidden mailbox rule, a saved login token.
• Privilege. Getting more power. A normal staff account can do little. The attacker hunts for admin rights: a password saved in a script, an admin who once logged in on the same laptop, a local flaw that lets a normal user act as an admin. This is privilege escalation.
• Spread. Using those rights to reach other machines, from one laptop to the file server and from the file server to the backup server. This is lateral movement.
• Action on objective. The reason for the whole attack: steal customer data, encrypt systems for a ransom, redirect payments, or quietly use your servers for the attacker's own work.

MITRE ATT&CK is the shared vocabulary defenders use for these steps. It is built from reports of real incidents. It groups attacker behaviour into tactics, the goal at that moment, and techniques, the method used to reach it. Every technique has an ID, so a detection rule, an incident report and a threat report can all point at the same thing. The five stages map onto its tactics roughly like this:

Real attacks are messier than a neat line. Some skip stages: a fraudster inside one mailbox may never need admin rights. Some loop back, spreading to a new machine and then hunting for better passwords there. The model still pays off, because it gives the defender two habits. First, put a control at every stage, so that when one fails, the next one still has a chance. This is called defence in depth. Second, look for the early stages. The time between the first click and the ransom note is often days and sometimes weeks. Every hour of that window is a chance to find the attacker while the damage is still small.

Why do the first steps so often involve a person? Verizon's yearly DBIR has found for years that a human element, someone tricked by a message, a reused or stolen password, or a plain mistake, is involved in most breaches. In recent editions that share has been well over half. That is a reason to design systems that expect people to be fooled sometimes. It is never a reason to blame the person who was.

Phishing: four warning signs, and why reports beat blame

Phishing is a message that pretends to come from someone you trust. It arrives by email, text message, chat, a phone call, even a QR code on a poster. It usually wants one of three things: your password typed into a fake sign-in page, a file opened on your computer, or a payment or favour done for the attacker. A message aimed at one named person with details about their job is called spear phishing.

You cannot memorise every trick, but nearly every phishing message shows at least one of four signs:

• The sender. The display name says one thing and the address says another. Look at the domain after the @ sign. Look-alike domains swap letters (rn for m), add words (mangrove-support) or use a different ending. Remember that a real address can send a fake request too, if the attacker controls that mailbox.
• Urgency or pressure. "Today", "or your account will be closed", "the CEO needs this now", "keep this between us". Pressure is there to stop you from checking.
• The link destination. The words of a link are not where it goes. On a computer, hover over it; on a phone, press and hold. Find the real site name, which is the part just before the first single slash. In https://partner.mangrove.example.verify-account.example/login the site is verify-account.example, whatever comes before it.
• An unusual request. Anything outside the normal way of working: pay a new bank account, buy gift cards, approve a sign-in prompt you didn't start, read out a code that was sent to your phone.

Here is how those signs look on a message that reached Mangrove store staff. The table shows the warning signs, not the whole message:

Now the part that matters most. Attackers send the same message to many people at once. The first report lets the security team search every inbox and pull out the other copies, block the sender and the fake site, and see who clicked. If someone did type a password, a report within minutes means the password is reset and every session is signed out before the attacker uses it. A report three days later means investigating an intrusion instead.

People only report quickly if reporting is safe. If clicking gets you named in a meeting, people hide their clicks, and the security team loses the one signal it most needs. So good teams put a one-click report button in the mail app, answer every report with a thank-you within minutes, never punish a click, and measure how many people report and how fast, rather than who clicked. Practice phishing tests are fine when they teach and harmful when they shame. And because some messages will always fool someone, the systems behind them should limit the damage: phishing-resistant sign-in such as passkeys refuses to work on a fake site at all. You will see why in Identity: passwords, MFA and passkeys.

Stolen passwords at scale: credential stuffing

Most people reuse passwords. When any website is breached, its list of email addresses and passwords tends to end up traded or published. Attackers then feed those pairs into automated tools that try them on other sites' login pages. This is credential stuffing, listed in ATT&CK as T1110.004. It is easy to confuse with two cousins, and the difference decides how you detect it:

• Brute force: many passwords against one account. Locking the account after a few failures stops it.
• Password spraying: one or two common passwords, such as a season and a year, against many accounts.
• Credential stuffing: real email and password pairs, a different password for every account, one or two tries each.

Stuffing works because each pair is correct somewhere. Only a small fraction of people reused that exact password on your site, but a list with millions of pairs still gives an attacker thousands of working accounts. Per-account lockout does not help, because each account sees a single failure and then nothing. To catch stuffing, you look across accounts. These are the signals defenders watch:

• Many accounts, few tries each. One IP address, or one device fingerprint, tries dozens of different accounts with one or two attempts per account. A real person types into one or two accounts.
• Many IP addresses. Attackers spread the traffic over hundreds or thousands of addresses so that no single one stands out. So watch the totals as well as each address.
• The success rate drops, then the successes look odd. If the Partner app normally sees about 9 in 10 logins succeed and one night sees 3 in 10 with ten times the traffic, something is guessing. The few successes that night come from new devices, new countries or accounts that never failed before.
• Unknown usernames and what follows a login. Many attempts for accounts that don't exist, then password resets, changed phone numbers, changed bank details and complaints a few days later.

The controls work at different points. MFA makes a correct password alone useless. Checking new passwords against lists of known-breached ones stops reuse at sign-up; NIST SP 800-63B requires services to compare new passwords against a blocklist that includes passwords from previous breaches. Rate limits per IP address, per account and across the whole login slow the tool down. Bot checks can be shown to suspicious attempts only. An alert on the overall success rate catches what per-IP rules miss. And telling users "a new device signed in to your account" turns every customer into a sensor.

Ransomware and double extortion

Ransomware encrypts files and systems so the owner cannot use them, then demands payment for the key. Most serious ransomware today is run by people at keyboards, who walk the whole attack chain over days or weeks. They get in through a phishing message, a stolen remote-access password or an internet-facing device with a known flaw. They gain admin rights. They find the backups and delete or encrypt them. Only then do they encrypt as many machines as they can at once, often on a weekend or a festival night when fewer people are watching.

Most groups now add double extortion: before they encrypt, they copy data out, and the note says "pay, or we publish it". Using the words from Thinking like an attacker, a good backup restores availability, but it cannot undo the loss of confidentiality. Some groups now skip encryption and only steal and threaten. Paying does not reliably fix either problem: keys sometimes fail, stolen data has been published or sold anyway, and payments fund the next attack. Government agencies such as CISA and the FBI advise against paying.

The defence is the attack chain again, with a control at every link:

• MFA on email, remote access and every admin account, so a stolen password is not enough to get in or to climb.
• Patching, internet-facing systems first. VPN gateways, firewalls and remote-access tools are prime targets. CISA's Known Exploited Vulnerabilities catalog lists flaws that are being used in real attacks, which makes it a good order for patching.
• Least privilege. Admins use a separate admin account only for admin work, never to read email. No shared local admin password on every laptop.
• Segmentation. Tills, store networks, office laptops, warehouse servers and backups sit in separate network zones, so one infected laptop can't reach the backup server. Networks, endpoints and the cloud goes deeper.
• EDR on every computer and server. It flags things like password theft from memory or one program rewriting thousands of files, and it lets the security team cut a machine off the network with one click.
• Offline or immutable backups that you have restored recently. A common rule is 3-2-1: three copies, on two kinds of storage, one away from the main site, with at least one copy that an attacker with admin rights can't delete. A backup you have never restored is only a hope.

Payment-change fraud: the breach that needs no malware

Business email compromise (BEC) skips most of the chain. The attacker either registers a look-alike domain or takes over a real mailbox, usually through phishing. With a real mailbox they often add a rule that forwards or hides certain emails, then sit and read. When an invoice is due, they send one short message from inside the real conversation: "our bank details have changed, please pay this account". No malware, no admin rights, and the request arrives at exactly the right time from the right person. The FBI's Internet Crime Complaint Center has for years reported business email compromise among the most costly crimes reported to it.

Spam filters and email authentication help at the edges. SPF, DKIM and DMARC make it harder to fake your exact domain, but they do nothing against a look-alike domain or a real mailbox in the wrong hands. The control that works is a process rule: any change to where money goes is confirmed by calling a number you already had, never one from the message. Add a second approver and a short waiting period for bank detail changes, keep payments inside your own app where you can, and alert on new mailbox rules that forward mail to outside addresses.