Cyberattack Explained: Stages, Types and What to Do

A cyberattack is a deliberate attempt to break into, disrupt or steal from a computer system, network or account. Most attacks follow the same seven steps, and you can break the chain at almost any of them.

"Cyberattack" is trending in the US right now. We have not confirmed which incident is driving the searches, so check the affected company's status page or your national CERT for live details. The advice below applies no matter which incident it is.

The seven stages of a cyberattack, and where you can stop each one

The best-known model is the Lockheed Martin Cyber Kill Chain. It splits an attack into seven stages. Defenders use it to decide where to put controls.

The lesson is simple. Early stages are cheap to block. Late stages are expensive to clean up.

Common cyberattack types and the first fix for each

Not every attack needs seven neat stages. This table shows the types you will meet most often and the single control that helps most.

Patching deserves special attention. When a browser flaw is actively exploited, update the same day. Our write-up of the Google Chromium vulnerability shows what a patch notice looks like and what to do.

A worked example: from one email to encrypted files

This is an illustrative scenario, not a real incident. It shows how the stages connect.

1. An attacker finds the finance manager's name on a company website (stage 1).

2. They send a fake invoice with a link to a login page that looks like Microsoft 365 (stages 2 and 3).

3. The manager types their password. The attacker logs in from another country (stage 4).

4. The attacker creates a hidden mailbox rule that forwards invoices to an outside address (stage 5).

5. Over two weeks, they learn how payments work. They then send a convincing bank-change request to a customer (stage 7).

Where could this have been stopped? Phishing-resistant MFA would have blocked step 3. An alert on new mailbox forwarding rules would have caught step 4. A call-back rule for bank changes would have blocked step 5. Any one of these breaks the chain.

What to do in the first hour after a suspected attack

Stay calm and work in this order. Speed matters, but so does not destroying evidence.

1. Isolate, don't wipe. Unplug the network cable or turn off Wi-Fi on the affected device. Do not reformat it yet.

2. Change passwords from a clean device. Start with email, banking and admin accounts. Sign out all active sessions.

3. Call your IT or security contact. Write down times, what you clicked and what you saw.

4. Preserve logs. Do not clear event logs or delete suspicious emails.

5. Report it. In the US, businesses and individuals can file with the FBI's IC3 at ic3.gov. If money was sent, call your bank right away.

These commands help you look for odd activity. Run them only on systems you own or administer. lastb, ss -tupn and the Get-WinEvent Security-log query need elevated rights: use sudo on Linux, and run PowerShell as Administrator on Windows.

# Linux: recent logins and failed logins
last -a | head -20
sudo lastb | head -20

# Linux: active network connections with process names
sudo ss -tupn

# Windows PowerShell (run as Administrator): failed logons (event 4625) in the Security log
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

# Windows: active connections with process IDs
netstat -ano

Look for logins at odd hours, unknown IP addresses and processes talking to servers you do not recognize. If you find any, escalate rather than trying to fix it alone.

A prevention checklist you can finish this week

These steps cost little and stop a large share of common attacks.

• Turn on MFA everywhere. Use an authenticator app or a passkey instead of SMS where possible. Start with email and admin accounts.

• Block legacy sign-in. In Microsoft 365, disable legacy authentication with a Conditional Access policy.

• Enable automatic updates. On Debian or Ubuntu servers, run sudo apt install unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades. Reboot when the kernel updates.

• Follow the 3-2-1 backup rule. Keep three copies, on two media types, with one offline or immutable. Test a restore every quarter. An untested backup is a guess.

• Publish email authentication. Set up SPF and DKIM, then publish a DMARC record. Start with p=none to monitor, then move to p=quarantine. Once legitimate mail passes, move from p=quarantine to p=reject.

• Remove standing admin rights. Daily work should use a normal account.

• Add a payment rule. Confirm any bank-detail change by calling a known number, never one in the email.

• Write a one-page response plan. List who to call, where backups live and who can approve shutting systems down.

Turning cyberattack knowledge into a security career

If this topic interests you, defensive roles are a natural next step. A security analyst spends the day on the stages above: spotting delivery, catching command-and-control traffic and limiting damage.

The CompTIA CySA+ exam focuses on detection and response. You can get the CS0-003 CompTIA CySA+ voucher for $224.99. The code is emailed within 12 hours of payment and also shown in your account. If you prefer the attacker's view, try our PT0-003 PenTest+ 8-week lab plan.

Build a home lab, read real incident reports and practice the commands above. Hands-on work sticks better than memorizing definitions.

Sources

• Google Trends: cyberattack (US)