How attacks happen: threat actors, the attack lifecycle and MITRE ATT&CK

Defenders who understand how attackers think can stop attacks earlier. This lesson explains who attacks, why, and how attacks unfold step by step.

Threat actors

Common attacks seen in Kenya and the region

• Business email compromise (BEC): criminals take over or fake an email account and redirect supplier payments.
• Ransomware: files encrypted and data stolen; payment demanded.
• SIM swap and mobile money fraud: taking over a phone number to reset accounts.
• Phishing and smishing: fake bank, KRA, eCitizen or delivery messages.
• Website attacks: outdated WordPress plugins, weak admin passwords.
• Insider fraud: staff abusing access to systems.

The attack lifecycle (cyber kill chain)

Lockheed Martin's Cyber Kill Chain describes attack stages:

Key idea: break any link and the attack fails. The earlier you detect, the cheaper the incident.

MITRE ATT&CK: a map of real attacker behaviour

MITRE ATT&CK (attack.mitre.org) is a free knowledge base of tactics and techniques seen in real attacks:

• Tactics: the attacker's goal at each step (e.g. Initial Access, Persistence, Privilege Escalation, Credential Access, Lateral Movement, Exfiltration, Impact).
• Techniques: how they achieve it (e.g. Phishing, Valid Accounts, Brute Force, Data Encrypted for Impact), each with an ID such as T1566 (Phishing).

Defenders use ATT&CK to:

• Check which techniques they can detect and which they can't (coverage gaps)
• Write detection rules for specific techniques
• Describe incidents in a common language
• Plan security tests that mimic real attackers

Map an incident to ATT&CK (run it)

incident = [
    ("Staff member clicked a fake 'invoice' email link", "Initial Access", "Phishing (T1566)"),
    ("Attacker logged in with the stolen password", "Initial Access / Persistence", "Valid Accounts (T1078)"),
    ("Created an email rule hiding replies from the bank", "Defense Evasion", "Email hiding rules (T1564.008)"),
    ("Sent the finance team new 'bank details' for a supplier", "Impact", "Financial theft (T1657)"),
]

print("Business email compromise, step by step:\n")
for i, (event, tactic, technique) in enumerate(incident, 1):
    print(f"{i}. {event}")
    print(f"   Tactic: {tactic} | Technique: {technique}")

print("\nControls that would have broken the chain:")
for c in ["Phishing training and email filtering", "MFA on email accounts", "Alerts for new mailbox rules", "Phone call-back to verify any change of bank details"]:
    print(" -", c)

Defence in depth

No single control stops everything. Layer them: training, email filtering, MFA, patching, endpoint protection, network segmentation, monitoring, backups and an incident response plan. If one layer fails, the next can still stop or detect the attack.

Summary

• Threat actors include criminals, fraud gangs, hacktivists, nation-states, insiders and script kiddies.
• The kill chain shows attack stages; breaking any stage stops the attack.
• MITRE ATT&CK maps real tactics and techniques; defenders use it for detection and testing.
• Use defence in depth: layered controls.