Weaponization Step in The Cyber Attack Cycle – Understand The 2nd Stage

In the previous post, we discussed the first phase of the Cyber Kill Chain i.e. Reconnaissance which involved gathering sensitive information about the target. Let’s move on and discuss the 2nd phase i.e. weaponization step in the cyber attack cycle in detail.

High-profile cyber criminals attack computer systems or communication networks to exploit the identified vulnerabilities and cause substantial damage to critical operations of infrastructure. They adopt sophisticated methods like weaponization techniques to get the job done.

What is Weaponization – Know The Prime Intent of Adversaries 

During the 2nd step, if you think from the attackers’ perspective, they plan on creating a weapon that can alter an experience for the user in a way that benefits the attacker. 

So, the goal here might be to change files or binary codes within them in preparation for emailing to the target. Or, modify websites to execute harmful code once one attempts to browse the site from a benign-appearing link.

Overall, the weaponization step in the cyber attack cycle is the preparation and staging phase of a cyberattack where the attackers have still not interacted with their intended target. On the other hand, in this stage, they mainly focus on creating their attack. That means they couple malicious software such as remote-access Trojan, or similar automated tools that can exploit and act as a weaponizer. For instance, an attacker may create a malicious MS Office Doc file that is intended to be attached to a phishing email.

Common Weaponization Tools Used by Adversaries

There are many weaponization tools available online. Hackers that are skilled and persistent can program their own complex malware to generate unique malware. However, anyone with an internet connection can easily obtain “point and click” tools. For example;

1. Metasploit: It is used for developing and executing exploit code against a remote target.
2. Lucky Strike: It helps create shell documents with encrypted code pieces that can infect a network.
3. BitsAdmin: Many commands in BITSAdmin are helpful for both legitimate and malicious actors. The tool’s variety of functions makes it reasonably easy to turn into a weapon. It is possible to include the BITSAdmin command in a weaponized file.
4. Veil Framework: It generates code that will bypass common anti-virus solutions.

Weaponization Step in the Cyber Attack Cycle From the Attacker’s Point of View

A ‘weaponizer’ joins malware and exploits it into a deliverable payload. Since in weaponization, the attackers are in the preparation stage, it’s most likely that they might be planning on generating malware using automated tools.

So, it’s important to understand how does the attacker’s mind work during this stage?

In this stage, they may try different things. Such as,

• They may obtain a weaponizer, either in-house or obtain through a public or private channel.
• They may select the ‘decoy’ document to present to the target in case of file-based exploits.
• It’s possible for them to select a backdoor implant and appropriate command & control infrastructure for operation.
• They may designate a specific ‘mission id’ and embed it in the malware or compile the backdoor and weaponize the payload.

So, understanding the possibilities is essential in order to identify & mitigate the actual problem.

Weaponization in Cybersecurity From Defenders’ Point of View

Weaponization is an important phase for defenders to understand. Though it may seem they can’t detect the weaponization step in the cyber attack cycle as it happens, they can infer by analyzing malware artifacts.

In practice, detection against weaponizer artifacts is often the more durable and resilient defense.

So, as a defender you can;

• Conduct full malware analysis from every aspect. Don’t limit the analysis to what payload it drops but analyzing how was it made is also important.
• Build weaponizer detections by identifying new campaigns and payloads that were only created because a weaponizer toolkit was reused.
• Analyze the timeline of when malware was created relative to when it was used. Since old malware is “malware off the shelf”, but, new malware might mean active, tailored operations.
• Collect metadata and files for future reference and analysis.
• Determine which APT operations tend to use similar weaponizer artifacts.

Are they publicly shared or privately held?

If everything is done in the right manner, then it can be possible to break the chain in the 2nd stage itself.

Watch Out For The Invaders

Given the nature of the weaponization step in the cyber attack cycle, the actions are mainly undetectable. As they say, you can’t stop people from making weapons. Likewise, you can’t prevent attackers from taking action to weaponize files.

However, as a stakeholder of the company, you can take proactive security measures and secure your IT infrastructure through vulnerability assessment and penetration testing (VAPT) and disaster recovery plans. 

Proactive due diligence and risk management can prevent attacks and secure IT assets to an extent. For cybersecurity guidance and help, contact our cyber experts now!