Employee clicks on fake email browser Outbound connection Exploit server Exploit response Phase 1: Exploit penetrates user workstation A. B. D. C.

Phase 2: Backdoor program is installed browser Exploit makes second outbound connection Payload Server Backdoor program is downloaded Phase 2: Backdoor program is installed A. B. C.

Hacker’s control server Backdoor connects to hacker Hacker’s control server Hacker explores internal network Phase 3: Remote access A. B. C.

Hacker collects intellectual property Hacker’s control server B. Hacker downloads stolen data Phase 4: Information theft

Web server that has been compromised by hacker Backdoor connects to compromised web server Web server that has been compromised by hacker Backdoor downloads base64 encoded file containing instructions Command and Control A. B. D. C.

Instructions specify where to connect to Hacker Command and Control (Detail) C. Hacker’s control server Web server that has been compromised by hacker A. B.