1. Employee clicks on fake email
browser
Outbound connection
Exploit server
Exploit response
Phase 1: Exploit penetrates user workstation A. B. D. C.

2. Phase 2: Backdoor program is installed
browser
Exploit makes second outbound connection
Payload Server
Backdoor program is downloaded
Phase 2: Backdoor program is installed A. B. C.

3. Hacker’s control server
Backdoor connects to hacker
Hacker’s control server
Hacker explores internal network
Phase 3: Remote access A. B. C.

4. Hacker collects intellectual property Hacker’s control serverB.
Hacker downloads stolen data
Phase 4: Information theft

5. Web server that has been compromised by hacker
Backdoor connects to compromised web server
Web server that has been compromised by hacker
Backdoor downloads base64 encoded file containing instructions
Command and Control A. B. D. C.

6. Instructions specify where to connect to Hacker
Command and Control (Detail) C.
Hacker’s control server
Web server that has been compromised by hacker A. B.