Advanced Targeted Attacks — The Attack · PDF fileAdvanced Targeted Attacks ... STAGE 1: System Exploitation • Drive-by attacks and casual browsing • Delivered via Web or email

Copyright (c) 2012, FireEye, Inc. All rights reserved. | CONFIDENTIAL 1

Advanced Targeted Attacks — The Attack Lifecycle


Today’s Cybercriminal Profile

•  Armed with drag and drop toolkits •  Committed to multi-stage, multi-

vector plan of attack •  Goal to breach defenses to

obtain valuable information


STAGE 1: System Exploitation

•  Drive-by attacks and casual browsing •  Delivered via Web or email

•  Blended attack across multiple threat vectors


STAGE 2: Binary Payloads Downloaded, Long-Term Control Established

•  Additional malware binaries downloaded •  One exploit equals dozen of infections

on same system

•  Criminals establish long-term control mechanisms


STAGE 3: Malware Callbacks

•  Malware calls criminal servers for instruction

•  Replicates and disguises itself to avoid scans

•  Malware communications allowed through firewall


STAGE 4: Data Exfiltration

•  Acquired data staged for exfiltration •  Exfiltrated over common protocols

•  Arrives at external server controlled by criminal


STAGE 5: Malware Spreads Laterally

•  Establish long-term network control •  Malware spreads laterally

•  Conducts reconnaissance


FireEye Malware Protection System

•  Next generation, advanced threat protection •  Industry’s only fully integrated solution •  Protects against advanced attacks

across multiple vectors •  Addresses all stages of advanced

attack lifecycle •  Effective against advanced persistent

targeted attacks

Advanced Targeted Attacks — The Attack · PDF fileAdvanced Targeted Attacks ... STAGE 1: System Exploitation • Drive-by attacks and casual browsing • Delivered via Web or email

Documents