After gaining access to a business network, an attacker may steal credentials, expand permissions, move between systems, and take or encrypt data. Understanding the cyberattack lifecycle helps businesses strengthen their defenses. Continuous monitoring and a coordinated response can help identify and contain an attack before it spreads.
Key Takeaways
- Initial access is often the beginning of an attack. What the intruder can reach next depends on your account permissions and security controls.
- Attackers can use legitimate accounts and tools, making their activity harder to distinguish from normal work.
- Detection and response belong together. An alert is only useful when someone investigates it and takes action.
- Backups support recovery, but they cannot undo the theft of sensitive information.
- Business leaders should know who monitors their systems, who can contain an attack, and what happens after hours. The five questions near the end of this article are a good place to start.
In June 2024, California-based Patelco Credit Union detected a ransomware attack that knocked out most of its banking services for about two weeks. Investigators later found that an unauthorized party had been inside its network since May 23, more than a month before the June 29 detection date. Patelco later notified 726,000 people that their personal information may have been exposed.
That timeline illustrates an important point: a business may discover an attack long after it began. For business owners, that raises a question: what could an attacker reach before someone realizes they are there?
At GoodSuite, we help businesses reduce the risk of an attack and prepare to respond if one happens. That starts with understanding how an attacker could get in, what they could access, and who would detect the activity and take action.
How Does a Hacker Get Into a Business Network?
A hacker may get in through a stolen password, a phishing email, unpatched software, or an insecure remote-access service. Security teams call that first entry initial access.
Some attackers research a specific business. Others scan for vulnerable systems and target whichever organizations they can access.
For example, someone on your team might receive an email asking them to open a shared document. The link takes them to a fake Microsoft 365 login page. If they enter their password, the attacker can steal it. Some phishing attacks can also capture an active login session, allowing access even after the person completes an MFA prompt.
We recommend several protections that work together: keeping software updated, securing remote access, helping staff recognize suspicious requests, and using phishing-resistant MFA, such as passkeys or hardware security keys. These measures reduce the ways an attacker can get in.
What Are the Stages of a Cyberattack After Initial Access?
Once an attacker gets in, they may look for ways to keep access, reach other systems, and find information they can steal or use. These activities form part of the cyberattack lifecycle. They don’t always happen in the same order, and some attacks involve only a few of them.
1. Maintaining Access
An attacker may create another way in so that changing the stolen password or restarting a computer won’t cut off access. This is called persistence.
They might create an unauthorized account, change account settings, or install remote-access software. That’s why the response team checks for other ways the attacker could return, rather than stopping at a password reset.
2. Mapping the Environment
Once inside, an attacker may check which servers and accounts they can reach, where sensitive files are stored, and what security tools are installed. Security teams call this discovery.
Your team may still be able to work normally during this stage. The attacker may gather information without making changes that cause obvious problems.
3. Stealing Credentials and Expanding Permissions
An attacker may look for passwords or other login information that lets them access additional accounts. An administrator’s account is especially valuable because it can let them change systems, software, and other users’ access.
Stealing login information is called credential theft. Gaining higher permissions is called privilege escalation. An attacker may use stolen administrator credentials to gain that greater access.
Giving people only the access they need for their work, and using separate accounts for administrative tasks, can limit the damage from a compromised account.
4. Moving Between Systems
An attacker may use access to one computer to reach another workstation or a server. This is called lateral movement.
MITRE’s ATT&CK framework explains that attackers can use legitimate credentials and built-in tools to move through a network. That can make their activity look like authorized IT work.
Restricting which systems can connect to one another helps limit how far an attacker can go. Monitoring helps security teams spot unexpected connections and investigate them.
5. Collecting Data or Disrupting the Business
An attacker may collect customer records, financial documents, or email conversations and copy them outside the business. That theft is called exfiltration.
They may also use ransomware to lock files and demand payment. Others may use a compromised email account to send fraudulent payment requests or tell customers to use different banking details.
Backups can help restore files, but they cannot undo data theft or a fraudulent payment. Limiting access to sensitive information and monitoring for suspicious transfers also help protect the business.
How Can a Security Team Detect an Attack?
Security teams look for activity that could indicate someone is accessing accounts or systems without permission. A security operations center, or SOC, uses monitoring tools and analysts to spot and investigate that activity.
An unfamiliar sign-in could be someone on your team traveling or using a new device. If that sign-in is followed by the creation of an administrator account and connections to several servers, an analyst can investigate whether those actions are authorized.
Other warning signs include unexpected changes to account permissions, unfamiliar remote-access software, attempts to turn off security tools, or large numbers of files being copied.
The team also checks whether these events are connected. Several actions viewed together may reveal an attack that would be harder to recognize from a single alert.
Monitoring should cover all the systems your business uses, including computers, servers, email, and cloud accounts. Coverage gaps can let an attacker’s activity go undetected.
What Happens When an Attack Is Detected?
The security team’s first priority is to stop the attacker from doing more damage. Depending on what happened, that could mean disconnecting a computer, disabling an account, signing out active sessions, or blocking the attacker’s connections.
The team also checks how the attacker got in, which systems they reached, and whether information was stolen or changed. It saves logs and other evidence, removes unauthorized accounts or software, and addresses the problem that allowed access.
Before bringing affected systems back online, the team checks for any remaining attacker access. Restoring files from a backup won’t solve the problem if the attacker can still get in.
Your response plan should name who can approve these actions, who keeps leadership informed, and who contacts your insurer or legal counsel.
Those decisions are easier to make before an attack. If a server is compromised overnight, the response team should know whether it can take that server offline immediately, who to notify, and which parts of the business will be affected.
What Should Business Owners Ask Their IT Provider?
Ask your IT provider to explain what happens if someone gains access to your systems:
- Which computers, servers, and cloud accounts do you monitor?
- Who checks alerts at night and on weekends?
- Can your team disable an account or disconnect a device immediately, or do you need our approval?
- How do you check whether the attacker accessed other systems or created another way to get in?
- When did we last practice our response plan and test restoring files and systems from backups?
The answers should make clear what is covered, who takes action, and when your team gets involved.
Frequently Asked Questions
Can a hacker remain in our network if everything seems normal?
Yes. An attacker may use a legitimate account, gather information, or maintain access without immediately disrupting work. Normal-looking systems do not prove that access is authorized. Monitoring accounts and devices helps identify suspicious behavior before a visible failure.
Does changing a compromised password stop the attack?
It can help, but it may not be sufficient. Responders also check active sessions, unauthorized account changes, other compromised credentials, and ways the attacker may have maintained access. The right steps depend on what the investigation finds.
Is antivirus enough to protect a business from a cyberattack?
Antivirus helps detect and block malicious software, but an attacker using stolen credentials may access accounts without installing malware. Businesses also benefit from monitoring that can identify suspicious activity and a security team that can respond. Managed detection and response (MDR) is one way to get that support. If you’re unsure what protection you have, ask your IT provider who monitors your systems and what happens when an attack is detected.
Next Steps
You’ve read how an attack develops. Now watch it happen.
In Inside the Breach: From Initial Access to Detection & Response, GoodSuite and our Managed Detection and Response partner, Blackpoint Cyber, demonstrated how an attacker gains access, compromises credentials, and moves between systems. Viewers also followed the security operations center’s analysts as they detected the activity and responded in real time.
Watch the replay here to see both sides of a cyberattack in action.
Then consider your own business: Who would spot an attack on your systems and take action to stop it?
If you’re unsure, talk with our team at GoodSuite. We’ll review your security coverage, how access is controlled, and whether you have a clear response plan. Our cybersecurity services include 24/7 monitoring, threat detection and response, vulnerability management, and staff training.
