A security analyst is investigating a recent incident at a s…
A security analyst is investigating a recent incident at a small e-commerce company. The analyst has gathered the following information: Initial Observation: An employee received an email with a malicious PDF attachment disguised as an invoice. Action: The employee opened the PDF, which exploited a known vulnerability in their PDF reader software. Result: The exploit allowed the attacker to install a remote access tool on the employee’s computer. Further Action: The attacker then used the remote access tool to move laterally within the network, eventually gaining access to the company’s customer database server. In which phase of the Cyber Kill Chain did the employee opening the malicious PDF attachment occur?
Read Details