Vulnerability discovery — Attackers identify weaknesses through security research, automated scanning, bug bounty programs, or by purchasing intelligence on dark web marketplaces.
Exploit development — The attacker creates or obtains code specifically targeting the identified vulnerability, often testing it against lab environments first.
Delivery — The exploit reaches targets through vectors including phishing emails, malicious websites, drive-by downloads, or direct network attacks against exposed services.
Execution — The exploit runs on the target system, bypassing security controls to achieve the attacker's immediate objective such as code execution or authentication bypass.
Post-exploitation — Attackers leverage initial access for privilege escalation, lateral movement, persistence establishment, and data exfiltration.
