AI is making waves across sectors and throughout the world. It’s also amplifying cyberattacks.
Last time out in our Cybersec Risk Focus, we covered Zero Trust Architecture and discussed last year’s eye-popping 1,265% increase in phishing attacks.
Today we look in depth at how some of these attacks play out, with phishing increasingly the first step in elaborate, multi-stage malware schemes. These steal credentials, change configurations, open backdoors, and move laterally for data exfiltration and ransomware attacks. Some continue to lurk for months, seeing viable targets and waiting for the opportune time to act.
And by combining techniques, they can often be launched without immediate, visible impact, seeking to achieve their goals without arousing suspicion.
Today we look in depth at several examples.
The What
Whether it’s seemingly legitimate office documents or PDFs with embedded content, QR codes or direct links with multiple redirects (passing even through legit sites), using stolen credentials or moving from on-prem to cloud (and back), multi-stage malware attacks seek out areas of opportunity, often leveraging legitimate functionality to hide their behaviors.
While there’s variation in the phases based on the attacker, target, and objectives, multi-stage cyberattacks often move through a series of steps:
What’s notable about these attacks is both their patience and level of sophistication. The goal is to gain access secretly and, once in, make a broad exploration, execute necessary changes, and prepare for either a criminal operation (such as lock-down or theft) or ongoing surveillance across systems.
The How: Actual Cases
To understand how these attacks work, we can look at four real examples.
They target different devices, industries, and goals.
Some are Advanced Persistent Threats (APT). These are often part of state-sponsored campaigns.
Others operate at a smaller scale and focus on financial gain through extortion.
Operation Triangulation (2019–present)
This attack began more than four years ago, with major details becoming public late last year.
It targeted iOS devices and focused on surveillance.
The attack remains one of the most complex ever reported, with 14 steps in its full chain.
Target: iOS devices
Attack Objective: Exfiltrate data including passwords, files, text messages, and geolocation while avoiding detection.
Steps:
- Initial Access: Attackers sent iMessage users invisible messages containing a compressed file with an embedded PDF.
Users did not need to open the PDF.
In many cases, they were likely unaware that the message or file even existed.
- Payload Delivery: The compressed PDF ran code that opened Safari in the background.
It then loaded components from the attacker’s servers.
This stage used three different zero-day vulnerabilities.
One vulnerability was largely undocumented and may have been intended for debugging.
That suggests the attackers had deep knowledge of Apple systems or related hardware.
The process remained invisible to the user.
- Lateral Movement and Escalation: The attack operated in memory, which helped it avoid leaving traces.
Once active, it could:
- Monitor communications
- Track location
- Modify files
- Change processes
- Extract passwords
- Move files to attacker-controlled servers
Impacts: Memory-only execution and four zero-day exploits made the attack very difficult to detect.
Restarting the phone could remove the malware.
However, attackers could simply send another invisible message and begin again.
Apple patched the vulnerabilities last summer.
One major warning sign was a phone that failed to update properly.
The recommended response was a factory reset with iMessage disabled.
Users could then install all updates, including the security fixes.
Kaspersky Labs uncovered the attacks after finding them on thousands of its own phones.
Different nations later made accusations about who was responsible.
Several governments have since restricted iPhone use among certain officials.
BlueNoroff Cryptocurrency Campaign (2023-2024)
This multi-stage attack was linked to the suspected North Korean-sponsored BlueNoroff group.
It targeted Apple devices and aimed to remain active inside infected systems.
Target: Cryptocurrency-connected businesses using macOS-based systems
Attack Objective: Persistent surveillance, data breaches (exfiltration), and cyber-currency theft.
Steps:
- Initial Access: Attackers sent phishing emails with links to fake cryptocurrency news and updates.
The messages targeted specific people and often copied real influencers.
If clicked, the links opened malicious PDFs.
Some attacks even used real academic papers as part of the delivery method.
- Secondary Payload Delivery: The PDF opened as a decoy.
At the same time, a hidden script downloaded the malicious program.
The attack used official Apple notarization obtained in October.
It could run on both Intel-based and Apple-based systems.
It could also bypass Apple security features.
- Persistence Mechanism: The attack changed the “.zshenv” configuration file in the user’s home directory.
This allowed the malware to load during Zsh sessions.
The backdoor could then:
- Connect to the hacker’s server
- Run commands
- Download more payloads
- Stay active without raising alarms
- Exfiltration: Attackers could manipulate files and remove data directly from the infected system.
Impacts: SentinelLabs researchers linked these attacks to a year-long campaign.
The campaign stood out because of its use of a malicious Zshenv file for persistence.
It also showed that attackers could continue getting new Apple developer accounts and official notarization.
Storm-0501 Hybrid Cloud Attack (2024)
Target: U.S. government agencies and critical infrastructure sectors, including manufacturing, transportation, and law enforcement
Attack Objective: Persistent backdoor for surveillance and exfiltration, also ransomware deployment.
Steps:
- Initial Access: Attackers likely used access from earlier incidents, stolen credentials, and known flaws in unpatched servers.
They also took advantage of accounts with too many permissions.
- Credential Harvesting: Once inside, attackers used Impacket’s SecretsDump module.
This allowed them to collect credentials across devices.
They continued moving through the network until they gained the admin access they needed.
- Lateral Movement: Attackers used tools such as Cobalt Strike.
They moved across the network using stolen credentials.
Command-and-control (C2) tools helped them reach endpoints and issue commands.
The attack also moved from on-premises systems into the cloud.
Once there, the attackers created persistent backdoors.
- Payload Deployment: After gaining enough access, attackers could deploy ransomware across the network.
At the same time, sensitive files were moved to attacker-controlled servers.
- Final Stage: Attackers used double extortion.
They threatened to leak stolen files while also locking systems with ransomware.
In some cases, attackers stayed hidden instead of launching a visible attack.
This allowed them to maintain access for future activity or surveillance.
Impacts: Microsoft Security highlighted this campaign because of its move from on-premises systems to the cloud.
It took advantage of weaknesses in hybrid cloud environments.
Like the attacks above, it also created long-term backdoors while avoiding detection.
Altice Corporation Impersonation Campaign (2024)
A similar campaign was discovered in July.
Attackers pretended to represent the Altice corporation.
The attack targeted private businesses and started with infected Microsoft Office files.
Target: Private businesses, particularly in finance and telecommunications
Attack Objective: Credential theft, data exfiltration, and long-term persistence in enterprise networks.
Steps:
- Initial Access: Attackers sent convincing fake financial reports.
The phishing campaign targeted finance teams and employees likely to open them.
The emails included:
- Word files
- Excel files
- Links to fake reports
The documents were designed to look legitimate.
- Secondary Payload: A macro extracted a hardcoded DLL file.
The file was written to disk and then loaded into memory.
It downloaded a BAT file from a C2 server.
The attack also used:
- A private authentication key
- A backdoor
- A Cobalt Strike beacon
These tools supported further movement across the network.
- Evasion and Persistence: The beacon ran through a legitimate Windows error-reporting tool.
This helped the attack avoid malware detection.
By hiding inside trusted system processes, the malware was less likely to trigger alarms.
A secondary backdoor also allowed access to continue if another part of the attack was discovered.
- Data Exfiltration and Future Action: Attackers collected sensitive information.
The infected systems could also be used for future attacks.
In some cases, attackers could move into connected partner networks.
Impacts: The campaign used several stages to stay hidden.
Its main goal was to collect as much data and access as possible without revealing the full attack.
The Role of Skilled Cybersecurity Professionals
These attacks are dangerous because they are designed to blend in.
They may:
- Copy legitimate processes
- Use trusted applications
- Launch in several stages
- Move across multiple devices
- Stay hidden for long periods
This makes them difficult to uncover.
In some cases, the victim may never realize the system was compromised.
Attackers can also use one infected system as a starting point for wider access.
By the time unusual activity is discovered, attackers may already have spread across the network.
This can overwhelm defensive systems.
It can also hide:
- The original point of entry
- The attacker’s location
- The final goal
Defending against these attacks is becoming more difficult.
Attackers continue to add layers and new steps to avoid detection.
Organizations need threat intelligence that does more than track current risks.
It should also help teams act early.
Other defensive measures include:
- Phishing and cybersecurity training that includes current attack methods and realistic examples
- Utilizing zero-trust defenses that limit lateral movement after an attacker enters the network
- Data privacy engineering techniques that isolate, anonymize, and protect sensitive information
- Continued monitoring of network behavior to establish normal activity and detect unusual patterns
- Regular review of access permissions to make sure users only have the access they need
- Layered defensive systems that match the multi-stage methods used by attackers
- Regular security tests and assessments
- Fast patching of known vulnerabilities
Several of these attacks used zero-day flaws or unpatched systems.
Keeping software updated remains one of the most important defenses.
How IT Recruiting Services Help Fill Critical Gaps
Much of this is part of any set of cybersecurity best practices for 2025.
But that brings us to PTP and what we offer.
As attacks become more advanced, organizations cannot afford to fall behind on staffing or expertise.
This is especially important as demand for specialists continues to rise.
Cybersecurity risks are also becoming more common.
PTP can help both on-site and remotely.
Our team offers experience and global access to a broad range of cybersecurity talent.
Conclusion
This ends this edition of our cybersecurity risk focus.
Multi-stage malware is another step in the ongoing fight between attackers and target organizations.
AI is increasing the scale and speed of this conflict.
The complexity of these attacks is eye-opening.
Organizations must stay informed about:
- Security trends
- New attack types
- System behavior
- Network activity
- Defensive controls
Ongoing monitoring is also essential.
For help staying up to date, check out our bi-monthly cybersecurity roundups and the full range of articles in our PTP Report on cybersecurity.
References
4-year campaign backdoored iPhones using possibly the most advanced exploit ever, Ars Technica
Unveiling a Target and Multi-Stage Malware Attack, Seguranca Informatica
Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations, Microsoft Security
Storm-0501: Ransomware attacks expanding to hybrid cloud environments, Microsoft Security
New MacOS Malware Linked to North Korean Hackers, PC Mag
North Korean hackers use new macOS malware against crypto firms, BleepingComputer
A deep dive into multi-stage attacks and the need for complete visibility, TechRadar
