Advanced cyber operations rarely depend on a single dramatic exploit.
Legitimate credentials may be stolen.
Real accounts may be used by someone else.
Normal administrative functions may be abused.
Infrastructure may be distributed across multiple countries.
Routes may change as defenders begin to investigate.
The objective may not be destruction itself.
Access can be valuable because it creates options.
A compromised energy network, communications system, government service, or other critical infrastructure may be used selectively, at a chosen time and place, to create political, economic, or strategic pressure.
Attribution is also difficult.
The server from which an operation appears to originate may have little connection to the organization ultimately directing it.
This section examines credential abuse, persistence, operational infrastructure, attribution, state-linked cyber activity, and the use of critical infrastructure as a strategic instrument rather than simply a target for destruction.