Offense informs defense

Defensive and offensive cybersecurity, through real incidents

The best defenses are built by understanding how attackers actually operate. Below: what each side does, how authorized offensive testing works, and seven documented cases showing the attacker's path next to the controls that would have stopped it.

Defensive security (blue team)

Protecting systems and data, detecting attacks early, and responding and recovering quickly.

Prevent: MFA, patching, secure configuration, least privilege, segmentation
Detect: logging, endpoint detection, monitoring and threat hunting
Respond: incident response plans, containment, communication
Recover: tested backups, continuity and lessons learned

Offensive security (red team)

Authorized professionals think and act like attackers to find weaknesses before criminals do. Done with permission, it's one of the fastest ways to improve defense.

Find: scanning and penetration testing
Emulate: red team exercises modeled on real threat groups
Validate: purple teaming, where attackers and defenders work together
Invite: vulnerability disclosure and bug bounty programs

How offensive testing compares

Each method answers a different question. Mature programs combine them.

Method	Question it answers	How it works	Typical cadence
Vulnerability scanning	What known weaknesses do we have?	Automated tools check systems against known flaws.	Continuous or monthly
Penetration testing	Can those weaknesses actually be exploited?	Experts try to break in within an agreed scope and time, and prove impact.	Annually and after major changes
Red teaming	Would we detect and stop a real adversary?	A goal-based campaign emulating a specific threat, testing people, process and technology.	For mature programs, periodically
Purple teaming	Do our detections work for these techniques?	Red and blue teams work side by side, running techniques and tuning detections live.	Quarterly or targeted
Vulnerability disclosure	What are outsiders finding?	A published policy that lets researchers report flaws safely, sometimes with bounties.	Always on

Authorization is what separates testing from attacking. Every offensive engagement needs written permission and agreed rules of engagement. In 2022 the U.S. Department of Justice said good-faith security research should not be charged under the federal Computer Fraud and Abuse Act. That policy is not permission to test systems you don't own; contracts and state laws still apply.

Real scenarios: attacker's path vs. defender's lesson

Documented incidents and one authorized CISA red team exercise. Techniques link to MITRE ATT&CK, the industry's shared catalog of attacker behavior.

RansomwareEnergyMay 2021

Colonial Pipeline

Ransomware hit Colonial Pipeline's IT network on May 7, 2021. To keep it away from the systems that control the pipeline, the company shut down the entire pipeline and paid a ransom. Full service restarted on May 12.

How the attack worked

Logged in through a legacy VPN profile that was no longer meant to be in use, with valid credentials.
Deployed ransomware on the business (IT) network.

T1133 External Remote Services T1078 Valid Accounts T1486 Data Encrypted for Impact

What would have stopped it

Inventory remote-access accounts and profiles, and disable any that aren't needed.
Require multi-factor authentication on every remote-access path.
Separate IT from operational technology so an IT incident doesn't force an operational shutdown.
Rehearse the shutdown decision before you need it.

RansomwareHealthcareFeb 2024

Change Healthcare

On February 12, 2024, criminals used stolen credentials to log in to a Change Healthcare Citrix remote-access portal that did not have multi-factor authentication. Nine days later, ALPHV/BlackCat ransomware encrypted systems, disrupting claims, pharmacy and payment services for providers across the country.

How the attack worked

Used compromised credentials on an internet-facing remote-access portal with no MFA.
Moved through the network and took data for nine days before deploying ransomware.

T1078 Valid Accounts T1133 External Remote Services T1486 Data Encrypted for Impact

What would have stopped it

Enforce MFA on every externally reachable login, with no exceptions for legacy or acquired systems.
Monitor for unusual logins and lateral movement; nine days is a window defenders can use.
Plan business continuity for services that others depend on.
Segment networks so one foothold can't reach everything.

Zero-day & data theftCross-sectorMay–Jun 2023

MOVEit Transfer (CL0P)

Starting May 27, 2023, the CL0P ransomware gang exploited a previously unknown SQL injection flaw (CVE-2023-34362) in Progress Software's MOVEit Transfer file-transfer product. It installed a web shell called LEMURLOOT and stole data from the underlying databases, then pressured victims to pay.

How the attack worked

Exploited a zero-day flaw in an internet-facing file-transfer application.
Installed a web shell to steal stored data, without needing to encrypt anything.

T1190 Exploit Public-Facing Application T1505.003 Web Shell

What would have stopped it

Keep an inventory of internet-facing software, including file-transfer tools.
Patch flaws on CISA's Known Exploited Vulnerabilities list first.
Look for unexpected accounts and files on exposed servers.
Don't let transfer servers keep sensitive data longer than needed, and know which vendors hold your data.

Social engineeringCross-sector2022 – present

Scattered Spider

A cybercrime group that targets large companies by calling IT help desks while posing as employees, flooding staff with MFA prompts, and hijacking phone numbers through SIM swaps. Once inside, it steals data and has deployed ALPHV/BlackCat ransomware, and has been seen joining victims' incident-response calls.

How the attack worked

Impersonated employees to get help desks to reset passwords and MFA.
Pushed repeated MFA prompts until someone approved one; used SIM swaps.
Installed legitimate remote-access tools to stay in.

T1656 Impersonation T1621 MFA Request Generation T1566 Phishing T1219 Remote Access Tools T1486 Data Encrypted for Impact

What would have stopped it

Use phishing-resistant MFA (FIDO/WebAuthn security keys or passkeys), which resists push bombing and SIM swaps.
Require strong identity checks before the help desk resets passwords or MFA.
Allow only approved remote-access tools, and audit for others.
Run incident communications on a separate, trusted channel.

Nation-stateCritical infrastructure2021 – present

Volt Typhoon

U.S. and partner agencies assess that this People's Republic of China state-sponsored group has been pre-positioning inside the IT networks of communications, energy, transportation and water organizations, so it could disrupt operations in a future crisis. In some networks it kept access for at least five years.

How the attack worked

Broke in through flaws in internet-facing routers, VPNs and firewalls.
“Lived off the land” with built-in tools like PowerShell instead of malware, and stole valid admin accounts.
Deleted logs selectively to hide its activity.

T1190 Exploit Public-Facing Application T1078 Valid Accounts T1059.001 PowerShell T1003.003 NTDS credential dumping T1070 Indicator Removal

What would have stopped it

Patch internet-facing appliances first, and replace devices past end-of-life.
Enable, centralize and retain logs, and watch how built-in admin tools are used.
Enforce phishing-resistant MFA and limit admin accounts.
Segment operational technology from IT.

Supply chainGovernment & enterprise2020

SolarWinds Orion

Attackers inserted malicious code into updates of SolarWinds Orion, widely used network-management software, which customers then installed as normal. The access was used against government agencies, critical infrastructure and private companies. CISA issued Emergency Directive 21-01, ordering federal agencies to disconnect or power down affected Orion products.

How the attack worked

Compromised a trusted vendor's software build so the malicious update arrived signed and expected.
Used the access to move into identity systems and cloud email.

T1195.002 Compromise Software Supply Chain T1078 Valid Accounts

What would have stopped it

Treat trusted management software as a risk: restrict its network access and watch its behavior.
Protect identity infrastructure (Active Directory, Microsoft 365) as critical systems.
Ask suppliers for secure-development evidence and software bills of materials (SBOMs).
Have an eviction plan for when trusted access is abused.

Authorized red teamCritical infrastructurePublished Nov 2024

CISA red team vs. a critical infrastructure organization

In an authorized assessment, CISA's red team emulated a real adversary. After phishing failed, the team got in through an unpatched internet-facing web server with a known flaw the organization had already identified but not fixed, then moved from the DMZ into the internal network through unsegmented paths. In a legacy environment without endpoint detection, it stayed undetected for months.

How the red team got in

Tried spearphishing first; it didn't work.
Exploited a known, unpatched flaw on an internet-facing server.
Moved inward through an unsegmented network and weak configurations.

T1566 Phishing T1190 Exploit Public-Facing Application T1078 Valid Accounts

What defenders should take from it

Fix known vulnerabilities on internet-facing systems; a known flaw left open is a decision, not an accident.
Segment the DMZ from internal networks and add network-layer monitoring.
Don't rely on endpoint tools alone; legacy systems need coverage too.
Make sure someone reviews and acts on alerts.

The patterns behind these cases

Pattern	Seen in	Defensive priority
Remote access without strong MFA	Colonial Pipeline, Change Healthcare, Scattered Spider	Phishing-resistant MFA on every external login
Internet-facing flaws	MOVEit, Volt Typhoon, CISA red team	Patch Known Exploited Vulnerabilities first; inventory what's exposed
Valid accounts and built-in tools	Volt Typhoon, SolarWinds, Scattered Spider	Behavioral monitoring, centralized logs, fewer admin accounts
Flat networks	Colonial Pipeline, Change Healthcare, CISA red team	Segment IT, OT and sensitive systems
Trusted third parties	SolarWinds, MOVEit	Supplier assurance, SBOMs, least-privilege for vendor tools

Trusted resources

MITRE ATT&CKHow attackers operate, technique by technique MITRE D3FENDDefensive countermeasures mapped to attacker techniques CISA Known Exploited VulnerabilitiesFlaws attackers are using now; patch these first CISA Performance Goals (CPGs)Baseline protections for every organization NIST Cybersecurity Framework 2.0Govern, identify, protect, detect, respond, recover #StopRansomwareCISA and FBI ransomware guidance and advisories

See your environment the way an attacker would

Strat Cyber Advisors helps you find and fix these gaps through security audits and risk strategy, then turn the lessons into a defensible program.

Take a free readiness scorecard Talk to us

Educational content summarized from the public sources linked on each scenario; details reflect those sources at publication and investigations may have continued since. Attack descriptions are kept at a high level on purpose. Strat Cyber Advisors is not affiliated with CISA, MITRE, NIST or the organizations named. Sources verified October 2026.

Work with
Strat Cyber

Need cybersecurity support? Share your project details. We're here to safeguard your digital assets.

Email: advisors@stratcyberadvisors.com
Members: Create free account · Sign in

Join free to unlock in-depth readiness assessments, executive and vendor toolkits, advisories and the briefing archive.