After the break-in: what attackers do once they are already inside
by Claudiu Hulea · IT Management Consultant
There’s a comforting myth about attacks: that once someone gets in, data theft or ransomware follows immediately. In reality, attackers take their time. They settle in, create backdoors, cover their tracks and disable detection tools — sometimes for weeks before doing anything visible. And the lesson that matters most: fixing the entry point is as important as removing the malware.
What happens once the attacker is already inside
A real incident analysis shows a methodical progression — not a strike, but a settling-in:
- Reconnaissance: the attacker enumerates running services and exfiltrates what they find — mapping the network.
- Persistence: they create unauthorized administrator accounts and enable Remote Desktop, so they can return at any time.
- Defense evasion: they disable Windows Defender and avoid EDR tools, so they stay unnoticed.
- Payload: they install malicious modules (for example BadIIS, for search-engine fraud), a cryptocurrency miner (XMRig) with obfuscated files, and download PowerShell scripts.
Each step is chosen to deepen access and make it hard to remove.
Why “dwell time” matters
The period during which the attacker stays undetected — dwell time — is exactly the window in which they turn from an intruder into a persistent problem. The longer they remain, the more backdoors they leave, the more credentials they steal, and the deeper they dig in. Fast detection isn’t a luxury; it shortens the window in which they can settle in.
The classic mistake: cleaning the symptom, leaving the door open
The most common failure in incident response is deleting the malware you found and stopping there. But if you don’t find out how the attacker got in, the vector stays open — and they come back, often through the backdoors they already planted. In one real case, fixing the SQL injection vulnerability that enabled entry was as essential as removing the installed malware. Cleanup without root cause is an illusion of safety.
What to do (the “assume breach” mindset)
Assume someone will get in — and prepare for after:
- A current asset inventory, across all physical and virtual infrastructure — you can’t defend what you don’t know you have.
- Reduce the attack surface: remove unnecessary services, ports and accounts.
- MFA on critical access, so a stolen account isn’t enough on its own.
- Consistent patching and monitoring of active applications.
- Investigate the root cause of every incident — find out exactly how the attacker got in, don’t stop at surface cleanup.
The takeaway
An attack doesn’t end at the moment of entry — that’s when the part where the attacker settles in actually begins. That’s why real defense means fast detection, limiting lateral movement, and incident response that closes the door, not just prevention. A security audit reduces the attack surface and checks what you have exposed, while a penetration test shows how far an attacker would get once inside. When you suspect a compromise, the right response is a root-cause investigation — exactly like in the anatomy of a Magento compromise.
Sources
Frequently asked questions
What is "dwell time"?
It is the period between when an attacker gains access and when they are detected or stopped. The longer it is, the more deeply the attacker settles in — creating backdoors, stealing credentials and moving laterally across the network.
Why is deleting the malware you found not enough?
Because removing artifacts doesn't close the entry vector. If you don't find out how the attacker got in (the root cause) and fix it, they come back — often through backdoors they already planted before being noticed.
What does "assume breach" mean?
It is the security mindset that assumes an attacker will succeed (or already has) in getting in. Instead of relying on prevention alone, you focus on fast detection, limiting lateral movement, and incident response.
How do I reduce risk in the post-breach phase?
A current asset inventory, removing unnecessary services, multi-factor authentication (MFA), consistent patching, monitoring/EDR, and investigating the root cause of every incident — not just surface-level cleanup.
