During a quarterly vulnerability scan, a security analyst discovered unused uncommon ports open and in a listening state. Further investigation showed that the unknown application was communicating…

Exploitation is the step where the attacker successfully breaches a vulnerability to gain access, but the C2 communication indicates a phase after initial exploitation.

The discovery of command and control (C2) communication on an infected server signifies that the attacker has successfully gained access (exploitation), established a persistent presence (installation), and is now communicating with their remote infrastructure to achieve their ultimate goals. This activity falls under the 'Actions on Objectives' phase of the Cyber Kill Chain, where the attacker executes commands to achieve their ultimate mission, such as data exfiltration or further compromise.

Weaponization is the phase where the attacker bundles an exploit with a backdoor into a deliverable payload, which occurs before delivery and exploitation.

Delivery is the phase where the weaponized payload is transmitted to the victim, occurring before exploitation and C2 communication.