Harry. a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear…

Preparation is the phase that precedes the attack and involves reconnaissance, target research, and tool staging - activities that occur before any intrusion attempt is made.

Cleanup is the final APT phase in which the attacker removes artifacts, logs, and backdoors to conceal their presence after objectives have been achieved.

Persistence is the phase that follows initial intrusion, during which the attacker establishes mechanisms to maintain long-term access - it assumes an existing foothold has already been created.

Initial Intrusion is the APT lifecycle phase in which the threat actor uses attack vectors - such as spear-phishing emails or exploitation of internet-facing servers - to breach the target environment for the first time. Successfully deploying malware to establish an outbound (command-and-control) connection is the defining outcome of this phase. All of Harry's described actions - spear-phishing, vulnerability exploitation, and malware deployment - align precisely with this phase.