Which step is involved in getting malware to run on the inside of the targeted organization?

Weaponization and Delivery are about creating and transmitting the malicious payload, not running it inside the target.

Exploitation is the act of successfully leveraging a vulnerability to gain unauthorized access to a system, which is necessary to get malware inside. Installation then involves establishing a persistent presence (e.g., installing a backdoor, setting up services) so the malware can continue to run and maintain access within the targeted organization.

Command and Control (C2) is the communication channel between the attacker and the compromised system, used after the malware is already running.

Actions on the Objective refer to the attacker's final goals (e.g., data exfiltration, destruction) performed after C2 and persistence are established.