Cyber Kill Chain v2: Recon → Weaponize → Deliver → Exploit → Install → Move → C2 → Act

Lockheed Martin's 2015 extension of the 2011 Cyber Kill Chain. The original seven phases describe a single intrusion; v2 adds an explicit Lateral Movement phase -- post-exploitation is where modern intrusions actually live -- and a Campaign overlay, because one actor runs multiple intrusions in parallel. The key insight: the chain is per-intrusion, the campaign is per-actor.

The Kill Chain v2 phases

7 original phases + lateral movement · campaign overlay on top

campaign overlay

1. Reconnaissance — Research, identify, select targets

The attacker harvests information about the target -- people, technology, infrastructure, partner networks, exposed services. Most of this is passive (OSINT) and indistinguishable from legitimate research, which is why the phase is so hard to detect.

Who: Intel + SOC (detection is mostly passive here)
Defender goal: Reduce attack surface and detect targeted scanning that crosses into active recon.
Primary deliverables: Named target profile (people, tech, infra)
Exposed-service inventory (from the attacker's perspective)
Likely initial-access vectors
Common pitfalls: Treating passive OSINT as undetectable -- it is, but the planning it feeds is not.
Ignoring brand-impersonation prep (lookalike domains, IDN homographs).
Framework mapping: Maps to ATT&CK Reconnaissance (TA0043) + Resource Development (TA0042).

Use platform tool: OSINT / recon resources

Walk an incident through Kill Chain v2

An 8-step click-through using the Lazarus / Copperhedge sample already in the platform'sAI Report showcaseas the running example. Click a step to jump to that phase.

Step 1 of 8 · Reconnaissance

Scanning the React/Next.js surface

A partner feed + a CTF IoC report named Lazarus exploiting CVE-2025-55182. The WAF + load balancer logs show the list.txt scanning pattern hitting our Next.js 15.x prod apps.

Artifacts produced at this step

Target profile: 3 Next.js 15.x prod apps + 1 staging
Initial-access vectors: RSC deserialization RCE

next: Weaponization

Kill Chain v2 vs. the other frameworks on the platform

The Kill Chain is a content framework -- it describes what the adversary did. It does not replace ATT&CK, Diamond, or the process frameworks (F3EAD, F2T2EA, OODA); it feeds them.

					Note
Cyber Kill Chain v2	content	What phases did the intrusion pass through (incl. lateral movement)?	DFIR + SOC	/ti/kill-chain-v2	The 7-phase chain plus lateral movement and a campaign overlay.
Lockheed Kill Chain	content	What phases did the intrusion pass through?	DFIR + SOC	/d/kill-chain	The original 7-phase chain -- v2 is the extension that fixes its blind spot.
Unified Kill Chain	content	How does the full campaign unfold across In / Through / Out?	CTI + DFIR + SOC	/ti/unified-kill-chain	The 18-phase meta-framework (Pols 2017) synthesizing the kill chain + ATT&CK.
F3EAD	process	How does the team operate end-to-end on a target?	CTI + SOC + IR	/ti/f3ead	The workflow the team runs; the kill chain describes what the actor did.
F2T2EA	process	How do we locate, track, and act on a target?	Ops + IR (targeting)	/ti/f2t2ea	Joint targeting cycle -- the ops side of the same fight.
OODA Loop	process	How fast can we decide and act?	IR + SOC (tempo)	/ti/ooda	Boyd's decision cycle -- the tempo at which the team runs the chain.
MITRE ATT&CK	content	Which specific techniques did the adversary use?	Detection eng + CTI	/ti/mitre	The shared vocabulary -- each chain phase maps onto ATT&CK tactics.
Diamond Model	content	Who did what to whom, and how?	CTI + IR	/d/diamond	Per-event reconstruction that fills in the who behind the chain.
ACH	process	Which hypothesis best explains the evidence?	CTI analysts	/ti/ach	Structured analytic technique used when the chain looks like more than one actor.

References

Hutchins, Cloppert, Amin — "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains" (2011) — the original paper that defined the 7-phase Cyber Kill Chain.
Lockheed Martin — Cyber Kill Chain 2.0 (2015) — the extension adding Lateral Movement and the Campaign overlay to the original chain.
Lockheed Martin — Cyber Kill Chain site — the vendor's current framing of the 7-phase model.
MITRE ATT&CK — the technique-level vocabulary each chain phase maps onto.
NIST SP 800-61 rev 2 — Computer Security Incident Handling Guide — the IR phases that Detection, Containment, Eradication, and Recovery align to.
MITRE ATT&CK Blog: "F3EAD: Operationalizing Cyber Threat Intelligence" (2018) — connects chain-level content to the F3EAD process workflow on this platform.

Cyber Kill Chain v2: Recon → Weaponize → Deliver → Exploit → Install → Move → C2 → Act

Note

Cyber Kill Chain v2

content

What phases did the intrusion pass through (incl. lateral movement)?

DFIR + SOC

/ti/kill-chain-v2

The 7-phase chain plus lateral movement and a campaign overlay.

Lockheed Kill Chain

content

What phases did the intrusion pass through?

DFIR + SOC

/d/kill-chain

The original 7-phase chain -- v2 is the extension that fixes its blind spot.

Unified Kill Chain

content

How does the full campaign unfold across In / Through / Out?

CTI + DFIR + SOC

/ti/unified-kill-chain

The 18-phase meta-framework (Pols 2017) synthesizing the kill chain + ATT&CK.

F3EAD

process

How does the team operate end-to-end on a target?

CTI + SOC + IR

/ti/f3ead

The workflow the team runs; the kill chain describes what the actor did.

F2T2EA

process

How do we locate, track, and act on a target?

Ops + IR (targeting)

/ti/f2t2ea

Joint targeting cycle -- the ops side of the same fight.

OODA Loop

process

How fast can we decide and act?

IR + SOC (tempo)

/ti/ooda

Boyd's decision cycle -- the tempo at which the team runs the chain.

MITRE ATT&CK

content

Which specific techniques did the adversary use?

Detection eng + CTI

/ti/mitre

The shared vocabulary -- each chain phase maps onto ATT&CK tactics.

Diamond Model

content

Who did what to whom, and how?

CTI + IR

/d/diamond

Per-event reconstruction that fills in the who behind the chain.

ACH

process

Which hypothesis best explains the evidence?

CTI analysts

/ti/ach

Structured analytic technique used when the chain looks like more than one actor.

Cyber Kill Chain v2: Recon → Weaponize → Deliver → Exploit → Install → Move → C2 → Act

The Kill Chain v2 phases

Reconnaissance

Weaponization

Delivery

Exploitation

Installation

Lateral Movement

Command & Control (C2)

Actions on Objectives

1. Reconnaissance — Research, identify, select targets

Walk an incident through Kill Chain v2

Scanning the React/Next.js surface

Kill Chain v2 vs. the other frameworks on the platform

References

Cyber Kill Chain v2: Recon → Weaponize → Deliver → Exploit → Install → Move → C2 → Act

The Kill Chain v2 phases

Reconnaissance

Weaponization

Delivery

Exploitation

Installation

Lateral Movement

Command & Control (C2)

Actions on Objectives

1. Reconnaissance — Research, identify, select targets

Walk an incident through Kill Chain v2

Scanning the React/Next.js surface

Kill Chain v2 vs. the other frameworks on the platform

References