How do attackers develop capabilities?

What “develop capabilities” means for an attacker

Attackers do not usually improvise their way through an operation. Capability development is the work that happens before deployment: building payloads, refining tooling, staging infrastructure, rehearsing workflows and tuning tradecraft so the campaign can run reliably under pressure. That preparation reduces noise, improves repeatability and makes later detection harder.

The important distinction is that capability development is not only about writing malware. It also includes the surrounding operational system, such as command channels, delivery methods, fallback paths, credential handling and evasion checks. Those supporting pieces are often what turns a rough proof of concept into an operational capability.

What attackers build before they go operational

At a practical level, attackers develop three things in parallel: artefacts, access paths and procedures. Artefacts include malware, loaders, scripts, phishing kits, payload builders and testing harnesses. Access paths include hosting, redirectors, compromised servers, cloud resources and any other infrastructure needed to deliver or control the operation. Procedures include how to gain initial access, move through the environment, exfiltrate data and recover if a route fails.

That preparation phase often mirrors legitimate software and operations work. Attackers test whether payloads detonate in sandboxes, whether command traffic is visible to security tools, whether antivirus or EDR reacts, and whether infrastructure survives basic scrutiny. A useful practical reference point for defenders is the MITRE ATT&CK Enterprise Matrix, which helps map the techniques that attackers commonly rehearse and refine.

For modern operations, capability building may also involve identity abuse, token theft, session replay or automation around account access. That is why defender visibility into staging behaviour matters, not just the final intrusion event. When the same environment is used repeatedly to test delivery, payloads or access methods, those rehearsal patterns can be more telling than the eventual attack.

How to recognise capability development in progress

Capability development usually leaves a trail, even when the attacker has not yet launched. Look for repeated short-lived builds, unusual compilation or packaging activity, small-scale execution tests, infrastructure changes that appear temporary, and access from systems that do not normally perform development work. On compromised hosts, repeated staging activity, archive creation, encoded blobs, and rapid iteration over tooling are common warning signs.

Defenders should also pay attention when the same actor or host shows both experimentation and operational tradecraft. A payload that is modified several times, a server that is used first for testing and later for delivery, or a login pattern that precedes external communication can indicate capability maturation rather than a one-off intrusion attempt.

External threat intelligence can help frame the broader pattern. CISA cyber threat advisories are useful when you need to compare observed preparation activity with known adversary tradecraft, especially where the same techniques recur across sectors and campaigns.

Risk and Threat Considerations

Capability development increases attacker reliability, persistence and stealth before the final incident ever occurs. The risk is not only that the attacker is present, but that the environment may already be serving as a test range for malware, infrastructure and access methods that will be reused at scale.

Failure mechanism: Attackers iterate in low-visibility environments until payloads, infrastructure and procedures consistently survive basic controls, then reuse the matured capability in the actual campaign.

Impact: Detection gets harder, dwell time can increase and a failed first attempt may still leave behind the tooling, staging infrastructure or access patterns needed for a later successful intrusion.

Practitioner Guidance

What to verify: Correlate build, staging and execution telemetry. If a host is compiling, packaging or testing artefacts outside its normal role, confirm whether that activity is authorised before assuming it is benign development work.

What to prioritise: Hunt for repeated rehearsal signals, not just confirmed malware execution. Temporary infrastructure, repeated payload variation and unusually frequent test runs often provide earlier warning than a single malicious binary.

Practitioner takeaway: Treat capability development as an operational phase of intrusion, because the strongest defensive opportunity is often the preparation trail, not the eventual payload.

Related resources from NHI Mgmt Group

• Guide: MITRE ATT&CK Guide for Defenders
• How do attackers turn a supply-chain incident into wider NHI compromise?
• Should organizations develop SLAs for NHI alert responses?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?