---
title: "Cyberattack Game Plan: How attackers choose their targets & plan their attack"
description: Whether a cybercriminal has chosen a broad list or refined group of targets, their next step will be to perform reconnaissance to begin their attack.
image: https://blog.teamascend.com/hubfs/Blog%20Feature%20Images/102919_CyberattackSeries-05.jpg
---
[Skip to main content](https://blog.teamascend.com/blog/cyberattack-game-plan-how-attackers-choose-their-targets-and-plan-their-attack#main)
[ ](https://teamascend.com/)
- [Show submenu for Services Services](http://teamascend.com/services/)
- [Show submenu for IT Consulting IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- [Show submenu for Cybersecurity Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- [Show submenu for IT Infrastructure IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- [Show submenu for Cloud Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- [Show submenu for Microsoft Services Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- [Show submenu for Salesforce Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- [Show submenu for Industries Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- [Show submenu for Resources Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Services](http://teamascend.com/services/)
- Show submenu for IT Consulting IT Consulting
- IT Consulting
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- Show submenu for Cybersecurity Cybersecurity
- Cybersecurity
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- Show submenu for IT Infrastructure IT Infrastructure
- IT Infrastructure
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- Show submenu for Cloud Cloud
- Cloud
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- Show submenu for Microsoft Services Microsoft Services
- Microsoft Services
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- Show submenu for Salesforce Salesforce
- Salesforce
- [Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- Show submenu for Industries Industries
- Industries
- [Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- Show submenu for Resources Resources
- Resources
- [Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
- [24/7 Client Services](https://portal-ascend.okta.com/)
[24/7 Client Services](https://portal-ascend.okta.com/)
Vulnerability Management, Perimeter Security
# Cyberattack Game Plan: How attackers choose their targets & plan their attack
TEAM ASCEND
October 28, 2019
- [.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fcyberattack-game-plan-how-attackers-choose-their-targets-and-plan-their-attack)
- [.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fcyberattack-game-plan-how-attackers-choose-their-targets-and-plan-their-attack)
- [](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3ECyberattack+Game+Plan%3A+How+attackers+choose+their+targets+%26+plan+their+attack%3C%2Fspan%3E&body=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fcyberattack-game-plan-how-attackers-choose-their-targets-and-plan-their-attack)
High-profile, newsworthy cyber breaches may have you believe that only big corporations like Target, [Facebook](https://www.forbes.com/sites/daveywinder/2019/09/05/facebook-security-snafu-exposes-419-million-user-phone-numbers/#25e90e671ab7), and [Equifax](https://www.techrepublic.com/article/turns-out-the-equifax-hack-was-even-worse-than-we-thought/) are where cyber criminals focus their efforts. However, it continues to be proven that small and mid-sized organizations are [being targeted frequently](https://www.techrepublic.com/article/how-data-breaches-are-hurting-small-businesses/), despite the belief that a smaller organization has nothing that would be valuable to a criminal.
The truth is actually quite contrary: small and mid-sized organizations are not only easier for criminals to target and breach, but they’ve proven fruitful for those criminals looking for personal data, financial data, and credential access.
According to industry research, some of the [most common reasons](https://www.csoonline.com/article/2866911/why-criminals-pick-on-small-business.html) that smaller organizations become the target of cyberattacks include:
- Low security investments or even cut security spending
- Lack of resources to implement and maintain strong security (time, budget, expertise)
- Small staff – often including a lack of dedicated IT or security specialists
- Low risk awareness or cybersecurity understanding
- Outdated or nonexistent security appliances, products, and software
These reasons are essentially a collection of unlocked—or even wide open—doors for cyber criminals to take advantage of, making it incredibly easy to perform an attack and successfully breach their target.
## **How do cyber criminals pick their targets?**
The truth is, in some cases it is completely random. Attackers using a “spray-and-pray” approach—through widespread phishing campaigns, web-hosted malware delivery, and the like—may access a list of email addresses and send their attack to as many people as possible, or infect a website and hope that enough people will get infected by the malware.
In instances where[cyber-espionage](https://www.zdnet.com/article/cyber-espionage-warning-the-most-advanced-hacking-groups-are-getting-more-ambitious/) is the goal, attackers may have their target(s) picked out in advance for political, personal, economic or other motives. These attacks generally take place when the attacker’s goal is to negatively impact the image, reputation, and proceedings of business for an entity or organization.
In the case of your “every day” cyber attacks (*not that we want them to be so normal!*), cyber criminals tend to land somewhere between specific, well-researched targets and broader, more generalized goals. These goals may correlate via location, industry, type of data held within the organization, and so on, depending on the motivations of the individual attacker or attack group.
Whether the cyber criminals have chosen a broad list of targets or have decided to attack a refined group of targets, like all of the local retailers in a certain area, their next step will be to perform reconnaissance so they can begin their attack.
## **How does cyber reconnaissance work?**
The intelligence-gathering stage of an attack is where an attacker will complete extensive research about potential targets and strategize for a successful attack. Some of the reconnaissance (recon) strategies commonly used include:
- **WHOIS Lookups**
Used for gathering domain names, IP addresses, and web system information.
- **NMAP Port Scanning**
A network discovery tool that can be used to identify open ports and vulnerabilities to exploit in your network.
- **Web Page Analysis & Email Address Search**
Using search engines and queries, attackers can gather information available about your organization and its email communications online.
- **Social Media Research**
Learning about your organization and its employees through Facebook, Linkedin, Twitter, and more can prove valuable for attackers looking to craft targeted phishing attacks.
The [NMAP](https://nmap.org/) port scanning approach is helpful for attackers looking to begin an attack that goes beyond the simple phishing email because it allows them to discover the “open doors” in your network—doors that they can use to get inside and start causing damage. This tool is important to illustrate and discuss because while it’s not malicious in nature, it is incredibly helpful to attackers as it easily provides them the information they need to breach their target.
## **NMAP Scanning in action**
Watch as Information Security Analyst Chris demonstrates an NMAP scan and explains how this reconnaissance technique is used by cyber criminals.
## **Cybersecurity Game Plan**
###### *Offense*
If an attacker has used NMAP Port Scanning against your network, signs of this will be present through Next-Generation Firewall (NGFW) logs or integrated logs in your SIEM solution. Proof of potential attacker recon should lead you to secure vulnerabilities and keep an eye on the other layers of security you have in place, like EDR and Malware Prevention, for signs of an attack.
###### *Defense*
While you can’t prevent someone from scanning your network from the outside, you can take a few steps to ensure that their online research and subsequent scans aren’t as fruitful as they prepare for an attack.
First, secure the information available about your organization online. As a business, it can be hard to balance publicizing information with keeping key details secure. Some suggestions include not listing direct employee emails or contact information on your website, having employees maintain privacy settings on Facebook and Linkedin accounts, and refrain from sharing private data about your business on your website, social media, or blog. These steps can help make it harder for a criminal to phish or spear-phish your organization by limiting their access to direct email addresses and making it harder to discover *who* to phish or impersonate within your organization.
Next, perform regular vulnerability scanning within your network or employ a security partner to regularly evaluate your security posture through scanning, assessments, or penetration tests. With frequently updated, actionable data about your network vulnerabilities, you can be on top of security from the perimeter level down to your endpoint devices. Port-level vulnerabilities are discovered and announced regularly, but it’s up to your organization to keep security products and software updated and proactively address vulnerabilities that require new configurations or security settings. If vulnerabilities are left unchecked, an NMAP scan could uncover an easy way into your network and an attacker can exploit it.
If your organization lacks the time, resources, or expertise to stay on top of the evolving security landscape, you might consider a Managed Security Service Provider (MSSP) to take that load off of your team. Read more about MSSPs here.
As discussed throughout the Cyberattack Series so far, layers of security that cover your account credentials, endpoint devices, email system, and the activities within your network are all key to maintaining a strong defense against cyberattack tactics used every day. Whether an attack begins with an email, an open port, or an infected device, it’s important to have both your offense and defense ready in the fight against your adversaries.
[](https://cta-redirect.hubspot.com/cta/redirect/2733374/d534b9a3-49dd-43ed-bea1-15a16ab3565e)
### Table of Contents
#### Get Insights Sent to Your Inbox
## Related Articles
Vulnerability Management, Perimeter Security
### [How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
September 24, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
Vulnerability Management, Perimeter Security
### [How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
September 22, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
Vulnerability Management, Perimeter Security
### [What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
September 17, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
[](https://teamascend.com/)
Contact
833-639-2285
-
-
-
-
-
- Company
- [About](https://teamascend.com/about/)
- [Services](https://teamascend.com/services/)
- [Testimonials](https://teamascend.com/client-success-stories/)
- [Partner With Us](https://teamascend.com/about/partner-with-us/)
- [Resources](https://teamascend.com/resources/)
- [Contact](https://teamascend.com/contact/)
- [Careers](https://teamascend.com/careers/)
- Services
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Salesforce Services](https://teamascend.com/salesforce-services/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
### Empowering Technology. Powered by People.
Technology is critical to businesses across all industries. Today's technology must be smart, reliable, adaptable, and secure. At Ascend Technologies, we deliver solutions at the highest level, from cloud computing to proactive cybersecurity strategies to Salesforce excellence. And the team? As impressive as the tech. Our practical support is focused on one thing: your success. Let's see what we can do together.
[Contact Us](https://teamascend.com/contact/)
©2026 Ascend Technologies, LLC, All Rights Reserved | [Privacy Policy](https://teamascend.com/privacy-policy/)
```json
{
"@context" : "https://schema.org",
"@type" : "WebPage",
"breadcrumb" : {
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://blog.teamascend.com",
"name" : "Home",
"position" : 1
} ]
},
"dateModified" : "2023-10-20T14🇲🇲56",
"description" : "Whether a cybercriminal has chosen a broad list or refined group of targets, their next step will be to perform reconnaissance to begin their attack.",
"name" : "Cyberattack Game Plan: How attackers choose their targets & plan their attack",
"primaryImageOfPage" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Blog%20Feature%20Images/102919_CyberattackSeries-05.jpg"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Ascend-Technologies-HubSpot-Logo.png"
},
"name" : "Ascend Technologies",
"url" : "https://blog.teamascend.com"
},
"url" : "https://blog.teamascend.com/blog/cyberattack-game-plan-how-attackers-choose-their-targets-and-plan-their-attack"
}
```