During which Kill Chain stage does the attacker download additional malware to maintain access and may install a backdoor?

• A. Delivery
• B. Reconnaissance
• C. Installation
• D. Exploitation

Answer: (C)

The Installation stage is when an attacker sets up persistence by installing malware or a backdoor after gaining access. Once initial access is achieved, the attacker drops or downloads additional components to maintain control, often configuring ongoing footholds and backdoor access that survive reboots or further actions. This is exactly what the scenario describes: downloading extra malware to keep access and install a backdoor.

Delivery involves getting the initial payload to the target, Exploitation is using a vulnerability to execute code, and Reconnaissance is gathering information before a break-in. The actions in question occur after access is obtained, at the stage focused on establishing and preserving that access.