Introduction The cyber kill chain comprises seven phases which illustrate the various cyberattack stages. Among the cyber kill chain’s steps is the weaponization stage, whereby the intruder develops a malware weapon, such as a worm or virus, to exploit the target’s vulnerabilities (Spring & Hatleback, 2017). Depending on the attacker’s purpose and target, this malware can manipulate undetected and new vulnerabilities (zero-day exploits) or focus on an amalgamation of several vulnerabilities (Dargahi et al., 2019). The paper provides an in-depth discussion of the software used by attackers during the weaponization step and the appropriate countermeasures for this activity. Software Used for Weaponization Some standard open access weaponization software types used by hackers include the Veil-Framework, Luckystrike, and Metasploit. According to Hoffmann et al. (2020), these software types typically automate the procedure of weaponizing files and implementing programs for eluding anti-virus, and other prevention/detection means, including UAC, ASLR, and DEP/NX. Spring and Hatleback (2017) identify Veil-Framework (Veil-Evasion) as a tool developed to create Metasploit payloads which bypass or evade conventional anti-virus solutions; it generates payload executables that elude standard anti-virus applications. Luckystrike relates to a PowerShell-based software used to develop malicious documents, particularly Office documents (Dargahi et al., 2019). It enhances the generation of shell documents typified by encrypted codes capable of infecting a network. Metasploit is compatible with many operating systems (OS) and is easily customized; it is used to develop and execute exploit codes against remote targets. It is an open-source framework utilized by ethical hackers and cybercriminals to probe or scrutinize systematic vulnerabilities on servers and networks (Hoffmann et al., 2020). Other weaponizing software forms include:   * Office-DDE-payloads: A collection of templates and scripts used to create DDE embedded Office documents using a technique known as the macro-less command.   * wePWNise: A tool used to develop VBA codes – architecture-dependent – utilized in Office templates or documents and automates the evasion application controls and manipulate mitigation software (Hoffmann et al., 2020).   * MacroShop: This is an assemblage of scripts, which facilitate payload delivery via Office Macros.   * WorsePDF: This software typically transforms conventional PDF files into malicious ones; additional software includes macro-pack and Cross-Platform Office Macro (“Defense strategies,” n.d.). Countermeasures for Weaponization Countermeasures recommended for ensuring cybersecurity during the weaponization phase include training workers on security awareness and technology installation for detecting malicious software accessing the environment. Several advanced attacks are initiated using the social engineering approach. The typical social engineering use in advanced attacks underscores the significance of workforce training. Employees must distinguish social engineering strikes and prospectively dubious emails and be knowledgeable of appropriate notification and incident response processes. There