{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1583","id":"T1583","name":"Acquire Infrastructure","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1583","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"1ab0a47f279c6934bcbd93dc417e04b47fa82d1c19cf60e86d7ba5bfec5e0fd9","description":"Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase.\n\nUse of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1583","external_id":"T1583"},{"source_name":"amnesty_nso_pegasus","description":"Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group’s Pegasus. Retrieved February 22, 2022.","url":"https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/"},{"source_name":"Mandiant APT29 Microsoft 365 2022","description":"Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023.","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source_name":"FBI Proxies Credential Stuffing","description":"FBI. (2022, August 18). Proxies and Configurations Used for Credential Stuffing Attacks on Online Customer Accounts . Retrieved July 6, 2023.","url":"https://www.ic3.gov/Media/News/2022/220818.pdf"},{"source_name":"Free Trial PurpleUrchin","description":"Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.","url":"https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/"},{"source_name":"Koczwara Beacon Hunting Sep 2021","description":"Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.","url":"https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"},{"source_name":"TrendmicroHideoutsLease","description":"Max Goncharov. (2015, July 15). Criminal Hideouts for Lease: Bulletproof Hosting Services. Retrieved March 6, 2017.","url":"https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf"},{"source_name":"Mandiant SCANdalous Jul 2020","description":"Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved November 17, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"},{"source_name":"ThreatConnect Infrastructure Dec 2020","description":"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.","url":"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1583.001","id":"T1583.001","name":"Domains","page":"techniques/enterprise/T1583.001/"},{"key":"enterprise/T1583.002","id":"T1583.002","name":"DNS Server","page":"techniques/enterprise/T1583.002/"},{"key":"enterprise/T1583.003","id":"T1583.003","name":"Virtual Private Server","page":"techniques/enterprise/T1583.003/"},{"key":"enterprise/T1583.004","id":"T1583.004","name":"Server","page":"techniques/enterprise/T1583.004/"},{"key":"enterprise/T1583.005","id":"T1583.005","name":"Botnet","page":"techniques/enterprise/T1583.005/"},{"key":"enterprise/T1583.006","id":"T1583.006","name":"Web Services","page":"techniques/enterprise/T1583.006/"},{"key":"enterprise/T1583.007","id":"T1583.007","name":"Serverless","page":"techniques/enterprise/T1583.007/"},{"key":"enterprise/T1583.008","id":"T1583.008","name":"Malvertising","page":"techniques/enterprise/T1583.008/"}],"telemetry":[{"id":"DC0103","name":"Active DNS","page":"telemetry/DC0103/","kind":"attack_component","category":"Network and protocol telemetry","description":"DNS results obtained through active queries rather than a historical passive observation.","collection_focus":"Record authorized query name/type, resolver, request time, response code and returned records. Keep active-query results separate from evidence that a victim made the same query.","providers":[{"name":"ISC BIND dig","scope":"Explicit DNS lookups against a selected resolver; output contains answer and query context.","source_id":"dig"},{"name":"Zeek DNS logs","scope":"Passive corroboration when the active query crosses an authorized visible sensor.","source_id":"zeek"}],"configuration":["Select the owned lab resolver, allowed query names and record types. Use bounded queries, not unrestricted enumeration.","Retain full answer sections, response codes, TTLs, resolver address and query/collection timestamps; record cache and split-DNS context.","Store current resolutions separately from passive historical observations. Repeat only at an approved interval and record changes without inferring ownership."],"configuration_example":null,"required_fields":["query","rrtype","resolver","answer","response_code"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0103","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","resolver":"192.0.2.53","answer":"192.0.2.20","response_code":"NOERROR"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A resolution result is time- and resolver-dependent. Active queries generated by an analyst do not prove a target or adversary made those queries.","sources":[{"id":"dig","title":"ISC BIND dig DNS lookup utility","url":"https://bind9.readthedocs.io/en/latest/manpages.html#dig-dns-lookup-utility"},{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0101","name":"Domain Registration","page":"telemetry/DC0101/","kind":"attack_component","category":"External context and intelligence","description":"Domain registration records and changes used as infrastructure context.","collection_focus":"Query an approved RDAP service/feed, retaining retrieval time and registration-event dates; preserve redaction and missing-field indicators.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["domain","event","registrant","retrieved_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0101","collector":"illustrative-lab-collector","observation":{"domain":"example.test","event":"registration","registrant":"redacted","retrieved_at":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"attack_component","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"DC0096","name":"Passive DNS","page":"telemetry/DC0096/","kind":"attack_component","category":"Network and protocol telemetry","description":"Historically observed DNS answers from passive collection or an authorized passive-DNS feed.","collection_focus":"Collect permitted DNS observations with RR type, answer, first/last seen and sensor/source; distinguish local sensor history from a broader intelligence feed.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["query","rrtype","answer","first_seen","last_seen"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0096","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","answer":"192.0.2.20","first_seen":"2026-09-27T11:00:00Z","last_seen":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0104","name":"Response Content","page":"telemetry/DC0104/","kind":"attack_component","category":"Network and protocol telemetry","description":"Content returned by a queried service, such as an HTTP response body or banner.","collection_focus":"Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["service","response_excerpt","content_type","body_truncated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0106","name":"Response Metadata","page":"telemetry/DC0106/","kind":"attack_component","category":"Network and protocol telemetry","description":"Metadata about an Internet-facing resource inferred from authorized scan responses, such as open ports, services and reported versions.","collection_focus":"Preserve target, observation time, scan method and response evidence; distinguish inferred service identity from an authenticated software inventory.","providers":[{"name":"Nmap XML reports","scope":"Structured port/service observations from a separately authorized scan or existing report.","source_id":"nmap"},{"name":"Zeek protocol observations","scope":"Passive corroboration for visible service responses; not equivalent to active scan coverage.","source_id":"zeek"}],"configuration":["Use an existing authorized scan report or an explicitly approved isolated target set. Record tool/version, scan options, time window and scope.","Preserve native XML and normalized host/port/protocol/service fields. Disable XML external-entity resolution in downstream parsers.","Keep inferred service names/versions and their confidence separate from authenticated inventory; retain response evidence when available."],"configuration_example":null,"required_fields":["target","port","transport","service","version","observation_source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0106","collector":"illustrative-lab-collector","observation":{"target":"192.0.2.20","port":443,"transport":"tcp","service":"https","version":"not_identified","observation_source":"authorized_lab_scan"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A reported open port or banner is not a proven vulnerability. Filtered/no-response states can reflect routing or policy. The website performs no scans.","sources":[{"id":"nmap","title":"Nmap XML output specification","url":"https://nmap.org/book/output-formats-xml-output.html"},{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1583","id":"T1583","name":"Acquire Infrastructure","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1583","technique_page":"techniques/enterprise/T1583/","page":"detections/enterprise/T1583/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[{"id":"atlas-basic-t1583-1","technique_id":"T1583","title":"T1583 Acquire Infrastructure","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#resource-development","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":35,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L35","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"5d958c90e79d4e712402c85e8bcc89dd8447e4c4be299460b90a2f05344f9244","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(domain OR certificate OR address IN threat_intelligence_denylist) -> ALERT","log_sources":[{"title":"Threat-Intelligence Platform Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#145-threat-intelligence-platform-logs"},{"title":"DNS Resolver Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#63-dns-resolver-logs"},{"title":"TLS and Certificate Metadata Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#71-tls-and-certificate-metadata-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0895","name":"Detection of Acquire Infrastructure","url":"https://attack.mitre.org/detectionstrategies/DET0895","stix_id":"x-mitre-detection-strategy--56752265-8647-4ce2-bc6c-c38c2e14685c","relationship_id":"relationship--c1778ef8-2a1d-43e7-bb1b-ad41aea30167","description":"","analytics":[{"id":"AN2027","name":"Analytic 2027","guidance":"Monitor for contextual data about an Internet-facing resource gathered from a scan, such as running services or ports that may buy, lease, or rent infrastructure that can be used during targeting. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.\nOnce adversaries have provisioned infrastructure (ex: a server for use in command and control), internet scans may help proactively discover adversary acquired infrastructure. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.\nMonitor for queried domain name system (DNS) registry data that may buy, lease, or rent infrastructure that can be used during targeting. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.\nMonitor for logged domain name system (DNS) data that may buy, lease, or rent infrastructure that can be used during targeting. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.\nConsider use of services that may aid in tracking of newly acquired infrastructure, such as WHOIS databases for domain registration information. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.","url":"https://attack.mitre.org/detectionstrategies/DET0895#AN2027","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0106","component":"Response Metadata","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN2027","source_url":"https://attack.mitre.org/detectionstrategies/DET0895#AN2027","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0106/"},{"component_id":"DC0104","component":"Response Content","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN2027","source_url":"https://attack.mitre.org/detectionstrategies/DET0895#AN2027","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0104/"},{"component_id":"DC0103","component":"Active DNS","name":"Domain Name","channel":"None","platforms":["PRE"],"analytic_id":"AN2027","source_url":"https://attack.mitre.org/detectionstrategies/DET0895#AN2027","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0103/"},{"component_id":"DC0096","component":"Passive DNS","name":"Domain Name","channel":"None","platforms":["PRE"],"analytic_id":"AN2027","source_url":"https://attack.mitre.org/detectionstrategies/DET0895#AN2027","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0096/"},{"component_id":"DC0101","component":"Domain Registration","name":"Domain Name","channel":"None","platforms":["PRE"],"analytic_id":"AN2027","source_url":"https://attack.mitre.org/detectionstrategies/DET0895#AN2027","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0101/"}]}]}],"telemetry_references":[{"id":"DC0103","name":"Active DNS","tag":"Active DNS","page":"telemetry/DC0103/","kind":"attack_component"},{"id":"DC0101","name":"Domain Registration","tag":"Domain Registration","page":"telemetry/DC0101/","kind":"attack_component"},{"id":"DC0096","name":"Passive DNS","tag":"Passive DNS","page":"telemetry/DC0096/","kind":"attack_component"},{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"},{"id":"DC0106","name":"Response Metadata","tag":"Response Metadata","page":"telemetry/DC0106/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) used various third-party email campaign management services to deliver phishing emails.(Citation: Leonard TAG 2023)","relationship_id":"relationship--a4676ad1-f8d2-43f0-a342-8d5d01bff9cf","references":[{"source_name":"Leonard TAG 2023","description":"Billy Leonard. (2023, April 19). Ukraine remains Russia’s biggest cyber focus in 2023. Retrieved March 1, 2024.","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used funds from stolen and laundered cryptocurrency to acquire operational infrastructure.(Citation: Mandiant APT43 March 2024)","relationship_id":"relationship--068ab14b-4869-44d2-a10d-bb550561bdb2","references":[{"source_name":"Mandiant APT43 March 2024","description":"Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has purchased access to victim VPNs to facilitate access to victim environments.(Citation: Mandiant_UNC2165)   ","relationship_id":"relationship--451d0efa-51c0-414b-a839-cb44edca7bdc","references":[{"source_name":"Mandiant_UNC2165","description":"Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.(Citation: Cadet Blizzard emerges as novel threat actor)","relationship_id":"relationship--21972d6c-e581-40e3-91f3-7aaa48f86885","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--4875a71a-5600-49b2-bd30-0927db99b536","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"G1033","name":"Star Blizzard","url":"https://attack.mitre.org/groups/G1033","kind":"intrusion-set","description":"[Star Blizzard](https://attack.mitre.org/groups/G1033) has used HubSpot and MailerLite marketing platform services to hide the true sender of phishing emails.(Citation: StarBlizzard) ","relationship_id":"relationship--c430932c-65d1-4f27-994b-fdf39220e530","references":[{"source_name":"StarBlizzard","description":"Microsoft Threat Intelligence. (2023, December 7). Star Blizzard increases sophistication and evasion in ongoing attacks. Retrieved February 13, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"}]},{"id":"G1041","name":"Sea Turtle","url":"https://attack.mitre.org/groups/G1041","kind":"intrusion-set","description":"[Sea Turtle](https://attack.mitre.org/groups/G1041) accessed victim networks from VPN service provider networks.(Citation: Hunt Sea Turtle 2024)","relationship_id":"relationship--0a68df25-bb5c-4c03-a65f-491b9a52cfc5","references":[{"source_name":"Hunt Sea Turtle 2024","description":"Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has used services such as Astrill VPN.(Citation: Sentinel One Contagious Interview ClickFix September 2025)(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)","relationship_id":"relationship--899c739b-1b17-4417-ab9f-a97eafa69451","references":[{"source_name":"Sentinel One Contagious Interview ClickFix September 2025","description":"Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source_name":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","description":"Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"}]},{"id":"G1056","name":"TeamPCP","url":"https://attack.mitre.org/groups/G1056","kind":"intrusion-set","description":"In May 2026 [TeamPCP](https://attack.mitre.org/groups/G1056) announced co-ownership of the BreachForums cybercriminal forum claiming responsibility for platform operations, dispute resolution, personnel vetting, and hosting monetary contests.(Citation: Flashpoint Mini Shai-Hulud MAY 2026)","relationship_id":"relationship--ee8ce0a1-04fa-4c4b-be30-a0d3c9b3d53d","references":[{"source_name":"Flashpoint Mini Shai-Hulud MAY 2026","description":"Flashpoint. (2026, May 28). The Mini Shai-Hulud Worm and the New Era of CI/CD Exploitation. Retrieved July 16, 2026.","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--aefa2807-65bf-4b81-b91b-d8ec2dfbd80b","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1090":"/ttp-simulation/techniques/enterprise/T1090/","T1583":"/ttp-simulation/techniques/enterprise/T1583/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1583","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0103","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","resolver":"192.0.2.53","answer":"192.0.2.20","response_code":"NOERROR"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0101","collector":"illustrative-lab-collector","observation":{"domain":"example.test","event":"registration","registrant":"redacted","retrieved_at":"2026-09-27T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0096","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","answer":"192.0.2.20","first_seen":"2026-09-27T11:00:00Z","last_seen":"2026-09-27T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0106","collector":"illustrative-lab-collector","observation":{"target":"192.0.2.20","port":443,"transport":"tcp","service":"https","version":"not_identified","observation_source":"authorized_lab_scan"}}]}}