{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1591","id":"T1591","name":"Gather Victim Org Information","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1591","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"5127e770bb548e438a73483c9c44bf4573ea1239ba7b723e57f5996a0659d8f8","description":"Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1591","external_id":"T1591"},{"source_name":"ThreatPost Broadvoice Leak","description":"Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts. Retrieved October 20, 2020.","url":"https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/"},{"source_name":"SEC EDGAR Search","description":"U.S. SEC. (n.d.). EDGAR - Search and Access. Retrieved November 17, 2024.","url":"https://www.sec.gov/edgar/search/"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","parent":null,"children":[{"key":"enterprise/T1591.001","id":"T1591.001","name":"Determine Physical Locations","page":"techniques/enterprise/T1591.001/"},{"key":"enterprise/T1591.002","id":"T1591.002","name":"Business Relationships","page":"techniques/enterprise/T1591.002/"},{"key":"enterprise/T1591.003","id":"T1591.003","name":"Identify Business Tempo","page":"techniques/enterprise/T1591.003/"},{"key":"enterprise/T1591.004","id":"T1591.004","name":"Identify Roles","page":"techniques/enterprise/T1591.004/"}],"telemetry":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input","category":"External context and intelligence","description":"External observations that may contextualize adversary preparation but do not show access to a victim.","collection_focus":"Retain source provenance, confidence and temporal bounds; explicitly label observations outside victim visibility.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["indicator","source_record","confidence","victim_access_observed"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input","category":"External context and intelligence","description":"Audit records controlled by an external provider that may only be available through an authorized disclosure or account-owner export.","collection_focus":"Document legal/account-owner access and provider coverage before ingestion. Preserve original IDs, timestamps and disclosure limits; do not seek unauthorized access.","providers":[{"name":"Authorized provider/account-owner audit exports","scope":"Available only with the provider or account owner’s lawful access and supported export.","source_id":"cloudtrail"},{"name":"CloudTrail in an owned lab account","scope":"A concrete lab-side example; it does not grant access to adversary-controlled accounts.","source_id":"cloudtrail"}],"configuration":["Establish the authorized account, record owner and export mechanism before collection. Without access, mark this input unavailable rather than simulating defender visibility.","Preserve source event IDs, account/resource IDs, original timestamps and the authorized disclosure/export record.","Document which events the provider actually exposes and compare delivered records to the request scope. Keep lab-side actions separate from victim-side evidence."],"configuration_example":null,"required_fields":["provider_record_id","access_basis","action","victim_network_observation"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Customer-accessible audit APIs do not expose arbitrary third-party accounts. A synthetic provider event cannot establish access, attribution or detection coverage in a real investigation.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."}],"detection":{"key":"enterprise/T1591","id":"T1591","name":"Gather Victim Org Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1591","technique_page":"techniques/enterprise/T1591/","page":"detections/enterprise/T1591/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0890","name":"Detection of Gather Victim Org Information","url":"https://attack.mitre.org/detectionstrategies/DET0890","stix_id":"x-mitre-detection-strategy--cd39aee1-03f0-489f-a800-ce00c6be617f","relationship_id":"relationship--b35d6a1a-324d-4495-87b2-216b57b2afb1","description":"","analytics":[{"id":"AN2022","name":"Analytic 2022","guidance":"Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0890#AN2022","platforms":["PRE"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","tag":"Proposed: External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input"},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","tag":"Proposed: Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input"}],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used large language models (LLMs) to gather information about satellite capabilities.(Citation: MSFT-AI)(Citation: OpenAI-CTI) ","relationship_id":"relationship--069fef69-8f09-4ba2-80f9-79e07e559d5c","references":[{"source_name":"MSFT-AI","description":"Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"},{"source_name":"OpenAI-CTI","description":"OpenAI. (2024, February 14). Disrupting malicious uses of AI by state-affiliated threat actors. Retrieved September 12, 2024.","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.(Citation: Kaspersky ThreatNeedle Feb 2021)","relationship_id":"relationship--2b9855a9-f381-4a3e-a0c2-80310374b165","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","description":"Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has compiled a list of victims by filtering companies by revenue using Zoominfo, which is a service that provides business information.(Citation: BiZone Lizar May 2021) ","relationship_id":"relationship--600d5767-1a78-4853-a152-a376b6a59239","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.(Citation: KISA Operation Muzabi) [Kimsuky](https://attack.mitre.org/groups/G0094) has also used large language models (LLMs) to gather information about potential targets of interest.(Citation: MSFT-AI) ","relationship_id":"relationship--63603405-b343-4e11-9ae0-3ece75611894","references":[{"source_name":"KISA Operation Muzabi","description":"KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source_name":"MSFT-AI","description":"Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--b7e572db-2657-4d7e-aa58-885dc7f32057","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) has gathered information on victim organizations through email and social media interaction.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--40495023-f12d-4789-8b11-1b14f0a4ea19","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has placed specific content in phishing emails to target members of particular political parties.(Citation: ESET MirrorFace DEC 2022)\n","relationship_id":"relationship--29d8bf9e-da2f-4a82-9cbb-765cade6a58a","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has gathered details on victims to ensure they target members of organizations within software or aviation.(Citation: CheckPoint_NimbusManticore_May2026) ","relationship_id":"relationship--c907b6a2-8ac8-479f-8ef1-73795027ff77","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.","relationship_id":"relationship--024d5595-aa4e-4d47-bc31-5b8ea5ed73c0","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1593.001":"/ttp-simulation/techniques/enterprise/T1593.001/","T1594":"/ttp-simulation/techniques/enterprise/T1594/","T1593":"/ttp-simulation/techniques/enterprise/T1593/","T1585":"/ttp-simulation/techniques/enterprise/T1585/","T1586":"/ttp-simulation/techniques/enterprise/T1586/","T1566":"/ttp-simulation/techniques/enterprise/T1566/","T1199":"/ttp-simulation/techniques/enterprise/T1199/","T1591":"/ttp-simulation/techniques/enterprise/T1591/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1591","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}}]}}