Skip to content

T1589 Gather Victim Identity Information

Adversaries may gather information about the victim’s identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.

Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.4 Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).19528367

Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).

Item Value
ID T1589
Sub-techniques T1589.001, T1589.002, T1589.003
Tactics TA0043
Platforms PRE
Version 1.2
Created 02 October 2020
Last Modified 21 April 2022

Procedure Examples

ID Name Description
G0050 APT32 APT32 has conducted targeted surveillance against activists and bloggers.11
G1001 HEXANE HEXANE has identified specific potential victims at targeted organizations.12
G1004 LAPSUS$ LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.13
G0059 Magic Hound Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.10
C0022 Operation Dream Job For Operation Dream Job, Lazarus Group conducted extensive reconnaissance research on potential targets.14
C0014 Operation Wocao During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.15

Mitigations

ID Mitigation Description
M1056 Pre-compromise This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

Detection

ID Data Source Data Component
DS0029 Network Traffic Network Traffic Content

References

  1. Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved October 20, 2020. ↩

  2. Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020. ↩

  3. Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020. ↩

  4. GrimHacker. (2017, July 24). Office365 ActiveSync Username Enumeration. Retrieved December 9, 2021. ↩

  5. McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020. ↩

  6. Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020. ↩

  7. Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020. ↩

  8. Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020. ↩

  9. Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy ‘login details leaked’. Retrieved October 19, 2020. ↩

  10. Miller, J. et al. (2021, July 13). Operation SpoofedScholars: A Conversation with TA453. Retrieved August 18, 2021. ↩

  11. Amnesty International. (2021, February 24). Vietnamese activists targeted by notorious hacking group. Retrieved March 1, 2021. ↩

  12. ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022. ↩

  13. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩

  14. ClearSky Research Team. (2020, August 13). Operation ‘Dream Job’ Widespread North Korean Espionage Campaign. Retrieved December 20, 2021. ↩

  15. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩