Skip to content

T1591 Gather Victim Org Information

Adversaries may gather information about the victim’s organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.

Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).12 Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).

Item Value
ID T1591
Sub-techniques T1591.001, T1591.002, T1591.003, T1591.004
Tactics TA0043
Platforms PRE
Version 1.1
Created 02 October 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G0007 APT28 APT28 has used large language models (LLMs) to gather information about satellite capabilities.34
G0046 FIN7 FIN7 has compiled a list of victims by filtering companies by revenue using Zoominfo, which is a service that provides business information.7
G0094 Kimsuky Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.8 Kimsuky has also used large language models (LLMs) to gather information about potential targets of interest.3
G0032 Lazarus Group Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.5
G1036 Moonstone Sleet Moonstone Sleet has gathered information on victim organizations through email and social media interaction.6
C0022 Operation Dream Job For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.10
G1017 Volt Typhoon Volt Typhoon has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.9

Mitigations

ID Mitigation Description
M1056 Pre-compromise This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

References

  1. Seals, T. (2020, October 15). Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts. Retrieved October 20, 2020. ↩

  2. Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024. ↩↩

  3. OpenAI. (2024, February 14). Disrupting malicious uses of AI by state-affiliated threat actors. Retrieved September 12, 2024. ↩

  4. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021. ↩

  5. Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024. ↩

  6. BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022. ↩

  7. KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024. ↩

  8. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  9. ClearSky Research Team. (2020, August 13). Operation ‘Dream Job’ Widespread North Korean Espionage Campaign. Retrieved December 20, 2021. ↩