Automation · API / MCP 中文

Technique note · T1583.001

Domains

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.

ATT&CK T1583.001 platforms — Status Active Version 20.1

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control.1 Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).23 Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.45678 Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).9101112 Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.13141516 Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.17 In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.18

  1. CISA MSS Sep 2020
  2. FireEye APT28
  3. PaypalScam
  4. CISA IDN ST05-016
  5. tt_httrack_fake_domains
  6. tt_obliqueRAT
  7. httrack_unhcr
  8. lazgroup_idn_phishing
  9. iOS URL Scheme
  10. URI
  11. URI Use
  12. URI Unique
  13. Categorisation_not_boundary
  14. Domain_Steal_CC
  15. Redirectors_Domain_Fronting
  16. bypass_webproxy_filtering
  17. Mandiant APT1
  18. Invictus IR DangerDev 2024

Groups using this technique

GroupNameCountry
grp_g1042RedEcho—
grp_g0134Transparent TribePakistan
grp_g1011EXOTIC LILY—
grp_g1018TA2541—
grp_g0122Silent Librarian—
grp_g0137Ferocious Kitten—
grp_g0090WIRTE—
grp_g0044Winnti Group—
grp_g0128ZIRCONIUM—
grp_g1035Winter Vivern—
grp_g1056TeamPCP—
grp_g0129Mustang PandaChina
grp_g1041Sea Turtle—
grp_g0032Lazarus GroupDPRK
grp_g1001HEXANE—
grp_g1057ShinyHunters—
grp_g1015Scattered Spider—
grp_g0035DragonflyRussia
grp_g1044APT42Iran
grp_g0049OilRigIran
grp_g1036Moonstone SleetDPRK
grp_g0006APT1China
grp_g1052Contagious Interview—
grp_g0069MuddyWater—
grp_g1012CURIUMIran
grp_g1055VOID MANTICORE—
grp_g1058The Gentlemen—
grp_g1033Star Blizzard—
grp_g0082APT38DPRK
grp_g1059NIMBUS MANTICORE—
grp_g1046Storm-1811—
grp_g0065LeviathanChina
grp_g0046FIN7—
grp_g0099APT-C-36—
grp_g0047Gamaredon GroupRussia
grp_g0136IndigoZebraChina
grp_g0092TA505—
grp_g0094KimsukyDPRK
grp_g0059Magic HoundIran
grp_g0139TeamTNT—
grp_g0140LazyScripter—
grp_g0045menuPass—
grp_g1006Earth LuscaChina
grp_g0007APT28Russia
grp_g0027Threat Group-3390China
grp_g0034Sandworm TeamRussia
grp_g0050APT32Vietnam
grp_g1002BITTERPakistan

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.