Automation · API / MCP 中文

Technique note · T1585.001

Social Media Accounts

Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. For operations incorporating social engineering, the utilization of a persona on social media may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona on social media may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Once a persona has been developed an adversary can use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others. These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

ATT&CK T1585.001 platforms — Status Active Version 20.1

Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.12 For operations incorporating social engineering, the utilization of a persona on social media may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona on social media may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Once a persona has been developed an adversary can use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others.34 These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

  1. NEWSCASTER2014
  2. BlackHatRobinSage
  3. NEWSCASTER2014
  4. BlackHatRobinSage

Groups using this technique

GroupNameCountry
grp_g0003CleaverIran
grp_g1011EXOTIC LILY—
grp_g1050Water Galura—
grp_g0117Fox Kitten—
grp_g1056TeamPCP—
grp_g0032Lazarus GroupDPRK
grp_g1045Salt Typhoon—
grp_g1001HEXANE—
grp_g1051Medusa Group—
grp_g1015Scattered Spider—
grp_g1036Moonstone SleetDPRK
grp_g1052Contagious Interview—
grp_g1012CURIUMIran
grp_g1055VOID MANTICORE—
grp_g1058The Gentlemen—
grp_g1033Star Blizzard—
grp_g0082APT38DPRK
grp_g1059NIMBUS MANTICORE—
grp_g0065LeviathanChina
grp_g0094KimsukyDPRK
grp_g0059Magic HoundIran
grp_g0034Sandworm TeamRussia
grp_g0050APT32Vietnam

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.