自动化接入 · API / MCP EN

技术说明 · T1584.005

Botnet

Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks. Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems. Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).

ATT&CK T1584.005 platforms — 状态 有效 版本 20.1

Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.1 Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.2 Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.3 With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).

  1. Norton Botnet
  2. Imperva DDoS for Hire
  3. Dell Dridex Oct 2015

使用该技术的组织

组织名称国家
grp_g0001AxiomChina
grp_g1017Volt Typhoon—
grp_g0099APT-C-36—
grp_g0125HAFNIUM—
grp_g0034Sandworm TeamRussia

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核;置信度与有效期按引用读取。