自动化接入 · API / MCP EN

技术说明 · T1585.001

Social Media Accounts

Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. For operations incorporating social engineering, the utilization of a persona on social media may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona on social media may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Once a persona has been developed an adversary can use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others. These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

ATT&CK T1585.001 platforms — 状态 有效 版本 20.1

Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.12 For operations incorporating social engineering, the utilization of a persona on social media may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona on social media may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Once a persona has been developed an adversary can use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others.34 These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

  1. NEWSCASTER2014
  2. BlackHatRobinSage
  3. NEWSCASTER2014
  4. BlackHatRobinSage

使用该技术的组织

组织名称国家
grp_g0003CleaverIran
grp_g1011EXOTIC LILY—
grp_g1050Water Galura—
grp_g0117Fox Kitten—
grp_g1056TeamPCP—
grp_g0032Lazarus GroupDPRK
grp_g1045Salt Typhoon—
grp_g1001HEXANE—
grp_g1051Medusa Group—
grp_g1015Scattered Spider—
grp_g1036Moonstone SleetDPRK
grp_g1052Contagious Interview—
grp_g1012CURIUMIran
grp_g1055VOID MANTICORE—
grp_g1058The Gentlemen—
grp_g1033Star Blizzard—
grp_g0082APT38DPRK
grp_g1059NIMBUS MANTICORE—
grp_g0065LeviathanChina
grp_g0094KimsukyDPRK
grp_g0059Magic HoundIran
grp_g0034Sandworm TeamRussia
grp_g0050APT32Vietnam

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核;置信度与有效期按引用读取。