Acquire Infrastructure
Technique · ATTACK:enterprise:T1583
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1583",
"title": "Acquire Infrastructure",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1583",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--0458aab9-ad42-4eac-9e22-706a95bafee2",
"external_id": "T1583",
"domain": "enterprise",
"created": "2020-09-30T16:37:40.271Z",
"modified": "2026-09-18T00:31:20.483Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "amnesty_nso_pegasus",
"url": "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/"
},
{
"source_name": "Mandiant APT29 Microsoft 365 2022",
"url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
},
{
"source_name": "FBI Proxies Credential Stuffing",
"url": "https://www.ic3.gov/Media/News/2022/220818.pdf"
},
{
"source_name": "Free Trial PurpleUrchin",
"url": "https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/"
},
{
"source_name": "Koczwara Beacon Hunting Sep 2021",
"url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
},
{
"source_name": "TrendmicroHideoutsLease",
"url": "https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf"
},
{
"source_name": "Mandiant SCANdalous Jul 2020",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--068ab14b-4869-44d2-a10d-bb550561bdb2
Mandiant APT43 March 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a68df25-bb5c-4c03-a65f-491b9a52cfc5
Hunt Sea Turtle 2024ATTACK:enterprise:T1583.008 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19357ea1-2e21-4e35-a99e-3e3cf3321e89
ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21972d6c-e581-40e3-91f3-7aaa48f86885
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:T1583.001 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22dd54d0-4285-444a-9bbd-ce3b3bd81b67
ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--451d0efa-51c0-414b-a839-cb44edca7bdc
Mandiant_UNC2165ATTACK:enterprise:T1583.005 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46b33aec-21e6-4a5d-b99d-6ce4396a16d8
ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4875a71a-5600-49b2-bd30-0927db99b536
SentinelOne Agrius 2021ATTACK:enterprise:T1583.004 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5221fc94-cddd-416a-b027-67bc7a68ced1
ATTACK:enterprise:T1583.002 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cc8aab6-8697-4277-8a12-290bfd15705d
ATTACK:enterprise:T1583.003 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78bde505-a353-4cae-a978-f87de382f3fd
ATTACK:enterprise:T1583.007 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8851f959-22db-4346-9505-9a3f534fb240
ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--899c739b-1b17-4417-ab9f-a97eafa69451
Sentinel One Contagious Interview ClickFix September 2025 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4676ad1-f8d2-43f0-a342-8d5d01bff9cf
Leonard TAG 2023ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aefa2807-65bf-4b81-b91b-d8ec2dfbd80b
ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c430932c-65d1-4f27-994b-fdf39220e530
StarBlizzardATTACK:enterprise:T1583.006 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e134a00e-8d72-4c3d-a5b1-3f9c6e1bd330
ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee8ce0a1-04fa-4c4b-be30-a0d3c9b3d53d
Flashpoint Mini Shai-Hulud MAY 2026