Compromise Infrastructure

{
  "id": "ATTACK:enterprise:T1584",
  "title": "Compromise Infrastructure",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1584",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--7e3beebd-8bfe-4e7b-a892-e44ab06a75f9",
  "external_id": "T1584",
  "domain": "enterprise",
  "created": "2020-10-01T00:36:30.759Z",
  "modified": "2026-09-18T00:31:20.766Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "amnesty_nso_pegasus",
      "url": "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/"
    },
    {
      "source_name": "Sysdig Proxyjacking",
      "url": "https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited/"
    },
    {
      "source_name": "FireEye DNS Hijack 2019",
      "url": "https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html"
    },
    {
      "source_name": "ICANNDomainNameHijacking",
      "url": "https://www.icann.org/en/ssac/registration-services/documents/sac-007-domain-name-hijacking-incidents-threats-risks-and-remediation-12-07-2005-en"
    },
    {
      "source_name": "Koczwara Beacon Hunting Sep 2021",
      "url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
    },
    {
      "source_name": "Nearest Neighbor Volexity",
      "url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
    },
    {
      "source_name": "Mandiant APT1",
      "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
    },
    {
      "source_name": "Talos DNSpionage Nov 2018",
      "url": "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
    },
    {
      "source_name": "NSA NCSC Turla OilRig",
      "url": "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
    },
    {
      "source_name": "Mandiant SCANdalous Jul 2020",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"
    },
    {
      "source_name": "ThreatConnect Infrastructure Dec 2020",
      "url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
    },
    {
      "source_name": "FireEye EPS Awakens Part 2",
      "url": "https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
    }
  ]
}