Gather Victim Org Information
Technique · ATTACK:enterprise:T1591
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1591",
"title": "Gather Victim Org Information",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1591",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--937e4772-8441-4e4a-8bf0-8d447d667e23",
"external_id": "T1591",
"domain": "enterprise",
"created": "2020-10-02T16:27:02.339Z",
"modified": "2026-05-12T15:12:00.706Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"reconnaissance"
],
"source_references": [
{
"source_name": "ThreatPost Broadvoice Leak",
"url": "https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/"
},
{
"source_name": "SEC EDGAR Search",
"url": "https://www.sec.gov/edgar/search/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--024d5595-aa4e-4d47-bc31-5b8ea5ed73c0
ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--069fef69-8f09-4ba2-80f9-79e07e559d5c
MSFT-AI · OpenAI-CTIATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29d8bf9e-da2f-4a82-9cbb-765cade6a58a
ESET MirrorFace DEC 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b9855a9-f381-4a3e-a0c2-80310374b165
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40495023-f12d-4789-8b11-1b14f0a4ea19
Microsoft Moonstone Sleet 2024ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44468587-67b5-4c44-8c2b-ed2b4769f055
ClearSky Lazarus Aug 2020ATTACK:enterprise:T1591.002 → subtechnique-of → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a742223-f67f-447f-af86-5ed546f8476b
ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--600d5767-1a78-4853-a152-a376b6a59239
BiZone Lizar May 2021ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63603405-b343-4e11-9ae0-3ece75611894
KISA Operation Muzabi · MSFT-AIATTACK:enterprise:T1591.001 → subtechnique-of → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8968bf11-5ba9-4012-a277-4a40ed796fbf
ATTACK:enterprise:T1591.004 → subtechnique-of → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9acea9fd-5c35-4956-b048-4e22dad5a044
ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f6aa827-90b4-4cf5-927f-e30fbbe44cd1
sentinelone operationDigitalEye Dec 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7e572db-2657-4d7e-aa58-885dc7f32057
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c907b6a2-8ac8-479f-8ef1-73795027ff77
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:T1591.003 → subtechnique-of → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2ce3446-c0ca-499c-bc7f-1930ce148285