Link Target

Subtechnique · ATTACK:enterprise:T1608.005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1608.005",
  "title": "Link Target",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1608/005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--84ae8255-b4f4-4237-b5c5-e717405a9701",
  "external_id": "T1608.005",
  "domain": "enterprise",
  "created": "2021-03-17T20:35:08.429Z",
  "modified": "2026-05-12T15:12:00.683Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "Netskope GCP Redirection",
      "url": "https://www.netskope.com/blog/targeted-attacks-abusing-google-cloud-platform-open-redirection"
    },
    {
      "source_name": "Netskope Cloud Phishing",
      "url": "https://www.netskope.com/blog/a-big-catch-cloud-phishing-from-google-app-engine-and-azure-app-service"
    },
    {
      "source_name": "URI Unique",
      "url": "https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF"
    },
    {
      "source_name": "Kaspersky-masking",
      "url": "https://www.kaspersky.com/blog/malicious-redirect-methods/50045/"
    },
    {
      "source_name": "Talos IPFS 2022",
      "url": "https://blog.talosintelligence.com/ipfs-abuse/"
    },
    {
      "source_name": "Malwarebytes Silent Librarian October 2020",
      "url": "https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"
    },
    {
      "source_name": "URI",
      "url": "https://www.techtarget.com/searchsecurity/tip/Preparing-for-uniform-resource-identifier-URI-exploits"
    },
    {
      "source_name": "URI Use",
      "url": "https://www.blackhat.com/presentations/bh-dc-08/McFeters-Rios-Carter/Presentation/bh-dc-08-mcfeters-rios-carter.pdf"
    },
    {
      "source_name": "iOS URL Scheme",
      "url": "https://docs.ostorlab.co/kb/IPA_URL_SCHEME_HIJACKING/index.html"
    },
    {
      "source_name": "Intezer App Service Phishing",
      "url": "https://www.intezer.com/blog/malware-analysis/kud-i-enter-your-server-new-vulnerabilities-in-microsoft-azure/"
    },
    {
      "source_name": "Proofpoint TA407 September 2019",
      "url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"
    },
    {
      "source_name": "Cofense-redirect",
      "url": "https://cofense.com/blog/major-energy-company-targeted-in-large-qr-code-campaign/"
    },
    {
      "source_name": "mandiant-masking",
      "url": "https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse"
    }
  ]
}

Explicit source assertions (8)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.