T1584.001: T1584.001

Search IOCs, vulnerabilities, APT…

216.73.217.86

← Back to attack patterns

View on MITRE ATT&CK The MITRE Corporation · Published 01/10/2020 02:51 · Modified 15/04/2026 12:25

Essential information

MITRE technique ID: T1584.001
Confidence: 100/100
Revoked: No
Published: 01/10/2020 02:51
Modified: 15/04/2026 12:25
Author / Source: The MITRE Corporation

Aliases

Domains

Platforms

PRE

Description

Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53).(Citation: Krebs DNS Hijack 2019) Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020) Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.(Citation: Palo Alto Unit 42 Domain Shadowing 2022)

Kill chain phases

Kill chain	Phase
mitre-attack	resource-development

Marking (TLP)

External references

Krebs DNS Hijack 2019
Palo Alto Unit 42 Domain Shadowing 2022
Microsoft Sub Takeover 2020
ICANNDomainNameHijacking
mitre-attack (T1584.001)

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.

Intrusion sets (APT) (27)

Earth Koshchei uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Magic Hound uses COBALT ILLUSIONITG18

The MITRE Corporation Confidence 100

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Kimsuky uses Black BansheeVelvet Chollima

The MITRE Corporation Confidence 100

[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Lazarus uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Secshow uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Slavic Nation Empire uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Mustard Tempest uses DEV-0206GOLD PRELUDE

The MITRE Corporation Confidence 100

[Mustard Tempest](https://attack.mitre.org/groups/G1020) is an initial access broker that has operated the [SocGholish](https://attack.mitre.org/software/S1124) distribution network since at least 2017. [Mustard Tempest](https://attack.mitre.org/groups/G1020) has partnered with [Indrik Spider](https://attack.mitre.org/groups/G0119) to provide access…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Smishing Triad uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT1 uses Comment CrewComment Group

The MITRE Corporation Confidence 100

[APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Transparent Tribe uses COPPER FIELDSTONEMythic Leopard

The MITRE Corporation Confidence 100

[Transparent Tribe](https://attack.mitre.org/groups/G0134) is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.(Citation: Proofpoint…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Inception Framework uses Cloud AtlasInception

The MITRE Corporation Confidence 100

[Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active…

First seen 01/01/1970 · Last seen 16/11/5138 ·
LummaC2 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 3

1–12 of 27

LummaC2 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
TSPY_TRICKLOAD uses

The MITRE Corporation Confidence 100

[TrickBot](https://attack.mitre.org/software/S0266) is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to [Dyre](https://attack.mitre.org/software/S0024). [TrickBot](https://attack.mitre.org/software/S0266) was developed and initially used by…

First seen 01/01/1970 · Last seen 16/11/5138 ·
RedLine Stealer uses

Family The MITRE Corporation Confidence 100

[RedLine Stealer](https://attack.mitre.org/software/S1240) is an information-stealer malware variant first identified in 2020.(Citation: ESET RedLine Stealer November 2024)(Citation: Proofpoint RedLine Stealer March 2020)(Citation: Splunk RedLine Stealer June 2023) [RedLine Stealer](https://attack.mitre.org/software/S1240)…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Rust backdoor uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
MintsLoader uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
QuackBot uses

The MITRE Corporation Confidence 100

[QakBot](https://attack.mitre.org/software/S0650) is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. [QakBot](https://attack.mitre.org/software/S0650) is continuously maintained and developed and has evolved from…

First seen 01/01/1970 · Last seen 16/11/5138 ·
NetSupport RAT uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
MaskBat uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
IcedID - S0483 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Acreed uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SparkRAT uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
QakBot - S0650 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 6

37–48 of 70

Part 2: Tracking LummaC2 Infrastructure related

7 MITREs 2 Malwares 200 Observables 1 APT
New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update … related

10 MITREs 3 Malwares 1 APT
Unmasking the FreeDrain Network related

14 MITREs 1 APT
Uncovering Actor TTP Patterns and the Role of … related

9 MITREs 87 Observables
Pulling the Threads on the Phish of Troy … related

6 MITREs 1 APT
The Next Level: Typo DGAs Used in Malicious … related

7 MITREs 17 Observables
Russian Influence Operations Target German Elections related

19 MITREs
Fake DeepSeek Sites Used for Credential Phishing, Crypto … related

8 MITREs
Uncovering Cyber Threat Networks: SmartApeSG & NetSupport RAT related

17 MITREs 7 Malwares 57 Observables
TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base related

6 MITREs 4 Malwares 102 Observables 1 APT
Sophisticated Google Domain Exploitation Chain Unleashed related

10 MITREs 3 Observables
Earth Koshchei Coopts Red Team Tools in Complex … related

13 MITREs 200 Observables 1 APT

← Previous

Page / 3

13–24 of 32

Vulnerabilities (CVE) (5)

CVE-2019-11580 KEV targets

Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in …

Published: 03/11/2021
Modified: 21/12/2025

CVE-2024-42009 KEV targets

9.3 Critical

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim …

Attack vector: Network
Published: 09/06/2025
Modified: 21/12/2025

Received

CVE-2019-0859 KEV targets

Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel …

Published: 03/11/2021
Modified: 29/05/2026

CVE-2023-43261 targets

7.5 High

An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.

Attack vector: Network
Published: 04/10/2023
Modified: 29/05/2026

CVE-2019-0797 KEV targets

Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an …

Published: 03/11/2021
Modified: 29/05/2026

Attack patterns (MITRE) (1)

T1584 subtechnique-of

Compromise Infrastructure MITRE

Campaign (4)

C0010 uses
2025 Poland Wiper Attacks uses
SolarWinds Compromise uses
Operation Dream Job uses

Course Of Action (1)

Pre-compromise mitigates

Contact About Legal notice Privacy policy Terms of use