Sub-technique of T1583 Acquire Infrastructure.View on attack.mitre.org
Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks. Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service.
Internet-facing edge devices and related network appliances that are end-of-life (EOL) and unsupported by their manufacturers are commonly acquired for botnet activities. Adversaries may lease operational relay box (ORB) networks – consisting of virtual private servers (VPS), small office/home office (SOHO) routers, or Internet of Things (IoT) devices – to serve as a botnet.
With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS). Acquired botnets may also be used to support Command and Control activity, such as Hide Infrastructure through an established Proxy network.
Rules on DetectionCode tagged with T1583.005.
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT5 | APT5 has acquired a network of compromised systems – specifically an ORB (operational relay box) network – for follow on activities. |
| GroupHAFNIUM | HAFNIUM has incorporated leased devices into covert networks to obfuscate communications. |
| GroupKe3chang | Ke3chang has utilized an ORB (operational relay box) network for reconnaissance and vulnerability exploitation. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
