| ID | Name |
|---|---|
| T1583.001 | Domains |
| T1583.002 | DNS Server |
| T1583.003 | Virtual Private Server |
| T1583.004 | Server |
| T1583.005 | Botnet |
| T1583.006 | Web Services |
Adversaries may purchase domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries can use purchased domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control.[1] Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).[2][3] Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries can also use internationalized domain names (IDNs) to create visually similar lookalike domains for use in operations.[4]
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.[5]
| ID | Name | Description |
|---|---|---|
| G0006 | APT1 |
APT1 has registered hundreds of domains for use in operations.[5] |
| G0007 | APT28 |
APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources and other organizations.[2] [6] |
| G0016 | APT29 |
APT29 has acquired C2 domains, sometimes through resellers.[7][8][9] |
| G0050 | APT32 |
APT32 has set up and operated websites to gather information and deliver malware.[10] |
| G0137 | Ferocious Kitten |
Ferocious Kitten has acquired domains imitating legitimate sites.[11] |
| G0046 | FIN7 |
FIN7 has registered look-alike domains for use in phishing campaigns.[12] |
| G0136 | IndigoZebra |
IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.[13] |
| G0094 | Kimsuky |
Kimsuky has registered domains to spoof targeted organizations and trusted third parties.[14][15][16][17][18] |
| G0032 | Lazarus Group |
Lazarus Group has acquired infrastructure related to their campaigns to act as distribution points and C2 channels.[19] |
| G0065 | Leviathan |
Leviathan has established domains that impersonate legitimate entities to use for targeting efforts. [20][21] |
| G0059 | Magic Hound |
Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.[22] |
| G0045 | menuPass |
menuPass has registered malicious domains for use in intrusion campaigns.[23][24] |
| G0129 | Mustang Panda |
Mustang Panda have acquired C2 domains prior to operations.[25][26][27] |
| G0034 | Sandworm Team |
Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages.[28] |
| G0122 | Silent Librarian |
Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.[29][30][31][32][33][34] |
| G0139 | TeamTNT | |
| G0134 | Transparent Tribe |
Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.[36][37] |
| G0128 | ZIRCONIUM |
ZIRCONIUM has purchased domains for use in targeted campaigns.[38] |
| ID | Mitigation | Description |
|---|---|---|
| M1056 | Pre-compromise |
Organizations may intentionally register similar domains to their own to deter adversaries from creating typosquatting domains. Other facets of this technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. |
| ID | Data Source | Data Component |
|---|---|---|
| DS0038 | Domain Name | Active DNS |
| Domain Registration | ||
| Passive DNS |
Domain registration information is, by design, captured in public registration logs. Consider use of services that may aid in tracking of newly acquired domains, such as WHOIS databases and/or passive DNS. In some cases it may be possible to pivot on known pieces of domain registration information to uncover other infrastructure purchased by the adversary. Consider monitoring for domains created with a similar structure to your own, including under a different TLD. Though various tools and services exist to track, query, and monitor domain name registration information, tracking across multiple DNS infrastructures can require multiple tools/services or more advanced analytics.[39]
Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access and Command and Control.