Skip to content

Social Media Accounts

Subtechnique · ATTACK:enterprise:T1585.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1585.001",
  "title": "Social Media Accounts",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1585/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b1ccd744-3f78-4a0e-9bb2-2002057f7928",
  "external_id": "T1585.001",
  "domain": "enterprise",
  "created": "2020-10-01T01:08:41.124Z",
  "modified": "2026-05-12T15:12:00.708Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "NEWSCASTER2014",
      "url": "https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation"
    },
    {
      "source_name": "BlackHatRobinSage",
      "url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12853add-45f8-4dfb-9d64-af39b1575dcf

US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14fac9a8-f835-492b-b4df-32b677ac9030

ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--325a293f-7b6e-4baf-bcb8-74550019e144

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f689d2d-0088-44b3-9fe8-3c2396d28b19

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Check Point Medusa Ransomware April 2025

ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4269e5cb-b2ad-4757-b0b0-bfd5e8b7dc38

Google EXOTIC LILY March 2022

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--428a1a44-f1bc-4589-94de-946233489905

ClearSky Siamesekitten August 2021

ATTACK:enterprise:G1050 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45269484-5a48-48a5-b0b5-23f4f792e06e

BushidoToken Qilin RaaS JUN 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4778438c-744e-4bc8-9a6f-6532125073ae

Microsoft CYBERWARCON NOV 2024 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4926189d-559f-488c-a465-25a23ce71880

CheckPointResearch_TheGentlemen_April2026 · Sophos_TheGentlemen_Sept2026

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fd0e9f0-cf27-48fe-a868-00b4291b025a

Mandiant_UNC1549_Feb2024

ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cf196e1-fccd-438c-b292-24a3607c1118

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6514cf17-0e40-4858-bd3e-58c8fb70796a

KISA Operation Muzabi

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6de233bc-efe2-4dbd-b0a6-994d45f6bc23

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fc8e3dd-1bb7-4e76-8a8c-9e836f944488

Microsoft Iranian Threat Actor Trends November 2021

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9613c02e-354f-4175-aca0-85d3bc30ba1f

Trend Micro TeamPCP MAY 2026 · Palo Alto TeamPCP MAR 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a60c0123-95a3-4409-a60e-354e4237d6cb

Dell Threat Group 2889

ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afaafa9d-6c93-4116-94c2-6ff11a304ed8

ESET Dukes October 2019

ATTACK:enterprise:T1585.001 → subtechnique-of → ATTACK:enterprise:T1585

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6c09dbf-0934-42c5-a517-847128a0ce5a

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0807a3c-a298-47ef-8705-7d7ca55d446e

Google TAG Lazarus Jan 2021

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d07edbd9-3fdd-43bd-9fa9-4fa7394a881c

CarySentinelLabs_CiscoSaltTyphoon_Dec2025

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e122b9fa-d722-4ee8-a5d7-0e585277676d

Volexity Ocean Lotus November 2020

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e270a284-e4f6-43e1-b116-bb2fc43325b8

Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · SecurityScorecard Contagious Interview October 2024 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · SecurityScorecard Contagious Interview FamousChollima October 2024 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e463f5ae-4b7a-40dd-94e1-1a04a22e5e23

ClearSky Pay2Kitten December 2020

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e562688d-a5e3-4a17-95dd-8ef7488e015e

ClearSky Kittens Back 3 August 2020

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e86f6977-8dc6-4d5d-9d87-a6ace0058642

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea78d30b-6678-475a-93c6-24c1cb7ccf54

Check Point VOID MANTICORE Handala Hack March 2026 · SPECOPS Outpost24 Handala Hack Stryker March 2026 · DOJ FBI Handala Hack March 2026 · Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026 · FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4980470-c6f6-4032-8d99-e707861a4180

Microsoft Moonstone Sleet 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.