Gather Victim Identity Information

{
  "id": "ATTACK:enterprise:T1589",
  "title": "Gather Victim Identity Information",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1589",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--5282dd9a-d26d-4e16-88b7-7c0f4553daf4",
  "external_id": "T1589",
  "domain": "enterprise",
  "created": "2020-10-02T14:54:59.263Z",
  "modified": "2026-05-12T15:12:00.633Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "reconnaissance"
  ],
  "source_references": [
    {
      "source_name": "OPM Leak",
      "url": "https://web.archive.org/web/20230602111604/https://www.opm.gov/cybersecurity/cybersecurity-incidents/"
    },
    {
      "source_name": "Detectify Slack Tokens",
      "url": "https://labs.detectify.com/writeups/slack-bot-token-leakage-exposing-business-critical-information/"
    },
    {
      "source_name": "GitHub truffleHog",
      "url": "https://github.com/dxa4481/truffleHog"
    },
    {
      "source_name": "GrimBlog UsernameEnum",
      "url": "https://grimhacker.com/2017/07/24/office365-activesync-username-enumeration/"
    },
    {
      "source_name": "Register Uber",
      "url": "https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/"
    },
    {
      "source_name": "GitHub Gitrob",
      "url": "https://github.com/michenriksen/gitrob"
    },
    {
      "source_name": "CNET Leaks",
      "url": "https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/"
    },
    {
      "source_name": "Obsidian SSPR Abuse 2023",
      "url": "https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/"
    },
    {
      "source_name": "Forbes GitHub Creds",
      "url": "https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196"
    },
    {
      "source_name": "Register Deloitte",
      "url": "https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/"
    }
  ]
}