Stage Capabilities

{
  "id": "ATTACK:enterprise:T1608",
  "title": "Stage Capabilities",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1608",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--84771bc3-f6a0-403e-b144-01af70e5fda0",
  "external_id": "T1608",
  "domain": "enterprise",
  "created": "2021-03-17T20:04:09.331Z",
  "modified": "2025-10-24T17:49:03.444Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "Volexity Ocean Lotus November 2020",
      "url": "https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"
    },
    {
      "source_name": "Netskope GCP Redirection",
      "url": "https://www.netskope.com/blog/targeted-attacks-abusing-google-cloud-platform-open-redirection"
    },
    {
      "source_name": "Netskope Cloud Phishing",
      "url": "https://www.netskope.com/blog/a-big-catch-cloud-phishing-from-google-app-engine-and-azure-app-service"
    },
    {
      "source_name": "ATT ScanBox",
      "url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
    },
    {
      "source_name": "DigiCert Install SSL Cert",
      "url": "https://www.digicert.com/kb/ssl-certificate-installation.htm"
    },
    {
      "source_name": "Gallagher 2015",
      "url": "http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/"
    },
    {
      "source_name": "Malwarebytes Heroku Skimmers",
      "url": "https://www.malwarebytes.com/blog/news/2019/12/theres-an-app-for-that-web-skimmers-found-on-paas-heroku"
    },
    {
      "source_name": "Dragos Heroku Watering Hole",
      "url": "https://www.dragos.com/blog/industry-news/a-new-water-watering-hole/"
    },
    {
      "source_name": "FireEye CFR Watering Hole 2012",
      "url": "https://web.archive.org/web/20201024230407/https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html"
    },
    {
      "source_name": "Malwarebytes Silent Librarian October 2020",
      "url": "https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"
    },
    {
      "source_name": "Proofpoint TA407 September 2019",
      "url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"
    }
  ]
}