Hide Infrastructure

Technique · ATTACK:enterprise:T1665

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1665",
  "title": "Hide Infrastructure",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1665",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--eb897572-8979-4242-a089-56f294f4c91d",
  "external_id": "T1665",
  "domain": "enterprise",
  "created": "2024-02-13T17:00:00.175Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "SocGholish-update",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
    },
    {
      "source_name": "TA571",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta571-delivers-icedid-forked-loader"
    },
    {
      "source_name": "mod_rewrite",
      "url": "https://bluescreenofjeff.com/2016-04-12-combatting-incident-responders-with-apache-mod_rewrite/"
    },
    {
      "source_name": "Browser-updates",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/are-you-sure-your-browser-date-current-landscape-fake-browser-updates"
    },
    {
      "source_name": "StarBlizzard",
      "url": "https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"
    },
    {
      "source_name": "QR-cofense",
      "url": "https://cofense.com/blog/major-energy-company-targeted-in-large-qr-code-campaign/"
    },
    {
      "source_name": "Schema-abuse",
      "url": "https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse"
    },
    {
      "source_name": "Orange Residential Proxies",
      "url": "https://www.orangecyberdefense.com/global/blog/research/residential-proxies"
    },
    {
      "source_name": "Facad1ng",
      "url": "https://github.com/spyboy-productions/Facad1ng"
    },
    {
      "source_name": "sysdig",
      "url": "https://sysdig.com/content/c/pf-2023-global-cloud-threat-report?x=u_WFRi&xs=524303#page=1"
    }
  ]
}

Explicit source assertions (8)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.