Procedure examples

Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.

EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.

Volt Typhoon has targeted the personal emails of key network and IT staff at victim organizations.

APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.

HAFNIUM has collected e-mail addresses for users they intended to target.

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.

Saint Bear gathered victim email information in advance of phishing operations for targeted attacks.

Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.

TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.

Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.

LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.

Moonstone Sleet gathered victim email address information for follow-on phishing activity.

HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.

Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.

AADInternals can check for the existence of user email addresses using public Microsoft APIs.

Kimsuky has collected victim employee name information.

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.

Silent Librarian has collected lists of names for individuals from targeted organizations.

Indrik Spider has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. Indrik Spider has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc.

Volt Typhoon has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network.

HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.

AADInternals can gather information about a tenant’s domains using public Microsoft APIs.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to map a complete network topology of the target infrastructure.

Volt Typhoon has conducted extensive reconnaissance of victim networks including identifying network topologies.

Salt Typhoon has used configuration files from exploited network devices to help discover upstream and downstream network segments.

MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors.

FIN13 has searched for infrastructure that can provide remote access to an environment for targeting efforts.

HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.

Andariel has limited its watering hole attacks to specific IP address ranges.

Magic Hound has captured the IP addresses of visitors to their phishing sites.

During the 2025 Poland Wiper Attacks, the adversaries obtained details on the configuration of the victim Fortinet perimeter device to include publicly disclosed details on an online forum used by criminal communities.

Volt Typhoon has identified target network security measures as part of pre-compromise reconnaissance.

For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.

During Operation Digital Eye, threat actors concealed malicious activity by using terms that aligned with the technological context of the targeted organization.

Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others. Kimsuky has also used large language models (LLMs) to gather information about potential targets of interest.

Volt Typhoon has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.

FIN7 has compiled a list of victims by filtering companies by revenue using Zoominfo, which is a service that provides business information.

MirrorFace has placed specific content in phishing emails to target members of particular political parties.

APT28 has used large language models (LLMs) to gather information about satellite capabilities.

Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.

Moonstone Sleet has gathered information on victim organizations through email and social media interaction.

Magic Hound has collected location information from visitors to their phishing sites.

Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.

In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.

LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.

During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.

Volt Typhoon has identified key network and IT staff members pre-compromise at targeted organizations.

FIN7 has identified IT staff and employees who had higher levels of administrative rights.

LAPSUS$ has gathered detailed knowledge of team structures within a target organization.