T1584.005: Botnet
Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.[1] Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.[2] Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.[3] With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).
Analyst context for executives and security teams
Botnet development matters because it is preparation for later operations, not the final attack itself. If an adversary controls many compromised third-party systems, they can use that infrastructure to scale phishing, DDoS, command-and-control redirection, or other targeting activity while making source attribution and blocking harder. For leaders, the key issue is whether the organization can recognize adversary preparation and withstand traffic, messaging, or infrastructure abuse that originates from distributed, legitimate-looking systems.
Executive priority
Treat this as a resilience and readiness issue tied to resource development. Executives should ask whether DDoS preparedness, phishing defenses, threat intelligence intake, and incident escalation procedures account for attacks launched from compromised third-party infrastructure. Because ATT&CK links this behavior to multiple groups and a campaign, it should influence control prioritization and tabletop planning, but the supplied data does not establish active targeting of any specific organization.
Technical view
This is an Enterprise ATT&CK sub-technique under Compromise Infrastructure in the Resource Development tactic, with platform PRE. SOC and IR teams should validate visibility before initial intrusion: threat intelligence indicators, external attack surface observations, DDoS telemetry, email security data, DNS/network reputation signals, and incident reporting workflows. MITRE provides no official detection text for this object, but the relationship to DET0883 indicates a detection strategy exists and should be reviewed where available. Defensive validation should focus on whether distributed infrastructure can be correlated to phishing delivery, DDoS activity, suspicious external scanning, or other pre-compromise patterns without assuming every botnet-sourced event is targeted.
Likely telemetry
- Threat intelligence reporting on botnet infrastructure, compromised routers, booter/stresser services, and adversary-controlled C2 redirection
- DDoS monitoring and upstream provider traffic summaries showing distributed source patterns
- Email security telemetry for large-scale phishing campaigns and sender infrastructure reputation
- DNS, proxy, firewall, and network flow logs showing repeated contact with known or suspected botnet-related infrastructure
- External attack surface monitoring for unusual scanning or targeting from distributed third-party systems
Detection direction
- Confirm whether DET0883 or equivalent internal analytics are mapped to this technique and whether they rely on current threat intelligence rather than static blocklists alone.
- Tune detections for distributed behavior patterns, reputation context, and campaign-level correlation; single IP-based alerts are likely to be noisy because botnets use many compromised third-party systems.
- Separate DDoS, phishing, and C2-infrastructure hypotheses during triage so analysts do not over-attribute activity from botnet nodes without corroborating evidence.
- Review blind spots in pre-compromise visibility: limited external telemetry, lack of upstream DDoS provider data, weak email infrastructure enrichment, and insufficient DNS/proxy retention can all reduce coverage.
- Use relationship context cautiously: Quad7 Activity and several groups are linked to this technique, but those relationships do not by themselves prove local exposure or attribution.
Mitigation priorities
- Prioritize pre-compromise mitigations consistent with M1056: reduce externally visible weaknesses, monitor for adversary preparation, and make successful operations harder before intrusion begins.
- Maintain DDoS response planning, including escalation paths with network and service providers, because the official description identifies DDoS as a possible follow-on use.
- Strengthen phishing resilience through email filtering, user reporting workflows, and incident playbooks because large-scale phishing is also identified as a possible follow-on activity.
- Use threat intelligence operationally: enrich alerts with botnet infrastructure reporting and review whether block, monitor, or escalate decisions are documented for audit and incident readiness.
- Exercise incident response scenarios where malicious activity originates from many compromised third-party systems, requiring correlation rather than simple source blocking.
Analyst notes and limits
The most important decision value is readiness for adversary infrastructure that exists before direct compromise. This technique is especially relevant to managed detection, threat intelligence, IR planning, DDoS preparedness, and phishing defense. The supplied relationships show use by Quad7 Activity and multiple groups, including Volt Typhoon, HAFNIUM, Sandworm Team, Axiom, and APT-C-36, but those links should be used for contextual enrichment rather than automatic attribution.
MITRE provides no official detection text for this technique, and the platform is PRE, so host-based detection expectations should not be inferred from the object alone. The M1056 mitigation description is truncated in the supplied data. Local telemetry, provider visibility, threat intelligence quality, and business exposure determine practical coverage.
Botnet
Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.[1] Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.[2] Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.[3] With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1584 | Compromise Infrastructure | This object subtechnique of Compromise Infrastructure. |
Groups, software, and campaigns
G0125: HAFNIUM
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.[1][2][3]
G0001: Axiom
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]
G0034: Sandworm Team
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]
In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]
G0099: APT-C-36
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
C0055: Quad7 Activity
Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. [1] [2] The botnet was initially composed primarily of TP-Link routers and was named Quad7 due to compromised devices exposing TCP port 7777 with the distinctive banner xlogin. Later activity showed a significant increase in compromised Asus routers and the addition of new ports and banners, including TCP port 63256 displaying alogin. Quad7 infrastructure functions as a collection of egress IPs that various China-affiliated threat actors have used to conduct password-spraying and brute-force operations. [1][3] Microsoft has reported that Storm-0940 leveraged credentials obtained through Quad7 Activity to target organizations in North America and Europe, including government agencies, non-governmental organizations, think tanks, law firms, energy firms, IT providers, and defense industrial base entities. [2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 734bbf4a20c9… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Norton Botnet
Norton. (n.d.). What is a botnet?. Retrieved October 4, 2020.
Open source URL -
[2]
Imperva DDoS for Hire
Imperva. (n.d.). Booters, Stressers and DDoSers. Retrieved October 4, 2020.
Open source URL -
[3]
Dell Dridex Oct 2015
Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.
Open source URL -
[4]
mitre-attack T1584.005Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.