T1590: Gather Victim Network Information
Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.
Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases).[1][2][3] Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).
Security context for executives and security teams
This technique matters because adversaries can use publicly available or elicited network information—domains, DNS, IP ranges, topology, trust dependencies, and security appliance clues—to make later targeting more precise. For leaders, the key issue is not whether this activity happens inside the network; much of it occurs before compromise and may be visible only through external exposure reviews, threat intelligence, or reconnaissance monitoring.
Executive priority
Treat this as an attack-surface and resilience question. Ask whether the organization knows what network details are exposed through WHOIS, DNS, passive DNS, public technical databases, websites, and third-party relationships. Priority should go to reducing unnecessary disclosure, validating external-facing inventory, and ensuring SOC/IR teams can connect reconnaissance findings to later risks such as initial access through trusted relationships or targeting of exposed infrastructure.
Technical view
T1590 is a reconnaissance technique on the PRE platform. ATT&CK does not provide official detection text, but the related detection strategy DET0869 indicates detection content exists for this behavior. SOC and detection teams should validate visibility into externally observable network data and any internal signals that suggest information gathering, including active scanning, phishing for information, and searches of public technical data sources when observable. Sub-techniques show the practical scope: domain properties, DNS, network trust dependencies, topology, IP addresses, and network security appliances.
Likely telemetry
- External attack surface inventory and asset ownership records
- DNS records, passive DNS findings, and registrar/WHOIS data
- Public IP range allocations and internet-facing service inventory
- Logs or reports from reconnaissance monitoring and external scanning detection
- Phishing-for-information reports and security awareness intake
Detection direction
- Validate what DET0869 covers in the local environment and map it to the T1590 sub-techniques rather than treating reconnaissance as a single alert type.
- Compare public DNS, WHOIS, passive DNS, and IP range data against approved disclosure and asset inventory to find unnecessary exposure.
- Tune detections to distinguish routine research, partner activity, vulnerability management, and legitimate scanning from suspicious reconnaissance patterns.
- Correlate reconnaissance indicators with later activity involving active scanning, searches of public websites/domains, resource acquisition, infrastructure compromise, or trusted relationship abuse where evidence exists.
- Account for the main blind spot: much of this behavior occurs off-network using public data sources, so absence of internal logs is not evidence that the activity did not occur.
Mitigation priorities
- Apply pre-compromise mitigation by reducing unnecessary public exposure of network, DNS, registrar, topology, and trust-dependency information.
- Maintain an accurate external-facing asset inventory, including domains, subdomains, IP ranges, mail-related records, and third-party service indicators exposed through DNS.
- Review what business, technical, and security appliance details are published in websites, records, procurement materials, and partner documentation.
- Use regular external exposure assessments to support vulnerability prioritization and compliance evidence for attack-surface management.
- Ensure incident response playbooks consider reconnaissance findings as early context for later targeting decisions.
Additional notes and limits
The relationship set is useful because it shows this parent technique decomposes into six concrete sub-techniques and is used by named groups including Indrik Spider, HAFNIUM, and Volt Typhoon. Those relationships support prioritizing coverage, but they do not by themselves prove current targeting of any specific organization.
ATT&CK provides no official detection text for this object, and the platform is PRE, meaning much of the behavior may occur before compromise and outside telemetry controlled by the defender. Local evidence from external exposure reviews, asset inventories, DNS/WHOIS records, partner data, and reconnaissance monitoring is required to assess real coverage and risk.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Gather Victim Network Information
Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.
Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases).[1][2][3] Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1590.001 | Domain PropertiesSub-technique | Domain Properties subtechnique of this object. |
| Enterprise | T1590.002 | DNSSub-technique | DNS subtechnique of this object. |
| Enterprise | T1590.005 | IP AddressesSub-technique | IP Addresses subtechnique of this object. |
| Enterprise | T1590.003 | Network Trust DependenciesSub-technique | Network Trust Dependencies subtechnique of this object. |
| Enterprise | T1590.004 | Network TopologySub-technique | Network Topology subtechnique of this object. |
| Enterprise | T1590.006 | Network Security AppliancesSub-technique | Network Security Appliances subtechnique of this object. |
Groups, software, and campaigns
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
G0119: Indrik Spider
Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.[1][2][3]
G0125: HAFNIUM
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.[1][2][3]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 3fa32dcd1350… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]WHOIS
NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.
Open source URL - [2]DNS Dumpster
Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
Open source URL - [3]Circl Passive DNS
CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.
Open source URL - [4]CISA AA24-038A PRC Critical Infrastructure February 2024
CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
Open source URL - [5]Mandiant_UNC2165
Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.
Open source URL - [6]Volexity Exchange Marauder March 2021
Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.
Open source URL - [7]Circl Passive DNS
CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.
Open source URL - [8]Circl Passive DNS
CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.
Open source URL - [9]DNS Dumpster
Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
Open source URL - [10]DNS Dumpster
Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
Open source URL - [11]WHOIS
NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.
Open source URL - [12]WHOIS
NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.
Open source URL - [13]mitre-attackT1590Open source URL
- [14]mitre-attackT1590Open source URL
- [15]mitre-attackT1590Open source URL
- [16]CISA AA24-038A PRC Critical Infrastructure February 2024
CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
Open source URL - [17]Mandiant_UNC2165
Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.
Open source URL - [18]Volexity Exchange Marauder March 2021
Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.