Mustard TempestG1020 ↗
Operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.1234
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.4
- Created
- 01 October 2020
- Last modified
- 12 May 2026
- Contributor
- Jeremy Galloway
Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.[1] Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53).[2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.5
CampaignsTop 9%
Campaigns91st percentile · 91% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Domains MITRE reference T1584.001
Top 25%of all ATT&CK techniques for number of groups
6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
SideCopyG1008 ↗
Has compromised domains for some of their infrastructure, including for C2 and staging malware.1
Transparent TribeG0134 ↗
Has compromised domains for use in targeted malicious campaigns.1
KimsukyG0094 ↗
Has compromised legitimate sites and used them to distribute malware.12
Magic HoundG0059 ↗
Has used compromised domains to host links targeted to specific phishing victims.1234
APT1G0006 ↗
Hijacked FQDNs associated with legitimate websites hosted by hop points.1
All 6 groups for this technique
5 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries compromised infrastructure to use for C2.1
C0010C0010 ↗
During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.1
Operation Dream JobC0022 ↗
For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.12
SolarWinds CompromiseC0024 ↗
For the SolarWinds Compromise, APT29 compromised domains to use for C2.1
C0021C0021 ↗
For C0021, the threat actors used legitimate but compromised domains to host malicious payloads.1
All 5 campaigns for this technique
Offense vs defense T1584.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Domains detection strategy DET0863
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Domains
1 platform
AN1995 · PRE
Monitor for logged domain name system (DNS) registry data that may hijack domains and/or subdomains that can be used during targeting. In some cases, abnormal subdomain IP addresses (such as those originating in a different country from the root domain) may indicate a malicious subdomain. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control. Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain. Efforts may need to be tailored to specific domains of interest as benign registration and resolution changes are a common occurrence on the internet. Monitor for queried domain name system (DNS) registry data that may hijack domains and/or subdomains that can be used during targeting. In some cases, abnormal subdomain IP addresses (such as those originating in a different country from the root domain) may indicate a malicious subdomain. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Passive DNSDC0096 | Domain Name | None |
| Domain RegistrationDC0101 | Domain Name | None |
| Active DNSDC0103 | Domain Name | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.