tfMITRE ATT&CK sub-technique

Network Devices T1584.008

sub-technique of T1584 Compromise Infrastructure

Tactic: Resource Development
Platform: PRE
Version: 1.1
Created: 28 March 2024
Last modified: 12 May 2026
Contributor: Gavin Knapp

Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 7%

Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Network Devices MITRE reference T1584.008

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.1 2

created 2023-07-272 referencesaka BRONZE SILHOUETTE

ZIRCONIUMG0128 ↗

Has compromised network devices such as small office and home office (SOHO) routers and IoT devices for ORB (operational relay box) Proxy networks.1 2

created 2021-03-242 referencesaka APT31

LeviathanG0065 ↗

Has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.1

created 2018-04-181 referenceaka MUDCARP

APT28G0007 ↗

Compromised Ubiquiti network devices to act as collection devices for credentials compromised via phishing webpages.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 4 groups for this technique

Offense vs defense T1584.008

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Network Devices detection strategy DET0859

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Network Devices

Enterprise

1 platform

AN1991 · PRE

Once adversaries leverage compromised network devices as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Response ContentDC0104	Internet Scan	None

Network Devices detections T1584.008

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs