TA578G1038 ↗
Has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.1
tfMITRE ATT&CK technique
Search Victim-Owned Websites T1594
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.1
- Created
- 02 October 2020
- Last modified
- 24 October 2025
- Contributor
- James P Callahan, Professional Paranoid
Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 73% of ATT&CK techniques have fewer threat groups attributed.3
CampaignsTop 12%
Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.