APT42G1044 ↗
Has leveraged LLMs to search for official emails to build target lists, and conduct reconnaissance on potential business partners.1
tfMITRE ATT&CK technique
Query Public AI Services T1682
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.0
- Created
- 25 March 2026
- Last modified
- 12 May 2026
- Contributor
- Menachem Goldstein
Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., Search Open Websites/Domains), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for Social Engineering approaches, identifying contact information for use in Phishing or Phishing for Information, or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Query Public AI Services MITRE reference T1682
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
KimsukyG0094 ↗
Has used LLMs to identify think tanks, government organizations, and experts to inform targeting for spearphishing campaigns.1
All 2 groups for this technique
Offense vs defense T1682
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Query Public AI Services detection strategy DET0919
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Query Public AI Services
1 platform
AN2062 · PRE
Much of this takes place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on designing defenses that are not reliant on atomic indicators.