Acquire Infrastructure is the tactic of obtaining servers, domains, cloud accounts, or other resources to support malicious operations. Threat actors use it to host payloads, relay traffic, and stage phishing or command-and-control, so defenders should track suspicious infrastructure registration, short-lived assets, and reused network patterns.
How Acquire Infrastructure works in an attack chain
Acquire Infrastructure is an upstream preparation tactic, not the payload itself. Attackers first secure hosting, domains, cloud instances, redirectors, or other resources that can survive short bursts of scrutiny, then use them to stage malware, proxy traffic, host phishing pages, or support command-and-control.
The security significance is that the infrastructure often looks routine in isolation. A single server, registrar account, or cloud tenant may be ordinary, but the pattern across many assets, such as rapid registration, disposable hosting, and repeated reuse of naming or network infrastructure, is what reveals malicious intent.
Why malicious infrastructure is valuable to threat actors
Infrastructure gives attackers control over where content lives and how traffic moves. That control helps them separate the initial compromise from the rest of the operation, rotate away from blocked hosts, and change delivery paths without changing the underlying campaign.
It also supports resilience and compartmentalisation. One asset may host a lure, another may serve payloads, and another may relay callbacks, which makes takedown slower and attribution harder. The same pattern appears across phishing, malware delivery, credential theft, and command-and-control operations.
What defenders look for when they map exposure
Defenders typically trace this tactic through domain registration patterns, hosting provenance, certificate usage, DNS churn, and cloud tenancy behaviour. Indicators become more useful when viewed together, especially when short-lived assets share registrants, IP ranges, naming conventions, or TLS and DNS fingerprints.
That is why public threat intelligence and infrastructure advisories matter. CISA cyber threat advisories help defenders correlate suspicious infrastructure with broader campaigns, while MITRE ATT&CK Enterprise Matrix provides the surrounding adversary techniques that often follow infrastructure acquisition.
How organisations reduce impact and investigate reuse
When malicious infrastructure is suspected, the first question is whether the asset is still live, newly stood up, or part of a reused pattern. That affects whether defenders block, sinkhole, monitor, or escalate for coordinated takedown. Exposure also matters when the infrastructure is inside a cloud provider, because compromise can create legal, operational, and abuse-notification issues beyond the immediate campaign.
Post-detection review should go beyond the asset itself. Teams should check whether the same registrar, VPS provider, SSL certificate, or cloud account has been used for other malicious services, because reuse is often what turns a one-off host into a repeatable campaign capability. CISA Industrial Control Systems resources are useful where hostile infrastructure is used to reach operational environments, while CSA Cloud Controls Matrix helps frame cloud-side governance and monitoring expectations.
Risk and Threat Considerations
Acquire Infrastructure matters because it lowers the cost of repeated abuse and gives attackers durable control over delivery, staging, and callback paths. Short-lived hosts, disposable domains, and recycled network patterns can make takedown and attribution difficult, especially when the same infrastructure is repurposed across multiple campaigns.
Failure mechanism: The attacker gains a controllable platform for phishing, payload hosting, or command-and-control, then rotates or replaces it faster than defenders can block or seize it.
Impact: The result is sustained malicious reach, more reliable delivery, and a broader attack surface for compromise, credential theft, and follow-on intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Directly names the tactic of obtaining infrastructure for malicious operations |
| Recommendation — Map observed hosting, domain, and cloud patterns to T1583 and hunt for campaign infrastructure reuse. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Suspicious infrastructure must be monitored through ongoing detection of external threats and anomalies |
| ID.RA-05 — Threats, vulnerabilities, likelihood, and impacts are used to understand risk | Infrastructure acquisition is a threat pattern that should inform risk understanding and prioritisation | |
| Recommendation — Continuously monitor domain, DNS, and cloud signals for suspicious infrastructure patterns. Incorporate malicious infrastructure patterns into threat and risk analysis. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Suspicious infrastructure requires monitoring and alerting to detect hostile external activity |
| RA-5 — Vulnerability Monitoring and Scanning | Infrastructure abuse often depends on exposed or misconfigured assets that need discovery and review | |
| Recommendation — Use SI-4 to alert on malicious domains, hosts, and callback infrastructure. Scan external-facing assets and cloud resources for exposure that could be abused as infrastructure. | ||
Practitioner Guidance
What to watch for: Treat rapid domain creation, mismatched hosting provenance, and repeated DNS or certificate patterns as a single investigative problem rather than isolated alerts. Infrastructure analysis is most effective when it is connected to campaign-level hunting, abuse reporting, and takedown workflows.
Practitioner takeaway: The most useful control is not just blocking a host, but recognising the reusable infrastructure pattern that lets the same operator stand up the next one.
Related resources from NHI Mgmt Group
- What is the difference between network controls and identity controls for infrastructure access?
- Why do static credentials create more risk in hybrid infrastructure?
- How should security teams govern AI-assisted infrastructure automation?
- How should security teams govern infrastructure identities alongside user identities?