Attackers use Acquire Infrastructure to obtain servers, domains, accounts or other resources that support malicious operations. They may register lookalike domains, rent hosting or compromise third-party systems to stage payloads and command-and-control. Defenders should monitor for suspicious domain registration, cloud resource abuse and infrastructure that matches known attacker patterns.
What Acquire Infrastructure means in an attacker playbook
acquire infrastructure is the stage where an attacker secures the assets needed to run an operation, rather than launching the intrusion itself. That can include domains, servers, cloud accounts, proxies, or compromised third-party systems. The point is to build a platform for staging, delivery, command-and-control, persistence, and concealment.
It is useful to think of this as operational setup. A campaign may begin long before any payload is delivered, because the attacker first needs places to host files, route traffic, impersonate legitimate services, or absorb abuse reports without immediately exposing the core operation.
That infrastructure can be owned, rented, registered, or hijacked. A lookalike domain may support phishing or redirection, while compromised hosting or cloud resources can hide malware staging and command-and-control. The same activity can also support resilience, giving the attacker fallback channels if one server, domain, or account is blocked.
How attackers build and use that infrastructure
Attackers often mix legitimate services with stolen or disposable resources to make their activity look ordinary. They may use cloud instances, CDN-like front ends, remote management tools, and short-lived domains to reduce friction and make takedown harder. The infrastructure is valuable because it gives the attacker control over where traffic goes and how long the operation survives.
At this stage, the infrastructure itself becomes part of the tradecraft. A server used for payload staging is not just a host, it is a control point. A domain used for callback traffic is not just a label, it is part of the path that defenders may need to block or sinkhole. That is why defenders look for infrastructure patterns, not only malware samples.
Infrastructure choices also reveal attacker intent. For example, domain naming, hosting geography, TLS certificate reuse, DNS behavior, and cloud provider abuse can all create correlation points. Those indicators help defenders connect otherwise separate events to the same operation, especially when payloads are heavily customized or short-lived. Command and Control (C2) Guide covers the operational side of beaconing, DNS-based C2, and infrastructure patterns defenders can hunt.
What defenders should look for and why it matters
Monitor for suspicious domain registration, abrupt cloud resource creation, unusual registrar or hosting choices, and infrastructure that matches known attacker patterns. These are often earlier signals than payload execution, and they can provide the first chance to disrupt the campaign before command-and-control becomes stable.
Also watch for overlap between infrastructure and identity abuse. An attacker who can acquire accounts, API keys, or hosting access may reuse those assets across multiple campaigns, which makes the infrastructure harder to distinguish from legitimate administrative activity. The State of NHI & AI Agent Breach Report 2026 is useful for understanding how compromised access material and abused accounts can support malicious operations at scale.
Defenders should treat infrastructure indicators as both detection leads and containment targets. Once a domain, host, or account is associated with hostile use, response usually means blocking, sinkholing, disabling, revoking, or seizing the resource where possible, then looking for the next hop in the attacker’s build-out.
Risk and Threat Considerations
Acquire Infrastructure is risky because it gives attackers durable control points for delivery and concealment. If defenders only hunt for final payloads, they may miss the earlier, cheaper stage where the attacker is still building reusable access, hosting, and routing infrastructure.
Failure mechanism: The attacker separates infrastructure acquisition from payload execution, so the domain, host, or account looks like ordinary provisioning until it is used for staging, C2, or redirection.
Impact: This creates earlier footholds, better persistence, and faster campaign recovery after takedown, while also increasing the chance that malicious traffic blends into legitimate hosting or administrative activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Directly matches attacker infrastructure acquisition for hosting and domains. |
| T1071 — Application Layer Protocol | C2 infrastructure commonly uses ordinary protocols to hide command traffic. | |
| T1568 — Dynamic Resolution | Lookalike domains and fast-changing infrastructure often rely on dynamic resolution. | |
| Recommendation — Map observed infrastructure buildup to T1583 and hunt for staging, redirectors, and C2 setup. Inspect protocol use for covert C2 and block anomalous application-layer callbacks. Track DNS churn and resolve suspicious domains to expose rotating attacker infrastructure. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Suspicious domains, hosting, and C2 infrastructure are detected through network monitoring. |
| Recommendation — Correlate DNS, proxy, and cloud logs to identify hostile infrastructure early. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Infrastructure acquisition is often first visible in logs that need analysis and correlation. |
| Recommendation — Review audit data for unusual domain, hosting, and account activity patterns. | ||
Practitioner Guidance
What to verify: Confirm whether newly observed domains, cloud instances, certificates, or accounts have a clear business owner, expected lifecycle, and normal peer group. If not, treat them as infrastructure acquisition rather than benign provisioning.
What good looks like: Detection teams can link DNS, hosting, registrar, and cloud telemetry into a single view so that suspicious infrastructure is flagged before it is widely used. The best signal is not one indicator in isolation, but a cluster of weak signals that together show a build-out pattern.
Decision rule: If the infrastructure can support command-and-control or payload staging, prioritize containment and credential or access review before waiting for confirmation of malware execution. By the time the payload is active, the attacker has usually already paid for the setup and will try to reuse it.
Practitioner takeaway: The key shift is to treat infrastructure itself as attacker capability, not just background plumbing, because the domain, host, or account often appears long before the compromise becomes visible.