Every phishing kit, adversary-in-the-middle proxy and command and control server needs somewhere to live, and the domains, servers and cloud accounts an attacker buys for it often become visible days before the first email lands. MITRE ATT&CK tracks this as T1583 Acquire Infrastructure, a Resource Development (TA0042) technique with eight sub-techniques covering domains, DNS servers, virtual private servers, physical servers, botnets, web services, serverless platforms and malvertising. It happens entirely outside your network, so the defender task is not detection on endpoints but exposure reduction and early warning: watching certificate logs and new domain registrations for your brand, blocking young and lookalike domains, hunting adversary servers through internet scan data, and taking infrastructure down fast. This guide is for SOC, threat intelligence, brand protection and email security teams. For the tactic overview, see the ATT&CK Resource Development Tactic Guide.
Key takeaways
- ATT&CK says you cannot prevent it, so plan to see it. The only v20 mitigation is M1056 Pre-compromise, which states the technique cannot easily be mitigated with preventive controls; the one exception noted is registering domains similar to your own.
- Brand-specific domains are the best early warning. CISA lists Scattered Spider domain patterns such as victimname-sso[.]com, victimname-servicedesk[.]com and victimname-okta[.]com; a certificate or registration for one of those is a direct signal.
- Cloud and serverless hide attacker infrastructure in trusted names. ATT&CK names Cloudflare Workers, AWS Lambda and Google Apps Script as serverless infrastructure whose traffic appears to come from common cloud provider subdomains.
- Expired domains you once trusted are acquirable. Mustang Panda re-registered expired domains, and the ForcedLeak research showed an expired domain still on an allowlist could be bought for about $5.
- Takedown speed is the metric. Infrastructure found before use is only valuable if it is blocked internally and reported to the registrar or host within hours.
What T1583 covers in ATT&CK v20
ATT&CK v20 (technique version 1.5) describes adversaries buying, leasing, renting or obtaining infrastructure for targeting. The PRE platform tag means the activity happens before or outside the victim environment. The sub-techniques differ sharply in how visible they are to a defender.
| Sub-technique | What is acquired (per ATT&CK) | Typical use | Defender visibility |
|---|---|---|---|
| T1583.001 Domains | Purchased or free domains, including homoglyphs, different TLDs and IDN homograph lookalikes | Phishing, drive-by compromise, C2 | High: registration data, certificate logs, passive DNS |
| T1583.002 DNS Server | Adversary-run DNS servers instead of hijacked ones | DNS-based C2 with conditional responses | Medium: passive DNS and NS records of suspect domains |
| T1583.003 Virtual Private Server | Rented VMs or containers, sometimes from providers with minimal registration requirements | C2, phishing hosting, scanning, exfiltration destination | Medium: internet scan fingerprints, hosting reputation |
| T1583.004 Server | Bought, leased or rented physical servers, including abuse of cloud free trials | Watering holes, phishing operations, C2 | Medium: as for VPS |
| T1583.005 Botnet | Rented or bought botnets, including leased ORB networks of VPS, SOHO routers and IoT devices | Large-scale phishing, DDoS, hiding C2 | Low: traffic comes from residential and small business IP space |
| T1583.006 Web Services | Accounts on popular services such as Google, GitHub or Twitter | C2 via web services, exfiltration, phishing | Low: blends with normal traffic |
| T1583.007 Serverless | Cloudflare Workers, AWS Lambda functions, Google Apps Scripts | Responding to implants or proxying to C2, harder attribution | Low: traffic uses provider subdomains |
| T1583.008 Malvertising | Purchased online advertisements, often impersonating brands in search results | Delivering trojanised software downloads | Medium: brand monitoring of ads and lookalike download sites |
Two adjacent techniques are easy to confuse with T1583. Taking over infrastructure that belongs to someone else, including your own forgotten subdomains, is T1584 Compromise Infrastructure. Creating social media and email accounts for personas is T1585 Establish Accounts; see MITRE ATT&CK T1585 Establish Accounts.
How adversaries use it: real cases
- Scattered Spider (G1015) and the 0ktapus pattern: CISA advisory AA23-320A (last updated 21 November 2023) says intrusions often begin with phishing and smishing that use victim-specific crafted domains, and gives the patterns victimname-sso[.]com, victimname-servicedesk[.]com and victimname-okta[.]com. ATT&CK v20 records the group registering domains that spoof corporate login portals. The Twilio Breach 2022 page lists the domains used in that campaign, including twilio-sso.com and twilio-okta.com, delivered by SMS so that email filtering never saw them. See the Scattered Spider Threat Actor Profile.
- APT28 (G0007): ATT&CK v20 records domains imitating NATO, OSCE and other organisations, phishing domains hosted on free services for brief periods, and newly created Blogspot pages used for credential harvesting. Short-lived hosting is why block decisions have to be fast. See the APT28 (Fancy Bear) Threat Actor Profile.
- Mustang Panda (G0129): during the RedDelta modified PlugX operations (C0047), ATT&CK v20 records adversary-controlled domains that were re-registrations of expired domains. Expired domains keep their history and reputation, which can carry them past reputation-based filters. See the Mustang Panda Threat Actor Profile Guide.
- Storm-1811 (G1046): ATT&CK v20 records domains created for use with remote monitoring and management tools, part of help desk impersonation campaigns. See the Storm-1811 Threat Actor Profile Guide.
- ForcedLeak research (2025): the ForcedLeak 2025 disclosure showed a different angle: an expired domain still listed in a content security policy allowlist was registered by the researcher for about $5 and became a trusted exfiltration channel for an AI agent. Salesforce secured the domain and enforced Trusted URLs for Agentforce from 8 September 2025. The lesson is that any domain your systems trust is infrastructure an attacker can acquire once you let it lapse.
Pre-attack signals and where to find them
ATT&CK v20 detection strategies for this technique (DET0895 for the parent, DET0892 for domains, DET0838 for VPS, DET0896 for web services, DET0829 for serverless) all point to data sources outside your network: domain registration records, passive and active DNS, and internet scan response content and metadata. The table turns those into practical feeds.
| Signal | Data source | What to look for | Sub-techniques covered |
|---|---|---|---|
| Certificates for lookalike names | Certificate Transparency logs (RFC 9162 describes CT 2.0; monitors watch logs for unexpected certificates) | Certificates for names containing your brand plus terms such as sso, okta, login, servicedesk, helpdesk, vpn or support | .001, and .007 where a custom domain fronts serverless |
| Newly registered domains | Registration data, newly registered domain feeds, RDAP lookups | Brand strings, homoglyphs, IDN homographs and alternative TLDs registered in the last 30 days | .001 |
| DNS changes on suspect domains | Passive DNS | A lookalike domain gaining MX records (email capability) or A records pointing at a hosting provider, often the step just before use | .001, .002, .003 |
| Adversary server fingerprints | Internet scan data (ATT&CK: Internet Scan response content and metadata) | Services, certificates, TLS negotiation features or response artefacts that match known C2 or phishing kits | .003, .004 |
| Brand abuse on platforms | Search ad monitoring, app stores, code hosting, file sharing | Ads impersonating your products, repositories or pages hosting lookalike installers | .006, .008 |
| Inbound traffic and clicks | Your secure email gateway, DNS resolver and proxy logs | First contact with a domain under 30 days old, or with serverless and tunnelling hostnames not used by your business | All, at the point of use |
For the mechanics of each feed, see the Certificate Transparency Monitoring Guide for Web Teams and the Newly Registered Domains Guide; this page focuses on how they fit the ATT&CK technique.
AiTM phishing infrastructure
Adversary-in-the-middle phishing needs a domain that looks credible, a TLS certificate, and a reverse proxy that relays to the real identity provider. All three leave traces: the certificate is logged in CT before the page can be served over HTTPS, the domain often follows the brand-plus-identity-term pattern CISA describes, and the proxy is commonly hosted on rented VPS, serverless platforms or tunnelling services. Treat a CT hit for a brand-plus-identity-provider name as a high-priority event: block it at the resolver and proxy immediately, then investigate. Because AiTM steals session cookies rather than passwords, the control that removes the payoff is phishing-resistant authentication; see the AiTM Phishing Guide and the Phishing-Resistant MFA Guide.
Serverless endpoints and tunnels
ATT&CK notes that serverless traffic appears to come from subdomains of common cloud providers, which makes it hard to tell from ordinary traffic and supports T1665 Hide Infrastructure. Domain reputation will not help here. The practical defence is an allowlist mindset for these shared namespaces: record which serverless and tunnel hostnames your organisation actually uses, and alert on or block first-seen ones from user and server networks. For tunnelling services specifically, see the Cloudflare Tunnel and trycloudflare abuse guide; for web services used as C2, see T1102 Web Service Defensive Guide.
Reducing exposure: controls you own
These are NHI Mgmt Group recommendations. ATT&CK itself offers only M1056 Pre-compromise for T1583.
| Control | What it does | Implementation notes |
|---|---|---|
| Defensive registration | Removes the most obvious lookalikes from the market (the one preventive step M1056 names) | Register key typos, brand plus identity terms and main TLDs; you cannot register every variant, so combine with monitoring. See the Domain Portfolio and Lookalike Domain Management Guide |
| Never let trusted domains lapse | Stops attackers acquiring a domain your allowlists, CSPs, OAuth redirect URIs or email rules still trust | Keep an inventory of every domain referenced in security configuration; auto-renew; before retiring a domain, remove it from all allowlists and hold it for years |
| Newly registered domain blocking | Denies access to domains younger than a set age at the resolver or proxy | For example, a block or warn policy for domains under 30 days old (an illustrative threshold, not a standard); allow exceptions by ticket. See the DNS Security and Protective DNS Buyer's Guide |
| Brand monitoring with CT | Early warning for lookalike sites that need TLS | Watch for your brand strings plus identity terms, product names and executive names; route hits to the SOC, not only marketing |
| Phishing-resistant MFA | Makes AiTM infrastructure useless against covered accounts | FIDO2 or certificate-based authentication for administrators first, then all staff |
| Fast takedown process | Shortens the useful life of acquired infrastructure | Pre-agreed registrar and host abuse contacts, evidence templates and an owner; see the Brand Impersonation and Lookalike Domain Takedown Playbook |
| Threat intelligence sharing | Brings in infrastructure others have already seen | Ingest sector ISAC and government indicator feeds into resolver and proxy blocklists automatically |
Where identity fits
Most acquired infrastructure in identity attacks exists to steal sessions and tokens: fake single sign-on portals, fake service desk pages and AiTM proxies. Non-human identities are exposed too. OAuth redirect URIs, webhook endpoints, CI/CD callback URLs and CSP or CORS allowlists all name domains, and a lapsed domain on any of those lists lets an attacker receive tokens or data meant for a trusted service. Include those configuration fields in your domain inventory. Hosting and bulletproof providers that ignore abuse reports are covered in the Bulletproof Hosting guide.
Rolling it out
- Inventory your names. List your registered domains, brand strings, product names and the identity terms your users would trust (your IdP name, sso, login, servicedesk). Add every domain referenced in allowlists, redirect URIs and CSPs.
- Start CT and new domain monitoring in alert-only mode. Run for two to four weeks, tune out your own registrations and partners, and measure the hit rate.
- Turn on blocking at the resolver. Block confirmed lookalikes immediately; pilot newly registered domain blocking with IT and security staff first, then widen, with a clear exception route and rollback by policy toggle.
- Connect to takedown. For every confirmed malicious domain, block internally first, then file abuse reports with the registrar and host, and record time to takedown.
- Add scan-based hunting. Where you have internet scan data, track fingerprints from government and vendor reporting relevant to your sector and feed hits into blocklists.
- Review quarterly. Check expired or expiring domains against configuration references and re-test that newly seen serverless and tunnel hostnames alert.
Measuring it
- Lead time: hours between first CT or registration sighting of a lookalike and its first appearance in inbound email, SMS reports or resolver logs (positive values mean you saw it first).
- Time to block: median time from confirmed lookalike to resolver and proxy block.
- Time to takedown: median time from abuse report to domain suspension or content removal.
- Lapse risk: number of domains referenced in security configuration that expire within 90 days without auto-renew (target zero).
- Phishing-resistant coverage: percentage of privileged and all users on phishing-resistant MFA.
Common failure patterns
- Brand monitoring sits in marketing. Lookalike alerts arrive days later in a shared inbox. Route identity-themed hits to the SOC with a block-first rule.
- Email-only defences. The Twilio Breach 2022 links came by SMS; resolver-level blocking protects managed devices regardless of how the link arrived.
- Letting old domains expire. As ForcedLeak showed, a forgotten domain on an allowlist becomes attacker infrastructure for a few dollars.
- Reputation-only filtering. Re-registered expired domains and serverless subdomains can carry good reputation; age and first-seen logic catch what reputation misses.
- No takedown owner. Teams detect lookalikes but nobody files abuse reports, so infrastructure stays live for the next campaign.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1583 and T1583.001 to T1583.008 (Resource Development, TA0042); mitigation M1056 Pre-compromise; detection strategies DET0895, DET0892, DET0838, DET0896, DET0829 | Technique definition, external data sources |
| MITRE ATT&CK v20 | T1566 Phishing, T1557 Adversary-in-the-Middle, T1189 Drive-by Compromise, T1665 Hide Infrastructure | Where acquired infrastructure is used |
| NIST SP 800-53 Rev 5 | PM-16 Threat Awareness Program; SI-5 Security Alerts, Advisories, and Directives; SC-7 Boundary Protection; SC-20 Secure Name/Address Resolution Service (Authoritative Source); RA-3 Risk Assessment | Threat intelligence, blocking at the boundary, protecting your own DNS names |
| NIST CSF 2.0 | ID.RA-02; DE.CM-01; DE.AE-02 | Receiving threat intelligence, monitoring network services, analysing events |
| CIS Controls v8.1 | Control 9 Email and Web Browser Protections; Control 13 Network Monitoring and Defense | DNS filtering and blocking of malicious domains |
Practitioner checklist
- Monitor Certificate Transparency and new registrations for your brand plus identity terms, routed to the SOC.
- Defensively register the highest-risk lookalikes and keep every security-referenced domain on auto-renew.
- Inventory domains named in allowlists, CSPs, OAuth redirect URIs and webhooks; remove before retiring any domain.
- Block or warn on newly registered domains at the resolver, with a ticketed exception route.
- Baseline the serverless and tunnelling hostnames your business uses and alert on first-seen ones.
- Maintain registrar and host abuse contacts and a takedown evidence template with a named owner.
- Move privileged users to phishing-resistant MFA first.
- Track lead time, time to block and time to takedown every month.
Standards and references
- MITRE ATT&CK: T1583 Acquire Infrastructure
- MITRE ATT&CK: T1583.001 Domains
- MITRE ATT&CK: T1583.007 Serverless
- MITRE ATT&CK: M1056 Pre-compromise
- CISA: Scattered Spider (AA23-320A)
- IETF: RFC 9162 Certificate Transparency Version 2.0
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: ATT&CK Resource Development Tactic Guide · Newly Registered Domains Guide · Brand Impersonation and Lookalike Domain Takedown Playbook · Bulletproof Hosting · MITRE ATT&CK T1566 Phishing