An attacker who knows your team structure, who holds admin rights, which outsourced help desk you use and when your staff are off shift can impersonate the right person to the right desk at the right time. MITRE ATT&CK T1591 Gather Victim Org Information (tactic Reconnaissance, TA0043) covers collecting that organisational picture: departments, business relationships, locations, operating tempo and the roles of key staff. It happens almost entirely outside your network, so this guide treats it as exposure reduction and verification design rather than detection. It covers the four v20 sub-techniques, real cases from ATT&CK and government advisories, what you leak and how to see it, the help desk controls that make org knowledge worthless, and how to test them. It is for security architects, help desk and identity owners, threat intelligence analysts and detection engineers. For identity data such as names and email addresses, see the MITRE ATT&CK T1589 Gather Victim Identity Information guide; this page stays on organisational data.
Key takeaways
- Org knowledge selects the target. ATT&CK records groups identifying IT staff with higher administrative rights (FIN7), team structures and supply chain relationships (LAPSUS$) and key network and IT staff (Volt Typhoon) before compromise.
- Prevention is exposure reduction. The only v20 mitigation is M1056 Pre-compromise, and MITRE's detection strategies say the activity mostly happens outside your visibility.
- The help desk is where org data turns into access. Scattered Spider and LAPSUS$ used gathered details to call support staff and obtain password and MFA resets for real, often privileged, users.
- Verification must not rely on knowable facts. Employee ID, manager name, department and security answers are exactly what T1591 collects; reset checks need factors an outsider cannot research.
- Suppliers are part of the org chart. T1591.002 Business Relationships maps MSPs and contracted help desks with elevated access, so supplier channels need the same verification rules.
What ATT&CK v20 says T1591 covers
ATT&CK describes T1591 as gathering details such as division and department names, specifics of business operations, and the roles and responsibilities of key employees. Sources include direct elicitation through T1598 Phishing for Information, social media (T1593.001) and the victim's own websites (T1594). ATT&CK links the results forward to further reconnaissance, to establishing resources such as T1585 Establish Accounts and T1586 Compromise Accounts, and to initial access through T1566 Phishing and T1199 Trusted Relationship. The platform is PRE: it describes adversary preparation, not activity on your hosts.
| Sub-technique (v20) | What is gathered | How attackers use it | Typical leak sources |
|---|---|---|---|
| T1591.001 Determine Physical Locations | Where key resources and infrastructure sit; legal jurisdiction | Choosing hardware or physical approaches, timing, jurisdiction-aware targeting | Office and data centre pages, planning filings, staff posts showing sites |
| T1591.002 Business Relationships | MSPs, contractors and partners with connected or elevated access; supply and shipment paths | Trusted relationship access, impersonating a supplier, supply chain compromise | Partner and case study pages, press releases, supplier logos, staff profiles listing the outsourcer |
| T1591.003 Identify Business Tempo | Operating hours and days; dates of purchases and shipments | Calling when the help desk is thin or outsourced out of hours, timing ransomware for weekends, matching normal login hours | Support hours pages, holiday notices, change freeze announcements |
| T1591.004 Identify Roles | Key personnel and what data or resources they can reach | Picking an admin or executive to impersonate, picking a help desk analyst to pretext | Professional networking profiles, job adverts naming tools and teams, conference talks, org charts in public documents |
T1591 sits beside T1589 Gather Victim Identity Information, T1590 Gather Victim Network Information and T1592 Gather Victim Host Information. In practice they are collected together; T1591 is the part that tells an attacker whose identity is worth stealing.
How adversaries use it: cases
- Help desk impersonation (Scattered Spider, G1015): the FBI and CISA joint advisory AA23-320A describes the group posing as IT or help desk staff to employees, and calling IT help desk staff to have passwords or MFA tokens reset, enabling account takeover in single sign-on environments. It notes that contracted help desks can be abused as a trusted relationship. The attackers behind the MGM Resorts Breach 2023 claimed they found an employee on LinkedIn and then called the help desk as that person; MGM has not confirmed those details. See the Scattered Spider Threat Actor Profile.
- Team structures and supply chain (LAPSUS$, G1004): ATT&CK cites Microsoft's DEV-0537 report for T1591.002 and T1591.004. Microsoft wrote that the group focused social engineering on knowledge of the target's business operations, including staff, support teams, incident response procedures and vendor relationships, then asked support personnel to reset a privileged account's credentials. Microsoft also notes that outsourced help desks make the tactic easier.
- Admins first (FIN7, G0046): ATT&CK records FIN7 identifying IT staff and employees with higher levels of administrative rights (T1591.004), and filtering candidate victims by revenue using a business information service (T1591).
- Behaving like staff (Volt Typhoon, G1017): CISA advisory AA24-038A says the actors identified key network and IT staff and typical user behaviour, and used that to avoid detection, for example by not using compromised credentials outside normal working hours. That is T1591.003 and T1591.004 feeding stealth later in the intrusion.
- Tailored lures (Lazarus Group, G0032): during Operation Dream Job (C0022), ATT&CK records the group gathering organisation information to pick specific targets and sending tailored job vacancy announcements to them.
- Retail help desk resets, 2025: in the Co-op Cyber Attack 2025 the attackers reportedly posed as staff to get a password reset. After the UK retail incidents the NCSC asked organisations to review help desk password reset processes, with particular attention to Domain Admin, Enterprise Admin and Cloud Admin accounts.
ATT&CK v20 also records Kimsuky (G0094) collecting organisation hierarchy, functions and press releases, and HEXANE (G1001) identifying executives, HR and IT staff for further targeting. The pattern is consistent: org data decides who gets called, phished or impersonated.
Exposure review: what you publish about yourself
You cannot stop anyone reading public pages, but you can decide what is on them. Run this review once a year and after reorganisations, mergers and new outsourcing contracts. Look at your organisation the way an attacker would, using the same public sources, without building tooling for it.
| Exposure | Why it matters for T1591 | NHI Mgmt Group recommendation |
|---|---|---|
| Job adverts naming the identity provider, PAM tool, help desk platform and team structure | Tells an attacker which portal to clone and which team to impersonate | Describe skills, not your exact stack and reporting lines; remove adverts when filled |
| Staff profiles giving titles such as "Okta administrator" or "Domain admin, service desk" | Directly answers T1591.004 Identify Roles | Awareness guidance for privileged staff; no mandate, but explain the risk and offer generic titles |
| Supplier case studies naming your outsourced service desk or MSP | Answers T1591.002 and suggests a supplier pretext | Approve supplier publicity through security review; prefer anonymised case studies |
| Published IT support hours, out-of-hours outsourcing and holiday cover | Answers T1591.003 and picks the weakest calling window | Publish support hours only to staff, behind sign-in |
| Org charts, board papers and procurement documents in public file stores | Gives roles, approval chains and supplier names in one file | Inventory public document stores; strip metadata and remove internal annexes |
| Incident response plans and on-call rotas reachable from the internet or wide internal groups | Microsoft reports LAPSUS$ joining response calls and channels | Hold response plans closely, as Microsoft advises; verify attendees on crisis bridges |
The broader method for reviewing your public footprint, including search engines and code repositories, is in the OSINT and Reconnaissance Guide.
Controls that make org knowledge worthless
Exposure reduction lowers the quality of an attacker's picture. The controls that matter more assume the picture is accurate.
Help desk verification
- No knowledge-based checks for resets: employee number, manager, cost centre, start date and security questions can all be gathered. Microsoft reports DEV-0537 answering recovery questions such as mother's maiden name.
- Out-of-band confirmation: call back on the number already in the HR or identity record, never one given on the call, or require approval by the user's line manager through an authenticated channel.
- Strongest checks for privileged accounts: for admin, executive and help desk staff accounts, require in-person or live video verification against photo ID, or a phishing-resistant self-service recovery flow. The NCSC singles out Domain Admin, Enterprise Admin and Cloud Admin resets.
- No MFA resets by phone alone: a password and MFA reset in one call hands over the account. Separate them, or route MFA re-registration through a temporary access credential issued only after strong verification.
- Same rules for suppliers: contracted help desks and MSPs must follow your verification standard, written into the contract and tested. CISA AA23-320A notes contracted help desks can be abused as a trusted relationship.
The full verification standard is in the Help Desk Identity Verification Policy Template, and the staff-facing side in the Vishing and Help Desk Social Engineering Awareness Guide.
Identity controls that limit the damage
- Phishing-resistant MFA: CISA AA23-320A recommends FIDO/WebAuthn or PKI-based MFA, which it says resists push bombing and SIM swaps.
- No standing admin rights: if the role an attacker picked has just-in-time elevation with approval, a reset of that user's password does not deliver admin access on its own.
- Alerts on identity changes: new MFA methods, new admin role assignments and new federated identity providers right after a help desk reset are the moment T1591 pays off. CISA describes Scattered Spider adding a federated identity provider for persistence.
Where non-human identities fit
Role mapping also points attackers at the people who hold machine credentials: platform engineers, CI/CD owners and integration admins. A help desk reset of one of those users can expose API keys, service account secrets and automation tokens stored in their vaults or pipelines. Keep those secrets out of personal reach where possible, and include service account owners in the privileged verification tier.
What you can detect
MITRE's detection strategies for T1591 and its sub-techniques (DET0890, DET0806, DET0855, DET0849, DET0807) state that the activity has a very high false positive rate and often takes place outside the target's visibility, and point defenders at related stages such as initial access. That is honest: no log shows someone reading your careers page. Work on the signals that do exist.
| Signal | Where to see it | What it suggests |
|---|---|---|
| Help desk calls asking about structure, who supports whom, support hours or supplier names | Help desk ticket categories and call notes, with a "suspicious contact" disposition | Direct elicitation (T1598) feeding T1591 |
| Reset requests for privileged or executive accounts from unusual numbers or outside the user's normal hours | Help desk platform, telephony logs | Role-targeted impersonation |
| Password or MFA reset followed within minutes by new MFA registration, new device or sign-in from a new network | Identity provider audit and sign-in logs | Org knowledge converted into account takeover |
| Lookalike domains combining your name with words such as sso, servicedesk or okta | Domain registration and certificate transparency monitoring | Preparation for staff-facing pretexts, as CISA describes for Scattered Spider |
| Fake profiles claiming to work for you or your suppliers | Brand and social media monitoring | T1585 Establish Accounts built on org data |
| Staff reports of unusual recruiter or supplier contact | Phishing report button and security mailbox | Targeted elicitation of key roles |
The NCSC also asks security operations centres to identify logins from atypical sources, such as VPN services in residential IP ranges, and to act on risky sign-ins flagged by threat intelligence detections. Those are the first hosts and accounts where gathered org data is used.
Measures that show it is working
- Privileged reset verification rate: percentage of admin and executive resets that passed the strong verification tier (target 100%).
- Supplier compliance: percentage of contracted help desks tested against your verification standard in the last 12 months.
- Exposure findings closed: items from the annual exposure review removed or accepted, and time to close.
- Suspicious contact reports: number of help desk "suspicious contact" dispositions per month; a rise after awareness work is a good sign.
- Reset-to-alert coverage: share of password and MFA resets that are correlated with the next 60 minutes of identity provider activity.
How to implement and test
- Classify accounts by reset tier: standard, privileged (admin, help desk, service account owners) and executive. Pull privileged membership from the identity provider and PAM tool, not from a spreadsheet.
- Write the verification standard: remove knowledge-based checks, define call-back and manager approval for the standard tier and in-person or video ID checks for the privileged tier. Pilot with one help desk team for two weeks and record handling time.
- Extend to suppliers: add the standard to outsourced help desk and MSP contracts with a right to test.
- Run the exposure review: careers pages, supplier publicity, public document stores and staff guidance. Agree owners for each finding.
- Build the reset correlation alert: any help desk reset of a privileged account opens a short watch window on MFA registration, role changes and federation changes.
- Test with authorised social engineering: commission vishing tests against the help desk and suppliers, with written authorisation and agreed rules of engagement. Repeat after changes.
- Roll back safely: if the new checks cause unacceptable lockouts, keep the privileged tier strict and relax only the standard tier, with a dated review. Never fall back to knowledge-based checks for admins.
Small organisations can start with step 2 for admin accounts only and a manager call-back for everyone else. Large organisations with several service desks need one standard across all of them, because attackers will call the weakest desk; see the Account Recovery and Help Desk Security Guide.
Common failure patterns
- Security questions as the reset check: answers come from the same public sources T1591 uses, and Microsoft reports LAPSUS$ answering them.
- A strict internal desk and a lenient outsourced one: attackers choose the out-of-hours or contracted desk they learned about through T1591.002 and T1591.003.
- Admin resets treated like any other: the MGM attackers claimed a single help desk call led to identity provider admin access.
- Response plans everyone can read: LAPSUS$ joined incident response calls; a widely shared plan tells intruders how you will react.
- Exposure review without owners: findings on job adverts and supplier publicity go nowhere unless HR, marketing and procurement own them.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK v20 | T1591, T1591.001 to T1591.004; mitigation M1056 Pre-compromise | Technique definition, procedure examples, detection strategies |
| NIST SP 800-53 Rev. 5 | AT-2(3) Social Engineering and Mining | Training staff, including help desk, to recognise elicitation |
| NIST SP 800-53 Rev. 5 | IA-12 Identity Proofing | Verification strength before resets and re-registration |
| NIST SP 800-53 Rev. 5 | SA-9 External System Services | Holding outsourced help desks to your controls |
| NIST SP 800-53 Rev. 5 | PM-16 Threat Awareness Program | Consuming intelligence on groups that use org reconnaissance |
| NIST CSF 2.0 | PR.AT-01, GV.SC-04, ID.RA-02 | Awareness, supplier criticality, threat intelligence intake |
Practitioner checklist
- Remove knowledge-based questions from every password and MFA reset path.
- Define a privileged reset tier with in-person or live video ID verification or phishing-resistant self-service recovery.
- Separate password resets from MFA re-registration.
- Write the verification standard into every outsourced help desk and MSP contract, and test it.
- Review careers pages, supplier publicity, public documents and support hours pages each year and after reorganisations.
- Keep incident response plans closely held and verify attendees on crisis calls.
- Alert on MFA, role and federation changes that follow a privileged reset.
- Monitor lookalike domains and fake profiles that use your name or your suppliers' names.
- Run authorised vishing tests against every help desk at least annually.
Standards and references
- MITRE ATT&CK: T1591 Gather Victim Org Information
- MITRE ATT&CK: T1591.004 Identify Roles
- CISA and FBI: AA23-320A Scattered Spider
- CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
- NCSC: Incidents impacting retailers, recommendations from the NCSC
- Microsoft Threat Intelligence: DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Vishing and Help Desk Social Engineering Awareness Guide, MITRE ATT&CK T1598 Phishing for Information, Help Desk Social Engineering Incident Playbook, Scattered Spider Threat Actor Profile.