T1597 Search Closed Sources Defensive Guide: Monitoring Closed Sources for Your Credentials and Access

Before an adversary touches your network, they can buy what they need to know about it, from paid data services, threat intelligence portals and criminal markets that you cannot see into. MITRE ATT&CK T1597 Search Closed Sources covers adversaries gathering victim information from paid, private or otherwise not freely available sources, ranging from reputable subscription feeds to dark web and cybercrime marketplaces. It sits in the Reconnaissance tactic (TA0043) and has two sub-techniques in ATT&CK v20: T1597.001 Threat Intel Vendors and T1597.002 Purchase Technical Data. Because the activity happens entirely outside your environment, the defensive job is exposure reduction: knowing what data about you is likely for sale, shrinking how useful it is, and making sure purchased credentials fail when they are used. This guide is for threat intelligence, detection engineering and identity teams. The broker economy behind much of this data is covered in the Initial Access Brokers Guide; this page focuses on T1597 and what it means for your controls.

Key takeaways

• You cannot detect the purchase. ATT&CK's only mitigation is M1056 Pre-compromise, and its detection strategies say the activity happens outside the target's visibility with a very high false positive rate. Effort belongs on exposure and on the moment the data is used.
• Credentials are the most dangerous item on the shelf. ATT&CK records LAPSUS$ purchasing credentials and session tokens from criminal underground forums, and Mandiant found that at least 79.7% of accounts used in the 2024 Snowflake campaign had prior credential exposure.
• Make bought data stale. Phishing-resistant MFA, short-lived tokens, rotation of non-human credentials and network allow lists turn a purchased password or token into a failed sign-in you can alert on.
• Your own disclosures are also a source. T1597.001 covers adversaries reading threat intelligence vendor data for trends, attribution and countermeasures that worked, so what you share with vendors and how they redact it matters.
• Monitor closed sources through a provider, legally. Credential exposure and access listing feeds are the practical way to see T1597.002 inventory about you; plan in advance who acts on a finding and how fast.

What T1597 covers

ATT&CK describes T1597 as searching and gathering victim information from closed sources that can be used during targeting. It distinguishes reputable private sources, such as paid subscriptions to technical and threat intelligence feeds, from less reputable sources such as dark web and cybercrime black markets. The information then feeds other reconnaissance, resource development and initial access, with ATT&CK naming T1598 Phishing for Information, T1593 Search Open Websites/Domains, T1587 Develop Capabilities, T1588 Obtain Capabilities, T1133 External Remote Services and T1078 Valid Accounts as follow-on techniques.

ATT&CK v20 separates a related case into its own technique: T1681 Search Threat Vendor Data, where actors look up reporting on their own campaigns and adjust. It is distinct from T1597.001 because it is not about victim information. Defenders who publish indicators should know that adversaries read them; ATT&CK's mitigation note for T1681 advises designing defences that are not reliant on atomic indicators.

How adversaries use closed sources: recorded cases

• LAPSUS$ (G1004), purchased credentials and tokens: ATT&CK records T1597.002 use by LAPSUS$, citing Microsoft's March 2022 analysis of DEV-0537. Microsoft describes the group buying credentials and session tokens from criminal underground forums, alongside the Redline infostealer, paying insiders for credentials and MFA approval, and searching public code repositories for exposed credentials. Purchased session tokens let the group replay authenticated sessions rather than defeat MFA. See the Lapsus$ Threat Actor Profile.
• EXOTIC LILY (G1011), business databases for targeting: ATT&CK records the group searching business databases including RocketReach and CrunchBase for information on targeted individuals. Google's Threat Analysis Group describes EXOTIC LILY as an initial access broker that, from November 2021, impersonated real employees using data from social media and those databases, registered lookalike domains with swapped top-level domains, and at its peak sent more than 5,000 emails a day to as many as 650 organisations, with follow-on Conti and Diavol ransomware run by other actors.
• UNC5537 and the Snowflake campaign, infostealer credentials at scale: Mandiant reports that the credentials UNC5537 used were primarily obtained from multiple infostealer campaigns, aggregated from a variety of infostealer log sources that circulate free and for sale, with the earliest infection dating to November 2020 and some credentials unrotated for years. Accounts without MFA or network allow lists were accessed with a username and password alone. The Snowflake breach analysis covers the identity lessons.

What closed sources may hold about you

Treat this as an inventory exercise. For each category, ask who could sell it, how current it is likely to be, and which control makes it useless.

Where identity fits

Most of what sells on closed markets is identity material. Human passwords get attention, but non-human credentials are often more valuable because they bypass MFA by design and are rotated less often: cloud access keys, personal access tokens, CI/CD secrets, package registry tokens and OAuth refresh tokens found in stealer logs from developer machines. A purchased service account password with no owner and no expiry can stay valid for years, as the Snowflake case showed for human accounts. Inventory these credentials, give each an owner and a maximum age, and replace static secrets with federated, short-lived credentials where the platform supports it. See the Infostealer Logs and Session Token Abuse Guide for the token side.

What to detect and where

ATT&CK v20 publishes detection strategies DET0822 (T1597), DET0816 (T1597.001) and DET0880 (T1597.002). Each analytic states that the activity may have a very high occurrence and false positive rate, takes place outside the target's visibility, and that detection should focus on related stages such as initial access. In practice that gives two places to look: external signals that your data is circulating, and internal signals that it is being used.

Monitoring criminal sources directly carries legal and personal safety risks. Most organisations should use a provider and agree what is collected and how. See the Dark Web Monitoring Guide and the Infostealer Logs Monitoring and Response Guide.

Mitigations: reducing exposure

ATT&CK maps T1597 and both sub-techniques only to M1056 Pre-compromise, stating that the technique cannot be easily mitigated with preventive controls and that efforts should focus on minimising the amount and sensitivity of data available to external parties. The controls below are NHI Mgmt Group recommendations that put that into practice.

1. Make stolen credentials fail: require phishing-resistant MFA for every human sign-in, including contractors and break-glass procedures, and remove password-only paths to data platforms and remote access.
2. Shorten credential life: set maximum ages for API keys, personal access tokens and service account secrets, and move workloads to federated short-lived credentials so a purchased secret expires before it is used.
3. Restrict where credentials work: apply network allow lists or conditional access to administrative interfaces, data warehouses and service accounts with predictable sources.
4. Cut the supply: manage contractor and developer devices or require virtual desktops for privileged access, since infostealer infections on unmanaged machines feed these markets.
5. Reduce scan exposure: keep an accurate external asset inventory and remove or restrict services that aggregators index, using the Attack Surface Management Guide.
6. Control what you disclose: agree with incident response and intelligence vendors how your incidents are reported and redacted, and favour behaviour-based detections over indicator lists that adversaries can read and rotate.

Implementation: a phased programme

1. Weeks 1 to 4, inventory: list domains, remote access paths, identity providers and the top 50 non-human credentials by privilege. Record which accept a password or static secret alone.
2. Weeks 2 to 6, monitoring: subscribe to a credential exposure feed covering your domains and key SaaS tenants; route findings to a ticket queue with an owner and a 24 hour reset target.
3. Weeks 4 to 12, hardening: close password-only paths, add network restrictions for service accounts, and set rotation for long-lived secrets. Pilot conditional access in report-only mode first, then enforce by group, keeping an exclusion group with a named owner for rollback.
4. Ongoing, test: each quarter, take a sample of exposed credentials from the feed and confirm they are already invalid. Run a tabletop where an access broker advertises your VPN.

Measuring it

• Time to invalidate: median hours from an exposure finding to password reset and session revocation.
• Live hit rate: percentage of exposed credentials still valid when checked (target near zero).
• Password-only paths: count of internet-reachable systems accepting a password without MFA.
• Static secret age: share of non-human credentials older than your maximum age.
• Exposure source mix: share of findings from unmanaged or contractor devices, which shows where to focus device controls.

Common failure patterns

• Resetting the password but not the session: stealer logs include cookies and tokens; a password reset alone leaves purchased sessions valid.
• Ignoring old findings: the Snowflake campaign used credentials stolen years earlier that were never rotated. Age is not safety.
• Monitoring humans only: feeds are tuned for email addresses, while API keys and tokens in the same logs go unchecked.
• No owner for findings: alerts land in a shared mailbox and nobody resets anything.
• Contractor blind spot: third-party staff sign in with your credentials from devices you do not manage, which is where many infostealer infections start.
• Indicator-only detection: detections built on published IPs and hashes stop working once adversaries read the same reporting and rotate.

Framework mapping

Related reconnaissance techniques: T1589 Gather Victim Identity Information (see the MITRE ATT&CK T1589 Gather Victim Identity Information) and T1598 Phishing for Information (see the MITRE ATT&CK T1598 Phishing for Information). Where purchased credentials are used, see the MITRE ATT&CK T1078 Valid Accounts Guide.

Practitioner checklist

• Credential exposure monitoring covers all corporate domains and key SaaS tenants, with a named owner.
• Exposure findings trigger password reset, session revocation and token revocation, not just a reset.
• No internet-reachable system accepts a password without MFA.
• Non-human credentials have an owner, a maximum age and network restrictions where possible.
• Contractor and developer access comes from managed devices or virtual desktops.
• Sign-in analytics alert on correct-password sign-ins from new ASNs, hosting providers and VPN ranges.
• Vendors that report on your incidents follow agreed redaction rules.
• Detections favour behaviour over indicators that adversaries can read in public reporting.

Standards and references

• MITRE ATT&CK: T1597 Search Closed Sources
• MITRE ATT&CK: T1597.002 Purchase Technical Data
• MITRE ATT&CK: M1056 Pre-compromise
• Microsoft Security: DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
• Google Cloud (Mandiant): UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
• Google Threat Analysis Group: Exposing initial access broker with ties to Conti
• MITRE ATT&CK: T1597.001 Threat Intel Vendors

Related NHI Mgmt Group resources: Initial Access Brokers Guide, Threat Intelligence Guide, ATT&CK Resource Development Tactic Guide, OSINT and Reconnaissance Guide.