Botnet - T1583.005 (31225cd3-cd46-4575-b287-c2c14011c074)
Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service.
Internet-facing edge devices and related network appliances that are end-of-life (EOL) and unsupported by their manufacturers are commonly acquired for botnet activities. Adversaries may lease operational relay box (ORB) networks – consisting of virtual private servers (VPS), small office/home office (SOHO) routers, or Internet of Things (IoT) devices – to serve as a botnet.(Citation: ORB Mandiant)
With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter) Acquired botnets may also be used to support Command and Control activity, such as Hide Infrastructure through an established Proxy network.
Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
---|---|---|---|---|
Botnet - T1583.005 (31225cd3-cd46-4575-b287-c2c14011c074) | Attack Pattern | Acquire Infrastructure - T1583 (0458aab9-ad42-4eac-9e22-706a95bafee2) | Attack Pattern | 1 |