Acquire Infrastructure: Domains

APT1 has registered hundreds of domains for use in operations.^[17]

APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.^[2][19][20]

APT32 has set up and operated websites to gather information and deliver malware.^[21]

BITTER has registered a variety of domains to host malicious payloads and for C2.^[22]

For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.^[23]

For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.^[24]

For C0021, the threat actors registered domains for use in C2.^[25]

For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.^[26]

For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.^[27]

CURIUM created domains to facilitate strategic website compromise and credential capture activities.^[28]

DarkGate command and control includes hard-coded domains in the malware chosen to masquerade as legitimate services such as Akamai CDN or Amazon Web Services.^[29]

Dragonfly has registered domains for targeting intended victims.^[30]

Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.^[31]

EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to ".us", ".co" or ".biz".^[32]

Ferocious Kitten has acquired domains imitating legitimate sites.^[33]

FIN7 has registered look-alike domains for use in phishing campaigns.^[34]

For FunnyDream, the threat actors registered a variety of domains.^[35]

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.^[36][37]

HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.^[38][39][40]

IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.^[41]

Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.^{[42][43][44][45][46][47][48]}

Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.^[49][50]

LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.^[51]

Leviathan has established domains that impersonate legitimate entities to use for targeting efforts. ^[52][53]

Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.^[54]

menuPass has registered malicious domains for use in intrusion campaigns.^[55][56]

Moonstone Sleet registered domains to develop effective personas for fake companies used in phishing activity.^[57]

Mustang Panda have acquired C2 domains prior to operations.^[58][59][60]

During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.^[61]

For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.^[62]

For Operation Ghost, APT29 registered domains for use in C2 including some crafted to appear as existing legitimate domains.^[63]

During Operation Honeybee, threat actors registered domains for C2.^[64]

For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.^[65]

Raspberry Robin uses newly-registered domains containing only a few characters for command and controll purposes, such as "v0[.]cx".^[66]

Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.^[67][68]

Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.^{[69][70][71][72][73][74]}

For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.^[75][76]

Star Blizzard has registered domains using randomized words and with names resembling legitimate organizations.^[77][78]

TA2541 has registered domains often containing the keywords "kimjoy," "h0pe," and "grace," using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.^[79][80]

TA505 has registered domains to impersonate services such as Dropbox to distribute malware.^[81]

TeamTNT has obtained domains to host their payloads.^[82]

Threat Group-3390 has registered domains for C2.^[83]

Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.^[84][85]

Winnti Group has registered domains for C2 that mimicked sites of their intended targets.^[86]

Winter Vivern registered domains mimicking other entities throughout various campaigns.^[87]

ZIRCONIUM has purchased domains for use in targeted campaigns.^[88]

Organizations may intentionally register similar domains to their own to deter adversaries from creating typosquatting domains. Other facets of this technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.