MITRE ATT&CK

@mitreattack@infosec.exchange
1.7K Followers
8 Following
91 Posts
Twitterhttps://twitter.com/mitreattack
Websitehttps://attack.mitre.org
MITRE ATT&CKJul 7, 2025

We are excited to announce our ATT&CKcon 6.0 keynote speaker, Lillian Teng! Lillian has worn many hats in our community, including as a Naval Criminal Investigative Service (NCIS) Cyber Special Agent, roles at the National Cyber Investigative Joint Task Force (NCIJTF) and FBI Cyber Division, and more recently in the private sector as a Director of Threat Investigations at Yahoo and Senior Director of Cyber Intelligence at Capital One. Lilian is also passionate about giving back, serving with the KC7: The Cyber Detective Game Foundation, Girl Security, and LEAP (Leadership Education For Asian Pacifics).

We're looking forward to having Lillian on our ATT&CKcon stage this October, and if you'd like to join her there in McLean, VA Oct 14-15, you only have 3 days left (until July 9th at 8pm EDT) to submit to the ATT&CKcon 6.0 CFP. Check out what we're looking for and shoot your shot at https://www.openconf.org/ATTACKCON2025.

Looking for in-person or virtual tickets? Stay tuned, those are coming soon. We also still have a few sponsorships open at https://na.eventscloud.com/website/82912/sponsorship-opportunities/.

MITRE ATT&CKJun 3, 2025

The MITRE ATT&CKcon 6.0 CFP is now open! Are you interested in joining us on the ATT&CKcon stage in McLean, VA October 14-15, 2025? Pitch us on your best ATT&CK related talk! Our CFP will close on July 9th at 8pm ET sharp, so get those proposals started.
https://www.openconf.org/ATTACKCON2025/openconf.php

We're looking for what's practical, what's aspirational, and what you should never ever do with ATT&CK. We're looking to hear from the community on any and all applications of ATT&CK. From managers to operators, if you're using ATT&CK we want to hear from you.

Interested in sponsoring ATT&CKcon? We have a couple slots left, and you can find out more at https://na.eventscloud.com/attackcon6. Looking to attend in-person or virtually? Hang tight, ticket sales will be announced in the coming months.

Show threadMITRE ATT&CKMay 8, 2025

And make sure to check out the ESXi material on ATT&CK including T1675 https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/

And see the entire v17 release for more information https://medium.com/mitre-attack/attack-v17-dfb59eae2204

VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant | Google Cloud Blog

Google Cloud Blog
Show threadMITRE ATT&CKMay 8, 2025

T1675 describes activity in which an adversary abuses ESXi admin services to execute commands on guest machines.

Google’s reporting details the threat actor UNC3886, Chinese cyber espionage group, using a zero-day vulnerability that enabled the execution of privileged commands across guest virtual machines without authentication of guest credentials from a compromised ESXi host and no default logging on guest VMs.

Read up on Google’s reporting: https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/

VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant | Google Cloud Blog

Google Cloud Blog
Show threadMITRE ATT&CKMay 8, 2025

We’re currently reading Google’s reporting on VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/

One of the big updates for ATT&CK v17 was the new platform ESXi which reflects the rise in attacks on virtualization infrastructure. The technique we’re spotlighting today is new to ATT&CK: T1675 ESXi Administration Command https://attack.mitre.org/techniques/T1675/

VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant | Google Cloud Blog

Google Cloud Blog
MITRE ATT&CKMay 8, 2025
An old idea that still holds true: Fight the enemy where they aren’t. Threat actors take this advice to heart by avoiding Endpoint Detection and Response solutions and targeting systems that do not generally support EDR such as VMware ESXi hosts.
Show threadMITRE ATT&CKApr 30, 2025
Read Volexity’s reporting here https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/ and be sure to browse the relevant procedures, mitigations, and detections at the ATT&CK technique page: https://attack.mitre.org/techniques/T1566/003/
Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) accounts of targeted individuals. This activity comes on the heels of attacks Volexity reported on back in February 2025, where Russian threat actors were discovered targeting users and organizations through Device Code Authentication phishing...

Volexity
Show threadMITRE ATT&CKApr 30, 2025
Signal is a powerful and effective end-to-end encrypted chat app. At the end of the day, that doesn’t help at all when you’re being spearphished. In fact, the lack of visibility and detection inherent in an encrypted chat app could even potentially hurt. That’s a wrinkle requiring vigilance on all parts.
Show threadMITRE ATT&CKApr 30, 2025
The world turns, the seasons change, but Russian threat actors targeting Microsoft 365 accounts stays the same. Earlier this year, the same actors were spotted conducting similar attacks also leveraging chat apps like Signal https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried out in a variety of ways. The majority of these attacks originated via spear-phishing emails with different themes. In one case, the eventual breach began with highly tailored outreach via Signal.Through its investigations, Volexity discovered that Russian threat actors were impersonating a variety of individuals

Volexity
Show threadMITRE ATT&CKApr 30, 2025
This behavior maps to T1566.003 Phishing: Spearphishing via Service, a technique in which adversaries send messages through various non-enterprise controlled services in large part because they are more likely to have a less-strict security policy than an enterprise. https://attack.mitre.org/techniques/T1566/003/
Phishing: Spearphishing via Service, Sub-technique T1566.003 - Enterprise | MITRE ATT&CK®