MITRE ATT&CK

MITRE ATT&CK

@attack.mitre.org

MITRE ATT&CK® - A knowledge base for describing the behavior of adversaries. Replying/Following/Reposting ≠ endorsement.

7.4K followers17 following162 posts

MITRE ATT&CK
@attack.mitre.org

Enterprise ATT&CK added Techniques for adversary use and abuse of AI, MFA bypass, and getting past CAPTCHAs, and Mobile brought back a Technique for delivering malicious apps outside official stores.

MITRE ATT&CK
@attack.mitre.org

If you register before 10/1 to attend in-person, you can submit a Lightning Talk for consideration. Keep an eye on your email for details after you register.

MITRE ATT&CK
@attack.mitre.org

15 days left. Every year, without fail, we get a handful of emails after the ATT&CKcon CFP deadline that say some variation of, "I was just about to submit..." Don't be that person. CFP closes 7/2 at 8:00 PM EDT. No extensions, no secret back door, no "just one more." openconf.org/ATTACKcon2026/

MITRE ATT&CK
@attack.mitre.org

ATT&CK v19 is live! 🍾 We've split Defense Evasion into Stealth and Defense Impairment, introduced Sub-Techniques to ICS ATT&CK, Detection Strategies to Mobile, and added some AI and Social Engineering to Enterprise. Check out all the details in our blog post at medium.com/mitre-attack....

medium.comATT&CK v19: The Defense Evasion Split, ICS Sub-Techniques, New AI & Social Engineering Coverage…ATT&CK v19 is here, and this release has been a long time coming. The Defense Evasion split is finally in place, detection strategies are…
MITRE ATT&CK
@attack.mitre.org

Pencil in Oct 27-28, 2026 for ATT&CKcon 7.0! We'll be live for both in-person in McLean, VA and live online. Drop us a line at attackcon@mitre.org if you're interested in sponsoring, watch for our CFP to open in May, and grab a ticket when they go on sale this summer. See you in October!

MITRE ATT&CK
@attack.mitre.org

Are you ready to celebrate National Chocolate Day this October 28th? We will be by releasing ATT&CK v18, our next version of MITRE ATT&CK! We'll be releasing our usual updates to Techniques and Groups, but check out some big defensive changes on the way in this release (medium.com/mitre-attack...).

MITRE ATT&CK
@attack.mitre.org

The ATT&CK team is out at #hackersummercamp and happy to chat, meet up, or just share some stickers. Drop a DM or stop by an appearance if you’re interested in saying hi!

Adam Pennington@whatshisface.bsky.social

Headed for Vegas for @bsideslv.org, @defcon.bsky.social, and @blackhatevents.bsky.social! I have hundreds of @attack.mitre.org stickers and will be popping up Friday 11am on DEF CON Creator Stage 2 (defcon.org/html/defcon-...), and for a short talk in the AttackIQ BH booth (#5030) Wed 11am.

defcon.orgdefcon.org
View full thread
MITRE ATT&CK
@attack.mitre.org

We're looking for what's practical, what's aspirational, and what you should never ever do with ATT&CK. We're looking to hear from the community on any and all applications of ATT&CK. From managers to operators, if you're using ATT&CK we want to hear from you.

MITRE ATT&CK
@attack.mitre.org

An old idea that still holds true: Fight the enemy where they aren’t. Threat actors take this advice to heart by avoiding Endpoint Detection and Response solutions and targeting systems that do not generally support EDR such as VMware ESXi hosts.

View full thread
MITRE ATT&CK
@attack.mitre.org

An old idea that still holds true: Fight the enemy where they aren’t. Threat actors take this advice to heart by avoiding Endpoint Detection and Response solutions and targeting systems that do not generally support EDR such as VMware ESXi hosts.

View full thread
MITRE ATT&CK
@attack.mitre.org

Google’s reporting details UNC3886, Chinese cyber espionage group, using a zero-day vulnerability that enabled the execution of privileged commands across guest virtual machines without authentication of guest credentials from a compromised ESXi host and no default logging on guest VMs.

MITRE ATT&CK
@attack.mitre.org

An old idea that still holds true: Fight the enemy where they aren’t. Threat actors take this advice to heart by avoiding Endpoint Detection and Response solutions and targeting systems that do not generally support EDR such as VMware ESXi hosts.

MITRE ATT&CK
@attack.mitre.org

🎣 Get in loser, we’re going phishing. This week, we’re going to spotlight how Russian threat actors are phishing targets associated with Ukraine and human rights to abuse Microsoft OAuth.

View full thread
MITRE ATT&CK
@attack.mitre.org

Signal is a powerful end-to-end encrypted chat app. At the end of the day, that doesn’t help at all when you’re being spearphished. In fact, the lack of visibility and detection inherent in an encrypted chat app could even potentially hurt. That’s a wrinkle requiring vigilance on all parts.

MITRE ATT&CK
@attack.mitre.org

Read Volexity’s reporting here www.volexity.com/blog/2025/04... and be sure to browse the relevant procedures, mitigations, and detections at the ATT&CK technique page: attack.mitre.org/techniques/T...

volexity.comPhishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth WorkflowsSince early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...
MITRE ATT&CK
@attack.mitre.org

🎣 Get in loser, we’re going phishing. This week, we’re going to spotlight how Russian threat actors are phishing targets associated with Ukraine and human rights to abuse Microsoft OAuth.

View full thread
MITRE ATT&CK
@attack.mitre.org

The world turns, the seasons change, but Russian threat actors targeting Microsoft 365 accounts stays the same. Earlier this year, the same actors were spotted conducting similar attacks also leveraging chat apps like Signal www.volexity.com/blog/2025/02...

volexity.comMultiple Russian Threat Actors Targeting Microsoft Device Code AuthenticationStarting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack cam...
MITRE ATT&CK
@attack.mitre.org

🎣 Get in loser, we’re going phishing. This week, we’re going to spotlight how Russian threat actors are phishing targets associated with Ukraine and human rights to abuse Microsoft OAuth.

View full thread
MITRE ATT&CK
@attack.mitre.org

The adversary contacts a victim via Signal or WhatsApp, invites them to a meeting, and sends them an OAuth phishing URL to join. Once the OAuth code is given up, the threat actor can access the victim’s M365 account.

MITRE ATT&CK
@attack.mitre.org

🎣 Get in loser, we’re going phishing. This week, we’re going to spotlight how Russian threat actors are phishing targets associated with Ukraine and human rights to abuse Microsoft OAuth.

MITRE ATT&CK
@attack.mitre.org

We’re currently reading Volexity’s recent report: “Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows” www.volexity.com/blog/2025/04...

volexity.comPhishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth WorkflowsSince early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...