Technique:  Acquire Infrastructure:Domains
It has registered hundreds of domains for use in operations.
It registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.
It has set up and operated websites to gather information and deliver malware.
It has registered a variety of domains to host malicious payloads and for C2.
For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.
For C0011, It registered domains likely designed to appear relevant to student targets in India.
For C0021, the threat actors registered domains for use in C2.
For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.
For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.
It has registered domains for targeting intended victims.
It has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.
It has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to ".us", ".co" or ".biz".
It has acquired domains imitating legitimate sites.
It has registered look-alike domains for use in phishing campaigns.
For FunnyDream, the threat actors registered a variety of domains.
It has registered multiple domains to facilitate payload staging and C2.
It has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.
It has established domains, some of which were designed to look like official government domains, for their operations.
It has registered domains to spoof targeted organizations and trusted third parties.
It has acquired domains related to their campaigns to act as distribution points and C2 channels.
It has used dynamic DNS providers to create legitimate-looking subdomains for C2.
It has established domains that impersonate legitimate entities to use for targeting efforts.
It has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.
It has registered malicious domains for use in intrusion campaigns.
It have acquired C2 domains prior to operations.
During Operation Dream Job, It registered a domain name identical to that of a compromised company as part of their BEC effort.
For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.
For Operation Ghost, It registered domains for use in C2 including some crafted to appear as existing legitimate domains.
During Operation Honeybee, threat actors registered domains for C2.
For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.
It has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages.
It has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.
For the SolarWinds Compromise, It acquired C2 domains, sometimes through resellers.
It has registered domains often containing the keywords "kimjoy," "h0pe," and "grace," using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.
It has registered domains to impersonate services such as Dropbox to distribute malware.
It has obtained domains to host their payloads.
It has registered domains for C2.
It has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.
It has registered domains for C2 that mimicked sites of their intended targets.
ItM has purchased domains for use in targeted campaigns.