Adversary-in-the-Middle T1557
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features…
- Tactics
- Credential Access, Collection
- Actors using it
- 8
- Sub-techniques
- 4
Ransomware groups reported using it
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- Wizard SpiderRussia · UNC1878, TEMP.MixMaster, Grim Spider · 49 techniques
- LuminousMothChina · 24 techniques
- Sea TurtleTürkiye · Teal Kurma, Marbled Dust, Cosmic Wolf · 22 techniques
- CleaverIran · Threat Group 2889, TG-2889 · 5 techniques