Compromise Accounts: Social Media Accounts (T1586.001) is a resource development technique tagged PRE. The adversary compromises existing social media accounts to use during targeting.
How attackers use it
MITRE says a compromised persona can create trust in a potential victim who has a relationship with it or knowledge of it. Methods include gathering credentials by phishing for information, buying credentials from third-party sites, and brute forcing credentials, such as through password reuse from breach dumps. Adversaries may do reconnaissance to choose which accounts to take.
A compromised profile can create new connections to targets or hijack existing ones. MITRE lists spearphishing via service as a follow-on use.
How to detect it
MITRE suggests monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization, or recently modified accounts making numerous connection requests to accounts affiliated with your organization. Detection can also focus on related stages such as initial access through spearphishing via service.
Teach staff to tell you when a contact's message feels off. Ask for the report before they click.
How to reduce the risk
MITRE lists Pre-compromise as the mitigation. For your own accounts, general practice applies.
- Use unique passwords and multi-factor authentication on every social account, including the company page.
- Limit who has access to company accounts, and review the list.
- Verify unexpected links from known contacts through another channel.
If a company page is the account at risk, treat it like any admin system: a short list of named managers, unique credentials, and a documented way to regain control through the platform.
Quick check
How do adversaries choose which accounts to take?
They may perform reconnaissance first, then compromise accounts that serve their operation.
What follow-on use does MITRE list?
Spearphishing via service, through connections of the hijacked profile.
