MITRE ATT&CK Technique
Description
Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Supported Platforms
Created
April 29, 2026
Last Updated
April 29, 2026
STIX Data
{'created': '2020-10-02T16:49:31.262Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': 'Adversaries may search social media for information about '
'victims that can be used during targeting. Social media sites '
'may contain various information about a victim organization, '
'such as business announcements as well as information about '
'the roles, locations, and interests of staff.\n'
'\n'
'Adversaries may search in different social media sites '
'depending on what information they seek to gather. Threat '
'actors may passively harvest data from these sites, as well '
'as use information gathered to create fake profiles/groups to '
'elicit victim’s into revealing specific information (i.e. '
'[Spearphishing '
'Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: '
'Cyware Social Media) Information from these sources may '
'reveal opportunities for other forms of reconnaissance (ex: '
'[Phishing for '
'Information](https://attack.mitre.org/techniques/T1598) or '
'[Search Open Technical '
'Databases](https://attack.mitre.org/techniques/T1596)), '
'establishing operational resources (ex: [Establish '
'Accounts](https://attack.mitre.org/techniques/T1585) or '
'[Compromise '
'Accounts](https://attack.mitre.org/techniques/T1586)), and/or '
'initial access (ex: [Spearphishing via '
'Service](https://attack.mitre.org/techniques/T1566/003)).',
'external_references': [{'external_id': 'T1593.001',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/techniques/T1593/001'},
{'description': 'Cyware Hacker News. (2019, October '
'2). How Hackers Exploit Social Media '
'To Break Into Your Company. '
'Retrieved October 20, 2020.',
'source_name': 'Cyware Social Media',
'url': 'https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e'}],
'id': 'attack-pattern--bbe5b322-e2af-4a5e-9625-a4e62bf84ed3',
'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
'phase_name': 'reconnaissance'}],
'modified': '2025-10-24T17:49:18.054Z',
'name': 'Social Media',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'attack-pattern',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_deprecated': False,
'x_mitre_detection': '',
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_is_subtechnique': True,
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_platforms': ['PRE'],
'x_mitre_version': '1.0'}