MITRE ATT&CK Technique
Reconnaissance T1593.001
Description

Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).

Supported Platforms
PRE
Created

April 29, 2026

Last Updated

April 29, 2026

STIX Data
{'created': '2020-10-02T16:49:31.262Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may search social media for information about '
                'victims that can be used during targeting. Social media sites '
                'may contain various information about a victim organization, '
                'such as business announcements as well as information about '
                'the roles, locations, and interests of staff.\n'
                '\n'
                'Adversaries may search in different social media sites '
                'depending on what information they seek to gather. Threat '
                'actors may passively harvest data from these sites, as well '
                'as use information gathered to create fake profiles/groups to '
                'elicit victim’s into revealing specific information (i.e. '
                '[Spearphishing '
                'Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: '
                'Cyware Social Media) Information from these sources may '
                'reveal opportunities for other forms of reconnaissance (ex: '
                '[Phishing for '
                'Information](https://attack.mitre.org/techniques/T1598) or '
                '[Search Open Technical '
                'Databases](https://attack.mitre.org/techniques/T1596)), '
                'establishing operational resources (ex: [Establish '
                'Accounts](https://attack.mitre.org/techniques/T1585) or '
                '[Compromise '
                'Accounts](https://attack.mitre.org/techniques/T1586)), and/or '
                'initial access (ex: [Spearphishing via '
                'Service](https://attack.mitre.org/techniques/T1566/003)).',
 'external_references': [{'external_id': 'T1593.001',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1593/001'},
                         {'description': 'Cyware Hacker News. (2019, October '
                                         '2). How Hackers Exploit Social Media '
                                         'To Break Into Your Company. '
                                         'Retrieved October 20, 2020.',
                          'source_name': 'Cyware Social Media',
                          'url': 'https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e'}],
 'id': 'attack-pattern--bbe5b322-e2af-4a5e-9625-a4e62bf84ed3',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'reconnaissance'}],
 'modified': '2025-10-24T17:49:18.054Z',
 'name': 'Social Media',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['PRE'],
 'x_mitre_version': '1.0'}
Quick Actions
Related Threat Actors (3)
Kimsuky
High

Contagious Interview
High

EXOTIC LILY
High