Compromise Infrastructure
Infrastructure compromise uses third-party resources without their owners' authorization.
What it means
Infrastructure compromise uses third-party resources without their owners' authorization. A legitimate host can consequently deliver or relay malicious activity.
MITRE ATT&CK catalogs this behavior as T1584, within resource development. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A normally reputable website starts serving suspicious content associated with an attack against the organization.
Evidence to examine
Review content versions, redirect behavior, delivery evidence, timing, and host relationships where available.
A common analytical pitfall
Provider reputation does not guarantee current content integrity, and victim infrastructure is not automatically attacker-owned.
Response considerations
Preserve delivery evidence and apply targeted protection while distinguishing a compromised relay from infrastructure controlled intentionally by the actor.
Legitimate resources can be repurposed
A fictional small business website begins serving content used in a separate phishing operation. The domain's established history may make the traffic appear less unusual than a newly registered site. The website owner may be another victim, so association with the resource does not automatically establish participation in the campaign.
Separate the infrastructure compromise from later target activity. Evidence that a site hosted malicious content does not show that every visitor executed it or that the investigated organization was successfully compromised. Build the sequence using hosting changes, delivery evidence, connections, and endpoint effects where available.
Ownership and control can diverge. A legitimate organization may retain domain registration while an unauthorized actor controls one directory or account on the server. Describe the scope of observed control rather than labeling the entire owner malicious. This distinction also guides coordination and remediation.
Map a compromised hosting relationship
For a paper exercise, create a fictional site owner, hosting provider, malicious upload, and recipient organization. Mark which party owns the resource, which party appears to control the uploaded content, and which facts remain unknown. Add a normal page on the same site to illustrate why broad conclusions can be misleading.
Defensive action may involve blocking the specific harmful location, preserving evidence, and contacting the appropriate owner through approved incident processes. Do not modify or investigate someone else's hosting account without authorization. A useful report states the affected resource, observed malicious use, time window, and attribution limits. This keeps the analysis focused on the compromised capability while recognizing that infrastructure owners can be victims rather than adversaries.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1584: Compromise Infrastructure